📊 Full opportunity report: The mandate. Why the US conversational- finance surface does not translate to Europe. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.

TL;DR

The US launched its personal finance surface permissionlessly, while Europe’s strict licensing and consent mandates create a fundamentally different architecture. This impacts market entry, product design, and who can build these services.

OpenAI’s personal-finance surface launched in the US on May 15, 2026, without regulatory restrictions, enabling permissionless account access. In contrast, Europe’s regulatory environment requires licensed, consent-based access governed by a complex framework of mandates, fundamentally altering how such surfaces can be built and operated. This shift is discussed in detail in the article on the unbundling of the budget app.

In the US, the launch relied on a permissionless model, where firms like OpenAI could aggregate financial data by connecting to bank accounts via APIs like Plaid, without needing licenses or regulatory approval. This approach treats data access as a product feature, enabling rapid innovation and a wide market of permissionless aggregators.

Europe’s framework, rooted in PSD2, FIDA, and the AI Act, treats account access and data sharing as regulated activities. Access requires licensing, consent dashboards, and conformity assessments, transforming the development of conversational finance platforms into licensing projects rather than product launches. The open-banking regime is replaced by a mandated, consent-based architecture, with compliance embedded into the product design.

This structural difference means that European firms building similar surfaces must navigate a layered, regulated environment, favoring licensed incumbents over permissionless newcomers. The regulatory regimes also impose high fines for non-compliance, increasing the barriers to entry and reshaping competitive dynamics.

The Mandate — Thorsten Meyer AI
MANDATE
● DISPATCH / MAY 2026
THORSTEN MEYER AI · AGENTIC COMMERCE · § 03
AGENTIC COMMERCE · 03
EUROPE / MANDATE
Essay · Regulatory-Architecture Reading · 2026-05-26

The mandate.
Why the US conversational-
finance surface does not
translate to Europe.

