Customer Behaviour in Saudi Open Banking: A Mediation and Moderation Model of Data Control and Prior FinTech Experience

Abstract

Open banking enables customers to provide third parties with financial information, yet this will be successful only when customers are ready to share it. Previous research concentrates on security, trust, and usefulness as direct motivators without paying attention to mechanisms. This research fills this gap by evaluating the effect of Perceived Security Assurance, Trust in Banks and FinTech Providers, and Perceived Usefulness on Willingness to Share Financial Data based on Perceived Data Control, which is based on Privacy Calculus Theory. A combination of cluster and purposive sampling was used to collect data from digital banking users in five regions in Saudi Arabia. There were a total of 384 valid responses that were analysed. SmartPLS 4 was used to run Partial Least Squares Structural Equation Modelling. The results reveal that PSA, TBFP, PUOB, and PDC directly impact WSFD and that PSA, TBFP, and PUOB also have a considerable impact on PDC. The outcomes of the mediation confirm that PDC mediates these relationships partially. Multi-group analysis also shows that these effects are greater amongst users with less experience in FinTech and with younger customers, especially in the pathways that involve perceived data control. The work adds to the theory in two ways. The extension of the Privacy Calculus Theory by adding the perceived control and pointing out the heterogeneity of users in data-sharing behaviour. It also changes the attention from the general adoption intention to the actual data-sharing behaviour in open banking. Practically, the results suggest that to foster customer engagement in open banking ecosystems, it is necessary to improve security, develop trust, prove value, provide user control, and use segment-specific actions.

1. Introduction

Open banking is a significant change in the sphere of financial services, which can enable customers to give third-party providers access to their financial information via application programming interfaces (APIs) [1]. It facilitates competition, innovation, and the redesign of traditional banking models by facilitating controlled data sharing [2]. Regulatory frameworks in the global markets have facilitated this shift and made open banking a central force in digital financial transformation [3]. Even with these infrastructural and regulatory developments, customer involvement, especially regarding their willingness to authorize the sharing of financial information with licensed third-party providers, is fundamental to the success of open banking [4]. Unlike conventional digital banking, which primarily enables customers to access banking services, open banking centres on customer-authorized financial data sharing through secure APIs. Therefore, this study adopts the term open banking because it specifically investigates customers’ perceptions and willingness to share financial data within this unique regulatory and technological environment.

Financial information sharing is not comparable to overall data disclosure because it involves sensitive information, such as transaction history, earnings information, and spending habits [5]. This has made customers consider various issues before consenting to provide such information. According to previous studies, perceived security, trust in the institutions, and the anticipated benefits play a vital role in these decisions [6]. High security guarantees perceived risk, and trust in the banks and FinTech service providers are the key factors in reducing uncertainty and increasing the use of the services [6,7], although trust in the services is the central element in minimizing uncertainty and expanding service use [8]. In the same way, the perceived usefulness, manifested in better financial services and customization, has been identified as one of the driving forces of adoption in digital finance [9].

The majority of existing research, however, considers these factors as direct predictors of adoption intention, which provides a simplified perspective of decision-making. To a large extent, they neglect the psychological mechanisms behind these perceptions and actual willingness to share financial data [10]. Privacy Calculus Theory (PCT) describes disclosure as a trade-off between perceived risks and benefits [9], yet recent research proposes that perceived control over personal data should be included in the [10]. Users experience reduced psychological vulnerability and become more willing to disclose financial information when they perceive that they can monitor, manage, and revoke access to their data [11]. Building on these recent theoretical developments, this study conceptualizes perceived data control as the central psychological mechanism through which perceived security assurance, trust in banks and FinTech providers, and perceived usefulness influence customers’ willingness to share financial data. By positioning perceived data control as a mediating construct within an open banking context, the proposed framework extends previous applications of Privacy Calculus Theory, which have predominantly examined these factors as direct predictors of behavioural intention.

Moreover, user reactions to these factors might be influenced by individual differences. Existing literature demonstrates that age is a factor that affects privacy sensitivity and disclosure behaviour [12], and FinTech experience increases digital confidence and understanding of processes related to data sharing [9]. However, these variables are not frequently considered as moderators, but as controls, and the impact they have on the development of the relations between the perceived control and data-sharing behaviour has not yet been studied.

Moreover, the existing literature on open banking has been mainly dedicated to the regulatory design, the market structure, and the ecosystem development [1,2]. Very little focus has been put on customer-level behavioural mechanisms, especially in the new digital finance landscapes. In the context of studying consumer attitudes, much attention is usually paid to the outcomes of adoption or loyalty instead of the fundamental behaviour of financial data sharing [13].

It is based on this that this study is informed by three important research questions. First, in what ways do perceived security assurance, trust in banks and FinTech providers, and perceived usefulness affect willingness to share financial data mediated by perceived data control? Second, how do previous FinTech experience and age moderate these connections, especially in determining the role of perceived data control in data-sharing behaviour? Third, what can be done to shift the emphasis from general adoption intention to the more basic behaviour of willingness to share financial data in open banking settings?

