Open Banking

Open banking dismantles the traditional boundaries between banks and technology providers, creating both opportunity and regulatory obligation. For account information service providers (AISPs) and payment initiation service providers (PISPs), registration, strong customer authentication (SCA) compliance, and data liability allocation are foundational legal concerns. For banks and ASPSPs, the duty to provide non-discriminatory API access while managing operational and security risk requires careful contractual and policy architecture.

In the EU, PSD2 is now transitioning to PSD3 alongside the Payment Services Regulation (PSR), introducing tighter fraud liability rules, enhanced SCA requirements, and a dedicated open-finance framework that extends beyond payment accounts. Our team tracks the legislative calendar and helps clients adapt compliance programmes before new rules take effect. In Türkiye, the BDDK's open-banking regulations under Law No. 6493 are still evolving; we advise both incumbents and new entrants on structuring their technical and legal readiness.

We also assist with data sharing and API framework agreements, liability caps and indemnity provisions between data providers and third parties, cross-border data transfer compliance under GDPR and KVKK, and the IP considerations that arise when proprietary data models are exposed through standardised APIs.