PSD3 & Open Banking: What Currency Exchange APIs Must Do to Comply by 2026

// PSD3-Compliant FX Transparency Endpoint
// Discloses markups and compares to mid-market rate
async function getCompliantConversionQuote(
  fromCurrency: string,
  toCurrency: string,
  amount: number,
  providerMarkup: number // e.g. 0.015 = 1.5%
) {
  // 1. Fetch mid-market rate (independently sourced)
  const midMarketResponse = await fetch(
    'https://currency-exchange.app/api/v1/convert',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'x-api-key': process.env.FX_API_KEY,
      },
      body: JSON.stringify({
        from: fromCurrency,
        to: toCurrency,
        amount: amount,
      }),
    }
  );
  const midMarketData = await midMarketResponse.json();
  const midMarketRate = midMarketData.rate;

  // 2. Calculate provider rate with markup
  const providerRate = midMarketRate * (1 + providerMarkup);
  const providerAmount = amount * providerRate;
  const midMarketAmount = midMarketData.result;
  const markupAmount = providerAmount - midMarketAmount;

  // 3. Return PSD3-compliant disclosure object
  return {
    quoteId: crypto.randomUUID(),
    timestamp: new Date().toISOString(),
    source: {
      from: fromCurrency,
      to: toCurrency,
      amount: amount,
    },
    rates: {
      midMarketRate: midMarketRate,
      providerRate: providerRate,
      markupPercentage: providerMarkup * 100,
    },
    amounts: {
      midMarketAmount: midMarketAmount,
      providerAmount: providerAmount,
      markupCost: markupAmount,
    },
    disclosure: {
      rateSource: 'Currency-Exchange.app mid-market',
      markupApplied: true,
      PSD3Compliant: true,
      lastRateUpdate: midMarketData.timestamp,
    },
  };
}

// PSD3 Consent Management for Currency API Access
import { NextRequest, NextResponse } from 'next/server';

export async function handleCurrencyApiAccess(
  request: NextRequest
) {
  // 1. Validate Strong Customer Authentication (SCA)
  const authToken = request.headers.get('authorization');
  const consentId = request.headers.get('x-consent-id');

  const isAuthValid = await validateSCA(authToken);
  const consent = await getConsent(consentId);

  if (!isAuthValid || !consent?.active) {
    return NextResponse.json(
      { error: 'SCA validation failed' },
      { status: 401 }
    );
  }

  // 2. Check consent scope matches request
  const requestedCurrencies = await request.json();
  const allowedCurrencies = consent.scope.currencies;

  const isScopeValid = requestedCurrencies.every(
    (c: string) => allowedCurrencies.includes(c)
  );

  if (!isScopeValid) {
    return NextResponse.json(
      { error: 'Consent scope exceeded' },
      { status: 403 }
    );
  }

  // 3. Fetch rates with audit trail
  const rates = await fetchCompliantRates(
    requestedCurrencies,
    consent.accountId
  );

  // 4. Log access for PSD3 audit requirements
  await logApiAccess({
    consentId: consent.id,
    providerId: consent.providerId,
    currencies: requestedCurrencies,
    timestamp: new Date().toISOString(),
    scaMethod: consent.scaMethod,
  });

  return NextResponse.json({
    ...rates,
    compliance: {
      standard: 'PSD3',
      consentId: consent.id,
      accessedAt: new Date().toISOString(),
    },
  });
}