The mandate. Why the US conversational- finance surface does not translate to Europe.

📊 Full opportunity report: The mandate. Why the US conversational- finance surface does not translate to Europe. on ThorstenMeyerAI.com — validation score, market gap, and execution plan.

TL;DR

The US rolled out a permissionless, API-based personal-finance surface in May 2026, while Europe’s regulatory framework requires licensed, consent-based access. This fundamental difference alters market structure, entry costs, and who can build these services.

On May 15, 2026, OpenAI launched its personal-finance surface in the United States, built on a permissionless, API-driven model that allows companies to access user financial data without prior licensing or regulation. In contrast, Europe’s regulatory environment mandates licensing and consent, making the same surface a complex licensing project rather than a simple product launch. This divergence fundamentally changes how financial data services are built and who can operate them. The unbundling of the budget app.

The US approach, exemplified by OpenAI’s launch, relies on a permissionless ecosystem where companies connect accounts through APIs like Plaid without needing prior regulatory approval. This model treats data access as a product feature, with compliance as an afterthought.

In Europe, however, the regulatory landscape is structured around strict mandates. The PSD2 framework, established in 2018, and its successor PSD3/PSR, set rules for licensed third-party providers to access bank data via regulated APIs. The upcoming FIDA regulation extends open banking to investments, pensions, and loans, creating a new license category, the Financial Information Service Provider, with operational dates expected around 2029-2030.

Additionally, the EU AI Act classifies AI systems used in credit scoring as high-risk, supervised by financial regulators like BaFin, adding another layer of regulation. These overlapping regimes mean that European firms must navigate licensing, consent dashboards, API conformity, and AI classification—an architecture that is fundamentally different from the US permissionless model.

The Mandate — Thorsten Meyer AI
MANDATE
● DISPATCH / MAY 2026
THORSTEN MEYER AI · AGENTIC COMMERCE · § 03
AGENTIC COMMERCE · 03
EUROPE / MANDATE
Essay · Regulatory-Architecture Reading · 2026-05-26

The mandate.
Why the US conversational-
finance surface does not
translate to Europe.

