EU Open Banking: Aggregators Bypass eIDAS Certificate Costs for Developers

This review examines two paths for accessing EU Open Banking APIs, contrasting the direct eIDAS certificate approach with the use of aggregator services to understand their respective costs, timeframes, and suitability for different developer needs.

The Answer Up Front

For indie developers, small businesses, or personal finance management (PFM) app builders needing access to EU bank data, an aggregator service like open-banking.io is the clear choice. This path bypasses the prohibitive EUR 2,000–10,000 per year eIDAS certificate costs and the weeks of regulatory overhead, offering API access in minutes. Large, regulated fintechs with high transaction volumes or enterprise treasuries requiring direct control and minimal intermediaries will still opt for direct eIDAS integration, as the cost and complexity are justified by their scale and regulatory posture.

Methodology

This v0 review draws on the founder John Frandsen's published claims at dev.to/johnfrandsen/open-banking-without-an-eidas-certificate-a-practical-developers-guide-2026-1j6, accessed 2026-07-22. The review covers the two distinct paths for EU Open Banking API access as described by the founder, including claimed costs, timeframes, and target users. The source provides a detailed comparison, including specific financial figures and regulatory requirements for direct access, and outlines the architectural approach of certificate-free aggregators. It also includes runnable code examples using open-banking.io's API. What is not covered in this v0 review includes independent benchmarks of aggregator performance, long-term workflow integration, actual API reliability across diverse banks, or edge case handling. Independent verification of the founder's claims regarding cost savings and time-to-first-call for aggregators versus direct eIDAS integration is pending. Update cadence: re-tested when claims diverge from observed behavior.

What It Does

The eIDAS Certificate Gate

Accessing European bank Open Banking endpoints directly, for tasks such as reading account balances programmatically, typically requires a mutual TLS certificate, specifically a Qualified Website Authentication Certificate (QWAC) and often a Qualified Electronic Seal Certificate (QSeal) for request signing. This requirement, mandated by PSD2 regulations, acts as a significant barrier for smaller entities. The founder reports these certificates cost roughly EUR 2,000–10,000 per year, involve weeks of paperwork, and necessitate a registered legal entity. This HTTP 401 Unauthorized error with a mutual TLS certificate required message is the common symptom of this regulatory gate.

Two Paths to EU Bank Data

The guide outlines two distinct approaches for accessing PSD2-compliant Account Information Service (AIS) APIs:

• Path A — Direct (You hold the eIDAS certificate): This involves applying for QWAC and QSeal certificates from a qualified trust service provider, registering as a Third Party Provider (TPP) with national regulators, and onboarding with each bank's developer portal. This path requires direct calls to bank endpoints over mutual TLS. The founder claims this approach costs EUR 2k–10k/year per certificate plus legal/regulatory overhead, with a time to first call of 4–12 weeks. Coverage is bank-by-bank, making it suitable for regulated fintechs, enterprise treasuries, or anyone needing to avoid data intermediaries.

• Path B — Aggregator (The aggregator holds the certificate): This path involves signing up with an AIS aggregator, obtaining an API key, and calling their unified API. The aggregator manages the eIDAS certificates, handles diverse bank integrations (e.g., Berlin Group, STET, UK Open Banking, Polish API standards), and provides a consistent REST interface. The founder claims this approach offers free tiers for small projects and usage-based pricing at scale, with a time to first call in minutes. It provides coverage across hundreds or thousands of banks in the EU/EEA through a single integration, making it ideal for indie developers, SMBs, PFM apps, and self-hosters who prioritize shipping over regulatory complexity.

What's Interesting / What's Not

The most interesting aspect of this analysis is the clear articulation of the economic and operational bypass that aggregators provide for EU Open Banking. The founder, John Frandsen of open-banking.io, explicitly states that the underlying architecture is common to all certificate-free aggregators, lending credibility to the general solution, even while using his own product for examples. The cost differential alone (EUR 2k-10k/year for direct vs. free/usage-based for aggregators) is a critical factor for early-stage projects or smaller businesses. The time-to-market difference, from weeks to minutes, is equally compelling for rapid iteration and deployment.

What's less interesting, though necessary, is the continued complexity of the underlying PSD2 landscape. While aggregators abstract away the certificate management and bank-specific API quirks (Berlin Group, STET, etc.), the fact that these variations exist underscores the ongoing fragmentation in the European financial API ecosystem. The aggregator model is a pragmatic solution to this fragmentation, but it doesn't eliminate the root cause. For developers, the value proposition is clear: trade some direct control for significantly reduced friction and cost. The trade-off is that you introduce a third-party intermediary, which may not be acceptable for all use cases, particularly those with stringent data sovereignty or security requirements that mandate direct bank interaction.

Pricing

• Direct eIDAS Certificate Path: EUR 2,000–10,000 per year per certificate, plus legal and regulatory overhead. This cost is for the certificates themselves, not including internal development or compliance staff.
• Aggregator Path (e.g., open-banking.io): Free tiers are available for small projects. Pricing scales with usage for larger applications.

Pricing snapshot date: 2026-07-22

Verdict

For any developer or small entity looking to integrate with EU Open Banking APIs, the aggregator path is the unequivocally superior choice. The direct eIDAS certificate route presents an insurmountable barrier of cost and time for most, making it viable only for well-funded, regulated fintechs or large enterprises where the volume and specific regulatory needs justify the significant investment. Aggregators democratize access, transforming a weeks-long, multi-thousand-euro regulatory hurdle into a minutes-long API integration. This approach allows smaller players to focus on product development rather than regulatory compliance, accelerating innovation in the EU financial ecosystem.

What We'd Test Next

Our next steps would involve independent verification of aggregator performance and reliability. We would benchmark the actual latency and success rates of API calls through an aggregator across a diverse set of EU/EEA banks, comparing it to direct calls where feasible. We would also assess the consistency and completeness of data returned across different bank integrations, specifically looking for variations in data models or missing fields that might arise from the abstraction layer. Long-term stability, uptime, and the responsiveness of aggregator support would also be critical areas for evaluation, especially concerning how they handle breaking changes from underlying bank APIs.

The investor read

The market for Open Banking aggregators in the EU/EEA, exemplified by services like open-banking.io, signals a strong demand for 'regulatory plumbing as a service.' Similar to how Plaid streamlined US financial data access, these aggregators abstract away the complexity and cost of PSD2 compliance (e.g., eIDAS certificates, diverse bank API standards). This trend enables a broader ecosystem of fintech innovation by lowering the barrier to entry for smaller developers and businesses. Comparable tools include Tink and TrueLayer, which have achieved significant scale and funding by consolidating bank integrations. For open-banking.io to be highly investable, it would need to demonstrate superior bank coverage, robust API reliability, competitive pricing, and a clear path to differentiation beyond simply abstracting eIDAS. Niche bank support or a particularly developer-friendly experience could be key differentiators in a consolidating market. This also represents a deliberate small/bootstrapped play for founders who prioritize solving a specific pain point with a lean team.