Open banking has transformed financial services from a walled-garden model into a programmable ecosystem. Banks, fintechs, and third-party providers (TPPs) now exchange account data and initiate payments through regulated APIs — and the availability of those APIs is no longer an internal engineering concern. It is a regulatory obligation, a commercial commitment, and a trust signal to the entire ecosystem that depends on your platform.
When an open banking API goes down, the failure doesn't stay contained within your infrastructure. It cascades to every TPP connected to your platform: personal finance apps that can't refresh balances, payment initiation services that can't route transactions, credit underwriters that can't retrieve account history. The downstream effect is immediate, visible, and measurable — and in regulated markets, it's reportable.
This guide covers the specific uptime challenges facing open banking platforms, what to monitor across the API and consent stack, and how to configure Vigilmon to maintain the availability your ecosystem depends on.
Why Open Banking Uptime Is a Regulatory Obligation, Not Just an SLA
PSD2 and Open Banking Standards Mandate API Availability
In the UK and EU, open banking APIs operated by account servicing payment service providers (ASPSPs) are subject to availability requirements under PSD2 and the UK Open Banking Standard. The FCA and EBA expect banks and their API management layers to maintain dedicated interfaces that are reliable, performant, and continuously monitored.
API downtime that affects TPPs is not a private matter between an engineering team and a monitoring dashboard — it must be tracked, reported, and in some cases disclosed to regulators. Banks that cannot demonstrate proactive monitoring of their open banking interfaces face increased scrutiny during API performance reviews.
TPP Ecosystem Trust Depends on Your Uptime
Every TPP connected to your open banking platform has made a commercial promise to their own users. A personal finance app promises real-time balance visibility. A payment initiation service promises instant payment execution. A mortgage broker's platform promises up-to-date income verification. When your API is unavailable, every one of those promises is broken — and the TPPs hear about it from their users before they hear about it from you.
Open banking platforms that proactively monitor and communicate outages build ecosystem trust. Those that let TPPs discover failures from user complaints lose partnerships.
Consent and Authentication Failures Cause Silent Data Droughts
The Open Banking consent model routes users through an authorisation journey before any data is shared. When the authorisation server or consent management service degrades, users can't connect accounts, refresh consents, or re-authorise after expiry. TPPs see no data, but the failure appears to be on the user's side — not the bank's. Without active monitoring of the consent flow, silent consent failures persist for hours before anyone identifies the root cause.
What to Monitor in an Open Banking Platform
1. Account Information Service (AIS) API
The AIS API is the highest-traffic endpoint in most open banking platforms, serving balance and transaction data to aggregators, PFM apps, and credit decisioning engines. Monitor:
- Account details and balance retrieval endpoints
- Transaction history fetch endpoints (including pagination handling)
- Account list endpoints across product types (current, savings, credit)
- Bulk retrieval endpoints for multi-account users
Check intervals of 60 seconds are appropriate for production AIS endpoints. During peak morning hours (07:00–09:00) when personal finance apps refresh balances for millions of users, consider 30-second intervals and immediate escalation for latency exceeding 2 seconds.
2. Payment Initiation Service (PIS) API
Payment initiation failures have direct financial consequences — failed payments, delayed settlements, and merchant fulfilment issues. Monitor:
- Payment order creation endpoints
- Payment status retrieval endpoints
- Standing order and scheduled payment endpoints
- Payment confirmation callbacks and webhooks
A PIS endpoint that returns 500 errors silently will not alert the TPP until their user's payment fails at checkout. Vigilmon's 60-second checks catch this within one minute of the first failure.
3. Strong Customer Authentication (SCA) and Authorisation Server
The OAuth 2.0 authorisation server underpins every open banking consent journey. Monitor:
- Authorisation endpoint availability
- Token exchange endpoints (authorisation code → access token)
- Token refresh endpoints
- Revocation endpoints
SCA server degradation is particularly damaging because it breaks both new consent journeys and token refresh for existing consents. An outage here silently invalidates data access for all connected TPPs simultaneously.
4. Consent Management Service
Open banking consent is a stateful resource — users create, view, and revoke consents through a managed consent layer. Monitor:
- Consent creation endpoints
- Consent status retrieval endpoints
- Consent revocation endpoints
- Consent expiry and re-authorisation triggers
Heartbeat monitoring on the consent lifecycle pipeline catches the silent failure where consent records stop updating even as the API appears to return 200 responses.