To reach these goals, the research design will be quantitative, based on survey data gathered from digital banking users in Saudi Arabia. Partial Least Squares Structural Equation Modelling (PLS-SEM) is used to test the proposed model and enables the simultaneous analysis of direct, mediating, and moderating effects.

This study contributes to the open banking and Privacy Calculus Theory literature in three ways. First, although previous studies have examined direct relationships and, more recently, some indirect relationships among privacy- and technology-related constructs, the specific role of PDC as the central psychological mechanism linking PSA, TBFP, and PUOB to WSFD has received limited attention, particularly in open banking. By conceptualizing PDC as the core mediating mechanism, this study extends the application of PCT to explain financial data-sharing behaviour. Second, the study incorporates prior FinTech experience and age as moderators of the relationship between PDC and WSFD, providing additional insight into how individual differences shape disclosure decisions in open banking. Third, the study provides empirical evidence from Saudi Arabia, where open banking is still evolving, thereby extending the contextual applicability of PCT and contributing evidence from an emerging digital financial ecosystem.

The rest of the paper will be organized in the following way. Section 2 is a literature review and formulates the hypotheses. Section 3 explains the methodology of the research. The empirical results are provided in Section 4. The findings are discussed in Section 5, and then in Section 6, the theoretical and practical implications. Section 7 is a limitation and future research directions, and Section 8 is the conclusion of the study.

2. Literature Review

2.1. Open Banking in Saudi Arabia

Open banking is a structural change to financial ecosystems that allows a customer to safely send their banking data to licensed third-party providers using standardized application programming interfaces (APIs) [1]. Worldwide, open banking models have been implemented to boost competition, promote FinTech innovation, and expand customer-centric financial services [3]. Open banking changes the history of bank-centric data structures and places customers in a more powerful position to control financial data [2].

The development of open banking is in line with a larger Saudi Arabian financial sector reform agenda and digital transformation. Regulatory frameworks have also been implemented as part of the financial modernization strategies to provide secure API standards, governance protocols, and consent management systems [14]. These are efforts to promote FinTech and enhance financial inclusion. Nonetheless, consumer participation is not necessarily a direct result of regulatory preparedness. Through an example of open banking ecosystems in the world, it has been proposed that the infrastructure provided at the market level is accompanied by customer confidence and desire to participate in data-sharing behaviours [4].

The developing studies show that the customer experience and the perceived service value drive engagement in the open banking setting [13]. However, the majority of empirical studies have to do with loyalty intention or adoption intention as opposed to the more basic behavioural act of sharing financial data. Considering that open banking is a technology that depends directly on customer consent to transfer data, the readiness to provide financial data is the essential behavioural control point on ecosystem operation.

Moreover, open banking spaces expose users to perceived digital risk because of the participation of various actors, such as the providers of FinTech and third-party aggregators. The more digital financial ecosystems grow, the bigger the issue of cybersecurity, data abuse, and unauthorized access [7]. Consequently, to guarantee sustainable ecosystem adoption, it is necessary to learn the factors affecting data-sharing willingness in the Saudi environment.

Although there are growing regulatory and technological advancements, few studies focus on empirical research on the psychological motivations of financial data-sharing behaviour in an open banking environment. Regulatory architecture and competitive outcomes are predominantly a focus of most studies, as opposed to the level of customer behavioural mechanisms [1,2]. This implies that there is a gap in contextual and behavioural research that should be filled through investigations.

2.2. Customer Willingness to Share Financial Data and Security Concerns

Customer willingness to provide financial data can be described as the desire to permit the use of personal banking data to improve the services or manage finances. In contrast to the adoption of general technology, open banking demands that customers share very sensitive financial data, such as transaction history, income trends, and expenditure habits [5]. Therefore, the decisions regarding data-sharing are risky in nature.

Issues related to security are critical in the development of disclosure behaviour. Perceived security guarantees, which denote the perception that technical protection, as well as regulatory controls, are sufficient to safeguard personal information, lessen perceived vulnerability and increase behavioural intent [6]. Empirical research also shows that data security is a strong predictor of the intention to adopt FinTech and form trust [6]. Moreover, the problem of cybersecurity attacks could severely harm the trust of the clients of online financial systems [7], which explains the significance of perceived institutional reliability.

The other important factor that determines the willingness to share financial data is trust. Trust decreases uncertainty and perceived risk in the digital context [11]. It has been suggested that preliminary trust greatly affects intention to use open banking-based services [8]. Since open banking involves cooperation between financial institutions and technology providers, trust is not confined to traditional financial institutions but involves third parties [3].

Disclosure behaviour also greatly depends on perceived usefulness. Customers will be inclined to provide financial data more when they have a sense of material value, including better financial guidance, budgeting assistance, or individualized service suggestions [9,15]. In open finance ecosystems, value-added services are incentives that, in turn, can balance out privacy issues [5].