In the US, account access is a product you buy and consent is a button you tap. In Europe, both are mandates you are licensed and supervised to fulfill.
The US surface shipped permissionlessly — connect via Plaid, 12,000+ institutions, read-only, no license. That rollout does not translate. In Europe every layer is a mandate. The foundation: PSD2 → PSD3/PSR (provisional agreement Nov 27 2025) makes account access a licensed, API-quality-supervised activity under a directly-applicable rulebook. The expansion: FIDA extends mandated access to investments, pensions, insurance, mortgages under a new FISP license — operational ~2029-2030, with a contested data-access fee at its core. The overlay: the EU AI Act classifies credit-scoring AI as high-risk (full obligations Aug 2 2026), supervised not by a tech regulator but by financial supervisors like BaFin. The structural argument: the US surface is built on a permissionless private substrate, and Europe has no permissionless substrate — it has a mandate at every layer. In the US compliance is an afterthought. In Europe, compliance is the architecture, and the conversational experience is the thin layer on top.
3
Overlapping mandates — payments,
data, AI — vs zero in the US build
7%
Of global turnover · the EU AI Act
maximum penalty
2029-30
When FIDA — the full-picture data
mandate — is likely operational
0
Permissionless routes to a European’s
bank data · it is a licensed activity
THE MANDATE· US SHIPPED PERMISSIONLESSLY · PLAID· EUROPE HAS A MANDATE AT EVERY LAYER· PSD2 MADE ACCESS A LICENSED ACTIVITY· PSD3/PSR · PROVISIONAL AGREEMENT NOV 27 2025· PSR DIRECTLY APPLICABLE ACROSS 27 STATES· MANDATORY API QUALITY · NO SCREEN-SCRAPING· FIDA · NEW FISP LICENSE· OPEN FINANCE · INVESTMENTS PENSIONS INSURANCE· DATA-ACCESS FEE THE CONTESTED CORE· EU AI ACT · CREDIT SCORING HIGH-RISK· FULL OBLIGATIONS AUG 2 2026· SUPERVISED BY BAFIN, NOT A TECH REGULATOR· CONSENT IS A DASHBOARD, NOT A BUTTON· COMPLIANCE IS THE ARCHITECTURE· THE MANDATE FAVORS THE LICENSED INCUMBENT· IN EUROPE YOU LICENSE A FINANCE SURFACE· THE MANDATE· US SHIPPED PERMISSIONLESSLY · PLAID· EUROPE HAS A MANDATE AT EVERY LAYER· PSD2 MADE ACCESS A LICENSED ACTIVITY· PSD3/PSR · PROVISIONAL AGREEMENT NOV 27 2025· PSR DIRECTLY APPLICABLE ACROSS 27 STATES· MANDATORY API QUALITY · NO SCREEN-SCRAPING· FIDA · NEW FISP LICENSE· OPEN FINANCE · INVESTMENTS PENSIONS INSURANCE· DATA-ACCESS FEE THE CONTESTED CORE· EU AI ACT · CREDIT SCORING HIGH-RISK· FULL OBLIGATIONS AUG 2 2026· SUPERVISED BY BAFIN, NOT A TECH REGULATOR· CONSENT IS A DASHBOARD, NOT A BUTTON· COMPLIANCE IS THE ARCHITECTURE· THE MANDATE FAVORS THE LICENSED INCUMBENT· IN EUROPE YOU LICENSE A FINANCE SURFACE·
FIG. 01 — THE SUBSTRATE · PRIVATE PRODUCT VS PUBLIC MANDATE
The US built account access privately and permissionlessly · Europe built it as public mandate
One architectural difference at the foundation propagates through the entire stack
United States
A product you buy
  • Access built by private aggregators — Plaid, Yodlee, MX, Finicity
  • No banking license required to read bank data
  • Read-only design sidesteps money-transmission rules
  • No single federal open-banking statute · the surface ships as a product
European Union
A mandate you fulfill
  • Access is a licensed activity — AISP / PISP under PSD2
  • Regulator authorization required; no permissionless route
  • Explicit, revocable, SCA-governed consent regime
  • A directly-applicable rulebook (PSR) · the surface must be licensed
The US surface shipped because the account-access layer it needed was already built, privately and permissionlessly, by Plaid — and because a read-only design kept it clear of the activities that trigger heavy regulation. That is the precise feature Europe does not share. Reading a European’s bank data without the right license is not a product — it is an unauthorized activity. The very first layer of the US build, the permissionless connect, is in Europe a regulatory authorization.
FIG. 02 — THE THREE-MANDATE STACK · WHAT THE SURFACE MUST SATISFY IN EUROPE
Payments, data, and AI — three overlapping regimes, all enforced by financial regulators
The US surface faced none of these at launch; the European surface faces all three at once
PSD3 / PSRPayments mandate
Account access is a licensed activity (AISP/PISP). PSR directly applicable across 27 states. Mandatory API quality, screen-scraping eliminated, IBAN-name checks, expanded fraud liability.
FIDAData mandate
