Banking Data APIs — procurement report
ProductArena · rankings as of 2026-09-15 · evidence as of 2026-09-15 · 7 products · 53 judged requirements · 371 judged cells
Methodology: Every product is judged against a shared taxonomy of user stories using cited evidence — hands-on probes > repository code > independent community sources > vendor claims — never opinion. Full writeup: https://ultrametric.ai/productarena/methodology
Leaderboard
| # | Product | PA Score | Coverage score | Applicable cells | Confidence |
|---|---|---|---|---|---|
| 1 | MX | 29.7 | 29.0 | 51/53 | B |
| 2 | TrueLayer | 26.2 | 25.6 | 48/53 | B |
| 3 | Mastercard Open Finance (Finicity) | 24.7 | 22.9 | 49/53 | C |
| 4 | Stripe Financial Connections | 22.4 | 32.3 | 48/53 | B |
| 5 | Yapily | 22.0 | 24.7 | 48/53 | C |
| 6 | Plaid | 17.8 | 30.3 | 48/53 | B |
| 7 | Teller | 12.9 | 21.5 | 47/53 | B |
PA Score = agent-readiness blend (see methodology). Coverage score = weighted share of judged requirements met. Confidence = how much of the score rests on tested vs claimed evidence (A–D).
Uncertainty note
The current #1/#2 gap in this arena is not close enough to qualify for the multi-judge uncertainty pass (or the pass has not covered it yet) — no extra caveat applies beyond the per-product confidence grades above.
Buyer checklist (RFP)
The arena's 53 judged user stories as requirements, grouped by theme. Priorities mirror the story weights our scoring uses (3 = must-have, 2 = should-have, 1 = nice-to-have). Interactive version with per-requirement verdicts for the top products: /arena/banking-data-apis/checklist
Account linking — stories about account linking in this arenaAccount linking
Stories about account linking in this arena
- developerLet a user connect their bank with a drop-in hosted flow — create a session server-side, open the widget, and get back a token for the connected account — without building institution UI myselfmust-have
- developerConnections to major institutions use bank-hosted OAuth rather than screen-scraped credentials — the platform documents its OAuth coverage and how legacy credential flows are being retiredshould-have
- ops leadBroken connections are repairable — expired or revoked links surface as documented statuses, and users can re-authenticate in an update flow without starting overshould-have
Agenticness — how well agents can access and operate the productAgenticness
How well agents can access and operate the product
- ai-native userPlug MCP servers into this product so it can use their toolsmust-have
- ai-native userConnect an agent via an official MCP servermust-have
- ai-native userDrive the product through a documented public APImust-have
- ai-native userDelegate tasks to a built-in AI assistant inside the productmust-have
- ai-native userPoint an agent at llms.txt or agent-oriented docsshould-have
- ai-native userRun the product headlessly / in CI for automationshould-have
- ai-native userUse an official CLIshould-have
- ai-native userIssue scoped/least-privilege API credentials for an agentshould-have
- ai-native userBuild against official SDKsshould-have
- ai-native userSubscribe to events via webhooksshould-have
- ai-native userGet AI-generated insights and suggestions from my data inside the productshould-have
- ai-native userSet up automations that run autonomously in the backgroundshould-have
- ai-native userOperate the product with natural-language commandsshould-have
- ai-native userExplore an interactive API reference with runnable examplesshould-have
- ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)should-have
- ai-native userRely on versioned APIs with a documented deprecation policyshould-have
- ai-native userTest against a sandbox environment without touching production datanice-to-have
Automation depth — how much of the product can run unattendedAutomation depth
How much of the product can run unattended
- ai-native userDefine rules that trigger actions automatically on eventsmust-have
- ai-native userPerform bulk operations across many items at onceshould-have
- ai-native userSchedule recurring jobs or workflowsshould-have
- ai-native userVersion, review, and roll back my automationsnice-to-have
Balance ownership — stories about balance ownership in this arenaBalance ownership
Stories about balance ownership in this arena
- developerObtain verified account and routing numbers (or tokenized equivalents) from a linked account to fund ACH or bank-debit payments without micro-depositsmust-have
- developerFetch a real-time balance for a connected account before initiating a payment — a documented balance endpoint intended for NSF and risk checksmust-have
