API banking is when a bank lets software reach accounts and payments through application programming interfaces (APIs) instead of branches, files or web portals. A company can open accounts, check balances and send ACH, wire or real-time payments from its own code. In the US, API banking comes in three forms: direct bank APIs, banking-as-a-service platforms and consumer open banking.
What API banking means
An API is a defined way for one program to ask another for data or actions. A banking API does this for bank functions: “show the balance of this account,” “send this payment,” “open a sub-account for this customer.”
Before APIs, companies moved money with batch files sent to the bank a few times a day, or by typing payments into an online portal. APIs let the same actions happen one at a time, in real time, from inside a company’s own product or finance system.
Behind every banking API sits the bank’s core, the system of record for accounts. If the core cannot post or report in real time, the API cannot either. For that layer, see what is core banking.
Three models of API banking
| Model | Who uses it | What the APIs cover | Examples from primary sources |
|---|---|---|---|
| Direct bank APIs | Corporate treasury and finance teams | Payments, receivables, balances, account reporting | J.P. Morgan Payments Developer Portal; Citi Developer portal |
| Banking-as-a-service (BaaS) platforms | Fintechs and software companies offering accounts to their own users | Accounts, sub-ledgers, cards, ACH, wires, real-time payments | Unit, Synctera, Treasury Prime, Increase |
| Consumer open banking APIs | Apps that a consumer authorizes to read their bank data | Account and transaction data shared with a third party | Governed in the US by the CFPB’s Section 1033 rule |
Direct bank APIs
Large banks run developer portals for business clients. J.P. Morgan’s Payments Developer Portal documents a Global Payments API that “allows for the initiation of multiple payment types across global markets through a single unified API,” plus receivables APIs. Citi’s developer portal offers treasury and cash management APIs and an API Explorer sandbox where developers can “run sample transactions, create sample payments, and inquire on account balances.”
These APIs serve the bank’s own clients. A company typically needs an account and an agreement with the bank before it gets production access.
BaaS platforms
A banking-as-a-service platform, often shortened to BaaS, sits between a software company and one or more partner banks. The bank holds the accounts. The platform supplies the API, the ledger and the compliance tooling.
- Unit sells APIs, a dashboard and white-label interfaces for accounts, payments, cards and credit from partner banks.
- Synctera offers APIs, a ledger and a console for building accounts, cards and payments on a sponsor bank from its network.
- Treasury Prime gives fintechs an API and a “Find a Bank” marketplace to reach banks in its network, and sells banks a supplemental core.
- Increase offers API access to accounts, ACH, wires, Real-Time Payments, FedNow and checks, and publishes per-transaction fees, such as $15.00 per wire.
A BaaS setup is one way to do embedded finance. The differences between the two terms are covered in embedded finance vs banking as a service.
Core-level APIs
Some cores expose their functions directly. Finxact, now part of Fiserv, was described at its acquisition as a cloud-native system with “100% accessibility to all data and functions via a robust set of modern APIs.” Jack Henry’s fiscal 2026 annual report describes Payments Orchestrator as an “API-first, direct-to-core embedded payments platform” with virtual accounts.
Bank API integration: what to expect
A bank API integration usually follows the same steps, whichever model is used.
- Agreement and onboarding. The bank or platform runs know-your-customer checks on the company and signs a program or service agreement.
- Sandbox. Developers build against a test environment with fake accounts and payments.
- Security setup. Production access usually needs certificates, keys and IP allowlists. J.P. Morgan, for example, lists a separate mutual-TLS endpoint for Push to Card payments.
- Ledger and reconciliation. The company matches API events, such as webhooks for incoming payments, against its own records.
- Go-live and monitoring. Limits start low and rise with volume and history.
Pricing is often not published. Among the BaaS profiles above, Increase publishes its fees; Unit, Synctera and Treasury Prime do not.
The US open banking rule: Section 1033
Open banking is the right of a consumer to share their own bank data with another company. In the US, the legal basis is Section 1033 of the Consumer Financial Protection Act of 2010. An open banking API is the channel a bank uses to share that data safely, instead of letting apps log in with the customer’s password.
The 2024 rule. The Consumer Financial Protection Bureau (CFPB) released its Personal Financial Data Rights final rule on October 22, 2024. It was published in the Federal Register on November 18, 2024, and took effect on January 17, 2025. It requires banks, credit unions and other providers to make covered data available to consumers and authorized third parties in electronic form, and sets duties for those third parties.
Compliance dates. The rule set compliance dates by size, from April 1, 2026, for the largest institutions to April 1, 2030, for smaller ones. A court order later pushed them back by 90 days, so the first date became June 30, 2026.
Reconsideration. On August 22, 2025, the CFPB issued an advance notice of proposed rulemaking to reconsider the rule. It asked about four issues: who counts as a consumer’s “representative,” whether banks may charge fees for data access, data security, and data privacy.
Litigation. A bank and two banking trade groups sued in federal court in Kentucky in October 2024. On October 29, 2025, the court enjoined the CFPB from enforcing the rule “until it has completed its reconsideration of the Rule.” The CFPB and the Financial Technology Association filed appeals to the Sixth Circuit in December 2025.
Status on September 24, 2026. The CFPB’s regulatory agenda, published in the Federal Register on August 14, 2026, lists a rulemaking to reconsider the 2024 rule. The CFPB’s rule page still shows the August 2025 advance notice as its latest action. While the court’s injunction stands, the CFPB cannot enforce the 2024 rule. This is a summary of public documents, not legal advice.