Extends mandated access to investments, pensions, insurance, mortgages, loans under a new FISP license. Standardized APIs + consent dashboards. A contested data-access fee may make aggregation cost money.
EU AI ActAI mandate
Credit scoring + creditworthiness = high-risk (Annex III). Conformity assessment, documentation, human oversight. Supervised by financial regulators (BaFin, CSSF). Fines up to 7% of global turnover.
A finance surface in Europe must be licensed for payment-data access (or partner with someone who is), prepare for a FISP license to aggregate the full financial picture, and classify itself under the AI Act — where the most commercially attractive features (“what loan can I get?”) sit closest to the high-risk line. The AI that is “just a chatbot” in the US is, in Europe, a regulated system whose classification depends on exactly how useful it tries to be.
FIG. 03 — THE STAGGERED TIMELINE · A MOVING REGULATORY TARGET
The mandate is not one event but a sequence — and the staggering is a filter
The firms that win architect for the end-state mandate, not the current one
Aug 2025
EU AI Act · GPAI obligations live · the frontier models that power a finance surface already carry systemic-risk obligations
Live
Nov 27 2025
PSD3/PSR provisional agreement · Parliament and Council reach political agreement; final texts expected in the Official Journal in 2026
Agreed
Aug 2 2026
EU AI Act · high-risk obligations land · credit-scoring / creditworthiness Annex III duties apply (subject to Digital Omnibus)
Operative
2027
PSD3/PSR core obligations · directly-applicable conduct rules land across the year after the transition
Landing
~2029-2030
FIDA operational · the full-picture data mandate and FISP license arrive, in staggered sector-by-sector “waves”
Forming
Building for PSD3 today while FIDA and the AI Act high-risk regime are still settling means building for a target that is still moving — which favors firms with the regulatory-intelligence capacity to track it and the patience to build for 2030 rather than ship for 2026. The staggered timeline is itself a filter: it selects for regulatory endurance over launch speed.
FIG. 04 — THE CONSENT ARCHITECTURE · WHAT REPLACES THE “CONNECT” BUTTON
The single most optimized moment of the US product is the single most regulated moment of the European one
The European surface cannot inherit the US onboarding · it must build a different, regulated core
The US default — collect broadly, use later — is the European violation. The consent dashboard, the granular permission model, the revocation flows, the purpose-binding, the audit trail are not features bolted onto the conversational experience; they are the regulated core that the experience sits on top of. The European surface is, by regulation, higher-friction at exactly the moment the US surface optimized for frictionlessness.
FIG. 05 — WHO BUILDS THE EUROPEAN SURFACE · THE REDISTRIBUTION OF ADVANTAGE
The mandate does not just slow the US surface — it changes who wins
Advantage moves from permissionless speed to licensed position
Disadvantaged
The US winners
A frontier lab + permissionless aggregator. Their core competency — permissionless speed and reach — is exactly what the mandate removes. No AISP/FISP license, no BaFin relationship. Arrive needing a license stack they don’t have.
Advantaged
Licensed EU fintechs
Already authorized AISPs/PISPs, PSD3-compliant API fleets, consent-native. “The lab + a licensed European partner” — and the partner holds more leverage than Plaid, because the license is scarcer than an API.
Advantaged
Incumbent banks
Already hold the data, licenses, consent relationships, supervisory standing. The incumbent disintermediated in the US thesis is, in Europe, structurally protected — the mandate that gates the challenger does not gate the bank.
In the US, the advantage went to whoever integrated the permissionless layer fastest and built the best surface on top. In Europe, it goes to whoever holds the licenses, the supervisory relationships, and the consent architecture. The mandate redistributes the advantage from the permissionless aggregator-and-lab toward the licensed incumbent-and-specialist — and Europe’s regulation is, among other things, an incumbent-protection architecture, whether or not that is its intent.
The architecture diverges at the foundation: the American surface treats account access as a product you buy and consent as a button you tap, while Europe treats both as mandates you are licensed and supervised to fulfill. In the US, you ship a finance surface. In Europe, you license one.
Thorsten Meyer · The Mandate · Agentic Commerce 03