- ops leadRetrieve account-holder details — names, addresses, contact data on file at the bank — to match the account owner against my customershould-have
- developerLinked accounts plug into my payment processor — documented integrations or token exchange that hand verified account credentials to third-party processors and platformsshould-have
Banking agent access — stories about banking agent access in this arenaBanking agent access
Stories about banking agent access in this arena
- ai-native userAn agent can operate the platform — create link sessions, retrieve balances and transactions, and manage connections through the API or an MCP surface with scoped credentialsmust-have
- ai-native userThe data comes back agent-consumable — clean structured JSON, documented schemas, and enrichment an automated financial workflow can reason over without heuristic parsingshould-have
Consent security — stories about consent security in this arenaConsent security
Stories about consent security in this arena
- ops leadEnd users can see and revoke what they've shared — a documented consent surface or portal where a user manages which apps hold access to their bank datashould-have
- ops leadSever and clean up — a documented way to delete a connection or user and have the platform stop collecting and purge held datashould-have
- developerI request only the data scopes I need — product-scoped consents and documented data-minimization controls, not an all-or-nothing grantshould-have
Data freshness — stories about data freshness in this arenaData freshness
Stories about data freshness in this arena
- developerTrigger an on-demand refresh of a connected account's data through the API when my use case needs now-fresh data, with the refresh semantics documentedshould-have
- developerData changes arrive as signed webhooks — new transactions, balance updates, connection state changes — so my system stays current without pollingshould-have
Institution coverage — stories about institution coverage in this arenaInstitution coverage
Stories about institution coverage in this arena
- founderThe platform documents how many institutions it reaches and where — published coverage numbers and geographies I can check against where my users actually bankmust-have
- ops leadPer-institution health is visible — documented institution statuses, outage or degradation signals, and error codes that distinguish a bank problem from my problemshould-have
Integration dx — sandboxes, test modes, webhooks, and how fast a developer gets to a working integrationIntegration dx
Sandboxes, test modes, webhooks, and how fast a developer gets to a working integration
- developerA sandbox with test institutions and documented test credentials lets me exercise linking, data retrieval, and error states end-to-end before touching a real bank accountmust-have
- developerOne link session can power multiple data products — auth, balances, transactions, identity — without forcing the user through separate connection flows per productshould-have
- developerGo from signup to my first linked sandbox account fast — self-serve API keys, a runnable quickstart, and client libraries in my languageshould-have
Openness — open source, data portability, and self-hosting storiesOpenness
Open source, data portability, and self-hosting stories
- ai-native userExport all of my data in open formats and leavemust-have
- ai-native userSelf-host the core productmust-have
- ai-native userDo everything through the API that I can do in the UIshould-have
- ai-native userRead the product's source under an open licenseshould-have
Payment initiation — stories about payment initiation in this arenaPayment initiation
Stories about payment initiation in this arena
- developerInitiate a bank payment from a connected account — a documented pay-by-bank or payment-initiation product with its live geographies stated honestlyshould-have
- developerRecurring bank payments are supported — variable recurring payments, standing consents, or documented recurring debit flows built on the connectionshould-have
Privacy posture — data-handling and privacy storiesPrivacy posture
Data-handling and privacy stories
- ai-native userPrevent my data from being used to train AI modelsmust-have
- ai-native userChoose where my data is stored (region/residency)should-have
- ai-native userControl data retention and deletionshould-have
- ai-native userOpt out of telemetry and usage trackingshould-have
Transactions enrichment — stories about transactions enrichment in this arenaTransactions enrichment
