For most of open banking's history, commercial Variable Recurring Payments (cVRP) have effectively meant the CMA9 - the nine largest UK banks and building societies mandated to support the standard. That's changing fast. Ozone API, the company that built the original UK open banking standard and still maintains its reference implementation, can now take any non-CMA9 UK bank from zero to a live, OBL 4.0-compliant cVRP deployment in eight to ten weeks, with no internal build required.
That timeline matters because there's now somewhere for those banks to plug in. The UK Payments Initiative (UKPI) - a 31-organisation consortium spanning NatWest, Nationwide, Monzo, Mastercard Open Banking Services, GoCardless, TrueLayer, Yapily, and Plaid - is operational, and regulators have described it as "the first new UK payment scheme since Faster Payments launched in 2008."
Ozone API's own framing of this is commercial: without fast infrastructure, "we risk a two-tier market where only the CMA9 banks are participating in cVRP," said co-founder and CEO Huw Davies, as reported by Open Banking Expo. That's a fair read of the competitive stakes. Dozens of non-CMA9 banks and building societies now have a realistic, fast path to monetising open banking payments that simply didn't exist a year ago.
But closing a two-tier commercial market opens a different question. The CMA9 built their open banking compliance functions over the better part of a decade, under direct regulatory mandate, with dedicated standards-monitoring teams and years of live production experience integrating third-party providers. The banks now moving onto cVRP in eight to ten weeks are, by design, skipping most of that build-out - that's the entire value proposition of a fast, vendor-supplied deployment. Speed to market and speed to risk-management maturity are not the same clock, and nothing about an eight-week infrastructure rollout guarantees the second one has caught up to the first.
UKPI's own value proposition is standardisation: a single rulebook and a shared commercial model so that providers don't have to negotiate bank-by-bank. That's a real improvement over the fragmented, bilateral integrations that have characterised UK open banking to date, and it's the kind of standing infrastructure Invela has argued for before.
But a shared commercial rulebook answers a different question than shared risk monitoring. UKPI's 31 organisations already include established account-accessing organisations and third-party providers - Plaid, TrueLayer, Yapily, and GoCardless among them - operating on a common commercial and technical standard. Every AISP and PISP in this ecosystem already clears a regulatory bar to operate at all – approval from the Financial Conduct Authority and thus a listing on the OBL directory - and that baseline is out of any single bank's hands: an access request from a regulated counterparty on the directory is one banks have to accept. That baseline isn't what's missing. What the rulebook doesn't specify is what needs to happen after the point of entry: continuously monitoring risk to ascertain whether previously sound AISPs and PISPs are still sound as their risk profile changes, including a way for what one bank learns about a deteriorating relationship to be shared with other institutions that intermediary also connects to. As dozens of non-CMA9 banks plug in over the next year, that gap doesn't close, it multiplies: each bank inherits the same regulatory starting point and begins its own relationship monitoring from zero, with no shared view of risk signals that may already exist elsewhere in the ecosystem. This risk also extends well beyond regulated AISPs and PISPs, to a much larger population of unregulated third-party providers that access accounts via those regulated intermediaries.
Every non-CMA9 bank that goes live on cVRP over the next year adds its own set of intermediary and third-party provider relationships to the UK's open finance ecosystem, even where the intermediary or third-party provider on the other end is already an established, accredited participant elsewhere in the system - relationships each institution and intermediary will vet, onboard, and monitor according to its own maturity and resourcing, not a shared standard built for ecosystem-wide consistency. An industry that took eight years to reach 100 billion API calls across nine banks is now positioned to add dozens of new bank-side relationships in a fraction of that time. The infrastructure to move money fast is now commercially available off the shelf. The infrastructure to continuously monitor the risks associated with who's moving the money - not just check their credentials once at the regulatory starting line - is the piece that determines whether this expansion looks, in a few years, like the growth story it should be, or like the extension of a fourth-party risk surface nobody was watching closely enough.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
Learn more about the Invela Network.
-p-2000.jpg)
