Key takeaways
- Nothing happens in Open Banking without the customer's explicit consent.
- Strong customer authentication always takes place inside the customer's own bank.
- Clear, honest consent screens increase completion rates as well as trust.
Consent is the foundation of Open Banking. A provider cannot read an account or start a payment unless the customer has clearly agreed to it, and the customer's bank checks that agreement every time.
Consent and authentication are different things
It helps to separate two steps that are often mixed up:
- Consent is the customer agreeing to what will happen: for example, paying a specific amount to a specific merchant.
- Authentication is the bank confirming that the person giving that consent really is the account holder.
In a Pay by Bank payment, the customer sees the payment details, confirms they want to proceed, and then authenticates with their bank to approve it.
Strong customer authentication
European rules require strong customer authentication (SCA) for electronic payments. It combines at least two independent factors from three categories:
- Something the customer knows, such as a PIN or password.
- Something the customer has, such as their phone or a card reader.
- Something the customer is, such as a fingerprint or face scan.
For bank payments, SCA happens entirely inside the bank's own app or website. The merchant and the payment provider never see or handle the customer's banking credentials.
The customer stays in control: they see exactly what they're approving, and they approve it with their own bank.
Designing a good consent screen
Before sending the customer to their bank, most flows show a short screen that explains what is about to happen. A good one:
- Shows the amount, the merchant and the reference clearly.
- Explains in one sentence that the customer will approve the payment in their bank.
- Names the regulated provider initiating the payment.
- Avoids walls of legal text. Link to the full terms instead.
Why it matters for conversion
Customers abandon flows they don't understand. A clear explanation before the redirect, and a familiar approval screen in the bank, removes most of the uncertainty. Good consent design isn't just compliance; it's a big part of what makes bank payments feel easy.