Regulation often makes it harder for a small company to compete. A new rule brings paperwork, legal advice, and compliance costs that a large company can absorb more easily. This can protect the firms that already lead the market.
Other rules shift the balance in favor of new entrants. Mobile phone number portability is a familiar example. Before customers could keep their numbers when changing operators, switching meant losing a number they had for years. Portability removed that obstacle, making it easier for customers to switch companies and for smaller operators to compete.
Europe applied a similar principle to banking in January 2018 through the Second Payment Services Directive, or PSD2. Eight years later, there is enough evidence to ask a wider question: under what conditions can regulation open a market to new competitors?
What PSD2 Changed
Before PSD2, the record of what you earned and paid remained inside your bank. A company that wanted to use that information to offer you a service needed an agreement with the bank, which had little reason to agree.
PSD2 transferred that decision to the customer. With your consent, a licensed company can see your account information or start a payment from your account, and the bank must provide the connection free of charge. This arrangement is known as open banking. The law also introduced stronger security for electronic payments, such as confirming a purchase with a code sent to your phone.
Fintechs are companies that use technology to provide financial services, and many are young. Those working in payments were particularly well placed to benefit from the changes introduced by PSD2.
What Happened to the New Entrants
Our findings suggest that PSD2 strengthened the position of payment fintechs. In a recent study, Pedro Jesus Cuadros Solas of CUNEF Universidad and Funcas and I, together with Banco de España’s José Manuel Carbó and Jara Quintanero, followed 423 Spanish fintechs from 2014 to 2022. We also compared 50 payment fintechs with 373 fintechs working in areas outside the scope of PSD2, including financial advice and software. The second group gave us a benchmark for the changes that might otherwise have occurred. PSD2 brought data access and stronger security at the same moment, and payment fintechs were exposed to both, so our results describe the effect of the law as a whole.
Payment fintechs became more profitable after the law took effect. Their return on assets, or profit relative to everything the firm owns, improved by 24 percentage points compared with the other fintechs. This is a large figure because many firms in the sample were young and losing money, which makes their profitability volatile. Higher sales drove the improvement. We found no comparable change in costs.
The funding pattern changed too. Among fintechs that raised external equity, payment fintechs obtained larger amounts, attracted more investors and waited less time between funding rounds. Investors from outside the European Union also participated more often.
Payment fintechs reduced their reliance on banks at the same time. Bank debt as a share of their total liabilities fell by about 11 percentage points compared with other fintechs. That decline was close to two thirds of the sample average. The firms competing with banks in payments were becoming less dependent on banks for their own financing.
Their workforce developed differently as well. Payment fintechs added employees more slowly, spent more on staff and had a larger share of permanent employees. This pattern is consistent with a move toward more specialized and better-paid jobs. Productivity also rose.
The effects did not appear immediately. They became clearer from 2019 onward, one year after PSD2 took effect. Firms needed time to adjust their technology, while investors waited for evidence of commercial progress.
Research by Michal Polasik of Nicolaus Copernicus University in Toruń and his coauthors points in the same direction, finding that the number of new payment startups across Europe rose after the directive was adopted. European payment fintechs raised close to 30 billion euros between 2018 and 2024, more than any other fintech category, and the technology press described a fintech boom. A study covering the 49 countries that had introduced open banking policies found that fintech venture investment increased by 50% after adoption. By the middle of 2025, more than 15 million people and small businesses in the United Kingdom were using services based on open banking, a figure equivalent to nearly one in three adults.
Why PSD2 Helped Entrants
PSD2 gave new entrants a legal right to use a resource controlled by incumbents: customer payment data. Because access was free and based on the customer’s consent, a small company did not have to negotiate separately with every bank.
Access also depended on trust. People may hesitate to share financial data with an unfamiliar company. A survey of Dutch consumers found that they were most willing to share payment data with their own bank. Their willingness to share with other firms increased with trust. Licensing and common security rules gave customers and investors some assurance that new providers met a standard.
Shared technology reduced another barrier. In Spain, one common platform served as the main connection point between banks and fintechs. A fintech could therefore reach many banks through one technical link.
GDPR produced a different competitive effect. The privacy law applies to every company that handles personal data, but a small firm has fewer resources to meet its obligations. Research from the National Bureau of Economic Research found that about a third of the apps in a large mobile app store disappeared after GDPR, while the entry of new apps fell by half. Venture investment in European technology firms declined. Websites also dropped smaller technology suppliers, which increased the market share of the largest suppliers.
Both laws concern personal data, but they affect competition in different ways. PSD2 gave new entrants access to a resource they could not create themselves. GDPR imposed a fixed cost, which weighs more heavily on a small firm. The contrast shows how the design of a regulation can determine whether it helps new firms compete or reinforces the standing of established companies.
Who Gets Access, and on What Terms?
The United States is now confronting a similar choice. A federal rule establishing a right comparable to the European one was approved in 2024, blocked in court in 2025 and is being rewritten. One unresolved question is whether banks may charge for data access, which the original rule prohibited. During the revision, access depends on private contracts between banks and the companies that connect fintechs to bank accounts. Those contracts allow the incumbent to set the price.
In the European Union, lawmakers reached a political agreement in November 2025 on an update to the payment rules. The agreement includes more detailed requirements for the connections that banks must provide. A separate proposal known as FIDA would extend data sharing to savings, loans, investments, insurance and pensions. Negotiators have debated whether the largest technology platforms should receive this data, since access could reinforce companies that already dominate other markets.
The policy is also moving beyond finance. Since September 2025, the EU Data Act has allowed owners of connected products, from cars to factory machines, to share the data those products generate with a repair shop or service provider of their choice.
Each case requires authorities to identify a resource controlled by an incumbent and decide who may use it, at what price and under which safeguards.
Lessons for Policymakers and Businesses
Policymakers need to identify the bottleneck: the resource that every competitor needs and the incumbent controls. Giving new entrants access can open the market, while customer consent keeps the decision with the person whose data is being shared. But access alone is not enough. Trust also matters. Licenses and security requirements come at a cost, but under PSD2 they also gave customers and investors a reason to deal with unfamiliar firms. Common technical standards lowered the cost of connecting to several banks. Assessing the impact of these rules takes time. The benefits for Spanish fintechs became clearer one year after the law took effect, so a review in the first few months would have missed them. Authorities also need to examine who uses the new access, especially when large platforms qualify under rules designed to encourage entry.
A new entrant can prepare for the date when an access rule takes effect. In our study, payment fintechs grew through sales, indicating that customers were willing to buy the services they offered under the new rules. Investors followed with larger and more frequent funding rounds. Founders may therefore need more equity and more specialized staff as the market develops. Established firms must be prepared for legislation that ends their exclusive access to customers. Then they must decide whether to cooperate with new entrants or develop their own response. In our Spanish data, banks did not become more frequent investors in payment fintechs after PSD2. They remained cautious about financing firms that were becoming competitors.
Our study shows that new entrants became stronger after PSD2, but it does not establish whether customers paid less or switched providers more often. Theory also points to a possible cost: when data sharing becomes common, a borrower who keeps information private may be treated as a higher risk.
A law like PSD2 gives competitors an opportunity to enter the market. The benefit to customers then depends on the services those competitors provide. As open banking spreads from payments to the rest of finance, the next step is to examine what this means for customers. Opening a market is only part of the story; the other is whether customers are better off.
© IE Insights.