In the US, account access is a product you buy and consent is a button you tap. In Europe, both are mandates you are licensed and supervised to fulfill.
The US surface shipped permissionlessly — connect via Plaid, 12,000+ institutions, read-only, no license. That rollout does not translate. In Europe every layer is a mandate. The foundation: PSD2 → PSD3/PSR (provisional agreement Nov 27 2025) makes account access a licensed, API-quality-supervised activity under a directly-applicable rulebook. The expansion: FIDA extends mandated access to investments, pensions, insurance, mortgages under a new FISP license — operational ~2029-2030, with a contested data-access fee at its core. The overlay: the EU AI Act classifies credit-scoring AI as high-risk (full obligations Aug 2 2026), supervised not by a tech regulator but by financial supervisors like BaFin. The structural argument: the US surface is built on a permissionless private substrate, and Europe has no permissionless substrate — it has a mandate at every layer. In the US compliance is an afterthought. In Europe, compliance is the architecture, and the conversational experience is the thin layer on top.
3
Overlapping mandates — payments,
data, AI — vs zero in the US build
7%
Of global turnover · the EU AI Act
maximum penalty
2029-30
When FIDA — the full-picture data
mandate — is likely operational
0
Permissionless routes to a European’s
bank data · it is a licensed activity
THE MANDATE· US SHIPPED PERMISSIONLESSLY · PLAID· EUROPE HAS A MANDATE AT EVERY LAYER· PSD2 MADE ACCESS A LICENSED ACTIVITY· PSD3/PSR · PROVISIONAL AGREEMENT NOV 27 2025· PSR DIRECTLY APPLICABLE ACROSS 27 STATES· MANDATORY API QUALITY · NO SCREEN-SCRAPING· FIDA · NEW FISP LICENSE· OPEN FINANCE · INVESTMENTS PENSIONS INSURANCE· DATA-ACCESS FEE THE CONTESTED CORE· EU AI ACT · CREDIT SCORING HIGH-RISK· FULL OBLIGATIONS AUG 2 2026· SUPERVISED BY BAFIN, NOT A TECH REGULATOR· CONSENT IS A DASHBOARD, NOT A BUTTON· COMPLIANCE IS THE ARCHITECTURE· THE MANDATE FAVORS THE LICENSED INCUMBENT· IN EUROPE YOU LICENSE A FINANCE SURFACE· THE MANDATE· US SHIPPED PERMISSIONLESSLY · PLAID· EUROPE HAS A MANDATE AT EVERY LAYER· PSD2 MADE ACCESS A LICENSED ACTIVITY· PSD3/PSR · PROVISIONAL AGREEMENT NOV 27 2025· PSR DIRECTLY APPLICABLE ACROSS 27 STATES· MANDATORY API QUALITY · NO SCREEN-SCRAPING· FIDA · NEW FISP LICENSE· OPEN FINANCE · INVESTMENTS PENSIONS INSURANCE· DATA-ACCESS FEE THE CONTESTED CORE· EU AI ACT · CREDIT SCORING HIGH-RISK· FULL OBLIGATIONS AUG 2 2026· SUPERVISED BY BAFIN, NOT A TECH REGULATOR· CONSENT IS A DASHBOARD, NOT A BUTTON· COMPLIANCE IS THE ARCHITECTURE· THE MANDATE FAVORS THE LICENSED INCUMBENT· IN EUROPE YOU LICENSE A FINANCE SURFACE·
FIG. 01 — THE SUBSTRATE · PRIVATE PRODUCT VS PUBLIC MANDATE
The US built account access privately and permissionlessly · Europe built it as public mandate
One architectural difference at the foundation propagates through the entire stack
United States
A product you buy
  • Access built by private aggregators — Plaid, Yodlee, MX, Finicity
  • No banking license required to read bank data
  • Read-only design sidesteps money-transmission rules
  • No single federal open-banking statute · the surface ships as a product
European Union
A mandate you fulfill
  • Access is a licensed activity — AISP / PISP under PSD2
  • Regulator authorization required; no permissionless route
  • Explicit, revocable, SCA-governed consent regime
  • A directly-applicable rulebook (PSR) · the surface must be licensed
The US surface shipped because the account-access layer it needed was already built, privately and permissionlessly, by Plaid — and because a read-only design kept it clear of the activities that trigger heavy regulation. That is the precise feature Europe does not share. Reading a European’s bank data without the right license is not a product — it is an unauthorized activity. The very first layer of the US build, the permissionless connect, is in Europe a regulatory authorization.
FIG. 02 — THE THREE-MANDATE STACK · WHAT THE SURFACE MUST SATISFY IN EUROPE
Payments, data, and AI — three overlapping regimes, all enforced by financial regulators
The US surface faced none of these at launch; the European surface faces all three at once
PSD3 / PSRPayments mandate
Account access is a licensed activity (AISP/PISP). PSR directly applicable across 27 states. Mandatory API quality, screen-scraping eliminated, IBAN-name checks, expanded fraud liability.
FIDAData mandate