Nevertheless, a large part of the existing literature assumes that security, trust, and usefulness are direct predictors of adoption intention. This type of linear modelling simplifies the process of decision-making and is not reflective of the cognitive mechanisms that determine the disclosure behaviour [16]. In particular, the literature has not adequately studied whether the determinants act through a mediating psychological variable, including perceived data control. This gap has to be filled in order to develop a theoretical basis for the decisions to share financial data.

2.3. Research Gap

Research on open banking has expanded considerably in recent years, reflecting growing academic and practical interest in digital financial ecosystems and the implementation of customer-centered financial services [1,5]. Existing studies have substantially advanced understanding of regulatory frameworks, market design, ecosystem governance, and digital transformation, providing valuable insights into the institutional and technological foundations of open banking [1,2,3]. However, comparatively less attention has been devoted to understanding the behavioural mechanisms underlying customers’ willingness to share financial data, despite customer consent representing the fundamental prerequisite for open banking services. Where customer-oriented research has been conducted, it has predominantly examined general technology adoption or usage intentions rather than the more specific behaviour of willingness to share financial data, which ultimately determines whether open banking services can function effectively [5,15].

Existing empirical studies have primarily examined PSA, TBFP, and PUOB as antecedents of technology adoption or disclosure intention, although recent studies have increasingly considered indirect relationships in digital privacy research [6,8,9]. However, comparatively limited attention has been given to the specific role of PDC as the mechanism linking these antecedents to WSFD within open banking. This limitation is particularly important because customer-authorized consent and revocation place PDC at the centre of open banking services [1,10,11].

Although prior FinTech experience and age have been examined as control variables and, in some studies, as moderators, their moderating roles in the relationship between PDC and WSFD remain insufficiently examined within PCT and open banking research [9,12,15].

Furthermore, the available empirical evidence remains concentrated in relatively mature open banking jurisdictions, while studies conducted in newly digitalizing financial markets remain comparatively limited. Although some studies have examined open banking-related behaviours in specific contexts, empirical evidence explaining how privacy calculus and perceived control operate in emerging open financial ecosystems is still scarce [4,13]. Consequently, the contextual applicability of existing behavioural models to rapidly evolving open banking environments such as Saudi Arabia remains insufficiently understood.

Collectively, the reviewed literature demonstrates that prior research has examined direct, indirect, mediating, and moderating relationships in digital financial and disclosure contexts; however, comparatively limited attention has been given to the specific psychological mechanism and boundary conditions through which perceived security assurance, trust, and perceived usefulness influence customers’ willingness to share financial data in open banking. Building upon these identified gaps, this study proposes and empirically tests a Privacy Calculus Theory-based model that conceptualizes perceived data control as the central mediating psychological mechanism linking perceived security assurance, trust in banks and FinTech providers, and perceived usefulness to customers’ willingness to share financial data. In addition, the proposed model examines the moderating roles of prior FinTech experience and age to provide a more comprehensive understanding of how individual differences influence financial data-sharing behaviour within the Saudi Arabian open banking context.

2.4. Theoretical Foundations: Privacy Calculus Theory (PCT)

Privacy Calculus Theory (PCT) is the theoretical background that enables explanations of individual information disclosure in online spaces. According to this theory, all individuals make rational decisions based on the perceived benefits and perceived risks involved in the decision to disclose personal information [17]. The initial models of privacy decision-making viewed disclosure as a trade-off affected by perceptions of fairness and trust [18]. Later empirical studies went ahead to refine this model by adding measurable constructs like privacy concerns, perceived risk, and expected benefit [19].

In digital financial services, PCT implies that customers would balance the benefits of the possible services, which include personalization and efficiency, with the perceived risks of privacy, including data breaches or misuse [9]. There is empirical evidence of the use of PCT in mobile banking that disclosure intention is a cost–benefit trade-off [9]. In the same way, [10] prove that privacy calculus mediates disclosure intention in mobile applications, further supporting its use in the online financial business.

Although previous Privacy Calculus Theory research has examined related concepts such as perceived control, privacy control, information control, and user control, these constructs primarily reflect individuals’ general perceptions of control over privacy settings, personal information, or system interactions. In contrast, perceived data control in the context of open banking specifically refers to customers’ perceived ability to authorize, monitor, manage, and revoke the sharing of their financial data with licensed third-party providers. Because open banking is fundamentally based on customer-authorized data sharing through secure APIs, perceived data control represents a context-specific mechanism that captures customers’ confidence in exercising control over financial information throughout the data-sharing process.

