PSD3, cVRP, and a $7 Trillion Embedded Finance Wave: Banking's Rewiring Summer

The EU's payments rulebook is inked, the UK just switched on its first new payments scheme in nearly two decades, and Banking-as-a-Service deals are once again landing in journalists' inboxes. Welcome to the busiest quarter of open banking in years.

Somewhere in Brussels this month, a printer is very warm. As of this week, the European Union's Third Payment Services Directive (PSD3) and its companion Payment Services Regulation (PSR) are hurtling toward publication in the Official Journal, the final procedural step before the 18-month transitional clock starts ticking for every payment services provider on the continent.

Meanwhile, the UK's Payments Initiative (UKPI) has already flipped the switch on commercial Variable Recurring Payments (cVRP), Banking-as-a-Service partnerships are back in the deal-flow spotlight, and core banking vendors are jostling for the modernization budgets that CIOs are finally releasing. If open banking felt like a slow-moving policy story in 2024, it just found another gear.

Here's the mid-summer scorecard, and what to watch next.

PSD3 and the PSR: signed, but the hard work is only starting

According to a July 2026 analysis by Norton Rose Fulbright, the European Parliament, Council and Commission agreed on the final versions of PSD3 and the PSR on April 23, 2026, with the texts subsequently published on the same date. Publication in the Official Journal of the European Union is anticipated between June and July, though industry lawyers at Morrison Foerster warn the timing "may slip to September."

Whatever the exact date, once the countdown begins, PSPs across the bloc have 18 months to comply. That is not a lot of runway for what the KPMG-Law team, in a July client note, characterises as "prescriptive requirements for API performance and uptime," expanded fraud-liability rules, and a full merger of the e-money institution regime into the payment institution framework.

What operators need to prepare for

Three of the biggest lifts, distilled from the July client alerts by Freshfields and PwC Netherlands: mandatory IBAN-name matching for every credit transfer, with liability shifting to PSPs that don't catch mismatches; broader reimbursement obligations for Authorised Push Payment (APP) fraud, which will squeeze fraud-loss ratios at banks that have been slow to invest in behavioural analytics; and stricter API performance metrics, forcing many issuers to graduate from screen-scraping alternatives to production-grade developer portals.

Following the anticipated Official Journal publication, expect a stampede of RFPs to Thought Machine, Mambu, Temenos and other core-banking vendors for platforms that can natively handle the new obligations without an army of consultants.

The UK's cVRP moment: the first new payment scheme since Faster Payments

While Brussels writes rules, London launched one. On June 2, 2026, the UK Payments Initiative went live with its commercial VRP scheme, the country's first new payment scheme since Faster Payments in 2008, according to Token.io's launch communications and confirmed by the FCA's news statement.

The scheme's founding shareholders read like a who's-who of British banking: Token.io as scheme operator alongside HSBC, Barclays, Lloyds Banking Group, NatWest, Nationwide, Santander, Monzo, Revolut and Starling. Thirty-one firms in total participated in the launch, per The Payments Association's July recap.

Why cVRP matters beyond the sweeping use case

The Competition and Markets Authority (CMA) first mandated VRPs back in 2022 for "sweeping", moving money between a customer's own accounts. cVRP extends that consent-based, API-driven payment mechanism to paying real businesses.

According to Plaid's July primer, that means a consumer could authorise their electricity provider to pull the exact amount of each month's bill (rather than a pre-nominated direct-debit amount), or let a subscription service adjust price without triggering a card-scheme dispute. Wave 1 covers regulated and trusted sectors including financial services and utilities. Wave 2, expected in the second half of 2026, will extend the scheme to general e-commerce.

The Financial Conduct Authority (FCA) and Payment Systems Regulator (PSR) issued a joint update in January 2026 saying they would "not prioritise a Competition Act 1998 investigation" into the centralised access-fee model UKPI is proposing, regulatory speak for "carry on."

