Open banking in Germany

Open banking in Germany rests on the access-to-account rules of the EU's second Payment Services Directive, carried into German law through the Zahlungsdiensteaufsichtsgesetz. A bank must let a licensed account information service provider or payment initiation service provider read account data or start a payment on the customer's behalf, once the customer has agreed. BaFin licenses and supervises these third-party providers the same way it supervises other payment institutions.

What makes this work in practice is a shared technical standard, not just the legal right. Without it, every bank would expose account access through its own incompatible interface.

The Berlin Group, a pan-European payments initiative based in Berlin, publishes NextGenPSD2, the API specification most German banks and third-party providers build against, alongside extensions from the German banking industry body Deutsche Kreditwirtschaft. More than three-quarters of European banks and hundreds of licensed third-party providers use some form of the Berlin Group framework, which covers account information, payment initiation and confirmation-of-funds requests, with support for redirect, decoupled and embedded strong customer authentication.

Since 2021 the Berlin Group has extended this work beyond the PSD2 minimum into an openFinance Framework, reusing the same technical infrastructure for data outside payment accounts, which is the direction the EU's own next regulation is taking as well.

The EU's proposed Financial Data Access Regulation (FIDA) would extend the PSD2 access model from payment accounts to savings, investment, pension and insurance data, with access organized through industry-run data sharing schemes rather than the current mix of bilateral bank APIs. As of 2026 FIDA is still in trilogue negotiation between the European Parliament, the Council and the Commission, and obligations are expected to phase in from 2027. A German bank that already exposes a NextGenPSD2 interface has a head start on the technical side, but FIDA would add new categories of data and new counterparties to manage consent for.

Two companies show the range of what open banking supports in Germany. finAPI, based in Munich and licensed by BaFin as an account information and payment initiation service provider, builds account aggregation, data analysis and KYC tools that more than 300 companies use, from banks to insurers to other fintechs; in 2025 the Italian firm Fabrick acquired 75 percent of its shares. figo, based in Hamburg, connects to more than 3,100 banks and reaches over 55 million online banking accounts in Germany and Austria through its banking-as-a-service platform.

finleap connect, a regulated payment institution with teams in Berlin, Frankfurt and Hamburg, builds open banking and regtech infrastructure for banks and corporates. These providers sit behind many of the budgeting apps, lending platforms and account-switching tools a bank customer in Germany uses without seeing the API layer underneath.

Account information and payment initiation providers spend much of their engineering time on the differences between banks that all claim to follow the Berlin Group standard but implement details, such as consent flows and error handling, in their own way. On the bank side, IT and compliance teams weigh how much of their open banking interface to build in-house against buying it from a specialist. Product teams look at where open banking data feeds other services: budgeting apps, credit scoring and, increasingly, instant payment initiation as an alternative to card checkout.

Finance Loop is the meeting place for people who build and supervise open banking and payments in Germany, Austria and Switzerland. It connects the finance, IT and AI communities, with events in Frankfurt, Munich, Berlin and Hamburg.

Finance Loop is a strategic partner of the Digital Euro Association, whose Digital Euro Conference in Frankfurt covers digital money infrastructure next to open banking and stablecoins. Related pages: payments in Germany, payments in Frankfurt and fintech in Frankfurt.

Most German banks build their PSD2 account access interface on NextGenPSD2, the API specification published by the Berlin Group, together with additions from Deutsche Kreditwirtschaft, the umbrella body for the German banking industry. It covers account information, payment initiation and balance confirmation requests.

Yes. An account information service provider or a payment initiation service provider needs authorization from BaFin, or a passported license from another EU supervisor, before it can access customer bank accounts under PSD2. Some banks also grant account access under a bilateral agreement with a fintech partner outside the regulated PSD2 interface, but the license requirement on the provider's side does not change. The payments in Germany page covers how that licensing process works.

FIDA would widen account access beyond payment accounts to savings, investment, pension and insurance data, through data sharing schemes the industry sets up rather than direct bilateral bank APIs. It is still under negotiation in 2026, with obligations expected to start from 2027.