Open Banking Grows Teeth: PSD3 Edges Closer, Core Banking Finds Its Commercial Proof, and BaaS Picks a Lane
As of this week, Europe's open banking reset is less a policy debate and more a build sprint. PSD3 and the PSR are in the pipeline, FiDA is wobbling toward adoption, and the core banking category is finally throwing off real revenue.
Open banking in 2026 is where the quiet infrastructure deals happen. No fireworks, just a steady drumbeat of regulatory texts, cloud-native cores going live and BaaS platforms sorting themselves into those who can comply and those who cannot. This week added fresh evidence to all three fronts.
PSD3 and the PSR: From Trilogue to Transposition
The headline fact: on 23 April 2026, the European Parliament, Council and Commission agreed the final versions of PSD3 and the Payment Services Regulation (PSR), with texts published the same day, according to analysis from Norton Rose Fulbright. The PSR will apply directly across the EU twenty days after publication, while PSD3 (a directive) requires national transposition within 18 months, targeting Q2/Q3 2028 applicability.
In plain English: the clock is ticking, but it is ticking slowly enough that banks and third-party providers have a window to actually get ready. That window closed a little this week with the PSD3 and Open Banking Forum at the Crowne Plaza Frankfurt Congress Hotel on 6 October.
What PSD3 and the PSR Change
Three practical shifts matter. First, harmonisation: the PSR puts core payment rules into directly applicable form, cutting the national gold-plating that fragmented PSD2. Second, access: non-bank payment service providers get clearer access to payment systems and settlement accounts. Third, fraud liability and SCA: the regime tightens fraud liability and modernises strong customer authentication for a world where phishing, APP fraud and deepfake impersonation are the real threats. Adyen captures the operational reality for merchants, and Coforge has written up the implementation challenge for banks.
FiDA: Open Finance's Slow Burn
The Financial Data Access (FiDA) Regulation, which extends open banking's logic to savings, pensions, insurance and credit, is still inching through the EU process. The first trilogue took place in April 2025, Fiskil notes, and the Parliament's ECON committee has been finalising its position during 2026. Phase 1 is set for Q4 2027 and will cover savings, consumer credit agreements, and property and casualty insurance, according to analysis from Hogan Lovells.
Core Banking Finds Its Commercial Proof
The second big story of October 2026 is that the core banking modernisation category is finally earning its valuation. Thought Machine's revenue crossed USD 100 million in Q2 2026, with the Vault core now described as a cloud-native, event-driven platform aimed squarely at tier-one banks. 10x Banking raised about GBP 40 million in August, led by AshGrove Capital. Mambu, the other European core banking name, wired agentic AI into its core this cycle.
BaaS Finally Picks a Lane
Analysis from Softjourn projects the BaaS revenue pool will grow from $1.7bn in 2021 to over $17.3bn in 2026, a 10x expansion in five years. More importantly, BaaS in 2026 is starting to sound like a regulated business model rather than a wrapper around a sponsor bank. The platforms that survive are those that invest in compliance infrastructure (consent management, transaction monitoring, audit trails) rather than selling access to a licence like a commodity.
Agentic AI Meets the Core: The 2028 Operating Model Takes Shape
The quiet subtext across all three stories (PSD3, FiDA, core banking) is that the regulated European bank of 2028 will run on cloud-native cores wired into real-time payments and standardised APIs, with AI agents handling an increasing share of operational workflows. Mambu's agentic AI integration, Thought Machine's event-driven architecture and 10x Banking's enterprise push each tell the same story from a different angle: the composable, API-first, AI-augmented bank is not a thought experiment anymore. It is a procurement cycle.
The Bottom Line
Open banking's second act is not about screen-scraping or free consumer apps. It is about regulated, standardised, portable financial data flowing through cloud-native cores and compliant BaaS platforms into the products that actually reach customers. PSD3 writes the rules. FiDA extends the surface area. Mambu, Thought Machine and 10x Banking build the engines. This week showed each piece moving at the same time, which is new, and worth paying attention to.