The real prize: a card-scheme alternative

If Wave 2 delivers, the UK will have a domestic, account-to-account rail with variable-amount, recurring-consent capability at scale. That's the closest thing yet to a genuine card-scheme alternative in a G7 market. Interchange-fee economics may finally get their long-forecast disruption.

BaaS: the $17 billion category no one's shutting up about

Just as regulators sharpen the rules, a new wave of Banking-as-a-Service partnerships is hitting the tape. The most eye-catching this month: Asprofin Bank and Digital TRVST announced on July 22 that they had entered a Banking-as-a-Service alliance for institutional, corporate and high-net-worth clients, with expected annualised transaction volume of around $5 billion within the first twelve months. The announcement, distributed by GlobeNewswire and picked up by the Manila Times, notes that embedded finance is nearing a $7 trillion market.

Broader category data from Softjourn's 2026 BaaS overview projects the BaaS revenue pool will grow from $1.7 billion in 2021 to over $17.3 billion in 2026, a 10x expansion in five years.

The post-Synapse rebound

For readers who watched the BaaS category get bruised in 2023–24 by the collapse of Synapse and a wave of enforcement actions against sponsor banks, the current news cycle is notably different. The deals landing this quarter emphasise direct core-to-partner API integrations that eliminate middleware layers (often the failure point), enterprise-grade regulatory oversight baked into the partnership at signing, and institutional and HNW client focus, where compliance budgets are already sized appropriately.

That's not to say the risks are gone. Reserve-account reconciliation, program-management standards and consumer-protection guardrails remain live issues on both sides of the Atlantic. But the tone of the July press releases is markedly more "grown-up" than the BaaS gold rush of 2021.

Core banking modernization: the market share fight of 2026

Underneath all of this sits the core banking software layer, and the July league tables have shifted only slightly.

According to Innowise's Q3 2026 core banking market analysis, Temenos remains the most widely deployed system globally, "trusted by more than 950 banks" and ranked the number one provider for 21 consecutive years. Temenos Transact continues to win the tier-one modernization mandates where deep functional depth is non-negotiable.

Mambu, profiled in comparison guides on PeerSpot and Slashdot, is winning where speed and digital-first flexibility matter more than legacy feature parity, particularly at neobanks and greenfield programs. Thought Machine has surpassed the $100 million total revenue threshold for the financial year ending December 2025, per its earlier corporate disclosures, and remains the go-to for banks committed to cloud-native architecture and smart-contract-driven product configuration. Rounding out the top five, Infosys Finacle and Oracle FLEXCUBE continue to command global market share.

The composable banking thesis, finally in production

The story that vendors have been selling since 2018, that banks can rip out monolithic cores and stitch together best-of-breed capabilities behind an API façade, is showing up in more RFPs this year than in any prior period, according to consultants at mobileLIVE. The reason isn't just technology; it's economics. As core mainframe maintenance costs escalate and open banking obligations tighten, "incremental modernization" is starting to lose to "replace and be done."

The through-line: rails, rules, and revenue

Zoom out from the individual announcements and a pattern emerges. Open banking is no longer an isolated regulatory workstream. It's a lever regulators are pulling to force better fraud controls and consumer protection (PSD3, PSR), payment networks are pulling to bypass card-scheme economics (cVRP), distributors and platforms are pulling to embed banking wherever transactions already happen (BaaS), and core vendors are pulling to sell modernization to CIOs who used to defer.

Following this month's announcements, the practical question for any bank board is not "when will open banking arrive?" It's "which of the four levers above are we already pulling, and which are our competitors pulling for us?"

What we're watching next

Three items on the FinanceX radar for August: Official Journal publication of PSD3/PSR, which starts the 18-month transitional clock; the cVRP Wave 2 scope announcement, which will define how quickly e-commerce merchants can plug in; and the next BaaS deal to break $10 billion in projected first-year volume, because if Asprofin and Digital TRVST are anywhere close to their $5 billion projection, someone bigger is coming.

Open banking used to be about opening APIs. In July 2026, it's about who owns the plumbing when everything connects.