- Open finance expands the scope of open banking from payment-account access toward permissioned financial data and services across a broader ecosystem.
- AI agents can act across institutions and platforms, so each agent needs a distinct identity and bounded authority tied to the customer or business it represents.
- Credentials prove connectivity. Runtime authorization governs access across partners, channels, and use cases.
- The opportunity includes faster lending, SME support, personalized finance, embedded payments, connected wealth, insurance, and partner distribution.
The Shift from Open Banking to Open Finance
Open finance is becoming a growth and distribution model for financial services. Agentic AI increases its potential and makes identity, delegated authority and runtime authorization essential.
Open banking established a secure way for customers to share payment-account data and initiate payments through authorized third parties. Open finance extends that model across a broader set of financial products, data and services, including lending, savings, investments, pensions and insurance. Its strategic value is the ability to make financial services available wherever customers choose to act, including partner ecosystems, embedded workflows and AI-agent experiences.
Agentic AI adds a new type of actor. An external agent may discover a product, assemble financial information, recommend an action, prepare a transaction or, within defined limits, initiate it under delegated authority. The institution must continuously establish which actor is making the request, whose authority it carries, what it may do in the current context and what evidence will support accountability afterward.
Authentication and API connectivity remain foundational, but they cannot answer those questions alone. Financial institutions need a connected trust chain spanning identity, consent, delegated authority, API protection, contextual policy, revocation and audit evidence. Higher-risk or consequential actions may require stronger verification or human approval.
This white paper explains the global move from open banking to open finance, the effect of agentic AI on financial APIs, the business value available to financial institutions and the trust controls required to scale new channels safely.
What Is Open Finance?
Open finance is the permissioned sharing and use of financial data and services across institutions, providers, platforms and applications through secure APIs.
Open banking initially focused on payment accounts and payment initiation. Open finance applies the same customer-controlled model to a wider financial relationship. Depending on the market and scheme, that may include lending, savings, investments, pensions, insurance and other data or services. The result is a richer financial context that can support more useful decisions and experiences.
The move is also commercial. APIs allow banks and other providers to place financial services inside partner experiences, business software and digital marketplaces. This can extend distribution, reduce customer effort and help institutions respond to needs in context rather than waiting for a customer to visit a bank-owned channel.
How Open Finance Differs From Open Banking
Why Open Finance is Entering a New Phase
Open finance is progressing globally through different regulatory and commercial models. Mature markets are moving from mandated access toward broader datasets and higher-value use cases. Newer markets are defining national frameworks and technical standards. Commercially led markets are replacing credential sharing and screen scraping with more secure, customer-permissioned APIs.
The common requirement is not a single global implementation. Institutions need a consistent way to govern identity, consent, authority, API access and evidence while adapting to local participants, data categories, standards and liability arrangements.
Brazil illustrates the scale available when infrastructure, adoption and commercial use cases reinforce one another. Banco Central do Brasil reports that its open-finance ecosystem connects 68 million accounts and handled R$1.16 billion in payments and transfers in July 2025 alone.1,2 In the United Kingdom, the Financial Conduct Authority's roadmap links the next phase of open finance with broader data access, AI-enabled services and agentic payments. These markets show why institutions should plan beyond minimum connectivity and focus on outcomes customers will choose to use.3
What Changes When Open Finance Becomes Agentic
Agentic AI introduces software that can pursue a customer goal across systems, make decisions within defined limits and request actions under delegated authority.
In a conventional open-banking journey, a customer authorizes an application to retrieve data or initiate a payment through a known flow. An AI agent may work asynchronously, use several tools, compare multiple providers and sequence a series of requests. Each request may appear valid in isolation even when the combined activity falls outside the customer's original intent.
An agent acting for a customer or business should therefore be treated as a governed actor. It needs a distinct identity, a verifiable relationship to the principal it represents and permissions limited by purpose, scope, duration and risk. The agent's operator, the partner application and the institution's service may also need to be identified so that the full chain can be reconstructed.
Four Questions Every Interaction Must Answer
· Who is acting, including the person, organization, application or AI agent making the request
· Whose authority the actor is using and how that relationship was established
· What the actor is permitted to do now, given the resource, purpose, transaction value, risk and current context
· What evidence will show what was requested, permitted, denied, escalated or completed
These answers can change during a journey. Retrieving a balance, preparing a transfer and releasing funds carry different consequences. A policy decision made when access began may be insufficient when the requested action changes. Authorization must therefore move closer to the action.