Extends mandated access to investments, pensions, insurance, mortgages, loans under a new FISP license. Standardized APIs + consent dashboards. A contested data-access fee may make aggregation cost money.
EU AI ActAI mandate
Credit scoring + creditworthiness = high-risk (Annex III). Conformity assessment, documentation, human oversight. Supervised by financial regulators (BaFin, CSSF). Fines up to 7% of global turnover.
A finance surface in Europe must be licensed for payment-data access (or partner with someone who is), prepare for a FISP license to aggregate the full financial picture, and classify itself under the AI Act — where the most commercially attractive features (“what loan can I get?”) sit closest to the high-risk line. The AI that is “just a chatbot” in the US is, in Europe, a regulated system whose classification depends on exactly how useful it tries to be.
FIG. 03 — THE STAGGERED TIMELINE · A MOVING REGULATORY TARGET
The mandate is not one event but a sequence — and the staggering is a filter
The firms that win architect for the end-state mandate, not the current one
Aug 2025
EU AI Act · GPAI obligations live · the frontier models that power a finance surface already carry systemic-risk obligations
Live
Nov 27 2025
PSD3/PSR provisional agreement · Parliament and Council reach political agreement; final texts expected in the Official Journal in 2026
Agreed
Aug 2 2026
EU AI Act · high-risk obligations land · credit-scoring / creditworthiness Annex III duties apply (subject to Digital Omnibus)
Operative
2027
PSD3/PSR core obligations · directly-applicable conduct rules land across the year after the transition
Landing
~2029-2030
FIDA operational · the full-picture data mandate and FISP license arrive, in staggered sector-by-sector “waves”
Forming
Building for PSD3 today while FIDA and the AI Act high-risk regime are still settling means building for a target that is still moving — which favors firms with the regulatory-intelligence capacity to track it and the patience to build for 2030 rather than ship for 2026. The staggered timeline is itself a filter: it selects for regulatory endurance over launch speed.
FIG. 04 — THE CONSENT ARCHITECTURE · WHAT REPLACES THE “CONNECT” BUTTON
The single most optimized moment of the US product is the single most regulated moment of the European one
The European surface cannot inherit the US onboarding · it must build a different, regulated core
The US default — collect broadly, use later — is the European violation. The consent dashboard, the granular permission model, the revocation flows, the purpose-binding, the audit trail are not features bolted onto the conversational experience; they are the regulated core that the experience sits on top of. The European surface is, by regulation, higher-friction at exactly the moment the US surface optimized for frictionlessness.
FIG. 05 — WHO BUILDS THE EUROPEAN SURFACE · THE REDISTRIBUTION OF ADVANTAGE
The mandate does not just slow the US surface — it changes who wins
Advantage moves from permissionless speed to licensed position
Disadvantaged
The US winners
A frontier lab + permissionless aggregator. Their core competency — permissionless speed and reach — is exactly what the mandate removes. No AISP/FISP license, no BaFin relationship. Arrive needing a license stack they don’t have.
Advantaged
Licensed EU fintechs
Already authorized AISPs/PISPs, PSD3-compliant API fleets, consent-native. “The lab + a licensed European partner” — and the partner holds more leverage than Plaid, because the license is scarcer than an API.
Advantaged
Incumbent banks
Already hold the data, licenses, consent relationships, supervisory standing. The incumbent disintermediated in the US thesis is, in Europe, structurally protected — the mandate that gates the challenger does not gate the bank.
In the US, the advantage went to whoever integrated the permissionless layer fastest and built the best surface on top. In Europe, it goes to whoever holds the licenses, the supervisory relationships, and the consent architecture. The mandate redistributes the advantage from the permissionless aggregator-and-lab toward the licensed incumbent-and-specialist — and Europe’s regulation is, among other things, an incumbent-protection architecture, whether or not that is its intent.
The architecture diverges at the foundation: the American surface treats account access as a product you buy and consent as a button you tap, while Europe treats both as mandates you are licensed and supervised to fulfill. In the US, you ship a finance surface. In Europe, you license one.
Thorsten Meyer · The Mandate · Agentic Commerce 03

