Open Banking Grows Up Again: PSD3 Edges Closer, BaaS Picks a Lane, and the Core Vendors Keep Winning
As of this week, Thought Machine's commercial momentum, 10x Banking's fresh capital, and Mambu's agentic AI play are turning core banking modernisation from a slide-deck ambition into a procurement line item. BaaS, meanwhile, is quietly consolidating around the providers who can spell DORA.
For roughly a decade, "core banking modernisation" sat somewhere between a procurement joke and a vendor pitch. This week it looks different. The regulation is tightening, the vendors are producing numbers, and the Banking-as-a-Service market is being quietly reshaped by procurement teams who have discovered the word "auditability".
PSD3 and PSR: the slow boil everyone pretends to ignore
The European Commission is still pushing PSD3 toward publication, with the Payment Services Regulation (PSR) applying directly across member states and skipping the usual national-transposition theatre, as Freshfields has summarised in client briefings this quarter. Open banking is at the heart of the shift. According to a recent Morrison Foerster briefing, banks will face more granular, enforceable obligations to provide functional APIs, with contingency mechanisms where they fail to deliver.
Translated into procurement English: the API team at every retail bank just got a new deadline, and the vendor team just got a new budget. FiDA, the broader framework pushing open banking into open finance, remains in trilogue, with pauses and resumptions reported through the summer. The commercial logic, however, is already baked in. Banks are modernising on the assumption that savings, investment, pension, mortgage, and non-life insurance data will all be in scope under FiDA, whichever version lands first.
That assumption changes what a "core" needs to do. A ledger that cannot speak to an API orchestration layer is now a liability. A middleware stack that cannot evidence consent across data domains is a compliance incident waiting to happen.
Thought Machine, 10x Banking, and the sound of commercial proof
If 2024 was the year the core banking category promised results, 2026 is the year it delivered a few. Thought Machine's annual recurring revenue is reported to have passed $100 million in Q2 2026, with its Vault core now positioned as a cloud-native, event-driven platform aimed at tier-one incumbents. The figure is a vendor-sourced claim and should be read as indicative, not audited. The direction, though, is corroborated by live deployments at Lloyds Banking Group and Standard Chartered.
10x Banking followed with roughly £40 million of fresh capital in August 2026, led by AshGrove Capital, as reported by trade press this autumn. The round is a strong signal that the UK core vendor has moved past the "promising start-up" phase into the "trusted supplier to global banks" category. 10x's own buyer guide names its customers, which is the sort of marketing you can only do when the contracts are signed.
Mambu, meanwhile, is leaning into agentic AI. Per a September roundup widely cited this month, the company has wired agentic AI into its core, offering banks workflows that can take decisions, rather than merely surface them. It is early days, and the governance questions around agentic systems in a regulated institution are substantial, but the direction is unambiguous: the core is becoming an intelligent participant in the bank's operating model, not just a database that happens to balance.
Tuum, the Estonian core-banking contender, continues its measured climb. CB Insights pegs its total raised at roughly $45.8 million, with Citi Ventures and BlackFin Capital Partners among its backers. This week's news in the segment is a confirmation: Bank CenterCredit has reportedly chosen Tuum to power its BaaS offering, a deal that signals the vendor's traction in markets where regional banks need to launch wholesale platforms without a decade of internal engineering.
Progressive modernisation: the US quietly accepts it cannot rip and replace
Across the Atlantic, the ABA Banking Journal this October ran a long piece on "progressive modernisation", a phrase that captures the mood among US community and regional banks. The quote worth remembering comes from a banker named in the article, Weiss, who told the ABA: "We're in a very rapidly changing marketplace". The take-away is that cores need to be configurable rather than coded, so banks can plug in digital, branch, and partner channels at the pace of the business, not the pace of a seven-year programme.
Softjourn's analysis, widely circulated this quarter, projects the BaaS revenue pool growing from $1.7 billion in 2021 to over $17.3 billion in 2026. Treat the number as directional, as vendor-adjacent research tends to flatter the category. The point stands: the money is there, and the capability is being bought.
BaaS picks a lane: DORA literate or out of the pitch
The BaaS market has had a difficult eighteen months. Several US sponsor banks were pushed out of the business by regulators. European providers watched the fallout with professional nervousness. This October, procurement teams on both sides of the Atlantic are quietly cutting providers from shortlists if they cannot credibly answer three questions: how do you meet DORA, how do you meet PSD3, and how do you meet local prudential requirements.
That is a quieter story than funding announcements, but it is the one that matters. The BaaS category is consolidating around providers who can prove operational resilience, data-portability, and third-party risk control. Everyone else is being politely declined.
Reports this month have also surfaced a non-binding term sheet from Coastal Financial that, if it progresses, could reshape the US sponsor-bank map. The specifics remain thin on the ground. The signal is not. The buyers of BaaS infrastructure are reorganising around institutions that look more like licensed utilities than like start-ups.
Open finance edges nearer, and the UK keeps writing the playbook
In the UK, the Payments Initiative's commercial VRP scheme went live on 2 June 2026, the country's first production-grade commercial variable recurring payment rail. The data from that scheme is starting to inform the next wave of open-banking commercial models across Europe. Smitech's recent note put the point plainly: an API layer sits alongside, and in front of, existing core systems, rather than replacing them. The UK's approach, cautious and iterative, is becoming the de facto reference for policymakers from Dublin to Riyadh.
Malaysia is working toward its first major open finance milestone in Q1 2027. Australia continues to refine the Consumer Data Right. India's account aggregator framework keeps expanding. The common thread: whichever regulator you ask, open banking has stopped being a one-off project and become a permanent capability demand on the bank's technology stack.
What to watch next
For CTOs, three questions matter in the next 90 days. First, is your core going to pass a PSD3-style API conformance review without emergency work? Second, is your BaaS provider (if you have one) ready to answer DORA questions in writing, with evidence? Third, where in your stack would an agentic AI workflow materially cut operational cost, and what is the governance model for letting it act?
For founders, the message is more bracing. The core vendors have reached commercial proof, which means the pie is now being cut. The route in is specialisation: data orchestration, consent management, agentic workflow governance, climate-risk scoring, or whatever vertical the incumbents cannot resource. Horizontal "modern core" plays with no commercial validation will struggle to raise.
Open banking, in other words, is finally growing teeth. The core is finally earning its budget. The next twelve months will decide which banks, and which vendors, step into them.
