Open Finance: API security beyond FAPI

The FAPI (Financial-grade API) standard defines the security floor for Open Finance participants — but the regulatory floor isn't the ceiling for a mature architecture.

What FAPI covers

• Mutual authentication via certificates (mTLS) for communication between institutions.
• Explicit customer consent, with a well-defined scope and validity period.
• Request signing to guarantee integrity and non-repudiation.

What's left to the architecture

Even with FAPI correctly implemented, an institution still needs to address:

1. Real-time revocation — when consent is revoked, access needs to be blocked within seconds, not on the next cache cycle.
2. Rate limiting per consent, not just per client_id, to prevent a third-party integration from overloading a single customer's data sharing.
3. Data-scope observability — an audit trail of exactly which fields were accessed, by which receiving institution, and when.

Defense in depth

Open Finance APIs expose sensitive customer data to third-party institutions. The reference architecture treats every call as potentially hostile: strict schema validation, output sanitization, and a dedicated gateway that isolates regulatory traffic from proprietary channel traffic.

Security in Open Finance isn't a compliance checklist — it's a continuous architectural requirement.