Impact of Regulatory Architecture on Market Dynamics

This fundamental difference in architecture means that European market entrants must obtain licenses and build consent-driven platforms, raising entry costs and favoring incumbents or licensed specialists. The US model, by contrast, allows permissionless innovation and rapid deployment but may lack the same regulatory oversight.

For consumers, this could mean slower adoption or more concentrated market power among established players in Europe. It also shifts the competitive landscape, potentially limiting new entrants but increasing data privacy and security through mandated consent and licensing regimes.

Amazon

API-based personal finance data aggregator

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Divergent Regulatory Foundations in US and Europe

The US’s permissionless approach stems from a privately built open banking layer, exemplified by companies like Plaid, which operate without direct regulation. Conversely, Europe’s open banking system is rooted in public regulation, notably PSD2, which requires licensed providers and consent-based access. The upcoming FIDA regulation and the AI Act further reinforce a mandate-first architecture, contrasting sharply with the US’s permissionless substrate.

This difference reflects broader regulatory philosophies: the US prioritizes innovation and rapid deployment, while Europe emphasizes control, privacy, and consumer protection through licensing and consent regimes.

“The structural argument I want to make: the US conversational-finance surface is a product built on a permissionless substrate, and Europe does not have a permissionless substrate — it has a mandate at every layer.”

— Thorsten Meyer

Amazon

European open banking compliance software

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Uncertainties in European Implementation Timeline

While the US launch is confirmed, the precise operational dates for the European open-finance and AI regulations remain uncertain. FIDA is still in trilogue, with expected implementation around 2029-2030, but delays or regulatory adjustments could alter this timeline.

It is also unclear how European firms will adapt existing platforms to meet the complex licensing, consent, and AI classification requirements, and whether new entrants will emerge under this architecture.

Amazon

PSD2 regulated banking API tools

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Next Steps in European Regulatory Rollout

Regulators are expected to finalize the FIDA and AI Act texts in the coming months, with implementation phases beginning around 2029-2030. European firms are preparing to build licensed, consent-based platforms, which may reshape the competitive landscape.

Meanwhile, US firms will continue to expand permissionless services, potentially exploring European markets under the new regulatory constraints, which could influence future product design and compliance strategies.

Amazon

AI credit scoring software high risk

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Key Questions

Why does the US launch not face the same regulatory hurdles as Europe’s?

The US approach relies on a permissionless, API-based ecosystem where companies can access data without prior licensing or regulation, unlike Europe’s mandated, license-based regime that requires compliance with PSD2, FIDA, and AI regulations.

How will the European approach affect new entrants?

The licensing and consent requirements increase entry costs and complexity, favoring established firms and licensed specialists over permissionless aggregators, potentially slowing innovation but increasing consumer protections.

When will the European open-finance and AI regulations become fully operational?

Operational dates are expected around 2029-2030, but exact timelines depend on the finalization of regulatory texts and implementation phases.

Will the European regulatory architecture lead to better consumer outcomes?

This remains an open question. The architecture emphasizes privacy and control but may result in slower innovation and less market dynamism compared to the US permissionless model.

What are the main differences between US and European financial data regulation?

The US favors permissionless innovation with minimal regulatory barriers, while Europe enforces a mandate-based, licensed approach emphasizing consent, compliance, and oversight.

Source: ThorstenMeyerAI.com

This content is for general information only and is not financial, tax or legal advice. Consult a qualified professional for decisions about your money.
You May Also Like

The Defender’s Window Is Closing Faster Than Anyone Is Counting

Recent developments reveal AI models are rapidly surpassing defensive limits, raising urgent questions about cybersecurity and policy responses.

Week Three — Foundation model vs Brownian motion. Kronos on five-minute BTC.

Kronos, a foundation model, was tested against Brownian motion for 5-minute BTC predictions. Results show no significant advantage, raising questions about modern models.

The bank account in the chat. How personal finance became an agentic on-ramp.

OpenAI launched a preview enabling ChatGPT Pro users to connect bank accounts for real-time personal finance insights, signaling a shift toward agentic finance.

The Compute Concentration Audit: When Sovereign Wealth Funds Notice Three Companies Own the Frontier

Global regulators are conducting a structural audit of the cloud infrastructure market, focusing on three dominant providers and their impact on AI development.