5. TPP Registration and Directory Integration
TPPs must be dynamically registered with open banking platforms and validated against the Open Banking Directory or eIDAS Trust Framework. Monitor:
- Dynamic Client Registration (DCR) endpoints
- TPP certificate validation service
- Open Banking Directory connectivity checks
- Onboarding workflow health endpoints
A broken TPP registration flow doesn't affect live traffic — it silently blocks new TPPs from onboarding. Monitoring the registration pipeline ensures growth isn't constrained by undetected infrastructure failures.
6. Webhook and Event Notification Delivery
Open banking platforms deliver real-time payment status and account update notifications to TPPs via webhooks. Monitor:
- Webhook delivery queue depth
- Event notification dispatch endpoints
- Failed delivery retry queues
- Subscription management endpoints
Heartbeat monitoring on the event delivery pipeline catches the case where notifications stop being dispatched even though the API endpoints appear healthy.
7. SSL Certificate and mTLS Configuration
Open banking APIs use mutual TLS (mTLS) for TPP authentication. An expired bank-side TLS certificate breaks all TPP connections simultaneously. Monitor:
- Production API gateway SSL certificates
- mTLS client certificate expiry (bank-issued TPP certificates)
- Sandbox environment certificates (to catch configuration drift before it reaches production)
Vigilmon monitors SSL certificates continuously and alerts weeks before expiry — giving your PKI team time to renew without an incident.
The Cost of Open Banking API Downtime
Open banking API failures are not absorbed quietly. TPPs escalate immediately because their SLAs with end users depend on your availability:
| Downtime duration | Likely impact | |---|---| | Under 5 minutes | TPP retry logic absorbs; monitoring alert received | | 5–30 minutes | TPP support queues fill; user-facing errors visible | | 30 minutes–2 hours | TPP incident declarations; potential regulatory notification | | 2+ hours | Formal incident reports; potential FCA/EBA disclosure requirements |
Vigilmon's one-minute check intervals mean most failures are detected and your team is alerted before the 5-minute threshold where TPP retry logic gives up.
Vigilmon Setup for Open Banking Platforms
Step 1: Map Your TPP-Facing API Surface
Start by listing every endpoint that external TPPs call in production:
- AIS balance and transaction endpoints
- PIS payment creation and status endpoints
- SCA and token endpoints
- Consent management endpoints
These are your highest-priority monitors: 60-second checks, immediate Slack + email alerts to your Open Banking operations team.
Step 2: Add Heartbeat Monitors for Batch and Async Jobs
Open banking platforms run batch jobs alongside real-time APIs — nightly consent expiry sweeps, payment reconciliation jobs, webhook retry processors. Add a Vigilmon heartbeat endpoint for each:
- Consent expiry notification job
- Payment settlement reconciliation job
- Webhook retry processor
- TPP certificate rotation job
If a batch job fails or doesn't run, Vigilmon alerts within the expected interval.
Step 3: Configure a TPP Status Page
Your TPP partners need authoritative incident status without routing through your support queue. Configure a Vigilmon status page with groups for:
- AIS API availability
- PIS API availability
- SCA and authorisation service
- Consent management
Publish the status page URL in your TPP developer portal and onboarding documentation. TPPs who can self-check status during incidents stop creating support tickets and trust your platform more.
Step 4: Set Up Escalation Routing by Incident Severity
- AIS or PIS API down: Immediate alert to engineering on-call + Open Banking operations manager
- SCA or consent service down: Immediate alert + escalate to VP Engineering within 10 minutes
- Webhook delivery failures sustained 15+ minutes: Engineering on-call + TPP relationship manager
- SSL certificate expiry under 30 days: Weekly digest to infrastructure team
Step 5: Monitor the Sandbox Environment Separately
Open banking sandbox environments serve TPP development and certification. A sandbox outage blocks new integrations and certification submissions. Monitor sandbox endpoints on the same cadence as production — with alerts routed to your developer relations team rather than engineering on-call.
Getting Started
Open banking platforms operate at the intersection of financial regulation, ecosystem trust, and real-time payments infrastructure. API downtime is not a private engineering problem — it is a commercial incident for your TPP partners and a regulatory event for your compliance team.
Vigilmon gives your open banking operations team the visibility to detect API failures, consent service degradation, and webhook delivery issues before they become TPP escalations or regulatory notifications.
Start monitoring your open banking platform at vigilmon.online — free for up to five monitors, one-minute check intervals, Slack alerts, and a status page included. No credit card required.
Tags: #openbanking #fintech #PSD2 #API #uptime #monitoring #TPP #payments