Building a Secure Open Banking Ecosystem: Lessons in Fintech API Gateway Design
DOI:
https://doi.org/10.63282/3050-9246.IJETCSIT-V7I3P112Keywords:
Open Banking, Fintech API Gateway, Open Finance, FAPI, PSD3, PSR, FDX, Zero-Trust, Dpop, Mtls, SPIFFE, Transaction Risk Analysis, Opentelemetry, Policy as CodeAbstract
Fintech API gateways have become the load-bearing element of open banking and open finance: they terminate third-party traffic, enforce strong-customer-authentication rules, and translate external requests into core-banking operations. A widely-cited 2020 reference design documented a competent service-mesh-based gateway that combined Istio, Apache Camel, and generic OAuth 2.0. In the five years since, the regulatory and technical baseline has shifted materially: the OpenID Foundation has approved FAPI 2.0 as a final specification, the EU Parliament and Council have reached provisional agreement on PSD3 and the Payment Services Regulation, the United States CFPB has finalized the Section 1033 Personal Financial Data Rights rule and recognized the Financial Data Exchange (FDX) as a standard-setting body, and FDX has released API v6.4 with a new Consensus Standard Data Format. This paper reports lessons learned and presents a reference architecture for building a fintech API gateway against this contemporary baseline. We decompose the gateway into six cooperating planes — edge ingress, identity and tokens, policy and risk, transformation and routing, east-west mesh, and observability and attestation — each mapped to current specifications. We formalize a composite Transaction Risk Analysis function aligned to PSD3 Strong Customer Authentication exemption logic, present an analytical latency envelope for the critical path derived from published component benchmarks (with empirical validation identified as future work), and give a threat-coverage matrix over the OWASP API Security Top-10 (2023). The paper is intended as a practical design reference for fintech and banking platform teams modernizing their gateways for the 2026–2027 compliance horizon.
References
[1] E. Ünsal, S. Özdemir, B. Öztekin, and M. Çavuş, "Building a Fintech Ecosystem: Design and Development of a Fintech API Gateway," in Proc. 2020 Int. Conf. on Innovations in Intelligent Systems and Applications (ASYU), 2020. doi: 10.1109/ASYU50717.2020.9297273
[2] P. Hosseyni, R. Küsters, and T. Würtele, "Formal Security Analysis of the OpenID FAPI 2.0: Accompanying a Standardization Process," in Proc. 37th IEEE Computer Security Foundations Symposium (CSF), Jul. 2024. doi: 10.1109/CSF61375.2024.00002
[3] European Parliament and Council, "Provisional Political Agreement on Payment Services Directive 3 (PSD3) and Payment Services Regulation (PSR)," 27 Nov. 2025. [Online]. Available: https://www.europarl.europa.eu/
[4] OpenID Foundation, "FAPI 2.0 Security Profile — Final Specification," Feb. 2025. [Online]. Available: https://openid.net/specs/fapi-security-profile-2_0-final.html
[5] Financial Data Exchange, "FDX API Version 6.4 — Spring 2025 Release," Apr. 2025. [Online]. Available: https://financialdataexchange.org/fdx-feed/fdx-announces-spring-2025-api-release-fdx-api-version-6-4/
[6] Consumer Financial Protection Bureau, "Personal Financial Data Rights Rule (12 CFR Part 1033)," Final Rule, Oct. 22, 2024. [Online]. Available: https://www.consumerfinance.gov/rules-policy/final-rules/required-rulemaking-on-personal-financial-data-rights/
[7] SPIFFE Project (CNCF), "Secure Production Identity Framework for Everyone (SPIFFE) Specification," 2024. [Online]. Available: https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/
[8] Open Policy Agent (CNCF), "Policy-based Control for Cloud Native Environments," 2024. [Online]. Available: https://www.openpolicyagent.org/
[9] OpenAPI Initiative, "OpenAPI Specification v3.1.0," 2021. [Online]. Available: https://spec.openapis.org/oas/v3.1.0
[10] OpenTelemetry Project (CNCF), "OpenTelemetry Specification," 2024. [Online]. Available: https://opentelemetry.io/docs/specs/
[11] D. Fett, B. Campbell, J. Bradley, T. Lodderstedt, M. Jones, and D. Waite, "OAuth 2.0 Demonstrating Proof of Possession (DPoP)," RFC 9449, Sep. 2023. [Online]. Available: https://www.rfc-editor.org/rfc/rfc9449
[12] B. Campbell, J. Bradley, N. Sakimura, and T. Lodderstedt, "OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens," RFC 8705, Feb. 2020. [Online]. Available: https://www.rfc-editor.org/rfc/rfc8705
[13] OWASP Foundation, "OWASP API Security Top 10 — 2023 Edition," 2023. [Online]. Available: https://owasp.org/API-Security/editions/2023/en/0x00-header/
[14] R. Chandramouli, "Building Secure Microservices-based Applications Using Service-Mesh Architecture," NIST SP 800-204A, May 2020. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-204A
[15] K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," in Proc. 16th ACM Workshop on Artificial Intelligence and Security (AISec), 2023. doi: 10.1145/3605764.3623985
[16] D. J. Bernstein, N. Duif, T. Lange, P. Schwabe, and B.-Y. Yang, "High-speed high-security signatures," J. Cryptographic Engineering, vol. 2, no. 2, pp. 77–89, Sep. 2012.
