The EU's FiDA Regulation: A Guide to Open Finance and the Expansion of Data Sharing to Investments, Mortgages, and Crypto

For years, European consumers have been able to link their basic bank accounts to budgeting apps and payment services, a system known as Open Banking. But the rest of their financial lives—mortgages, investment portfolios, pension funds, and crypto assets—have remained locked inside the proprietary silos of individual institutions.

That fragmentation is about to end. The European Union is finalizing the Financial Data Access (FiDA) regulation, a sweeping legislative framework designed to transition the continent from Open Banking to a comprehensive Open Finance ecosystem.

FiDA mandates that financial institutions must make nearly all customer data available to authorized third parties in real-time, provided the customer explicitly consents. The regulation aims to turn financial data into a portable asset co-owned by the consumer, rather than a proprietary resource hoarded by the institution that collected it.

The scope of the new regulation is vast. While its predecessor, the Payment Services Directive (PSD2), only covered payment accounts, FiDA extends data-sharing obligations to savings accounts, mortgage credit agreements, non-life insurance products, and occupational pensions.

Crucially, the regulation explicitly includes crypto-assets. By naming digital assets directly, FiDA aligns with the EU’s Markets in Crypto-Assets (MiCA) framework, bringing crypto data out of the regulatory gray area and placing it on the exact same footing as traditional equities and bonds.

The mechanics of this new ecosystem rely on two primary actors: 'Data Holders' and 'Data Users.' Data Holders are the traditional banks, insurers, and investment firms that currently store the information. Data Users, officially termed Financial Information Service Providers (FISPs), are the licensed fintechs and third parties seeking access to build new services.[1]

To facilitate this massive exchange of information, market participants will be required to establish Financial Data Sharing Schemes (FDSS). These governed consortiums will define the technical API standards, liability models, and operational rulebooks that make cross-platform data sharing technically feasible.

One of the most significant departures from previous open banking rules is the introduction of a compensation model. Under PSD2, banks were forced to build APIs and share payment data for free, a mandate that caused widespread industry resentment.

FiDA corrects this by allowing Data Holders to charge 'cost-based compensation' for the data they provide. This shift transforms compliance from a pure sunk cost into a potential revenue stream, incentivizing traditional institutions to build higher-quality, more reliable data interfaces.

For consumers, the cornerstone of the FiDA experience will be the mandatory 'consent dashboard.' Every Data Holder must provide a centralized, real-time interface where customers can view exactly who has access to their data, what it is being used for, and for how long.[1]

This dashboard empowers users to revoke access with a single click, ensuring that control remains firmly in the hands of the data subject. The European Commission is also pushing for these dashboards to integrate with the upcoming EU Digital Identity Wallet to standardize strong customer authentication.[1]

While FiDA is designed to foster competition, the EU is acutely aware of the geopolitical risks associated with opening up vast troves of financial data. A major sticking point in the legislative negotiations has been the potential for massive technology conglomerates to exploit the new rules.[1]

To prevent monopolization, the regulation includes a targeted exclusion: companies designated as 'gatekeepers' under the Digital Markets Act (DMA)—such as Alphabet, Amazon, and Meta—are explicitly banned from obtaining FISP licenses. This ensures that Big Tech cannot use its existing market dominance to swallow the European financial sector.[1]

The legislative journey for FiDA has been complex. Introduced in June 2023, the framework received political agreement from the Council of the EU in late 2024. Trilogue negotiations between the Commission, Parliament, and Council resumed in mid-2025 to iron out the final details.[1]

Formal adoption of the regulation is expected by late 2025, but the financial industry will not be forced to flip a switch overnight. Recognizing the immense technical complexity of the mandate, policymakers have agreed on a phased implementation timeline.

Phase 1, expected to take effect 24 months after the regulation enters into force, will cover foundational products like savings accounts, consumer credit agreements, and motor insurance.

Phase 2, slated for 36 months post-adoption, will bring the most complex and highly anticipated asset classes into the fold. This phase includes investments in financial instruments, mortgages, personal pensions, and crypto-assets.

Finally, Phase 3 will roll out at the 48-month mark, encompassing occupational pensions, business creditworthiness assessments, and the remaining non-life insurance products.

For financial institutions, the runway to compliance is short. Banks and insurers must begin auditing their internal systems immediately, mapping where their data lives and addressing the technical debt that could hinder real-time API connectivity.

Ultimately, FiDA represents a fundamental rewiring of the European financial system. By breaking down data monopolies and establishing a secure, standardized framework for sharing, the regulation sets the stage for a new generation of personalized, cross-platform financial services.[2]