For much of digital finance, consent has been treated as an event. A customer accepts terms, authorises a connection, permits data access or signs a mandate. The system records the decision and the service continues.
That model is beginning to look too static for a financial system in which data is shared continuously, payments can recur within agreed parameters and artificial-intelligence systems may act on a customer’s behalf. The more persistent the relationship between a financial service and a customer’s data or money, the more important it becomes for permission itself to remain visible and controllable over time.
This is creating an emerging design principle that can be described as continuous consent. The phrase is not a single regulatory term with one global definition. It is an analytical description of financial services in which customers can see what they have authorised, understand the scope and duration of that authority, change or revoke it, and sometimes set conditions that govern future activity.
Open banking has already made consent operational
The clearest evidence comes from open banking. UK standards do not treat account-data permission as a forgotten checkbox. The latest Open Banking Customer Experience Guidelines require or recommend dashboards through which customers can view and revoke ongoing connections. Account-information service providers must provide dashboards allowing users to manage consents across connected banks, while payment and confirmation-of-funds services have their own consent-management journeys.
The distinction is important because open banking is now operating at substantial scale. Open Banking Limited reported that the UK ecosystem had passed one billion payments and 100 billion API calls by 30 July 2026. In June alone, the system processed 2.81 billion API calls and 40.16 million payments. July API performance data show almost 2.94 billion successful calls with average unweighted availability of 99.76%. The permission architecture behind those connections is therefore no longer a niche feature; it supports recurring financial activity at infrastructure scale.
Consent is shifting from “yes or no” to “what, why and for how long”
A useful way to understand the shift is to separate initial authorisation from continuing control. The latest UK open-banking guidance says explicit consent for account-information access should make clear why data is needed, what will be shared and for how long. Dashboards are then used to show active connections and make revocation possible. Open Banking’s consent-management guidance describes these tools as central to customer control over data sharing.
Variable recurring payments push the idea further. A customer can authorise payments to occur repeatedly within defined conditions rather than approve every payment individually. The current VRP consent-dashboard guidance requires payment-initiation providers to give users a facility to view and revoke relevant consents and to make the conditions of those permissions transparent.
The result is permission that behaves less like a signature on a document and more like a configurable control.
Open finance expands the number of permissions that may need managing
Open finance extends the concept beyond payment accounts. The Bank for International Settlements’ March 2026 paper on international open-finance experience describes open finance as customer-permissioned data sharing that can reduce information asymmetries, support competition and improve access to financial services. It also stresses the importance of standardised protocols, interoperability and robust regulatory frameworks.
The UK Financial Conduct Authority’s April 2026 open-finance roadmap sets a path toward broader delivery between 2026 and 2030, beginning with areas such as SME lending and mortgages. The FCA explicitly frames open finance around giving consumers and businesses greater control over their financial data.
As the number of connected products expands—from current accounts to savings, mortgages, investments, insurance and pensions—the customer can accumulate a web of permissions. That makes one-off disclosure progressively less useful. A customer needs to know not just what was agreed years ago, but what remains active now.
AI agents make the authority question harder
The next stage could involve software acting on those permissions. The FCA’s July 2026 Mills Review of AI in retail financial services found consumer appetite for agentic AI: research commissioned by the regulator suggested that one-fifth of UK adults would be likely to use AI capable of acting autonomously within pre-set goals.
That creates a qualitatively different consent problem. A customer may not simply authorise a single payment or one data transfer. They may instruct an agent to keep savings above a threshold, pay certain bills, move surplus cash, search for better rates or initiate transactions within defined limits.
In that environment, authority has several dimensions: what the agent may do, which accounts it may access, what data it may use, how much money it may move, when human approval is required and how quickly the customer can terminate the arrangement. Continuous consent becomes closely linked to machine identity and delegated authority.
Revocation is becoming as important as authorisation
A permission system is credible only if users can withdraw authority in practice. Open Banking’s revocation guidance says dashboards should be easy to find and should not place barriers in the way of customers seeking to revoke access or consent.
Data-protection law reinforces the broader principle. The UK Information Commissioner’s Office states that where an organisation relies on consent to use personal information, an individual can withdraw that consent and the organisation must stop the relevant processing. Its July 2026 guidance on the right to object was updated following changes under the Data (Use and Access) Act.