Recent extensions of Privacy Calculus Theory suggest that favourable perceptions of security, trust, and usefulness alone do not necessarily translate into information disclosure. Instead, these perceptions first strengthen individuals’ confidence that they can effectively control how their personal information is collected, shared, monitored, and withdrawn. Perceived control over personal information can reduce psychological uneasiness and increase confidence in disclosure decisions [10]. Similarly, when individuals believe that they can monitor or revoke data-sharing authorizations, their perceived vulnerability is reduced [11]. Consequently, perceived data control functions as an important psychological mechanism through which customers convert favourable evaluations of an open banking environment into a willingness to share financial data. Accordingly, perceived data control is conceptualized as a mediating mechanism rather than merely a direct antecedent of disclosure behaviour.

Although control-related constructs have received increasing attention in Privacy Calculus Theory research, they have primarily been examined either as direct antecedents of disclosure intention or as complementary privacy-related variables. Relatively little research has investigated perceived data control as the central psychological mechanism through which security assurance, trust, and perceived usefulness influence customers’ willingness to share financial data in open banking. By positioning perceived data control as a mediating construct within an open banking context, the proposed framework provides a more comprehensive explanation of financial data-sharing behaviour beyond the traditional cost–benefit perspective.

Additionally, the researchers working with PCT are likely to disregard confounding variables such as demographic characteristics or Internet experience. There is some evidence that older persons are more sensitive to financial privacy [12], and previous familiarity with FinTech helps boost trust in digital transactions [9]. The inclusion of these moderating factors broadens the contextual application of Privacy Calculus Theory and provides a richer understanding of how individual differences influence financial data-sharing behaviour.

Although Privacy Calculus Theory has frequently been operationalized using constructs such as perceived benefits, perceived risks, privacy concerns, and disclosure intention, it does not prescribe a fixed set of constructs. Rather, researchers adapt the theory according to the research context and objectives. In the present study, perceived usefulness represents the benefit evaluation, while perceived security assurance represents customers’ positive evaluation of the security mechanisms that reduce perceived risk in regulated open banking environments. Furthermore, willingness to share financial data represents the disclosure intention specific to financial data-sharing behaviour. Rather than explicitly modelling general privacy concerns, this study focuses on perceived data control because open banking fundamentally relies on customers’ ability to authorize, monitor, and revoke access to their financial information. This context-specific operationalization maintains theoretical consistency with Privacy Calculus Theory while providing a more focused explanation of financial data-sharing behaviour.

Accordingly, this study extends Privacy Calculus Theory by conceptualizing perceived data control as the central mediating psychological mechanism linking perceived security assurance, trust in banks and FinTech providers, and perceived usefulness with customers’ willingness to share financial data in an open banking environment. Furthermore, by examining the moderating roles of previous FinTech experience and age, the proposed framework provides a richer understanding of how individual differences shape financial data-sharing behaviour. This theoretically grounded framework contributes to the continued development of Privacy Calculus Theory in digitally regulated financial ecosystems.

2.5. Hypotheses Development

2.5.1. Perceived Data Control and Willingness to Share Financial Data

Open banking requires customers to explicitly authorize the sharing of their financial information with licensed third-party providers. Thus, the readiness to disclose financial information is the behavioural outcome of the given study. Although previous studies have analysed the adoption intention in general [8,15], more specific studies have investigated the data-sharing willingness as a behavioural construct [5]. Such a difference is paramount as the implementation of open banking is impossible without clear data disclosure permission. The decision to disclose personal information has long been recognized as a central behavioural outcome in privacy and information systems research. Early studies established that individuals evaluate the potential benefits and risks of information disclosure before deciding whether to share personal information [17,18]. These foundational studies provide the theoretical basis for examining customers’ willingness to share financial data within open banking, where disclosure decisions involve highly sensitive financial information.

According to Privacy Calculus Theory (PCT), people make a decision to share information based on the perceived risks and benefits [9]. Nevertheless, extended versions of PCT believe that a sense of being in control of personal data is an important factor that determines disclosure behaviour [10]. Perceived vulnerability decreases when people feel that they have the ability to track, control, or recall access to their information, making them more willing to reveal information [11].

Consent dashboards and revocation mechanisms are also usually included in the regulatory frameworks used in open banking environments [1]. However, psychological perception of control can be different from real regulatory protection. If customers think that they still have control over their financial information, they will have a higher level of confidence in using open banking services.

Although perceived data control has received increasing attention in privacy research, its role within open banking remains underexplored, particularly as a mechanism explaining how customers translate favourable perceptions of the open banking environment into willingness to share financial data. Within the Privacy Calculus Theory perspective, customers are unlikely to disclose sensitive financial information solely because they perceive a banking platform as secure, trustworthy, or useful. Rather, these favourable evaluations strengthen customers’ confidence that they retain meaningful control over their financial information, thereby increasing their willingness to authorize data sharing. Consequently, perceived data control is expected to directly promote willingness to share financial data while also serving as the underlying mechanism through which other antecedents influence disclosure behaviour.

H1: 

Perceived data control has a direct positive impact on willingness to share financial data.

