Open Banking API Integration: Developer’s Implementation Guide
Open banking is moving from regulation to production. Vietnam’s Circular 64/2024/TT-NHNN took effect on March 1, 2025, and Open Banking Limited reported more than one billion open banking payments in the UK by July 2026. This guide, part of our guide to fintech app development cost, explains how to integrate: which rules apply, how to build consent and security, and what to ask a delivery partner. For the concept itself, see our article on open APIs in banking.
Quick answer
Open banking API integration connects your app to bank APIs so users can share account data or start payments with their consent. The work covers local rules, an OAuth consent and security layer, data mapping, testing, and monitoring. Start with the market you serve: Vietnam’s Circular 64/2024 requires full bank compliance before March 1, 2027.
Open banking API integration connects your app to bank APIs so users can share data or start payments with their consent
1. What Is Open Banking API Integration?
Open banking API integration is the work of connecting an application to a bank’s published APIs, so that a customer can authorize the app to read account data or initiate payments. The integration covers consent, authentication, data handling, and monitoring, and it differs depending on whether you build for the bank or for a third party.
Banks expose and secure the APIs. Third parties, such as fintech apps, lenders, and accounting tools, consume them. Most developers face one side or the other, and the rules, risks, and test plans differ for each.
2. Which Rules and Standards Apply?
The rules that apply depend on the market. Vietnam has a binding circular with a compliance deadline, the EU is moving from PSD2 to PSD3 and a new payment services regulation, the UK runs a mature standard at scale, and the US rule is under reconsideration. Check each market before you design, because consent and security duties differ.
| Market | Status | What developers need to know |
| Vietnam | Circular 64/2024/TT-NHNN in force since March 1, 2025. Full compliance required before March 1, 2027. | A contract with each bank; consent limited to 180 days unless agreed otherwise; payment APIs only for banks and intermediary payment service providers |
| EU | PSD2 applies today. PSD3 and the Payment Services Regulation reached a provisional agreement in November 2025; adoption is expected in 2026, and the application is likely in late 2027. | More prescriptive API performance and uptime rules, and detailed written agreements for strong customer authentication providers |
| UK | More than one billion payments and 100 billion API calls across the CMA9 banks by July 30, 2026; 2.81 billion API calls in June 2026. | A mature, high-volume ecosystem to benchmark your design against |
| US | The CFPB’s October 2024 rule was enjoined and is under reconsideration; a new proposal went to OIRA review in August 2026, and its content is not public. | Plan for rule changes; build on industry standards rather than the current text |
On technical standards, the common references are the UK Open Banking Standard, the Berlin Group NextGenPSD2 framework in the EU, and the Financial Data Exchange (FDX) API in North America. For security, the OpenID Foundation published the FAPI 2.0 Security Profile as a final specification in February 2025. Vietnam sets its own technical standards in the appendices to the Circular.
Open banking rules differ by market: Vietnam’s Circular 64 sets a March 2027 deadline, while the EU moves toward PSD3
3. How Do You Integrate an Open Banking API?
Integrate in seven steps: choose a route to the banks, secure access, build the consent flow, implement authorization, map the data, test in a sandbox and then in production, and monitor afterward. The order matters, because consent and security design decide what data you can request and how long you can keep using it.
Choose a route
Connect to banks directly or through an aggregator or platform.
⚠ Watch for: Coverage by country and bank
Secure access
Register as a third party or sign a contract with each bank.
⚠ Watch for: Vietnam requires a contract with the bank
Build consent
Show what data you request and why; let users look up and withdraw consent.
⚠ Watch for: Expiry rules, such as 180 days in Vietnam
Authorize
Use the OAuth 2.0 authorization code flow with a high-security profile.
⚠ Watch for: Token binding and client authentication
Map data
Normalize accounts, balances, and transactions across banks.
⚠ Watch for: Different fields and error codes per bank
Test
Use each bank’s sandbox, then a limited production pilot.
⚠ Watch for: Sandbox and production can behave differently
Monitor
Track errors, latency, consent expiry, and access logs.
⚠ Watch for: Rate limits that banks apply to automated queries
Should You Connect Directly or Use an Aggregator?
Connect directly when you serve a few banks and need full control of consent and data. Use an aggregator or platform when you need many banks quickly and can accept its coverage, pricing, and data model. Many teams start with an aggregator to launch, then connect directly to the banks that carry most of their traffic.
Whichever route you choose, check coverage for the exact banks and countries you need. Aggregators differ by market, and a provider that covers one region may not cover another. This comparison is editorial, not a vendor ranking.
4. What Security Does the Integration Need?
Open banking integrations need strong authorization, minimal data, and full logging. The FAPI 2.0 Security Profile sets a high bar for OAuth 2.0: pushed authorization requests, PKCE, and sender-constrained access tokens. On the bank side, Vietnam’s Circular adds cyber safety, monitoring, and log retention duties, and it limits automated queries from third parties.
- Authorization. FAPI 2.0 requires the authorization code flow with PAR and PKCE using the S256 method, and it rejects the resource owner password credentials grant.
- Tokens and clients. Access tokens must be sender-constrained, using mutual TLS or DPoP, and clients must authenticate with mutual TLS or private_key_jwt.
- Bank-side duties in Vietnam. Banks must meet at least level 3 cyber safety requirements, monitor for unusual access, keep logs of third-party API use for at least 3 months, and keep backups for at least 1 year.
- Third-party duties in Vietnam. Third parties must give customers tools to look up and withdraw consent, use data only within the agreed scope, and report security incidents.
5. What Does Savvycom’s Banking Work Show?
Savvycom has not published an open banking platform project, so the closest evidence is bank integration work. For a Cambodian bank, Savvycom built native iOS and Android apps with APIs for real-time core banking synchronization, two-factor authentication, AES-256 encryption, and security audits. The bank reported 61.5% user adoption and 99% user satisfaction.
The foreign exchange assistant Savvycom built for a South Korean financial services company shows control patterns that carry over to API work: trades tied to a locked quote, role-based access, and automatic logging of every transaction. It went live in three months. Read the multi-agent FX project for details.
Neither project is an open banking platform, and the public pages do not name authentication methods or endpoints. Treat them as evidence of bank integration and security practice, not of FAPI or consent management delivery.
6. What Should You Ask an Integration Partner?
Ask a partner to show experience in the specific market and standard you need, not only banking in general. A useful partner can explain how it handles consent, token security, bank-by-bank differences, and monitoring. Ask for the sandbox work they have done and for how they would test failure cases such as expired consent and bank downtime.
- Standards. Which of Circular 64, PSD2, FDX, or FAPI 2.0 have they implemented?
- Consent. How do they build look-up, withdrawal, and expiry?
- Security. How do they bind tokens and test the integration for vulnerabilities?
- Operations. Who monitors errors, rate limits, and consent expiry after launch?
If you are planning a banking or fintech integration, see Savvycom’s digital banking solutions.
