PSD2 mandated access, not standardisation. Every bank in scope had to expose account and payment APIs to licensed third parties, but no single technical specification was made mandatory. The Berlin Group's NextGenPSD2 framework became the most common reference point, yet it left enough room for interpretation that "PSD2 compliant" banks still built meaningfully different APIs. This page collects the sourced, quantified evidence of that gap. It's useful for anyone writing a new open banking or open finance specification who wants to see, concretely, what happens when a spec leaves optionality on the table.
Last reviewed: August 26, 2026
The field-level evidence: same spec, different data
Enable Banking analyzed live API traffic across 4,491 European financial institutions and found that basic data fields are returned at wildly different rates depending on the bank. Nordea (Finland) returns account holder name on personal accounts 81% of the time. ING (Netherlands) returns a creditor account on only 36% of personal debit transactions, and a reference number on just 4% of business credit transactions. Handelsbanken (Sweden) returns a given field on 83% of personal accounts but 0% of business accounts.
None of this is a compliance failure. Every one of these banks satisfies its PSD2 obligation. It's what happens when a specification makes a field optional and leaves the decision to each bank's own data model.
The consent-flow evidence: a regulator had to step in
The EBA's February 2021 opinion on obstacles to PSD2 dedicated interfaces found that "compliant" banks required anywhere from 1–3 screens taking 10–30 seconds up to 5–15 screens taking 2–3 minutes for functionally the same consent flow. Some banks were also blocking app-to-app redirection or demanding authentication beyond what PSD2's RTS on Strong Customer Authentication required.
That a European regulator had to publish a formal opinion pushing back on flows that were already technically compliant is the clearest available evidence that PSD2 compliance and cross-bank interoperability are two different things.
One mandate, at least six national dialects
PSD2 is a single EU-wide regulation, but the API layer built to satisfy it split along national lines. Our regulations dataset tracks the technical specification each jurisdiction actually adopted:
| Specification | Jurisdiction | Note |
|---|---|---|
| STET PSD2 API | France, Belgium | Built by a French banking consortium; not a Berlin Group profile at all |
| PolishAPI | Poland | Berlin Group based, with Polish national adaptations |
| COBS | Czech Republic | National implementation guideline layered on the Berlin Group framework |
| SBAS | Slovakia | National implementation guideline layered on the Berlin Group framework |
| BISTRA | Bulgaria | Explicitly documented as "Berlin Group based" |
| BOI API Spec | Israel | Also described as "Berlin Group based," outside the EU entirely |
Who ends up paying for the variance
Konsentus tracked 537 authorized TPPs across the UK and EEA as of Q3 2025, with roughly 60% operating beyond their home market. Cross-border TPPs don't get to integrate once; each new bank relationship means adapting to that bank's specific implementation choices. And there is no EU-wide standard for reporting API usage or reliability, so this fragmentation isn't even centrally measured; it shows up as engineering cost inside aggregators and TPPs, not as a regulatory statistic.
The counterfactual: what a prescriptive spec produced
The UK took a different design choice: one implementation entity (Open Banking Limited, formerly OBIE), one detailed read/write specification, and a functional conformance test suite the CMA9 banks had to pass before going live. That doesn't mean UK implementations are perfectly uniform, but it removed the "national dialect" failure mode entirely, because there was only ever one dialect to build. For a standards body writing a new spec today, that's the practical choice on the table: leave fields and flows optional and expect Berlin-Group-style divergence, or specify tightly and pay for it with less short-term flexibility for individual banks.
Frequently asked questions
No. PSD2 is a regulation that mandates banks provide TPP access to accounts, but it deliberately does not specify a single technical interface. The Berlin Group's NextGenPSD2 XS2A framework is the most widely referenced technical response, but the regulatory text only sets "framework conditions," leaving banks and national banking associations to build their own conformant implementations.
Sources
- Enable Banking — The Open Banking Data Problem PSD2 Didn't Solve (live-traffic field presence data)
- Konsentus — The Unfinished Story of European Open Banking (Nov 2025)
- Tink — EBA Opinion on PSD2 API obstacles, fallback and exemptions (Feb 2021 opinion summary)
- Open Banking Tracker — Global Open Banking Regulations dataset (58 jurisdictions, incl. STET/PolishAPI/COBS/SBAS/BISTRA API specifications)