2.5.2. Perceived Security Assurance

Perceived security assurance is an expression of the opinions of customers in relation to the effectiveness of technical protection and regulatory controls that protect their financial data. The importance of security perceptions in technology adoption has long been recognized in information systems research. Early studies demonstrated that users’ perceptions of system security significantly influence their trust and acceptance of electronic services, particularly when personal or financial information is involved [20,21]. These foundational findings provide the theoretical basis for examining perceived security assurance within contemporary digital financial services and open banking environments. Building on these foundational studies, recent research in FinTech settings shows that security indicators, including encryption, authentication protocols, and institutional controls, mitigate perceived risk and increase trust [6]. Empirical research has shown that perceived security is a strong predictor of FinTech production intention [6] and maintains trust in the aftermath of cybersecurity attacks [7,22] also confirmed that perceived security has a significant positive impact on users’ intention to adopt m-wallets, highlighting its role in digital financial behaviour.

In PCT, security assurance reduces the perceived risks associated with information disclosure by increasing customers’ confidence in the protection of their personal data [9]. However, favourable perceptions of security alone may not be sufficient to encourage customers to share sensitive financial information. Rather, security assurance strengthens customers’ confidence that they can effectively authorize, monitor, and revoke access to their financial data throughout the data-sharing process. Consequently, security assurance is expected to enhance customers’ perceived data control, which in turn increases their willingness to share financial information in an open banking environment.

The regulations of open banking create universal API security architectures [1]. However, behavioural responses by the customers lie in subjective perceptions of security as opposed to objective compliance. Perceived control can mediate the relationship between security and willingness to share, in case security mechanisms increase users’ confidence in handling the permissions of data.

Although previous studies have primarily examined security as a direct determinant of adoption, some recent studies have also considered indirect mechanisms in digital financial contexts. However, comparatively limited attention has been given to examining perceived data control as the mediating mechanism through which perceived security assurance influences customers’ willingness to share financial data in open banking contexts [6], without considering the mediating variables. This theoretical void is filled by integrating perceived data control. Similarly, a study by [23] confirmed that perceived security has a significant positive impact on users’ intention to adopt m-wallets, highlighting its role in shaping digital payment behaviour.

H2a: 

Perceived security assurance has a direct positive impact on willingness to share financial data.

H2b: 

Perceived security assurance has a direct positive impact on perceived data control.

2.5.3. Banks and FinTech Providers Trust

Trust is a fundamental building block of digital financial ecosystems. It is an indication of trust in the institution’s competence, integrity, and benevolence [11]. Trust has long been recognized as a fundamental determinant of individuals’ willingness to engage in uncertain online transactions. Seminal studies conceptualized trust in terms of competence, integrity, and benevolence and demonstrated its critical role in reducing uncertainty and facilitating technology adoption and electronic commerce [24,25]. These foundational perspectives provide the theoretical basis for examining trust in contemporary open banking environments. With open banking, customers are required to trust conventional banks as well as third-party FinTech providers [2].

Empirical studies have shown that trust is a strong indicator of intention to use open banking services [8] and FinTech adoption [6]. In addition, trust is stabilizing after disruptions in cybersecurity [7]. In PCT, trust decreases the perceived uncertainty and, in effect, reduces the psychological cost of the disclosure choices [9].

Nevertheless, trust may also strengthen customers’ perceptions of data control. Although trust reduces uncertainty regarding how financial information will be collected, managed, and shared, customers are unlikely to disclose sensitive financial data simply because they trust financial institutions. Rather, trust enhances customers’ confidence that consent mechanisms, data governance practices, and revocation procedures will operate in their interests, thereby strengthening their perception that they retain meaningful control over their financial information. Consequently, perceived data control is expected to transmit the positive influence of trust to customers’ willingness to share financial data.

Although trust has been widely examined as a direct predictor of technology adoption and disclosure intentions, considerably less attention has been given to its indirect influence through perceived data control within open banking contexts. This indirect route is an attempt to fill an empirical gap in the literature and concurs with theoretical developments in the privacy calculus. Prior studies in the context of FinTech have confirmed that trust plays a pivotal role in influencing the intentions or willingness of users to use the service [26].

H3a: 

Trust in banks and FinTech providers has a direct positive impact on willingness to share financial data.

H3b: 

Trust in banks and FinTech providers has a direct positive impact on perceived data control.

2.5.4. Perceived Usefulness

Perceived usefulness, originally introduced in the Technology Acceptance Model (TAM), refers to the degree to which an individual believes that using a particular system enhances his or her performance [27]. The construct has subsequently been validated across a wide range of technology contexts and recognized as one of the most influential determinants of technology adoption [28,29]. In the context of open banking, perceived usefulness reflects customers’ beliefs that open banking services improve financial efficiency, personalization, and decision-making, and it continues to play an important role in the adoption of digital financial services [9,15]. Under an open finance ecosystem, perceived benefit is raised through value propositions including aggregated financial dashboards, customized credit offers, and improved budgeting tools [5].