Financial services add an operational complication: withdrawing permission can change the product itself. Revoking a data connection may stop an affordability tool from working. Ending a recurring-payment consent can interrupt a service. Cancelling an agent’s authority may require pending actions to be stopped safely. Good design therefore has to explain consequences as clearly as it presents the revocation button.
Continuous consent could become a competitive feature
It is tempting to view consent management purely as compliance. But customer control can also affect product trust.
Financial services increasingly compete on how much data customers are willing to share and how much authority they are willing to delegate. A lender may obtain richer cash-flow information if a small business maintains an open-finance connection. A wealth platform may provide better consolidated advice if a customer permits access to multiple accounts. An AI assistant may become more useful if it can act rather than merely recommend.
Each gain in usefulness asks the customer to grant more persistent access. Firms that make those permissions understandable and reversible may therefore have an advantage over firms that bury them inside legal text.
The design challenge is avoiding consent fatigue
There is an obvious counterargument. More consent screens do not necessarily produce more meaningful consent. Customers already encounter extensive privacy notices, cookie controls, payment confirmations and security prompts. Adding repeated approval requests can create fatigue and encourage automatic clicking.
Continuous consent should therefore not mean continuous interruption. The stronger model is persistent visibility with proportionate intervention: the customer can inspect active permissions at any time, receives clear warnings when scope changes or authority becomes unusually broad, and is asked to re-authorise when the risk justifies it.
This is especially important for vulnerable consumers. A system that is technically transparent but cognitively difficult can still produce poor outcomes. Permission dashboards need plain language, clear duration, understandable limits and an obvious distinction between viewing data, moving money and allowing autonomous action.
Consent records could become part of financial infrastructure
As permissions become more dynamic, firms will need stronger records of what was authorised and when. That has implications for audit, complaints, fraud investigations and liability.
If a disputed payment was initiated by an AI agent, the relevant question may not be simply whether the customer logged in. It may be whether the agent had valid authority for that type of transaction, within that amount, at that time. If data was used to price a product, firms may need to show whether access was current and whether downstream sharing remained permitted.
This suggests a future in which consent becomes machine-readable infrastructure: timestamped, scoped, revocable and associated with identifiable users, firms and software agents. That is an inference, not a completed industry standard. But the building blocks are already visible in open banking’s consent objects, dashboards and recurring-payment frameworks.
Implications for banks, fintechs and regulators
Banks may need to treat consent management as a customer-experience layer rather than a compliance back office. As data portability expands, account providers could become the place where customers monitor which third parties can see or act on their financial information.
Fintechs face the opposite challenge: their value often depends on access to data held elsewhere. Clear permissioning can strengthen trust, but revocation makes customer relevance more important. A service that stops delivering visible value may lose access as easily as a subscription can be cancelled.
Regulators will have to balance control with usability. Too little transparency risks opaque delegation. Too much friction can suppress beneficial data sharing and push customers toward workarounds. Interoperable consent standards may therefore become as important as interoperable data standards.
From permission at onboarding to permission throughout the relationship
Digital finance is becoming more persistent. Data feeds remain connected. Payments recur. Algorithms monitor activity continuously. AI agents may soon act inside boundaries that customers define.
A static permission model was built for a more static product. The emerging alternative is not endless confirmation prompts, but authority that remains legible throughout the life of the service.
That changes consent from a legal moment into a product capability. The financial institutions that manage it well may not simply satisfy regulators. They may make customers more comfortable sharing the data and authority on which the next generation of financial services depends.
References
1. Open Banking Limited — One billion payments and 100 billion API calls — 30 July 2026 ecosystem milestone and June metrics.
2. Open Banking Limited — API performance — July 2026 API availability and call volumes.
3. Open Banking Standards — Dashboards — Latest consent and access-dashboard guidance.
4. Open Banking Standards — Consent & Data Sharing Management — Consent-management customer journeys.
5. Open Banking Standards — AIS Consent — Purpose, data and duration requirements.
6. Open Banking Standards — VRP Consent Dashboard — Viewing and revoking variable recurring-payment consent.
7. Open Banking Standards — Revocation — Guidance on revoking access and consent.
8. BIS Papers No 168 — Opening doors to open finance — 30 March 2026 international evidence.
9. FCA — Open finance roadmap — 14 April 2026 roadmap to 2030.
10. FCA — Mills Review on AI in retail financial services — 6 July 2026 agentic-AI consumer research.
11. ICO — The right to object to the use of your information — Updated 23 July 2026, including withdrawal of consent.