Mastercard Open Finance

What it is

Mastercard bought Finicity in 2020, and the naming is worth spelling out because three versions are in circulation. The product is Mastercard Open Finance. The company providing it is "Finicity, a Mastercard company", which is how the docs put it. The URLs and several GitHub repositories still say open-banking, and every authenticated request carries a Finicity-App-Token header. One API, three names; a reader arriving with any of them is in the right place.

The shape is conventional: Mastercard Data Connect is the hosted link flow, and your server exchanges a partner authentication for a two-hour token and reads accounts and transactions. Investment accounts are not a separate product — holdings arrive as a position array on the account object, so whatever call returns full account detail returns positions with it.

This card is the US API. Australia and Europe are separate Open Finance offerings on separate documentation, and nothing here transfers to them.

Pricing

No figure is published, but the billing model is, which is more than most of this category manages.

Account and transaction data bill one of two ways. Data Access Tiers is pay-per-use per customer per month: Tier 1, Account Simple Details, is name, type, status and currency at no additional cost and exists so you can check a permissioned account is live before paying for it; Tier 2 adds balances and the position array; Tier 3 adds transactions, and if you touch both in one month only Tier 3 is charged. The alternative is the older standalone subscriptions, Account Limited Aggregation and Transaction Aggregation. Decisioning reports — Balance Analytics, Cash Flow Analytics, verification of assets and income — are billed per successful call on top.

The sandbox is genuinely self-serve. Sign up, create a project, select Open Finance, and you get a Partner ID, Secret and App Key with test customer profiles behind them. That is the cheapest way in this category to find out whether the payload has what you need before anyone quotes you.

Data & coverage

A position carries symbol, securityName, units, currentPrice with a currentPriceDate, marketValue, costBasis, costBasisPerShare, paidPrice, dailyChange, totalGLDollar and totalGLPercent, posType for long or short, transactionType for cash versus margin, an FI-defined fiAssetClass and a normalised assetClass, and for options optionType, optionStrikePrice, optionSharesPerContract and optionExpireDate. A securityId with a securityIdType beside it is how a CUSIP reaches you.

Account types run wide — investment, investment tax deferred, brokerage, non-taxable brokerage, IRA, Roth 401k, SEP and Simple IRA, 403b, 457, 401a, Keogh, Thrift Savings Plan, 529, UGMA, UTMA, ESPP, pension, profit sharing and variable annuity.

The first aggregation pulls up to six months of transactions for a traditional account and the docs recommend pulling daily thereafter; TxPUSH pushes changes to a webhook instead, and a Load Historic Transactions call extends the window to 24 months where the institution has the history. Mastercard claims connectivity to 95% of US deposit accounts — a claim about deposits that says nothing about brokerage reach. Unlike the rest of this category, though, there is a Get Institutions endpoint, so a sandbox key lets you check coverage yourself.

Integrations

REST and JSON. No first-party client libraries in any language: the vendor publishes an OpenAPI specification, a Postman collection, bash and PowerShell setup scripts and a ReactJS reference app and tells you to generate a client. github.com/Mastercard/finicity-openapi redirects to open-banking-us-openapi, which is Java and was last pushed on 14 September 2026. Data Connect ships web, iOS and Android SDKs. Webhooks cover Data Connect events, TxPUSH and report generation.

Limitations

• No published price at any tier, and which billing model suits you is explicitly a question for a sales representative.
• API requests must originate from an IP in the United States, United Kingdom, Canada or Australia.
• Fidelity carries a warning of its own: Mastercard notifies clients that third-party data providers may require a separate market-data licence to receive holdings, market values, vestings and symbols over the Fidelity OAuth connection. That is a licence between you and somebody who is not Mastercard.
• OAuth institutions need per-application registration, and when an institution moves off a legacy connection your customers lose theirs and have to reauthenticate.
• Six months of transaction history on first aggregation for a traditional account; 24 months needs a separate Load Historic Transactions call and depends on the institution.
• TxPUSH and Data Access Tiers are mutually exclusive — the tiers page says partners using TxPUSH are not eligible for them, so the billing model the docs explain best is the one you lose by taking the push option.
• Holdings are institution-reported and dated by currentPriceDate; refresh is a daily pull and nothing here is a market feed.
• Read-only. No orders.

Alternatives

Plaid Investments has the better-documented investments product, a published coverage file and a Trial plan that reaches real data. Akoya is API-only by design and narrower. MX is the comparison if you are a bank already running its platform. SnapTrade is where to go if the deal size is small. Mastercard's argument is the institution relationships and a sandbox you can reach this afternoon.