Within Privacy Calculus Theory, perceived usefulness represents the benefit component of the disclosure decision [9]. The higher the perceived benefits relative to the perceived risks, the greater the intention to disclose personal information [30]. However, recognizing the benefits of open banking does not necessarily lead customers to share financial data unless they also believe that they can control how that information is shared and managed. When customers perceive that data sharing is both valuable and under their control, they are more likely to regard disclosure as a voluntary and manageable decision rather than an unavoidable privacy risk. Consequently, perceived data control is expected to mediate the relationship between perceived usefulness and willingness to share financial data.

Although perceived usefulness has been widely examined as a direct determinant of technology adoption, comparatively limited attention has been given to its indirect influence on customers’ willingness to share financial data through perceived data control in open banking. Addressing this gap extends the application of Privacy Calculus Theory to open banking contexts.

H4a: 

Perceived usefulness has a direct positive impact on willingness to share financial data.

H4b: 

Perceived usefulness has a direct positive impact on perceived data control.

2.5.5. The Mediating Role of Perceived Data Control

Perceived data control refers to customers’ perception that they can authorize, monitor, manage, and revoke access to their personal financial information. The concept of perceived control has long been recognized as an important determinant of individuals’ behavioural responses in psychology and information systems research. Earlier studies showed that individuals are more willing to engage in information disclosure and online transactions when they believe they can exercise meaningful control over their personal information [18,31]. Control perceptions take centre stage in behavioural decision-making in open banking settings where information sharing is voluntary and reversible [1]. Privacy Calculus Theory implies that people take into consideration risks and benefits before information disclosure [9,17]; nonetheless, recent studies indicate that perceived control may mitigate psychological vulnerability and increase disclosure confidence [10,11]. The customers would feel empowered in the management of their data permissions, especially when they believe that there are high levels of security safeguards and credible institutions [6]. In the same manner, perceived usefulness can support the feeling that the sharing of data is meaningful and monitored. Thus, perceived data control is a major mediating force that transforms security, trust, and usefulness into the readiness to share financial information.

The mediating role of perceived data control is grounded in the proposition that favourable perceptions of security assurance, trust, and usefulness influence disclosure behaviour indirectly by strengthening customers’ confidence in their ability to control financial information. Rather than assuming that these antecedents independently produce willingness to share financial data, the proposed framework argues that they first shape customers’ perceptions of control over authorization, monitoring, and revocation of data sharing. This perception of control reduces psychological vulnerability and transforms favourable evaluations of the open banking environment into actual willingness to disclose financial information. Accordingly, perceived data control represents the central behavioural mechanism linking the antecedent constructs to willingness to share financial data.

H5a: 

Perceived security assurance positively impacts willingness to share financial data through perceived data control.

H5b: 

Trust in banks and FinTech providers has a positive impact on willingness to share financial data through perceived data control.

H5c: 

Perceived usefulness positively impacts willingness to share financial data through perceived data control.

2.5.6. The Moderating Role of Prior Experience and Age

Prior FinTech experience influences customers’ information disclosure behaviour by increasing their technological self-efficacy and reducing uncertainty in digital financial environments [9]. Customers with greater FinTech experience are generally more familiar with consent mechanisms, permission settings, and data-sharing dashboards, which strengthens their perception of control over personal financial information. Existing studies also suggest that greater digital literacy enhances users’ confidence in using financial technologies [15]. However, comparatively limited attention has been given to whether prior FinTech experience strengthens the relationship between perceived data control and willingness to share financial data within open banking contexts. Therefore, this study extends prior research by examining prior FinTech experience as a moderator of this relationship.

H6a: 

Prior FinTech experience positively moderates the relationship between perceived data control and willingness to share financial data.

Age has been widely recognized as an important factor influencing individuals’ privacy perceptions, risk assessments, and technology adoption behaviour [12,32]. Compared with younger users, older individuals generally perceive greater uncertainty and privacy risks when engaging with digital financial services, making them more cautious about disclosing personal financial information [12]. Consequently, they are more likely to rely on their perceived ability to authorize, monitor, manage, and revoke access to their financial data before deciding to disclose it. In other words, perceived data control becomes a more influential determinant of willingness to share financial data as users become more sensitive to potential privacy risks.

This argument is consistent with Privacy Calculus Theory, which suggests that individuals evaluate information disclosure decisions by balancing perceived benefits against perceived risks. Since older users generally perceive higher privacy-related risks, the availability of meaningful control over personal financial information becomes increasingly important in reducing perceived vulnerability and uncertainty. Therefore, the positive relationship between perceived data control and willingness to share financial data is expected to be stronger for older users than for younger users. Although age has frequently been incorporated as a control variable in studies of digital finance, its moderating role within Privacy Calculus Theory and open banking remains comparatively underexplored.

