UK Open Banking API Performance 2022–2023

Executive Summary

In a follow-up to the 2020–21 and 2021–22 reports, APImetrics made more than 8 million API test calls to 29 banks in 2022–23 to determine the quality of Open Banking APIs implemented in conformance with the standards published by each bank.

API performance in banking is critical to the user experience for payment processing, transfers, and other digital use cases. It is also regulated by the Financial Conduct Authority (FCA), which considers Open Banking a strategic priority for the UK financial sector.

Performance improved overall, but remains sub-optimal. Compared with 2021–22, the CMA9 and traditional banks improved while neobanks declined. The CMA9 were nearly as performant as challenger neobanks, while smaller traditional banks showed the weakest performance. Infrastructure choice mattered more than ever: Azure performed dramatically slower than other cloud providers and substantially slower than its own performance in the preceding period.

Introduction

The UK continues to be at the forefront of the global Open Banking revolution thanks to the proactive attitude of its regulators. The resulting ecosystem encourages smaller banks, fintechs, and neobanks to participate alongside the largest banks. As the most advanced Open Banking market in the world, the UK provides an example of best practice that other jurisdictions can use as a model.

This follow-up study covers the large CMA9 UK banks, traditional High Street banks, credit card providers and building societies, and new entrant banks (neobanks). The endpoints were provided by the banks and measured using the APImetrics active API monitoring service, including its patented Cloud API Service Consistency (CASC) quality scoring system.

The data was generated from real API calls made using the FAPI-compliant consent process with the support of third-party provider (TPP) partner tomato pay. All calls were made between July 1, 2022 and June 30, 2023.

Key Findings

• Performance varies significantly between banks: Most banks experienced good overall performance, but a small number need attention for underperformance.
• Poor performance has a measurable cost: An underperforming endpoint needs an estimated 2.5 times the resources of a good performer. At a standard rate of $75 USD per hour, this can cost as much as $50,000 USD per endpoint per year.
• Latency differs by more than six times: There is over 1,100 milliseconds of total latency between the fastest and slowest banks, with large differences in DNS lookup, TCP connect, and processing time.
• Cloud choice matters: Azure's median DNS lookup time is above 70 ms, compared with below 10 ms for AWS and IBM and above 20 ms for Google.
• Location matters: UK-hosted applications generally perform best. The report does not recommend Nordic data centers for UK Open Banking applications.

Financial-grade API consent endpoints are not reliant on historical technical debt in the same way as many legacy applications. The differences therefore point to implementation resources, consent solution choices, caching and validation, and the infrastructure serving the journey.

Scope of Report

We made approximately 8.4 million API calls to Open Banking consent endpoints and measured availability and latency components including DNS name lookup, TCP connect, SSL handshake, and backend processing time.

The UK Open Banking landscape was categorized into three groups: CMA9 banks, the largest incumbent banks; traditional banks, established smaller banks and building societies; and neobanks, innovative entrants to UK banking services.

APImetrics monitored FAPI-compliant journey endpoints for 29 Open Banking brands, up from 28 in 2021–22.

Methodology

APImetrics used its active API performance and quality monitoring system with a Software Statement Assertion from partner tomato pay to make standardized end-to-end consent calls for the FAPI journey at 29 bank brands, approximately every five minutes from software agents hosted at all 22 European cloud locations.

Raw metrics were combined using patented Cloud API Service Consistency (CASC) technology to generate a quality score every month for each brand.

Each call consists of steps before data is exchanged: Name Lookup (DNS), TCP Connect, and SSL Handshake. As a rule of thumb, the SSL handshake is double the TCP connect time, and can be longer when the server analyzes the incoming connection. Once the connection is established, the request is uploaded, processed, and returned; the total elapsed time is logged.

Detailed Results

Endpoints

Traditional banks have been the lowest-quality bank type since early 2021. In 2022–23, both traditional banks and neobanks performed consistently in the CASC Green Zone, although neobanks typically outperformed the CMA9 and traditional banks. Including the Irish CMA9 banks, there were several months when CMA9 banks led the neobanks.

In 2021–22, traditional banks averaged in the Yellow Zone. In 2022–23, they improved into the Green Zone, indicating high-quality APIs with no major issues. APImetrics estimates that improving an endpoint from the Yellow Zone to the Green Zone saves approximately 720 support engineer hours per year. For the three Open Banking authentication endpoints considered here, the 12-month savings were more than GBP 125,000.

Unlike in 2020–21 and 2021–22, no traditional bank suffered a major outage. Average availability was still lowest for traditional banks, while neobanks and CMA9 banks achieved Three Nines availability.

Cloud data center performance

Most applications that call Open Banking APIs are hosted in a cloud data center from AWS, Azure, Google, or IBM. APImetrics made the same calls using the same infrastructure and configuration from the same cloud data centers. Latency becomes perceptible to end users at roughly 400–450 ms, and Azure was the slowest cloud overall throughout the period, with latency above 450 ms.

AWS and IBM were comparable for the first part of the period, while Azure was slowest in 2023. Google sat between the two faster clouds and Azure. Cloud choice can add 100 ms or more of latency when every millisecond counts.