Why the Agentic API Economy Changes the Scale of Trust
Agentic AI changes both who calls financial APIs and how frequently those calls occur. One customer goal can generate many machine-to-machine requests as an agent retrieves data, assembles context, compares products and prepares an action. Cloudflare reports that more than half of the dynamic traffic on its global network is API-related and much of it is automated.4 Salesforce reported that financial services generated 10% of monthly Agentic Work Unit output in its dataset and that the sector's output grew thirteenfold between February 2025 and April 2026.5 These figures are not measures of financial-data API traffic, but they indicate the direction and pace of automation.
Authentication cannot be treated as proof that every subsequent request is appropriate. Salt Labs found that 99% of the API attack attempts it analyzed originated from authenticated sources.6 Financial institutions need policy enforcement and evidence at the level of the action, even when the token, client or session is valid.
Where Trusted Open Finance Creates Business Value
Open finance creates value when permissioned data improves a real decision, service or transaction. The strongest use cases connect customer benefit with a controlled operating model.
What a Trusted Open Finance Architecture Requires
A trusted open finance architecture connects participant identity, consent, delegated authority, API protection, runtime policy, revocation and audit evidence.
Verify every participant
The institution must recognize customers, businesses, employees, partners, applications and AI agents in their proper roles. It must also establish the relationships among them, including which person or organization an agent represents and which service operates it.
Secure financial APIs
Financial APIs require controls designed for sensitive data and high-value actions. OpenID Connect, OAuth 2.0 and Financial-grade API security profiles provide important building blocks, including stronger client authentication, protected authorization requests, message integrity and secure token use. API gateways must validate requests and enforce the institution's requirements at the edge.
Connect consent to delegated authority
Consent records what the customer agreed to share or allow. Delegated authority determines what another actor may do on the customer's or business's behalf. Both should be specific about purpose, scope, duration and permitted actions. They should also be revocable when the mandate ends or circumstances change.
Authorize each action in context
A valid session or access token does not establish that every action is appropriate. Contextual policy can evaluate the actor, principal, resource, purpose, value, device, risk and journey state before allowing, denying or escalating a request.
Use stronger verification and human approval
Consequential activity may require stronger customer verification, additional authentication or explicit human approval. Institutions can automate lower-risk work while reserving human intervention for decisions and transactions with material financial or regulatory impact.
Preserve evidence and support revocation
Each material action should leave a record connecting the principal, agent or application, consent, delegated mandate, policy decision and outcome. Access, tokens and authority must be revocable so the institution can respond when the customer's instructions, risk or relationship changes.
Open Finance Identity Solution Requirements
Although regional schemes differ, financial institutions repeatedly encounter the same architectural requirements. Meeting them through reusable controls reduces custom development and allows product teams to focus on the financial APIs and customer journeys that create value.
Standards-aware and maintainable
Open finance specifications and scheme rules continue to develop. A solution should support the relevant OAuth, OpenID Connect and FAPI security profiles and make updates manageable as regional requirements evolve. Standards support should reduce the amount of security logic that each development team must create and maintain.
Deployable alongside existing identity systems
Institutions should be able to introduce open-finance controls without replacing a working customer identity and access management environment. A drop-in approach can add the API-security, client-identity and standards capabilities required for open finance while reusing the existing customer journey and identity estate.
Integrated with consent and business systems
Open-finance consent is rarely a simple yes-or-no decision. The experience may need to present account, product or transaction information held in the bank's domain systems. The identity architecture should work with the institution's consent-management service, customer channels and systems of record rather than forcing that business logic into the identity layer.
Scalable across participants and use cases
The architecture should support customer-facing applications, trusted third parties, aggregators, partner platforms and agents without a separate control model for each one. Trusted directories, client registration, lifecycle governance and reusable policies help reduce repeated onboarding and integration work.
Focused on financial value
Security and identity components should handle participant validation, standards-based authorization flows, token controls and policy enforcement so that bank teams can focus on APIs that support lending, payments, financial management and other domain-specific outcomes.
How Modern Identity Supports Trusted Open Finance
Identity acts as the trust and control layer for open finance, helping institutions secure the channel, govern each actor and connect permissioned access to accountable action.