H6b: 

Age positively moderates the relationship between perceived data control and willingness to share financial data.

2.5.7. Conceptual Framework and Proposed Research Model

Figure 1 represents the conceptual framework of the proposed study that investigates the factors that determine the readiness of customers to share financial information in open banking. The model is a combination of direct, mediating, and moderating relationships that are based on Privacy Calculus Theory [9,17].

Figure 1. Proposed Model of the Study.

The perceived security assurances, trust toward banks and the FinTech providers, and the perceived usefulness are placed as the main antecedents affecting the intention to share financial data. Those constructs have both direct and indirect effects, with the intervening variable being perceived data control. Perceived data control is the perception of customers of their capacity to access and revoke their financial data, which is the key psychological process that transforms the perception of security, trust, and usefulness into the behavioural intention.

Also, experience in FinTech and age are introduced as moderating variables and affect the quality of the correlation between the perceived data control and the willingness to share financial information. This combined theory is a complete explanation of the data-sharing behaviour within the open banking environment.

3. Research Methodology

This study employs a quantitative research design to test the proposed model using survey data from digital banking users in Saudi Arabia. A structured questionnaire was developed based on measurement scales adapted from the existing literature and administered to respondents with relevant experience in digital banking and FinTech services. Partial Least Squares Structural Equation Modelling (PLS-SEM) was employed using SmartPLS 4 to analyze the data, while preliminary data screening was performed using SPSS 23. PLS-SEM was selected because it is well suited for complex models, prediction-oriented analysis, non-normal data, and the assessment of mediation and moderation effects [33,34]. The analysis was conducted in two stages. First, the measurement model was evaluated to assess reliability and validity. Second, the structural model was evaluated to test the hypothesized direct, mediating, and moderating relationships.

3.1. Instrument Development

This study employed a structured questionnaire to collect the data required to test the proposed research model. The questionnaire comprised two sections. The first section collected respondents’ demographic information, while the second section measured the five research constructs: Perceived Security Assurance (PSA), Trust in Banks and FinTech Providers (TBFP), Perceived Usefulness of Open Banking (PUOB), Perceived Data Control (PDC), and Willingness to Share Financial Data (WSFD). All measurement items were adapted or developed to measure respondents’ perceptions within the context of open banking, where customers voluntarily authorize the sharing of financial data with licensed third-party providers.

All constructs were measured using a five-point Likert scale ranging from 1 (“Strongly Disagree”) to 5 (“Strongly Agree”). Perceived Security Assurance (PSA) and Trust in Banks and FinTech Providers (TBFP) were each measured using four items, Perceived Usefulness of Open Banking (PUOB) and Perceived Data Control (PDC) were each measured using three items, and Willingness to Share Financial Data (WSFD) was measured using six items. The complete list of measurement items is presented in Appendix A.

The measurement items for four constructs were adapted from previously validated instruments to ensure content validity and consistency with the existing literature. Specifically, the items measuring Perceived Security Assurance and Trust in Banks and FinTech Providers were adapted from [35], Perceived Usefulness of Open Banking was adapted from [36], and Perceived Data Control was adapted from [37]. Since no established measurement scale adequately captured respondents’ willingness to share financial data in the context of open banking, the items for Willingness to Share Financial Data were developed specifically for this study based on the research objectives and informed by an extensive review of the literature on open banking, privacy, trust, and financial data-sharing behaviour. Appendix A presents the complete list of measurement items and their corresponding sources.

To ensure the validity and reliability of the measurement instrument, a systematic validation procedure was followed. First, the questionnaire, including both the adapted and newly developed items, was reviewed by three academic experts in information systems and financial technologies and two practitioners with experience in digital financial services. Their feedback was incorporated to improve the clarity, wording, and relevance of the questionnaire items. The revised questionnaire was then pre-tested with a small group of respondents to evaluate its readability and ease of understanding, and minor wording revisions were made where necessary.

Subsequently, a pilot study involving 90 respondents was conducted to evaluate the reliability and suitability of the measurement instrument before the main survey. The required sample size for the pilot analysis was estimated using G*Power version 3.1 based on the maximum number of predictors in the structural model and was also consistent with the 10-times rule recommended for PLS-SEM [38]. The pilot results confirmed that the questionnaire items were clear, understandable, and suitable for the main survey. No substantial issues relating to item clarity or wording were identified; therefore, the questionnaire was retained for the main survey.

3.2. Data Collection & Sample

The data were collected from customers of commercial banks operating across Saudi Arabia who regularly use digital financial services. The target population consisted of individuals holding an active account with a licensed commercial bank and using services such as mobile banking, internet banking, digital wallets, and other FinTech applications. Respondents represented customers from multiple commercial banks rather than a single banking institution, ensuring that the sample captured a broader range of digital banking users. These participants were considered appropriate for the study because they had direct experience with digital financial services and were therefore well positioned to evaluate issues related to data control, open banking, and financial data-sharing behaviour.

