The risk profile completely changes

The risk profile completely changes when you move from AISP (Account Information) to PISP (Payment Initiation). Reading a balance is one thing; moving money is another. I feel like the security standards for write-access APIs need to be way stricter. I found a good comparison on securing Open Banking APIs and the layered approach to mitigating risks in third-party integrations: https://cybersecuritynews.com/securing-open-banking-apis-mitigating-risks-in-third-party-integrations/. It argues for step-up authentication (MFA) for any sensitive action. If the API doesn't trigger a biometric check on the user's phone for a transfer, it's not secure enough for 2026. Convenience shouldn't override basic theft prevention.