The open banking competition regime after the smart data SI
In short: The open banking competition regime is changing basis. Open banking began as a CMA competition remedy under the Retail Banking Market Investigation Order 2017. The smart data statutory instrument under Part 1 of the Data (Use and Access) Act 2025 is expected in Q4 2026 and would move it onto an FCA-supervised statutory footing. That shift, not the technology, governs access, governance and funding as open banking grows.
Commercial open banking already moves money. Account-to-account payments now run on rails that began life as a competition remedy imposed on the largest banks. What matters for the next phase is the legal regime behind the technology, and that regime is shifting. Open banking is moving from a one-off competition remedy administered by the Competition and Markets Authority to a statutory regime supervised by the Financial Conduct Authority, and the vehicle for that move is the smart data statutory instrument under the Data (Use and Access) Act 2025. For banks, payment firms and the businesses building on open banking, that change of basis is what decides access, governance and funding as volumes grow.
Open banking began as a competition remedy
Open banking exists because the CMA required it. The Retail Banking Market Investigation Order 2017 obliged the nine largest UK current account providers to adopt common standards and to fund and maintain Open Banking Limited as the body that runs the shared standards. Alongside the Order, the Payment Services Regulations 2017 require account providers to give authorised third parties access to accounts at the customer’s request. The Order is a competition tool: a remedy designed for a defined problem in retail banking, aimed at the CMA9, and built to be temporary. It was never meant to be the long-term constitution for a payments market.
That origin shapes the limits open banking has now reached. The Order binds only the nine banks, not the wider set of firms a mature market needs. It rests on the CMA’s market-investigation powers rather than on a regulator with a continuing mandate over the ecosystem. And it does not provide a durable basis for funding the shared infrastructure once the remedy is lifted. These are the gaps that a move to statute is meant to close.
What the smart data SI changes
Part 1 of the Data (Use and Access) Act 2025 provides the statutory framework. Section 2 lets the Secretary of State or the Treasury require a data holder to provide customer data to an authorised person at the customer’s request. Section 6 provides for decision-makers that accredit and supervise those authorised persons. Section 7 provides for interface bodies that set and maintain the technical standards. Section 8 provides for enforcers with powers of compliance notice and financial penalty. The Act creates none of this directly; each is settled by a sector statutory instrument made under the framework.
For open banking, a DUAA SI is the decisive step. The government’s modernisation package committed to giving the FCA powers over the future of open banking, including powers to underpin commercial schemes developed by industry. The smart data instrument, expected in Q4 2026, carries that change into law. In substance it would mandate access through standard interfaces beyond the original nine banks, put accreditation and supervision on a statutory basis, give the FCA oversight of the standards body and the wider ecosystem, and place the funding of the shared infrastructure on a transparent, regulated footing.
In FS25/4, published in August 2025, the FCA set out the design of a Future Entity that will take on and extend the functions Open Banking Limited performs under the CMA Order, providing common standards, directory and certification services across the ecosystem. The FCA expects the Future Entity, and the operators of the industry-led commercial schemes that sit above it, to be regulated as interface bodies under section 7. The CMA Order remains in force pending the move to that long-term regulatory framework. The fuller account of the Part 1 architecture across sectors sits in our companion piece, DUAA smart data schemes.
The competition position changes with the basis
Chapter I of the Competition Act 1998 prohibits agreements between undertakings that have the object or effect of restricting competition, and it is central to any industry-led scheme. How it applies depends on the basis the scheme rests on. A scheme whose rules are a private agreement between competitors is assessed as a private arrangement, with exemption available only through the fact-specific section 9 route. A scheme whose rules are required or sanctioned by regulation made under primary legislation, whose accreditation is run by a statutory decision-maker, and whose standards sit with a statutory interface body, is a different object of assessment, and arrangements that firms are required by regulation to enter sit differently again under the Act’s exclusions. The point for this post is the general one: the competition analysis follows the basis, and the move to a statutory regime changes that basis.
That is why the change of basis matters more than any feature of the technology. Three things move onto a firmer footing at once. Access stops depending on a remedy aimed at nine banks and becomes a statutory entitlement on standard terms, which the regime must keep open, fair and non-discriminatory between established firms and newcomers. Governance moves from a company maintained under a CMA order to a body holding a statutory function, with defined rights of review and a regulator behind it. Funding moves from the residue of a competition remedy to a regulated and transparent basis that can support the infrastructure for the long term. Each of these is a competition question as much as a payments one, and each is settled by the instrument rather than by the market. Where a scheme’s design has to be tested against both, our payments and scheme governance page sets out how we help.
Open banking: competition remedy compared with statutory regime
| Feature | CMA Order 2017 regime | Smart data SI regime |
|---|---|---|
| Legal basis | CMA market-investigation remedy | Statutory instrument under DUAA 2025 Part 1 |
| Who is bound | The nine largest current account providers | Data holders specified by the regulations |
| Oversight | CMA, through the Order | FCA, as supervisor of the ecosystem and central operator |
| Standards body | Open Banking Limited, maintained under the Order | Future Entity, regulated by the FCA as an interface body (s.7) |
| Funding | Borne by the CMA9 under the remedy | Transparent, regulated basis set by the regulations |
| Competition analysis | Remedy plus Chapter I on any private arrangement | Chapter I on a regulator-administered statutory framework |
Viewpoint
The smart data instrument is the step that moves open banking from a competition remedy to a regulated market, and three points will determine how it lands. The first is whether access extends, on fair and non-discriminatory terms, beyond the nine banks bound by the CMA Order. The second is the scope and durability of the FCA’s oversight of the Future Entity and the wider ecosystem. The third is whether the instrument is drafted to extend from open banking to open finance without further primary legislation. The competition position of any industry-led scheme will depend on how far its rules rest on the statutory regime rather than on private agreement. The draft instrument is expected in Q4 2026, and these are the points to watch when it is published.
Frequently asked questions
Is the open banking smart data SI in force?
No. Part 1 of the Data (Use and Access) Act 2025 is in force, but the sector statutory instrument for open banking has not been laid. It is expected in Q4 2026. Until then open banking continues to operate under the CMA Retail Banking Market Investigation Order 2017 and the Payment Services Regulations 2017.
What is the difference between the CMA Order and the smart data regime?
The CMA Order is a competition remedy binding the nine largest current account providers, administered by the CMA and designed to be temporary. The smart data regime is a statutory framework under which the FCA supervises the ecosystem, accreditation and standards sit with statutory bodies, and access extends beyond the original nine banks. The instrument moves open banking from remedy to regulated market.
Does the smart data SI remove Chapter I competition risk for industry schemes?
Not by itself. Chapter I of the Competition Act 1998 remains central to any industry-led scheme, and the answer depends on the scheme’s basis. A scheme operating as a private agreement between competitors is fully exposed and relies on the section 9 route. A scheme whose rules are required or sanctioned by statutory regulation is assessed differently. The competition analysis follows the basis on which the scheme rests.
How does this affect firms beyond the nine banks?
The CMA Order binds only the CMA9. A smart data instrument can require access from data holders the regulations specify, so the obligation can extend across the market. For payment firms and third party providers, the practical questions are the accreditation criteria, the access terms, and how the regime is funded. Those are settled by the instrument when it is laid.
Further reading: Rob Bratby, writing as General Counsel to UK Payments Initiative, sets out the scheme’s own perspective in Why UK Payments Initiative needs smart data.
For advice on open banking access, scheme governance or the competition position of an industry-led payments scheme, contact Rob Bratby at Bratby Law. We advise banks, payment institutions, electronic money institutions and scheme operators on payments regulation and scheme governance.
