Open banking promised to democratise financial services. It is delivering on that promise — but the compliance obligations that come with it are catching many fintechs off guard.
Open banking promised to democratise financial services. It is delivering on that promise — but the compliance obligations that come with it are catching many fintechs off guard.
The regulatory framework is tightening rapidly. In November 2025, the EU Parliament and Council reached provisional agreement on PSD3 and the Payment Services Regulation (PSR), with publication expected in the first half of 2026 and full compliance required by late 2027. This is a compressed timeline for businesses that have been operating under PSD2's more permissive regime.
PSD3 expands the regulatory scope to cover all payment service providers, including technical service providers and data aggregators that were previously unregulated or lightly regulated. Many fintech platforms operating as intermediaries — facilitating access to account data, initiating payments, or aggregating financial information — will require formal payment licences for the first time. The PSR replaces most of PSD2's conduct rules with a directly applicable regulation governing transparency, user rights, strong customer authentication (SCA), open banking access, and operational security requirements.
The AML dimension is the one fintechs most frequently underestimate. From 2027, the EU Anti-Money Laundering Regulation (AMLR) will apply alongside PSD3 and PSR, creating an integrated compliance regime where payments, identity verification, and AML responsibilities converge. Strong customer authentication requirements expand. Due diligence standards tighten with risk-based triggers. Transaction monitoring becomes more granular. Fraud liability provisions align SCA with AML obligations.
For fintechs, this means that compliance is no longer a discrete function — it is embedded in the product. API design must accommodate AML data requirements. Onboarding flows must integrate regulatory due diligence without destroying the user experience. Transaction monitoring must operate in real time against customer risk profiles that are dynamic, not static.
The data sharing model that underpins open banking also creates specific AML risks. Access to aggregated account data means that fintechs may hold — or facilitate access to — sensitive financial information across multiple institutions. The data governance obligations are substantial, and a data breach or misuse of customer information creates both regulatory and reputational risk.
For Isle of Man-based fintechs, the EU-specific rules may not apply directly, but the underlying principles do. The IOMFSA expects compliance proportionate to risk, and any fintech operating across borders will need to assess which regulatory frameworks apply to its activities.
At Kybri Consulting Limited, we advise fintech businesses on compliance strategy — from regulatory perimeter analysis and licensing pathway assessment through to AML/CFT framework design and operational readiness.
A thirty-minute call, no obligation. If the answer is that you do not need us yet, you will hear that too.
