by Amr Mohamed
Europe's first generation of financial-data regulation was about getting data to move. Its next generation is beginning to confront a harder question: what happens once it does.
The Financial Data Access regulation is revealing on both counts. FiDA extends the logic of PSD2 well beyond payment accounts, into pensions, mortgages, investments, insurance and savings. FiDA is still moving through the EU legislative process, with negotiations between Parliament and Council continuing, so its final timetable is not yet settled. But the interesting part is not what it proposes to open. It is what it carves out.
Data collected as part of a consumer creditworthiness assessment is excluded from scope, explicitly on financial exclusion grounds. And where other shared financial data could still be used to draw creditworthiness conclusions, the text envisages the European Banking Authority setting a data-use perimeter for how that information may be used.
A regulation written to expand access carves out creditworthiness, then anticipates the carve-out leaking, because inference does not respect data categories.
The architecture of the regulation acknowledges something important. Access is no longer the only constraint. What you infer from the data matters just as much.
You can mandate a pipe. You cannot mandate judgment
Open banking was an access mandate. It said a person's payment data belongs to them and they should be able to direct it elsewhere. Judged on those terms it worked. Connectivity has become infrastructure. Aggregators made account access dramatically easier, and a fintech can now begin working with live financial data without building bank connectivity from scratch.
There was an implicit assumption that access would produce understanding. It did not, and the reason is structural.
Access problems are specifiable. There is a data holder, a data user, a consent, an API, a latency requirement. You can write that down, supervise it, and fine people for failing it. Nobody can mandate that a firm correctly infer whether a person's income has become unreliable, or whether their obligations have quietly crowded out their buffer. So the rules addressed the part that could be specified and left the market to supply the rest.
Much of what became productised first was categorisation. Merchant labels, spend buckets, monthly averages. Useful plumbing, but a label is not an interpretation. Knowing someone spent 52 euros at a supermarket tells you almost nothing. Knowing their income arrival shifted from regular to irregular over a quarter while fixed obligations held flat tells you a great deal. The first is in the data. The second has to be inferred.
Two curves are crossing
The rest of the calendar points the same way as the FiDA carve-out.
The revised Consumer Credit Directive applies from 20 November 2026 and puts creditworthiness assessment obligations on a firmer footing. AI systems used to evaluate the creditworthiness of natural persons are classified as high-risk under Annex III of the AI Act, with obligations applying from 2 December 2027. And in Schufa, the Court of Justice established that a score cannot escape the automated decision-making rules simply because a different institution formally signs off, where that score plays a determining role.
Obligations attaching to access are broadening. Obligations attaching to interpretation are hardening. Those two curves are now crossing.
The industry spent the last decade building infrastructure for the first. The next decade is about building infrastructure for the second.
What the next layer has to look like
The layer after open banking is not another pipe. It is the interpretation layer everyone assumed would emerge on its own, and it arrives under a different constraint than open banking did.
Much of the infrastructure around open banking was built before today's rules on automated inference took shape. The interpretation layer does not get that sequence. It will be regulated from the day it matters, so governance has to be architectural rather than retrofitted. This layer does not get that sequence. It will be regulated from the day it matters, so the governance has to be architectural rather than retrofitted. Three properties follow, and they are the minimum bar for anyone building here, including us.
Uncertainty reported separately from the estimate. Thin evidence should produce a less certain answer, not a confident average one. A system that returns the same shape of output on six observations and six hundred is hiding the thing a risk officer most needs. Being able to say there is not enough here is a feature.
Decisions reconstructable after the system has changed. Models improve, data sources move, thresholds get retuned. If explaining a decision from eighteen months ago requires the system to still be what it was, you cannot explain it. The record has to hold the values it was served, not references to what the current version would say.
Accountability that stays with the institution. You cannot outsource a decision and its accountability in the same transaction. Whoever extends the credit answers for it. Infrastructure can inform the decision, surface uncertainty, and preserve the evidence behind it. It should not blur who is responsible for the outcome.
None of that is compliance overhead. It is what makes the output usable by a firm that has to defend it.
The boundary nobody questions
The industry divides financial behavior into banking, lending, investing, insurance, pensions. Those divisions are real in the sense that licences, supervisors and org charts are real. They are not real in the sense that they describe how anyone lives.
A person deciding what to do with two hundred euros is making one decision under one set of constraints: spend it, save it, invest it, or take a risk with it. Same income, same obligations, same buffer, same capacity to absorb a shock.
Open banking inherited those boundaries and opened one. FiDA proposes to open the rest. But opening every category separately still leaves you looking at a person through five windows.
The work that matters now is not adding a sixth. It is building the layer that reads what is behind them, and being able to prove afterwards exactly how it read it.