UK Open Banking API Performance 2023-2024

Executive Summary

From June 2023 to July 2024, APIContext, in partnership with tomato pay, conducted approximately 8 million API test calls across 29 UK banks to assess the quality of their Open Banking APIs. These APIs support services such as payment processing and transfers, and their performance is regulated by the UK Financial Conduct Authority (FCA).

Overall API performance improved, but it is still not where it needs to be for the UK to continue leading Open Banking globally. The largest banks (CMA9) and traditional banks improved, while neobanks began to lag in quality and consistency. Smaller traditional banks continued to show the weakest results.

Infrastructure choices remain important. Fintech solutions deployed on Microsoft Azure substantially underperformed compared with other cloud providers and, in some areas, compared with their own results from the previous year.

1. 01

   Azure cloud performance continues to decline

   Azure locations, especially in Northern Europe, experienced substantial latency increases and an 80% increase in DNS lookup times compared with the previous year.

2. 02

   Traditional banks improve, but still struggle with speed

   Some traditional-bank APIs recorded p99 times above 4,500 milliseconds, affecting user experience and operational efficiency.

3. 03

   Neobanks maintain strong performance

   Tide and Monzo continued to deliver near-perfect availability and the fastest response times of any category.

4. 04

   Global leadership is being challenged

   The UK remains a leader, but other markets are moving forward. Continued investment is needed to maintain that lead under the UK's National Payments Vision.

Introduction

The United Kingdom remains a leader in the global Open Banking movement, largely because of its forward-thinking regulatory environment. Regulators have shaped an ecosystem that includes major established banks, smaller financial institutions, credit card companies, building societies, fintechs, and neobanks.

Open Banking allows third-party companies, with customer consent, to access financial data securely through Application Programming Interfaces (APIs). These APIs create opportunities for new financial services and applications, giving consumers more choice in how they manage their finances.

In this fourth annual report, APIContext evaluated the performance of Open Banking APIs from CMA9 banks, traditional High Street banks, credit card companies, building societies, and digital banks. The data was collected using APIContext's outside-in APImetrics monitoring service and its proprietary CASC (Cloud API Service Consistency) system.

All results are based on real API calls made using the same process consumers would go through. Calls followed Financial-grade API (FAPI) standards and were gathered from July 1, 2023 to June 30, 2024.

Key Findings

• Cloud variability increased: All clouds experienced a slight decline from the numbers measured in the previous report.
• Azure performance declined further: Northern European Azure locations had the highest latency, with DNS lookup times up 80% year over year and latency regularly exceeding 2,000 milliseconds.
• AWS and IBM remained strong: Both generally delivered p99 times under 600 milliseconds for most bank types.
• Neobanks led in availability and speed: Digital-first banks such as Tide and Monzo continued to outperform traditional banks and some CMA9 banks.
• CMA9 banks remained stable: Most provided consistent service, but struggled to match the speed and agility of neobanks.
• Traditional banks continued to lag: Especially where Azure infrastructure was involved, latency reached 4,500 milliseconds.
• Data-center choice matters: Akamai Connected Cloud UK and AWS UK were the fastest locations, with p99 times around 1,084 and 1,150 milliseconds.

Scope of Report

This report analyzes 29 UK-based bank brands, grouped into CMA9 banks, neobanks, and traditional banks. APIContext monitored FAPI-compliant consent endpoints with around 8 million API calls between July 1, 2023 and June 30, 2024.

The analysis covers availability and reliability; DNS, TCP connect, SSL handshake, processing, and total-time latency; performance by cloud provider; and comparative performance across bank types.

Methodology

APIContext used its proactive, outside-in APImetrics performance and quality monitoring system to conduct standardized, end-to-end FAPI consent calls for 29 banking brands. Calls ran at approximately five-minute intervals, with software agents deployed across dozens of cloud locations throughout Europe.

The resulting metrics were analyzed using the patented Cloud API Service Consistency (CASC) framework. CASC integrates availability, latency, and consistency into a quality score for comparing bank brands and cloud providers.

Each call records DNS name lookup, TCP connection, SSL handshake, upload, server processing, download, and total time. No APIContext customer data was used: all data points were generated independently through controlled synthetic calls.

Akamai Connected Cloud was added as a new provider during this report period. APIContext expects cloud providers and individual data centers to change over time, so the methodology remains substantially similar year to year to support longitudinal analysis.