Stories about transactions enrichment in this arena
- developerPull transaction history for a connected account through the API — paginated, with documented history depth and a sync pattern for fetching only what changedmust-have
- finance leadThe platform derives income and cash-flow signals from connected accounts — recurring streams, payroll detection, or documented income verification products built on the same datashould-have
- developerRaw bank transactions come back enriched — cleaned merchant names, categories, and logos — documented as a capability of the platform, not left as an exercise for meshould-have
Appendix: recorded probes
Hands-on probe recordings — transcripts/videos a human can replay, the strongest evidence tier. Watch them at https://ultrametric.ai/productarena/proofs
- Mastercard Open Finance (Finicity)
curl -si https://api.finicity.com/aggregation/v1/customers | head -2 # Finicity-era API host under Mastercard, keyless → 401terminal · recorded 2026-09-15 · exit 0 - Mastercard Open Finance (Finicity)
curl -sL https://developer.mastercard.com/llms.txt | head -2terminal · recorded 2026-09-15 · exit 0 - MX
curl -si https://api.mx.com/users -H 'Accept: application/vnd.mx.api.v1+json' | head -2 # keyless → 401terminal · recorded 2026-09-15 · exit 0 - MX
curl -sL https://docs.mx.com/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - MX
curl -s -X POST https://docs.mx.com/mcp -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # keyless initialize completes with serverInfoterminal · recorded 2026-09-15 · exit 0 - Plaid
curl -si -X POST https://production.plaid.com/accounts/balance/get -H 'Content-Type: application/json' -d '{}' # keyless → 400 naming the missing client_idterminal · recorded 2026-09-15 · exit 0 - Plaid
curl -sL https://plaid.com/docs/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - Plaid
curl -s -X POST https://api.dashboard.plaid.com/mcp/sse -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # the Dashboard MCP Plaid documents (OAuth mcp:dashboard scope)terminal · recorded 2026-09-15 · exit 0 - Stripe Financial Connections
curl -si https://api.stripe.com/v1/financial_connections/accounts | head -2 # keyless → 401terminal · recorded 2026-09-15 · exit 0 - Stripe Financial Connections
curl -sL https://docs.stripe.com/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - Stripe Financial Connections
curl -s -X POST https://mcp.stripe.com/ -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # the remote MCP server Stripe documents at docs.stripe.com/mcpterminal · recorded 2026-09-15 · exit 0 - Teller
curl -si https://api.teller.io/accounts | head -2 # keyless → 400, not a 401 challengeterminal · recorded 2026-09-15 · exit 0 - Teller
curl -sL https://teller.io/docs/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - TrueLayer
curl -si https://api.truelayer.com/data/v1/accounts | head -2 # keyless → 401terminal · recorded 2026-09-15 · exit 0 - TrueLayer
curl -sL https://docs.truelayer.com/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - TrueLayer
curl -s -X POST https://docs.truelayer.com/mcp -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # JSON-RPC "Authorization required" authgateterminal · recorded 2026-09-15 · exit 0 - Yapily
curl -sL https://docs.yapily.com/llms.txt | head -3terminal · recorded 2026-09-15 · exit 0 - Yapily
curl -s -X POST https://docs.yapily.com/mcp -H 'Content-Type: application/json' -d '<jsonrpc initialize>' # keyless initialize completes with serverInfoterminal · recorded 2026-09-15 · exit 0 - Yapily
curl -s https://api.yapily.com/docs/v3/openapi.json | head -c 150terminal · recorded 2026-09-15 · exit 0
Cite as: ProductArena by Ultrametric Inc, Banking Data APIs arena, rankings as of 2026-09-15 — https://ultrametric.ai/productarena/arena/banking-data-apis
License: © 2026 Ultrametric Inc. Brief quotation of individual verdicts, scores, or evidence excerpts is permitted with attribution to "ProductArena by Ultrametric Inc (ultrametric.ai/productarena)", as is use of the data to evaluate, contest, or contribute corrections. Bulk copying, redistribution, or use to build competing datasets requires prior written permission (see DATA-LICENSE in the repository).
No liability: rankings, verdicts, and scores are research outputs derived from the cited evidence at a point in time, provided "as is", without warranties. Ultrametric Inc accepts no responsibility for procurement, purchasing, or other decisions made in reliance on them — verify against the cited evidence before acting (https://ultrametric.ai/productarena/terms).