Payment Initiation API

A payment initiation API is an application programming interface that lets authorised software instruct a payment from a bank account. In its most common form, it is the interface a bank exposes under open banking rules so that a licensed third party, called a payment initiation service provider, can set up a payment on a customer's behalf after the customer approves it with the bank. The term is also used for banks' own corporate APIs, which let businesses send payments directly from their systems without uploading files.

Payment initiation APIs are one half of the core open banking interface; the other half is the account information API, which gives read-only access to balances and transactions. Both are offered through the bank's dedicated interface. Payment initiation APIs underpin consumer services such as pay by bank and business uses such as automated supplier payments and treasury sweeps.

An open banking payment through the API typically involves these steps:

1. Consent. The payment provider sends the bank a request describing the payment: amount, currency, payee account, reference and sometimes an execution date. The bank returns an identifier for this payment consent.
2. Authentication. The customer is passed to the bank, by redirect, app-to-app switch or an embedded flow, and authenticates with strong customer authentication. The bank shows the payment details so the customer can approve exactly what will be paid.
3. Authorisation. After approval, the bank issues a short-lived access token to the provider for that payment.
4. Submission. The provider uses the token to submit the payment. The bank executes it, usually over an instant payment system.
5. Status. The provider queries or receives notifications of the payment's status so it can tell the merchant or customer whether the payment succeeded.

APIs typically support several payment types, including single immediate payments, future-dated payments, standing orders, international payments and, in some markets, variable recurring payments.

In the European Union, the Second Payment Services Directive (PSD2) requires banks offering online accounts to allow licensed providers to initiate payments, and its technical standards set rules on authentication and communication. The directive does not prescribe one API format, so industry groups created common specifications, notably the Berlin Group's NextGenPSD2 framework, used by many banks in continental Europe. In the United Kingdom, the largest banks were required to implement a single open banking standard, covering both the API specifications and the customer experience. Other countries, including Brazil, Australia and Saudi Arabia, have set national standards for payment initiation as part of their open banking or open finance programmes.

Corporate payment APIs offered by banks outside open banking regulation work differently. They are governed by a contract between the bank and its business client, often use the client's own credentials and certificates, and may let the client send payments without a separate customer approval for each one, since the client itself is the account holder.

Because a payment initiation API can move money, it is protected by several layers of security. Providers identify themselves using certificates, often with mutual authentication and checks against a regulatory register or open banking directory. Requests are typically signed so they cannot be altered, and access tokens are tied to a single payment consent. Strong customer authentication must include dynamic linking, which ties the authentication to the specific amount and payee. The customer never shares their banking credentials with the third party.

• E-commerce checkout. Merchants offer pay by bank as a lower-cost alternative to cards.
• Account funding. Investment, crypto and savings apps let customers top up their accounts from a bank account instantly.
• Bill and invoice payment. Billers send payment links that open directly in the customer's banking app.
• Business payments. Accounting and payroll software initiates supplier or salary payments directly from company accounts.
• Sweeping. Customers move money automatically between their own accounts, for example to savings or to pay down credit.

The quality of payment initiation APIs varies between banks. Some suffer from frequent outages, slow responses or extra authentication steps that cause customers to abandon payments. Status information is not always reliable, so providers may not know immediately whether a payment has been executed. Commercial models are also still developing: regulated access is generally free to licensed providers, while premium features such as guaranteed payments or higher limits may be offered under commercial agreements. Finally, unlike card payments, most API-initiated transfers offer limited dispute rights, so schemes and regulators are exploring additional consumer protection for open banking payments.