Detailed Results

6.1 Networking elements

An API is only as reliable as the network it runs on. DNS resolution varied substantially by cloud provider. Akamai produced an outstanding 6 ms result, more than ten times faster than the slowest Azure resolution. All cloud providers were slower than the previous year, putting additional pressure on applications to perform quickly.

6.2 Availability and latency

Neobanks averaged 99.98% availability, with several months reaching 100%, and typically remained under 400 milliseconds. CMA9 banks averaged 99.93% availability. Traditional banks improved slightly to 99.81%, but their latency remained a critical issue, especially when hosted on Azure, where p99 times regularly exceeded 4,500 milliseconds.

Overall time is compounded by complex financial transactions, which may require three to ten individual API calls. A payment or transaction-validation sequence can therefore take up to 30 seconds, long enough for an end user to wonder whether the payment failed or to submit it twice.

6.3 Overall quality

CASC combines endpoint performance, availability, reliability, resilience, and outliers into a score from 1 to 10. CMA9 and traditional banks improved the reliability and resilience of their Open Banking APIs, while neobank quality declined. Neobanks still performed better than traditional banks, but without renewed attention to reliability they risk losing ground.

Recommendations

1. Prioritize cloud optimization: TPPs and banks that rely on connections to other banks should prioritize moving low-latency workloads away from Azure. AWS and IBM provided the most consistent performance, while Akamai offered excellent infrastructure where speed matters most.
2. Use proactive monitoring: Continuous API monitoring is essential to maintain high performance. Real-time insight into performance bottlenecks enables rapid intervention.
3. Focus on traditional banks: Traditional banks should modernize API infrastructure to close the gap with neobanks and CMA9 banks. Backend processing remains a key bottleneck and a material business risk.
4. Keep the global perspective: The UK's Open Banking leadership provides lessons for other markets. As more countries adopt regulation, a robust ecosystem of interoperable players will be critical for long-term success.

Glossary

The API, Open Banking, and performance terms used throughout this report, defined for teams comparing regulated financial APIs.

4xx HTTP status code

A response generated when a request is made to an endpoint that does not exist or for which the user lacks authorization.

5xx server error

An actual reported error from the application server hosting the API.

Agent

The APImetrics software agent running at a cloud location and generating synthetic calls as if it were an end user or partner.

API

An Application Programming Interface; here, a web API that receives an HTTP request and returns data or changes remote state.

Availability

An estimate of whether an endpoint is reachable and able to respond, distinct from pass rate because authentication or malformed requests can fail while the endpoint remains available.

CASC score

Cloud API Service Consistency, an APIContext patented blended metric combining availability, latency, reliability, response consistency, and outliers into a single quality score.

CMA9 banks

The nine large UK banks mandated by the Competition and Markets Authority to expose certain Open Banking APIs.

Cloud provider

An organization providing commercial infrastructure for hosting applications, such as AWS, Azure, Google Cloud, IBM Cloud, or Akamai Connected Cloud.

DNS latency

The time taken by the cloud service making an API call to identify the target server and route the request.

FAPI

Financial-grade API, a technical specification based on OAuth 2.0 and OpenID Connect with additional requirements for high-security financial APIs.

Latency

The time involved in an API call, including DNS, handshake, upload, processing, and download; in this report it is measured in milliseconds.

OBIE

Open Banking Implementation Entity, the UK entity managing Open Banking standards.

p99 time

A value below which 99% of measured latency values fall; the remaining 1% are slower.

Processing time

The time the server takes to process a request before sending its response.

Software Statement Assertion

A signed JSON Web Token containing client metadata and proving that a request comes from a regulated Open Banking entity.

Total time

The time between making a request to an endpoint and receiving the complete response, including network setup and transfer.

About tomato pay

Fractal Labs Ltd, trading as tomato pay, is an API-based embedded payment and financial services platform supporting partners focused on small and medium enterprises. tomato pay also offers QR-code-based payments and invoice applications for businesses and sole traders.

About APIContext

APIContext eliminates blind spots for enterprises across the digital delivery chain with proactive synthetic monitoring, performance analytics, and automated conformance validation. Our platform delivers actionable insights so connected systems perform and conform—ensuring every interaction is trusted, secure, and compliant.

What are your APIs saying to AI? Contact us to find out.