Open banking networks in the Nordics and the Baltics

Background: PSD2 opened up bank interfaces

The European Union’s second Payment Services Directive (PSD2, Directive (EU) 2015/2366) permanently changed the way payment account data and payment functions can be accessed. The directive began to apply in January 2018, and its key technical supplement, Delegated Regulation (EU) 2018/389 on strong customer authentication and secure communication, became applicable in September 2019.

Before PSD2, third parties wishing to offer services based on account data or credit transfers often had to rely on so-called screen scraping: the customer handed their online banking credentials to the service, which logged in to the bank on their behalf and read the data from the page. The method was fragile and problematic from a security standpoint, because the third party obtained the customer’s full credentials.

PSD2 replaced this model with regulated access. Banks, which the directive refers to as account servicing payment service providers (ASPSPs), must offer authorised third parties a secure interface. The third party no longer sees the customer’s credentials; instead, the customer authenticates directly with their own bank and gives their consent.

Roles and licences in the ecosystem

Open banking involves three key roles. Distinguishing between them matters, because each role carries different obligations and licensing requirements.

Role	Abbreviation	What the role does
Account servicing provider (bank)	ASPSP	Maintains the payment account and offers an interface to authorised third parties.
Payment initiation service provider	PISP	Initiates a payment from the customer’s bank account at the customer’s request. Does not handle the funds itself.
Account information service provider	AISP	Retrieves information from one or more payment accounts with the customer’s consent.

Payment initiation services require a payment institution licence, and account information service providers must register with the supervisor of their home state. In Finland, the supervisor is the Finnish Financial Supervisory Authority (Finanssivalvonta). A licence or registration is valid across the entire European Economic Area through the so-called passporting procedure, which means that a Swedish payment institution, for example, can offer its services in Finland after notifying the supervisors.

Note

Many solutions that merchants call “bank payments” combine several roles. The same provider may act both as a payment initiation service and as an account information service, and may additionally offer payouts through its own banking connections.

API standards and their diversity

PSD2 obliged banks to offer an interface but did not prescribe a single technical standard. As a result, several parallel frameworks emerged in Europe. In continental Europe, and widely in the Nordics as well, the Berlin Group’s NextGenPSD2 framework or implementations derived from it are used. The United Kingdom, by contrast, developed its own Open Banking Standard.

Despite a common framework, implementations often differ in their details. Differences include the following:

SCA model: redirect, decoupled or embedded authentication.
Consent management: consent validity periods, renewal practices and account selection.
Payment products: whether the interface supports instant payments, scheduled payments, recurring payments or bulk payments.
Error codes and statuses: how the payment status is returned and how detailed the error messages are.

Providers identify themselves using qualified certificates under the eIDAS Regulation: qualified website authentication certificates (QWAC) to establish the connection and qualified electronic seals (QSealC) to sign messages. The certificate contains information about the licence and roles, so the bank can verify them automatically.

Bank IDs: a defining feature of the region

A characteristic of the Nordic and Baltic countries is that strong electronic identification is widely used and linked to banking services. This is a significant advantage for open banking: when users are accustomed to identifying themselves with the same tool both at their bank and in public services, approving a payment at the bank is a familiar step.

In Finland, strong electronic identification is governed by the Act on Strong Electronic Identification and Electronic Trust Services (laki vahvasta sähköisestä tunnistamisesta ja sähköisistä luottamuspalveluista, 617/2009). Banks’ identification tools are part of the trust network of identification services supervised by the Finnish Transport and Communications Agency Traficom. In Sweden and Norway, BankID plays a corresponding role, in Denmark MitID, and in the Baltic countries Smart-ID and Mobile-ID, among others.

Technically, this means that the payment approval flow is often very short: the user selects their bank, authenticates with a mobile app and confirms the payment. The authentication result can also serve other purposes, such as verifying identity, which has led to solutions that combine identification and payment in the same user journey. In such cases, the principles of data protection and data minimisation become even more important.

Regional overview

Finland

Finland is part of the euro area, so SEPA instant credit transfers and the euro area deadlines of the EU Instant Payments Regulation apply to Finnish banks. The widespread use of bank IDs and a long tradition of credit transfers have created a solid foundation for account-to-account payments in e-commerce.

Sweden

Real-time payments have long been part of everyday life in Sweden, and the mobile payment service Swish has become widely established. Many of the region’s open banking providers have Swedish roots, which is also reflected in their expansion into the other Nordic countries and Finland.

Norway and Denmark

Norway is not an EU member, but as an EEA country it has applied PSD2. Denmark is not part of the euro area, so the Instant Payments Regulation’s deadlines for non-euro area Member States apply there later. MobilePay, the mobile payment service used in Denmark and Finland, merged with Norway’s Vipps to form Vipps MobilePay.

The Baltic countries

Estonia, Latvia and Lithuania are part of the euro area. The region is served both by local banks and by subsidiaries of Nordic banking groups, and mobile identification is widely used. Nordic providers often expand into the Baltics because the technical environment is similar.

Aggregators and network effects

It is not practical for an individual merchant to integrate separately with the interfaces of dozens of banks. For this reason, aggregators have emerged on the market: providers that maintain connections to a large number of banks and offer the merchant a single, unified interface.

An aggregator’s value comes from network effects. The more banks whose customers can pay through the same integration, the more attractive the solution is for the merchant. At the same time, the aggregator takes on the management of differences between bank interfaces, the maintenance of certificates and the monitoring of incidents.

In recent years, the market has seen consolidation. For example, the British company TrueLayer announced in March 2026 that it had completed its acquisition of the Swedish company Zimpler following approval by the Swedish Financial Supervisory Authority. Corporate transactions affect bank coverage and the development of interfaces, so when planning an integration it is worth monitoring providers’ ownership structures as well.

Technical challenges in practice

Although regulation has harmonised the fundamentals, the same challenges recur in practical integration work:

Interface availability and performance. Response times and availability of bank interfaces vary. The forthcoming Payment Services Regulation (PSR) is intended to set more precise performance requirements for interfaces than before.
Status uncertainty. If the user closes the browser during the bank approval step, the final status of the payment must be determined through status queries or notifications from the bank.
Consent lifecycle. Account information consents expire, and their renewal must be designed in a user-friendly way.
Mobile journeys. Switching from an online shop to the bank’s app and back (app-to-app) requires careful implementation so that the user returns to the right place.
Interpreting errors. Bank-specific error codes must be mapped into consistent messaging that users can understand.

Where developments are heading

The next phase of open banking is already in sight. In November 2025, the European Parliament and the Council reached a provisional agreement on the PSD3 Directive and the Payment Services Regulation (PSR), and the final compromise texts were published in April 2026. The reform moves most of the practical rules into a directly applicable regulation, reducing differences between Member States. The exact dates of application depend on final adoption and publication.

At the same time, the EU Instant Payments Regulation is making instant credit transfers a baseline service in the euro area. Combined with open banking interfaces, this creates the conditions for account-to-account payments that are as effortless for users as card payments but run on a different infrastructure. The Nordic and Baltic countries, where strong electronic identification is already part of everyday life, are well positioned in this development.

The success of open banking is not decided by any single interface, but by how reliably the entire chain from bank to merchant works.

Sources and further reading

Disclaimer

This guide has been prepared carefully from public sources, but regulation and service features change. Always check current information from official sources and the providers' own documentation. Corrections: support@brevixoo.com.