[17] PCI Security Standards Council, "PCI Data Security Standard v4.0.1," Jun. 2024. [Online]. Available: https://www.pcisecuritystandards.org/
[18] B. Laurie, A. Langley, and E. Kasper, "Certificate Transparency," RFC 6962, Jun. 2013. [Online]. Available: https://www.rfc-editor.org/rfc/rfc6962
[19] EMVCo, "EMV 3-D Secure Protocol and Core Functions Specification, v2.3.1.1," Spec. Bulletins 279/280, Aug. 2025. [Online]. Available: https://www.emvco.com/emv-technologies/3-d-secure/
[20] OpenSSF, "Supply-chain Levels for Software Artifacts (SLSA)," v1.0, 2023. [Online]. Available: https://slsa.dev/
[21] NIST, "Module-Lattice-Based Digital Signature Standard (ML-DSA)," FIPS 204, Aug. 2024. [Online]. Available: https://doi.org/10.6028/NIST.FIPS.204
[22] Z. Zhou et al., "Performance Comparison of Service Mesh Frameworks: the mTLS Test Case," arXiv preprint arXiv:2411.02267, Nov. 2024. [Online]. Available: https://arxiv.org/abs/2411.02267
[23] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, "Zero Trust Architecture," NIST Special Publication 800-207, Aug. 2020. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-207
[24] R. Chandramouli and Z. Butcher, "A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments," NIST Special Publication 800-207A, Sep. 2023. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-207A
[25] A. Ponce, J. Soldani, A. Brogi, "Microservice security: a systematic literature review," PeerJ Computer Science, vol. 8, p. e779, Jan. 2022. doi: 10.7717/peerj-cs.779
[26] Z. Lu, D. T. Delaney, and D. Lillis, "A Survey on Microservices Trust Models for Open Systems," IEEE Access, vol. 11, pp. 28840–28855, 2023. doi: 10.1109/ACCESS.2023.3259556
[27] R. Xu, W. Jin, and D. Kim, "Microservice Security Agent Based on API Gateway in Edge Computing," Sensors, vol. 19, no. 22, p. 4905, Nov. 2019. doi: 10.3390/s19224905
[28] A. Chatterjee, M. W. Gerdes, P. Khatiwada, and A. Prinz, "SFTSDH: Applying Spring Security Framework with TSD-Based OAuth2 to Protect Microservice Architecture APIs," IEEE Access, vol. 10, pp. 41914–41934, 2022. doi: 10.1109/ACCESS.2022.3165548
[29] M. Gounari, T. Stavropoulos, and S. Katsikas, "Harmonizing Open Banking in the European Union: An Analysis of PSD2 Compliance and Interrelation with Cybersecurity Frameworks and Standards," International Cybersecurity Law Review, vol. 5, no. 1, pp. 79–120, 2024. doi: 10.1365/s43439-023-00108-8
[30] Y. Elkhatib and J. Povedano Poyato, "An Evaluation of Service Mesh Frameworks for Edge Systems," in Proc. 6th Int. Workshop on Edge Systems, Analytics and Networking (EdgeSys '23), Rome, Italy, May 2023, pp. 1–6. doi: 10.1145/3578354.359286
