UK Open Banking reaches 1B payments milestone
Open Banking Limited has reported that the UK Open Banking framework has reached significant milestones, with over one billion payments and 100 billion API calls made across the CMA9 institutions. This achievement signifies a major shift in the financial industry, as open banking evolves from a compliance requirement to a key component of enterprise infrastructure for both financial institutions and fintech companies. The Competition and Markets Authority introduced the open banking mandates for the nine largest current account providers over eight years ago.
Scaling of Infrastructure and Network Traffic
According to data from Open Banking Limited, the core banking infrastructure of the CMA9 has experienced sustained growth, with a 4.4 percent increase in volume in June 2026 compared to the previous month. This growth is accompanied by a 50 ms improvement in latency and a weighted system uptime of 99.35 percent. The total number of successful open banking payments completed in June 2026 reflects the steady expansion of the network.
The total volume of A2A transactions and API requests processed across the CMA9 institutions has reached historic highs. This high volume of traffic poses significant engineering and security challenges for IT security architects and DevSecOps teams, as they must ensure that systems can handle the load of processing 2.81 billion monthly API calls.
Growth Driven by Variable Recurring Payments
Although Single Domestic Payments experienced a slight decline of 1.2 percent in June, with 32.43 million transactions, total payment volumes remained strong. The growth of the network was driven by the rapid adoption of Sweeping Variable Recurring Payments, which increased by 6.7 percent month-on-month to reach 7.73 million transactions. VRPs enable users to grant continuous consent for automated A2A funds transfers within predefined parameters.
Enterprise merchants, fintech applications, and corporate treasury platforms are increasingly utilizing VRPs to automate liquidity management, recurring savings allocations, and subscription processing, thereby avoiding traditional credit card scheme fees. This shift in automated payments creates a complex environment where maintaining security while ensuring speed is a significant challenge.
API Security and Operational Resilience
Maintaining an average response time of 349 milliseconds at scale requires the implementation of strict API gateway rate-limiting, edge caching, and automated load balancing to mitigate latency spikes and prevent distributed denial-of-service vulnerabilities during peak traffic periods. Consistent performance under heavy loads is a primary challenge for system architects.
The rise of VRPs requires third-party providers to secure OAuth 2.0 and Financial-grade API token management systems against credential stuffing, token hijacking, and unauthorized consent alteration. Managing these tokens securely is essential to protecting user data and maintaining trust in the system.
Open banking transfers settle instantly over real-time payment systems, such as the UK’s Faster Payments network. However, because real-time settlement lacks native credit card chargeback mechanisms, bad actors frequently target the human layer through complex Authorized Push Payment fraud and social engineering rather than attempting technical API exploits.
Contrasting Regulatory Approaches: US and UK
The metrics highlighting the growth of open banking in the UK show the differing regulatory approaches between European and American markets. The UK employed top-down regulatory enforcement via the CMA9 to implement standardized APIs, creating a single technical baseline that accelerated institutional adoption. In contrast, the US financial sector historically relied on bilateral market agreements and screen scraping.
