The UK Competition and Markets Authority's Retail Banking Market Investigation Order 2017 is the competition remedy that created UK Open Banking. It required the nine largest UK banks (the CMA9) to adopt and maintain a common, open API standard and funded the Open Banking Implementation Entity (OBIE) to write the specification, run conformance, and operate a directory — the delivery machinery that made the UK the reference open-banking regime.
CMA Open Banking Order
Regulator guidance United Kingdom
The UK’s Retail Banking Market Investigation Order 2017 is the piece most people forget when they credit the UK’s open-banking success to PSD2. Open banking in Britain was not only a payments directive — it was a competition remedy. The Competition and Markets Authority, having found that entrenched incumbents made it too hard for customers to switch and for challengers to compete, ordered the nine largest banks to open up.
- It named the CMA9 - The Order applied to the nine largest UK current-account providers and required them to adopt and maintain a single, common, open API standard rather than nine incompatible ones.
- It created a delivery body - The Order established and funded the Open Banking Implementation Entity (OBIE) to write the specification, run a conformance regime, and operate a trust directory — the machinery a bare mandate lacks.
- Antitrust through interoperability - This is mandated interoperability as a competition tool: prying open a concentrated, data-hoarding market by requiring standardized access, redistributing power toward consumers and challengers.
The CMA Order is why the UK is the model everyone copies. A mandate that names its targets, funds a delivery body, and enforces conformance reaches past existence to usefulness — the distinction at the heart of every open-banking regime I score.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
UK Open Banking Standard
OBIE wrote and maintains this standard under the CMA Order.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
x-fapi-auth-date
mandated
credentialed only
via fapi
x-fapi-customer-ip-address
mandated
credentialed only
via fapi
x-fapi-customer-last-logged-time
mandated
credentialed only
via fapi
x-fapi-financial-id
mandated
credentialed only
OBIE-specific; identifies the ASPSP in every request.
x-fapi-interaction-id
mandated
credentialed only
via fapi
Required by the UK Open Banking read/write standard for every call.
x-idempotency-key
mandated
credentialed only
Required on payment initiation. The regulatory concern is a duplicated payment, and this header is the control.
x-jws-signature
mandated
credentialed only
Non-repudiation for payment orders. A legal requirement expressed as a detached JWS in a header.