Implications of Regulatory Architecture on Market Entry

The divergence in regulatory architecture fundamentally alters who can build and operate conversational finance surfaces in Europe. Unlike the US, where permissionless innovation fosters rapid market expansion, Europe’s mandated approach favors licensed firms, potentially leading to slower deployment, increased costs, and a more concentrated market. Understanding this difference is crucial for firms planning to operate across jurisdictions and for policymakers considering the impacts of regulation on innovation and consumer choice.
Amazon

bank account API integration tools

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

European Financial Data Regulations and AI Oversight

Europe’s financial data access has been shaped by PSD2 since 2018, requiring licensed third-party providers for account aggregation. The upcoming PSD3/PSR and FIDA regulations will expand these mandates to include investments, pensions, and other financial products, with operational dates around 2029-2030. The AI Act, effective from August 2026, classifies AI systems used for credit scoring as high-risk, subject to strict supervision by financial regulators such as BaFin. These layered regulations create a permissioned environment that contrasts sharply with the US’s permissionless approach, which relies on private API connections without licensing requirements.

“The same surface, brought to Europe, is not a product launch. It is a licensing project, a consent-architecture project, and an AI-classification project, conducted under overlapping regimes enforced by regulators.”

— Thorsten Meyer

Bill Organizer - Monthly Bill Payment for Personal Budgeting Financial, Payments Checklist Organizer, 5.8" x 8.5", Black

Bill Organizer – Monthly Bill Payment for Personal Budgeting Financial, Payments Checklist Organizer, 5.8" x 8.5", Black

EASY TO MANAGE – Use this bill payment tracker notebook for tracking your personal expenses. Never miss another…

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Unclear Impact on Consumer Outcomes and Innovation

It remains unclear whether Europe’s regulatory architecture will lead to better consumer protections or simply slow innovation and concentrate market power. The long-term effects on service quality, competition, and consumer choice are still being evaluated as implementation progresses.
RegTech and Compliance Automation with Python: Building AI-Powered Regulatory Systems and Supervisory Technology

RegTech and Compliance Automation with Python: Building AI-Powered Regulatory Systems and Supervisory Technology

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Future Developments in European Open-Finance Regulation

Regulators are expected to finalize PSD3/PSR and FIDA regulations around 2029-2030, establishing the licensing and consent frameworks. Firms interested in building European conversational finance surfaces will need to adapt to these mandates, and the market will likely see a shift toward licensed, compliant providers. Observers will monitor whether this architecture results in more secure, consumer-friendly services or hampers innovation.
DeskFX Free Audio Effects & Audio Enhancer Software [PC Download]

DeskFX Free Audio Effects & Audio Enhancer Software [PC Download]

Transform audio playing via your speakers and headphones

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Key Questions

Why can’t US permissionless finance surfaces operate the same way in Europe?

Because Europe’s regulatory environment treats account access and data sharing as licensed, consent-based activities, requiring firms to obtain licenses and comply with strict rules. The US approach relies on permissionless API connections, which are not permitted under European law.

What are the main regulatory regimes affecting European financial data access?

The main regimes include PSD2, which mandates licensed third-party access; the upcoming PSD3/PSR; FIDA, expanding data access to investments and other products; and the AI Act, regulating high-risk AI systems used in finance.

How does the AI Act influence conversational finance platforms in Europe?

The AI Act classifies systems used for credit scoring and assessment as high-risk, requiring compliance with supervision, conformity assessments, and transparency obligations, which adds complexity and cost to deploying such systems.

Will Europe’s approach slow down the development of conversational finance services?

It is possible. The licensing and compliance requirements create higher barriers to entry and slower deployment, favoring established, licensed firms over permissionless startups. The long-term impact on innovation remains uncertain.

Who is best positioned to build the European version of these surfaces?

Licensed, compliant financial technology firms with existing regulatory licenses and strong consent management capabilities are best positioned, unlike US-based permissionless aggregators.

Source: ThorstenMeyerAI.com

This content is for general information only and is not financial, tax or legal advice. Consult a qualified professional for decisions about your money.
You May Also Like

732 Bytes to Root. One Hour of Scan Time.

A new Linux privilege escalation bug, Copy Fail, was found in just one hour of scanning, collapsing the cost of zero-day exploits and challenging security assumptions.

The Enforcement Countdown: 89 Days Until the EU AI Act’s GPAI Penalty Phase Begins

The EU AI Act’s enforcement powers for GPAI providers activate in 89 days, enabling fines up to €35M or 7% of global turnover, impacting major tech firms.

Compliance in International Direct Sales: Navigating Global Regulations

The key to successful international direct sales lies in mastering global regulations; discover how to navigate compliance challenges effectively.

Cybersecurity operations signal monitor: A backdoor in a LinkedIn job offer

Security researchers detect a backdoor in a LinkedIn job posting, highlighting new risks for organizations and the need for vigilant monitoring.