Open banking in the UK has crossed a threshold that most sector commentary underplays. The infrastructure no longer just shares account data; it now initiates recurring payments, positioning fintech firms as direct competitors to card-on-file and Direct Debit rails that traditional banks have controlled for decades. For incumbents, this is not a branding problem or a UX gap. It is a structural shift in where transaction revenue sits.
Open banking payment initiation and the threat to bank revenue rails
Variable recurring payments (VRPs) represent the sharpest edge of the fintech challenge to traditional banking services. Where earlier open banking mandates focused on read-only account access, the move towards payment initiation gives fintech firms the ability to trigger and manage transactions without routing through card networks.
Read also: Brexit aftermath: economic implications for UK businesses in 2026
The practical consequence is measurable. Businesses that previously relied on Direct Debit or card-on-file now have an alternative channel, one that bypasses interchange fees entirely. For banks earning basis points on every card transaction processed through their acquiring or issuing arms, this erodes a revenue line that has been remarkably stable for two decades.
The FCA has signalled its intention to develop a longer-term open banking framework, which suggests the regulator sees payment initiation as permanent infrastructure rather than a pilot. Open banking is shifting from data layer to payment rail, and incumbents that treat it as a data-sharing compliance exercise are mispricing the risk.
See also: Mental health support services: advancements in the UK healthcare sector
UK payments regulation rewrite: tokenised payments and stablecoins
HM Treasury’s July 2026 consultation proposed a fundamental overhaul of payment-services and e-money regulation. The scope is broad: tokenised payments, stablecoins, and agentic open banking are all in play. The consultation described work towards legislation in 2027-28, so these remain proposals rather than binding rules.
What matters for traditional banks is the direction, not the timetable. The consultation considers whether more detailed requirements should sit in FCA rules rather than primary legislation. If that approach prevails, the regulator gains the flexibility to adapt requirements quickly, a pace that suits fintech firms far better than it suits legacy compliance architectures.
Three areas deserve attention from banking operations teams:
- Stablecoin settlement could introduce new payment instruments that compete with commercial bank money for retail transactions, forcing treasury desks to model liquidity in unfamiliar token formats.
- Tokenised deposits and payments may require banks to maintain parallel ledger infrastructure, duplicating rather than replacing existing core banking systems.
- Agentic commerce, where AI-driven agents initiate payments autonomously, raises questions about authentication and liability frameworks that current banking terms of service do not cover.
None of these outcomes is guaranteed. The consultation is still open. But the direction of travel signals that UK regulation is preparing to accommodate fintech payment instruments at the same level as traditional bank-issued ones.
Critical infrastructure risk: shared technology suppliers in digital banking
The expansion of digital banking, by fintechs and incumbents alike, has concentrated operational dependency on a narrow set of cloud and core-banking-as-a-service providers. New oversight arrangements now apply to major technology suppliers deemed critical to the financial sector.
Banks and fintechs remain responsible for their own supplier risk management. The oversight regime does not transfer that liability. It adds a supervisory layer on the suppliers themselves, but it does not eliminate the concentration risk that comes from multiple firms sharing the same infrastructure.
We observe this pattern repeatedly in incident analyses: a single provider outage cascades across challenger banks, payment processors, and sometimes parts of incumbent operations simultaneously. The practical limit of digital transformation is that moving to the cloud does not diversify risk if every competitor moves to the same cloud region with the same provider.
For traditional banks weighing build-versus-buy decisions on digital infrastructure, the regulatory message is clear. Outsourcing execution does not outsource accountability. Boards signing off on fintech partnerships or platform migrations need supplier-concentration mapping that goes beyond tier-one vendors into sub-contractors and shared dependencies.
Branch closures, cash access duty, and the limits of digital-only strategy
Since 18 September 2024, FCA rules have required designated banks and building societies to assess access to cash before closing branches or ATMs. This regulatory duty introduces a constraint that purely digital fintech models do not face, but that traditional banks cannot ignore.
The emergence of shared banking hubs, where multiple banks share a single physical location, represents one practical response. These hubs preserve cash access without requiring each bank to maintain its own branch network. The model is a compromise: it reduces property costs while satisfying the regulatory obligation.
For fintech firms, the cash-access duty is largely irrelevant; most operate without physical infrastructure. But it creates an asymmetry worth noting. Traditional banks carry regulatory obligations that fintech competitors do not share, from cash access to deposit protection schemes with different capital requirements. Any analysis of competitive positioning that ignores these structural cost differences overstates the fintech advantage.
Conversely, the branch-closure trend reflects genuine shifts in customer behaviour. Card payments now dominate retail transactions in the UK by a wide margin. The remaining cash-dependent population is shrinking, and the regulatory duty itself may prove time-limited as demographics shift.
Fintech and banking fraud: the mule-account problem
Faster, frictionless payments, the very feature that makes fintech attractive, also reduce the window for fraud detection. Fraud infrastructure intersects deeply with both traditional and fintech payment channels, and mule accounts remain a persistent challenge across the sector.
Speed and security remain structurally opposed in payment design. Fintech firms that compete on instant settlement face the same tension that banks have managed for years, but with thinner compliance teams and less historical transaction data to train detection models.
The competitive dynamic here is more nuanced than the standard disruption narrative. Banks hold decades of transaction data and established relationships with law-enforcement agencies. Fintech firms bring machine-learning agility and fewer legacy-system constraints. Neither side has solved the problem. Collaboration frameworks, particularly around data sharing for fraud prevention, will likely determine which model proves more resilient.
The fintech revolution in UK banking is not a single story of digital newcomers displacing analogue incumbents. It is a regulatory, infrastructural, and operational realignment where the rules governing payments, data, physical access, and fraud liability are all being rewritten simultaneously. The firms that navigate this period well, whether fintech or traditional bank, will be those that read the regulatory direction accurately and invest in the operational capacity to match it.
