Open Banking API Explorer + Rate Limit Simulator

Regulatory origin: UK OB was mandated by the Competition and Markets Authority (CMA) in 2017 and implemented by the OBIE. CFPB 1033 derives from Dodd-Frank §1033 and was finalized in October 2024, with compliance windows running through 2030.

Scope: UK OB covers accounts, payments, and confirmation of funds for CMA9 banks and any UK-regulated AISP/PISP. CFPB 1033 covers covered financial institutions holding consumer accounts — checking, savings, credit cards, and digital wallets — with depository institutions over $850B in assets first in scope (April 2026).

Authentication: UK OB mandates SCA under PSD2 — typically FAPI 1.0 with PAR and PKCE. CFPB 1033 requires OAuth 2.0 with standard PKCE and prohibits screen-scraping once compliant APIs are available.

Data portability: Both regimes grant consumers the right to share their data with authorized third parties. UK OB data is held for 90 days; CFPB 1033 access tokens expire per the consumer's authorization scope and duration.

Why rate limiting matters: Open Banking APIs enforce rate limits to protect infrastructure and ensure fair use across all connected TPPs (Third Party Providers). Exceeding limits results in HTTP 429 responses, which can cascade into degraded user experience if your retry strategy is poorly designed.

UK Open Banking guidance: The OBIE recommends ASPSP APIs handle at least 50 requests per second across all TPPs, with individual TPPs typically limited to 300–500 requests per minute. Exact limits vary by institution. The Retry-After header must be respected.

CFPB 1033 / FDX guidance: The FDX standard recommends developer APIs support 60 requests/minute per client by default. The final rule requires providers not impose "unreasonable limitations" on data access, though specific numeric limits are institution-defined.

Retry strategies:

• Exponential Backoff: Wait time doubles with each retry (1s, 2s, 4s, 8s...). Standard best practice.
• Exponential + Jitter: Adds random variance to prevent thundering herd. Preferred in high-concurrency environments.
• Linear Backoff: Fixed wait interval between retries. Simple but can cause retry storms.
• Immediate Retry: No wait. Rarely appropriate — causes rapid 429 accumulation.

Always respect the Retry-After header if present. Cap your maximum retry count (typically 3–5 attempts) to avoid infinite loops.