Ping's open-finance architecture is designed to work alongside an institution's existing CIAM, consent-management services and core banking systems. PingGateway serves as the secure API enforcement point, while PingOne Advanced Identity Cloud provides identity, access management and directory capabilities. Trusted ecosystem services can validate participating applications and credentials.
At the API edge, PingGateway can enforce the controls required by the institution's open-finance profile, including client and token validation, protected authorization flows, message and transport security, and audit events. The architecture can use external consent systems so the institution retains control of the domain-specific consent experience and evidence.
The same foundation extends to agentic journeys. An AI agent can be represented as a distinct actor, related to the principal it serves and issued permissions limited to the delegated purpose. Contextual policy can govern API and tool requests at runtime, require step-up verification or human approval for consequential activity, and record the decision chain. Agentic use cases extend the identity and policy model; they do not require the institution to build a separate identity silo.
Figure 1. Ping Identity open finance solution architecture
Experience grounded in open banking standards
Ping Identity's open-finance experience began in mature open-banking markets. Ping provided the reference implementation for the United Kingdom's Open Banking Implementation Entity and has operated the UK Open Banking Test Facility as a service for financial institutions since 2018. Ping has also contributed to the standards used to secure financial-data sharing, including FAPI and related OAuth extensions such as pushed authorization requests, mutual TLS and JWT-based security profiles.
This combination of standards participation, implementation experience and deployment flexibility helps institutions apply a proven identity foundation to regional open-finance schemes and new agentic channels. Specific conformance requirements should be assessed against the target scheme, product release and deployment configuration.
How Financial Institutions Should Prepare
Start with customer and business value
Identify journeys where broader financial context, partner distribution or agent-assisted execution improves a measurable outcome. Credit decisions, SME cash-flow support, personal financial management and embedded payments provide concrete starting points.
Map the full actor and authority chain
Document the customer or business, each provider and application, the agent and operator, where relevant, the financial APIs and data involved, and the actions each actor may request. Record where consent, delegation, stronger verification or human approval is required.
Separate connection from permission
Define which controls establish that an actor can connect and which policies determine whether a specific action should be allowed. Apply runtime authorization to resources and actions with different levels of consequence.
Create reusable controls
Use common patterns for participant identity, client onboarding, consent integration, delegated authority, API enforcement, revocation and evidence. Reusable controls make it easier to adapt to new schemes, partners and use cases without creating inconsistent silos.
Test accountability before scale
For each material action, confirm that the institution can reconstruct who or what acted, the principal involved, the authority and purpose, the policy decision, any human approval and the outcome. This evidence is essential for operations, disputes, audit and risk management.
The Path to Accountable Financial Action
Open finance will determine where financial services can appear. As customers increasingly act through partners, platforms and AI agents, identity will determine whether institutions can trust what happens in those channels.
The institutions that lead will connect permissioned access to clear authority, contextual policy and evidence. They will be able to extend services without losing control of the customer relationship, automate lower-risk activity while protecting consequential actions, and apply one trust model across different markets and ecosystem participants.
Frequently Asked Questions
What is the role of identity in open finance?
Identity establishes every participant and relationship in the interaction. It connects the customer or business to the application, provider or AI agent; supports scoped and revocable authority; enables policy decisions at the moment of action; and records evidence for accountability.
Is API security enough for agentic open finance?
API security is necessary but not sufficient. It can protect connectivity, clients, tokens and traffic. Agentic use cases also require institutions to determine whose authority an agent carries, whether a specific action matches the delegated purpose and when to deny, escalate or require human approval.
What is delegated authority?
Delegated authority is the bounded permission one actor receives to act for another. In open finance, it should specify the principal, purpose, permitted data or actions, duration, limits and conditions for revocation or approval.
How does FAPI support open finance?
Financial-grade API security profiles define stronger patterns for authorization, client authentication, message integrity and token use when APIs handle sensitive or high-value data. Regional open-finance schemes can apply these patterns differently, so institutions should assess the standards and conformance obligations relevant to each deployment.
Can Ping work with an existing CIAM platform?
Yes. The architecture is designed to add API enforcement, client-identity and open-finance controls alongside existing customer identity, consent-management and banking systems. This allows an institution to reuse established customer journeys while introducing the controls required for financial APIs and ecosystem participants.
How should human approval be used?
Human approval should be reserved for actions whose financial, regulatory or customer impact warrants additional control. Policy can allow low-risk information gathering, then require stronger verification or explicit approval before a payment, commitment or other consequential action.