Open Banking for B2B Scenarios
Stefan Nilsson
· 2 min readKey Takeaways
Open banking is expanding globally, pushing banks to open up APIs and increasing market competition to improve customer outcomes.
This creates new compliance and technical demands — banks must support easy TPP integration, strong security, and compatibility with legacy infrastructure.
B2B open banking is more complex than consumer scenarios but gets less attention — consent in consumer cases is straightforward, but B2B involves delegated authority (e.g., a CEO/CFO consenting while someone else performs the action).
Lines of responsibility vary by business, making standardized consent models difficult to apply across B2B use cases.
Curity addresses this via configurable claims and scopes — delegating specific trust/consent per client without custom code.
Curity supports financial-grade standards like FAPI and CIBA, plus built-in consent management and authentication.
On this page
More and more countries across the globe are adopting open banking regulations. As a result, banks must open up their APIs to allow users to share data. These strides have increased competition in the financial market to improve customer outcomes.
Consumer-focused finance is an inevitable outcome of open banking and is a positive development for consumers. However, it means additional compliance and technical demands for financial institutions. Banks need to make it simple and easy for Trusted Third-party Providers (TPPs) to develop and integrate, achieve enhanced security levels, and integrate with the rest of the infrastructure, including legacy systems. In other words, there are many aspects and new complexities to manage in the open banking paradigm.
The Challenges of Open Banking for B2B
When discussing open banking, we tend to highlight the consumer-facing challenges. However, the business-to-business (B2B) side is often left out of the conversation. This does surprise me a little, as B2B is much more varied and complicated (perhaps that's why it's a tough subject to breach). For example, how do you handle consent in scenarios like a pension fund broker placing orders on behalf of a business customer in the bank?
In a consumer scenario, you can relatively easily manage the consent of TPP access to a personal account. However, in the B2B case, it's not as straightforward. The account owner (the CEO or CFO) must give consent, but the actual action is often delegated to someone further down in the organization. This line of responsibility could look different from business to business.
A Solution for B2B Open Banking Access Control
This is where the Curity Identity Server comes in to address all kinds of open banking requirements and nuances. It gives banks sophisticated tools to solve the more advanced access control challenges. In the Curity Identity Server, you can easily configure claims and scopes to delegate very specific trust and consent using data originating from various sources that are "burned" into access tokens on a per-client basis.
You can set up on-behalf-of flows precisely as is required for your use case, by configuration, without any code. The backend services and APIs will have an easy time granting access by utilizing the information directly available in tokens.
type: embedded-entry-inline id: 7pGbsseqiTAxBCyI8vqhGC
At Curity, we actively follow the global mandates to ensure that the Curity Identity Server aligns with the evolving open banking and financial-grade regulations. We support essential financial-grade profiles such as FAPI and CIBA, as well as built-in consent management and user authentication.
New specifications are continuously added to empower our customers to comply with regulations and solve not only the simple use cases but also the complex ones. Using our product, even the most challenging B2B scenarios are possible to solve without resorting to code.
Related resources
Frequently Asked Questions
What exactly is a Trusted Third-Party Provider (TPP)?
A TPP is a third-party service (such as a fintech app or account aggregator) that banks grant API access to, so customers can share their financial data or initiate payments through external providers rather than only through the bank's own channels.
What are FAPI and CIBA, and why do they matter for open banking?
FAPI (Financial-grade API) is a security profile designed for high-assurance API access in financial contexts, while CIBA (Client Initiated Backchannel Authentication) enables authentication flows that don't require a redirect-based browser interaction — both are relevant standards banks and TPPs need to support for secure, compliant open banking implementations.
Can the same access control setup handle both simple consumer scenarios and complex B2B scenarios?
Yes — the same configurable claims/scopes and on-behalf-of flow setup is designed to scale from simple consumer use cases to more advanced B2B delegation scenarios, without needing separate custom-coded solutions for each.