Bank data can now move between institutions and authorized third parties in seconds. For auditors, that creates an opportunity. It also creates a question.<\/p>\n\n\n\n
Can the data be relied upon as audit evidence? That question sits at the center of PSD2 and open banking.<\/p>\n\n\n\n
PSD2 and open banking are closely connected. They are not the same thing. PSD2 is a European regulatory framework. Open banking is a broader model for controlled access to financial data.<\/p>\n\n\n\n
For CPAs, the distinction matters. A regulated data-access process does not automatically make the resulting information sufficient for PSD2 and Open Banking in audit confirmations: A practical comparison of compliance approaches and evidence. The auditor must still consider source, authorization, integrity, relevance, and reliability.
<\/p>\n\n\n\n
The revised Payment Services Directive, or PSD2, established a regulatory framework for payment services across the European Economic Area. Among other provisions, it enabled regulated third-party providers to access payment-account information with customer authorization.<\/p>\n\n\n\n
The European Union’s PSD2 framework<\/a> also introduced requirements around authentication and secure communication.<\/p>\n\n\n\n Open banking is broader.<\/p>\n\n\n\n It generally refers to the controlled sharing of financial account data with authorized third parties through secure interfaces. PSD2 helped drive this model in Europe, but open banking is not limited to PSD2 or to Europe.<\/p>\n\n\n\n That distinction becomes important when audit teams work across jurisdictions.<\/p>\n\n\n\n A bank API in the United States does not become a PSD2 service simply because it performs a function similar to that of an EU API. Likewise, an open-banking connection does not automatically qualify as an audit confirmation.<\/p>\n\n\n\n The technology may look similar. The legal framework and audit implications may differ significantly. The difference between PSD2 and open banking is primarily one of scope.<\/p>\n\n\n\n PSD2 is legislation. It establishes obligations for payment service providers and creates a framework for specific payment-related services.<\/p>\n\n\n\n Open banking is a broader financial-data access model. Its scope depends on the jurisdiction, participating institutions, data types, consent mechanisms, and applicable regulation.<\/p>\n\n\n\n This distinction also matters when discussing compliance.<\/p>\n\n\n\n PSD2 Open Banking Compliance should not be treated as synonymous with audit compliance.<\/p>\n\n\n\n PSD2 addresses regulated access to payment-account information. Auditing standards address the auditor’s responsibility to obtain and evaluate appropriate evidence.<\/p>\n\n\n\n Those are separate questions.<\/p>\n\n\n\n For example, an authorized third party may obtain account information through a secure interface. That establishes something about the method of access. It does not, by itself, establish that the information is sufficient to support an auditor’s conclusion.<\/p>\n\n\n\n The European Commission’s financial-data access framework<\/a> also illustrates how European policy is moving beyond traditional payment-account access toward a wider financial-data environment.<\/p>\n\n\n\n For global audit practices, this means terminology needs to be precise. PSD2 was not written as an auditing standard.<\/p>\n\n\n\n Its purpose is to regulate payment services and to facilitate secure access to payment account information. An audit confirmation has a different objective.<\/p>\n\n\n\n The auditor needs evidence from an appropriate external source that addresses a financial statement assertion or another audit objective.<\/p>\n\n\n\n That distinction is reflected in the PCAOB’s current confirmation standard, AS 2310, The Auditor’s Use of Confirmation<\/a>.<\/p>\n\n\n\n The standard requires the auditor to obtain relevant and reliable audit evidence from a knowledgeable external source. It also addresses electronic communications and third-party intermediaries.<\/p>\n\n\n\n This is particularly relevant to digital confirmation platforms.<\/p>\n\n\n\n A technology provider can facilitate the exchange. It does not replace the external source.<\/p>\n\n\n\n The auditor still needs to understand how the information moved from the financial institution to the audit file and whether the process introduces risks to reliability. A practical review can start with four questions.<\/p>\n\n\n\n Who provided the information?<\/strong><\/p>\n\n\n\n The auditor should be able to identify the external source and explain why it is appropriate for the audit procedure.<\/p>\n\n\n\n Who authorized the access?<\/strong><\/p>\n\n\n\n Consent and authorization matter. The process should establish that the account holder permitted access to the relevant information for the intended purpose.<\/p>\n\n\n\n Was the information protected from alteration?<\/strong><\/p>\n\n\n\n Electronic transmission creates its own risks. The auditor should consider whether information could have been intercepted, modified, or manipulated.<\/p>\n\n\n\n Can the process be documented?<\/strong><\/p>\n\n\n\n An audit file needs more than a successful API response. It should contain enough information to explain the procedure performed and support the auditor’s conclusion.<\/p>\n\n\n\n These questions are more useful than simply asking whether a provider uses open banking. The U.S. market requires a separate analysis.<\/p>\n\n\n\n There is no single U.S. equivalent to PSD2 governing open banking across the entire financial sector. Instead, the regulatory environment has developed through existing financial laws, agency rules, market practices, and newer data-access initiatives.<\/p>\n\n\n\n The Consumer Financial Protection Bureau’s Personal Financial Data Rights rule under Section 1033 of the Dodd-Frank Act is a major development.<\/p>\n\n\n\n The CFPB’s Personal Financial Data Rights framework<\/a> addresses consumer access to financial information and authorized third-party access to it.<\/p>\n\n\n\n However, the position is evolving. The CFPB states that the rule’s compliance dates were stayed by a federal court in October 2025. The Bureau has also been reconsidering aspects of the rule.<\/p>\n\n\n\n That makes one point especially important for U.S. CPAs.<\/p>\n\n\n\n Do not treat “open banking” as a U.S. regulatory status.<\/p>\n\n\n\n A provider’s data-access model must be evaluated against the laws, contractual arrangements, security controls, and professional standards that actually apply to the engagement. The practical difference can be summarized simply.<\/p>\n\n\n\n
<\/p>\n\n\n\nThe <\/strong>difference between PSD2 and Open Banking<\/strong><\/h2>\n\n\n\n
<\/p>\n\n\n\nWhy PSD2 compliance does not equal audit evidence<\/strong><\/h2>\n\n\n\n
<\/p>\n\n\n\nFour questions CPAs should ask<\/strong><\/h2>\n\n\n\n
<\/p>\n\n\n\nThe US approach is not PSD2<\/strong><\/h2>\n\n\n\n
<\/p>\n\n\n\nWhat this means for audit confirmations<\/strong><\/h2>\n\n\n\n