AWS, Google, and IBM improved their DNS performance compared with 2021–22, with lookup time decreasing by 40% or more. Azure increased by 80%. The report attributes the whole of Azure's increase in total time to the increase in DNS time.

Performance by cloud and bank type

Removing the impact of Nordic data centers showed that the performance differences between bank types were consistent across clouds. For median total time, the speed order was AWS, IBM, Google, then Azure for all three bank types. Traditional banks had p99 times around 1,400 ms regardless of cloud, while neobanks had p99 times below 700 ms.

Slow calls affect user experience. Neobanks can provide faster and more reliable endpoints than traditional banks, with fewer outliers, indicating a difference in infrastructure quality. Banks with greater p99 total times will likely encounter more API issues and higher support costs: high latency comes at a price.

Recommendations

Only by monitoring API quality from the end-user perspective can an organization understand how its APIs behave. Internal monitoring will not expose every issue that requires rapid escalation and resolution.

• Monitor API quality actively from the locations where end users and TPPs make calls.
• Choose cloud and data center locations carefully; UK and Ireland generally provide the best performance for UK Open Banking.
• Design for the additional processing overhead of traditional banks when building services for their users and APIs.
• Prefer AWS or IBM for performance-critical applications based on the 2022–23 data.
• Investigate Azure DNS lookup performance before building a performance-critical UK Open Banking application on Azure.

About tomato pay

tomato pay is a QR-code-based payments and invoice app for businesses and sole traders who want to receive payments in a safe, streamlined, and cost-effective way. It offers low-cost QR-code payments with no hidden fees and near-immediate cash settlement.

The app provides access to bank accounts and transactions in one place. Users can create invoices, automate discounts and late penalties, send payment reminders, and connect their bank account so digital payments are embedded in the invoice.

Glossary

The measurement, API, and Open Banking terms used throughout this report, defined for teams comparing performance across banks, clouds, and locations.

4xx HTTP status code

A client-side response generated when a request is made to an endpoint that does not exist or for which the user lacks authorization. These warnings generally should not be included when determining endpoint performance and quality.

5xx server error

An actual error reported by the application server hosting the API.

Agent

The APImetrics software agent running at cloud locations around the world to generate synthetic calls as if they were made by an end user or partner.

API

An Application Programming Interface; in this report, a web API that receives an HTTP request and returns data or changes the state of a remote resource.

API call

A single HTTP request made to a particular endpoint. Request and response details are stored for analysis of performance and quality.

Authentication and authorization

The processes used to validate the identity of a requesting party and confirm that it has been granted access to an API endpoint, often using OAuth 2.0 and FAPI.

Availability

A measure closely linked to pass rate. An endpoint can be available even when a call does not pass because of authentication, authorization, or malformed-request issues.

Cloud provider

An organization that provides a commercial service hosting applications on servers, such as AWS, Google Cloud, Microsoft Azure, or IBM Cloud.

Configuration

Internal and external network configuration, including load balancers and routing tables, that can materially affect API performance and quality.

CASC score

Cloud API Service Consistency, an APImetrics metric combining availability, latency, reliability, response consistency, and outliers into a benchmarked quality score. Green is 8.00 or greater, Yellow is 6.00–7.99, and Red is below 6.00.

CMA9 banks

The nine large UK banks mandated by the Competition and Markets Authority to expose Open Banking APIs and regularly report performance.

DNS latency

The time taken by the service making the API call to identify the target server and route the request using the Domain Name System.

Endpoint

The web address called by an API request, together with the parameters and security needed to make the call.

FAPI

Financial-grade API, a technical specification based on OAuth 2.0 and OpenID Connect that defines additional security requirements for financial and other high-security industries.

Handshake time

The time required to establish the secure HTTP connection between services.

Latency

The time between making a request and receiving the response, including DNS, connection, handshake, upload, processing, and download components.

Metric

A measure of an aspect of endpoint performance, such as availability or the median length of a latency component.

Non-conformance

An endpoint that does not respond according to its published specification, for example by returning missing fields or unexpected errors.

OBIE

Open Banking Implementation Entity, the UK entity managing Open Banking standards in the United Kingdom.

Open Banking

A paradigm for banking, financial, and payment services that enables new products and experiences through data exchange using APIs.

p99 time

The value below which 99% of measured latency values fall; the remaining 1% are slower. p99 is useful for understanding performance at the extremes.

Processing time

The time the server takes to process a received request before sending a response to the end user.

PSD2

Payment Services Directive 2, a pan-European agreement covering access to payment and banking services for financial services providers in the EU and United Kingdom.

Reliability

The tendency of an endpoint to respond within a narrow range of times. A reliable endpoint may not be fast, but its latency variance is relatively small.

Software Statement Assertion

A signed JSON Web Token containing metadata about a third-party provider's client software, issued through the Open Banking Directory and used to prove the identity of the regulated entity.

Total time

The time between a request being made to an endpoint and the complete response being received, including DNS, TCP connection, and handshake time.

About APIContext

APIContext eliminates blind spots for enterprises across the digital delivery chain with proactive synthetic monitoring, performance analytics, and automated conformance validation. Our platform delivers actionable insights so connected systems perform and conform—ensuring every interaction is trusted, secure, and compliant.

What are your APIs saying to AI? Contact us to find out.