For much of digital finance, consent has been treated as an event. A customer accepts terms, authorises a connection, permits data access or signs a mandate. The system records the decision and the service continues.
That model is beginning to look too static for a financial system in which data is shared continuously, payments can recur within agreed parameters and artificial-intelligence systems may act on a customer’s behalf. The more persistent the relationship between a financial service and a customer’s data or money, the more important it becomes for permission itself to remain visible and controllable over time.
This is creating an emerging design principle that can be described as continuous consent. The phrase is not a single regulatory term with one global definition. It is an analytical description of financial services in which customers can see what they have authorised, understand the scope and duration of that authority, change or revoke it, and sometimes set conditions that govern future activity.
Open banking has already made consent operational
The clearest evidence comes from open banking. UK standards do not treat account-data permission as a forgotten checkbox. The latest Open Banking Customer Experience Guidelines require or recommend dashboards through which customers can view and revoke ongoing connections. Account-information service providers must provide dashboards allowing users to manage consents across connected banks, while payment and confirmation-of-funds services have their own consent-management journeys.
The distinction is important because open banking is now operating at substantial scale. Open Banking Limited reported that the UK ecosystem had passed one billion payments and 100 billion API calls by 30 July 2026. In June alone, the system processed 2.81 billion API calls and 40.16 million payments. July API performance data show almost 2.94 billion successful calls with average unweighted availability of 99.76%. The permission architecture behind those connections is therefore no longer a niche feature; it supports recurring financial activity at infrastructure scale.
Consent is shifting from “yes or no” to “what, why and for how long”
A useful way to understand the shift is to separate initial authorisation from continuing control. The latest UK open-banking guidance says explicit consent for account-information access should make clear why data is needed, what will be shared and for how long. Dashboards are then used to show active connections and make revocation possible. Open Banking’s consent-management guidance describes these tools as central to customer control over data sharing.
Variable recurring payments push the idea further. A customer can authorise payments to occur repeatedly within defined conditions rather than approve every payment individually. The current VRP consent-dashboard guidance requires payment-initiation providers to give users a facility to view and revoke relevant consents and to make the conditions of those permissions transparent.
The result is permission that behaves less like a signature on a document and more like a configurable control.
Open finance expands the number of permissions that may need managing
Open finance extends the concept beyond payment accounts. The Bank for International Settlements’ March 2026 paper on international open-finance experience describes open finance as customer-permissioned data sharing that can reduce information asymmetries, support competition and improve access to financial services. It also stresses the importance of standardised protocols, interoperability and robust regulatory frameworks.
The UK Financial Conduct Authority’s April 2026 open-finance roadmap sets a path toward broader delivery between 2026 and 2030, beginning with areas such as SME lending and mortgages. The FCA explicitly frames open finance around giving consumers and businesses greater control over their financial data.
As the number of connected products expands—from current accounts to savings, mortgages, investments, insurance and pensions—the customer can accumulate a web of permissions. That makes one-off disclosure progressively less useful. A customer needs to know not just what was agreed years ago, but what remains active now.
AI agents make the authority question harder
The next stage could involve software acting on those permissions. The FCA’s July 2026 Mills Review of AI in retail financial services found consumer appetite for agentic AI: research commissioned by the regulator suggested that one-fifth of UK adults would be likely to use AI capable of acting autonomously within pre-set goals.
That creates a qualitatively different consent problem. A customer may not simply authorise a single payment or one data transfer. They may instruct an agent to keep savings above a threshold, pay certain bills, move surplus cash, search for better rates or initiate transactions within defined limits.
In that environment, authority has several dimensions: what the agent may do, which accounts it may access, what data it may use, how much money it may move, when human approval is required and how quickly the customer can terminate the arrangement. Continuous consent becomes closely linked to machine identity and delegated authority.
Revocation is becoming as important as authorisation
A permission system is credible only if users can withdraw authority in practice. Open Banking’s revocation guidance says dashboards should be easy to find and should not place barriers in the way of customers seeking to revoke access or consent.
Data-protection law reinforces the broader principle. The UK Information Commissioner’s Office states that where an organisation relies on consent to use personal information, an individual can withdraw that consent and the organisation must stop the relevant processing. Its July 2026 guidance on the right to object was updated following changes under the Data (Use and Access) Act.
Financial services add an operational complication: withdrawing permission can change the product itself. Revoking a data connection may stop an affordability tool from working. Ending a recurring-payment consent can interrupt a service. Cancelling an agent’s authority may require pending actions to be stopped safely. Good design therefore has to explain consequences as clearly as it presents the revocation button.
Continuous consent could become a competitive feature
It is tempting to view consent management purely as compliance. But customer control can also affect product trust.
Financial services increasingly compete on how much data customers are willing to share and how much authority they are willing to delegate. A lender may obtain richer cash-flow information if a small business maintains an open-finance connection. A wealth platform may provide better consolidated advice if a customer permits access to multiple accounts. An AI assistant may become more useful if it can act rather than merely recommend.
Each gain in usefulness asks the customer to grant more persistent access. Firms that make those permissions understandable and reversible may therefore have an advantage over firms that bury them inside legal text.
The design challenge is avoiding consent fatigue
There is an obvious counterargument. More consent screens do not necessarily produce more meaningful consent. Customers already encounter extensive privacy notices, cookie controls, payment confirmations and security prompts. Adding repeated approval requests can create fatigue and encourage automatic clicking.
Source: globalbankingandfinance.com