To capture geographical variation across the country, respondents were recruited from the Central, Western, Eastern, Southern, and Northern regions of Saudi Arabia. A mixed sampling approach was adopted. First, cluster sampling was used to ensure geographical representation across these regions. Subsequently, purposive sampling was applied within each region to recruit individuals who actively used digital banking and FinTech services. This approach ensured that participants possessed sufficient experience to evaluate the study constructs, including perceived data control, awareness of open banking, and willingness to share financial data.

Data were collected using a structured online questionnaire administered through Google Forms. Approximately 2500 survey invitations were distributed via social media platforms, professional networks, banking-related online communities, and personal contacts to reach eligible participants across Saudi Arabia. Before completing the questionnaire, respondents were informed about the purpose of the study, assured that participation was voluntary and anonymous, and asked to provide informed consent. Screening questions were used to ensure that only individuals holding an active bank account and regularly using digital banking or FinTech services participated in the study. A total of 405 responses were received, representing a 16.2% response rate. After data screening, 21 questionnaires were excluded because of missing or incomplete responses, resulting in 384 valid responses for the final analysis.

The final sample comprised 384 valid responses, which is considered adequate for quantitative research involving large populations [39,40]. In addition, the sample size exceeds the minimum requirements recommended for Partial Least Squares Structural Equation Modelling (PLS-SEM) and provides sufficient statistical power to estimate the proposed direct, mediating, and moderating relationships reliably [38]. Therefore, the sample size is appropriate for achieving the objectives of this study. Although a mixed cluster and purposive sampling approach was employed to enhance geographical representation across the five major regions of Saudi Arabia, the findings should be interpreted as representative of active digital banking users who meet the study’s inclusion criteria rather than the entire Saudi population.

All answers were anonymous. The study was explained to the participants, and their involvement in the survey was voluntary. Table 1 summarizes the demographic data of respondents, including their major characteristics, such as age, gender, region, education level, and previous experience with FinTech.

Table 1. Demographic Information of the Sample.

Category	Attributes	Frequency	Percentage (%)
Gender	Male	208	54.2
	Female	176	45.8
Age Group	18–24 years	122	31.8
	25–34 years	98	25.5
	35–44 years	88	22.9
	45 years and above	76	19.8
Education Level	High School/Diploma	87	22.7
	Bachelor’s Degree	123	32
	Master’s Degree	130	33.9
	Ph.D.	44	11.5
Region (Saudi Arabia)	Central	113	29.4
	Western	92	23.9
	Eastern	80	20.8
	Southern	54	14.1
	Northern	45	11.7
Bank Account (Screening)	Yes	384	100.0
Length of Relationship with Primary Banking Institution	Less than 2 years	70	18.2
	2 to 3 years	102	26.6
	4 to 5 years	98	25.5
	More than 5 years	114	29.7
Use of Digital Banking Channels	Mobile banking app	150	39.1
	Internet banking	82	21.4
	Branch only	48	12.5
	Both digital and branch	104	27.1
Prior FinTech Experience	Less than 2 years	92	24.0
	2 to 3 years	108	28.1
	4 to 5 years	96	25.0
	More than 5 years	88	22.9
Awareness of Open Banking in KSA	Not aware	94	24.5
	Heard of it	156	40.6
	Know it well	134	34.9

4. Empirical Analysis

SPSS 23 and SmartPLS 4 were used in data analysis. The analysis employed Partial Least Squares Structural Equation Modelling (PLS-SEM) using SmartPLS 4. PLS-SEM was selected because the objective of this study was to estimate a comprehensive structural model that simultaneously examined multiple direct, mediating, and moderating relationships among latent constructs. The analysis focused on explaining the variance in customers’ willingness to share financial data and perceived data control rather than evaluating the overall fit of an established covariance structure. Moreover, PLS-SEM has been widely adopted in recent information systems, FinTech, and open banking research investigating similar behavioural models, making it an appropriate analytical technique for the present study [35,38].

Data screening, which involved cleaning, handling of missing values, common method bias evaluation, and linearity, was initiated using SPSS 23. The model and test relationships were estimated using SmartPLS 4 after this. It was done in two steps: measurement model evaluation and structural model evaluation.

4.1. Assessment of Common Method Bias

Common method bias (CMB) may occur when data for both the independent and dependent variables are collected from the same respondents using a self-reported survey, potentially introducing systematic measurement error [41]. To minimize this risk, several procedural remedies were implemented during the survey design and data collection process. Participation was voluntary, respondents were assured of anonymity and confidentiality, informed consent was obtained prior to participation, and only validated measurement scales adapted from previous studies were used. In addition, screening questions ensured that only eligible digital banking users participated in the survey.

Following data collection, Harman’s single-factor test was employed to assess the presence of CMB. The first factor accounted for 29.45% of the total variance, which is below the recommended 50% threshold, indicating that CMB is unlikely to be a serious concern. Furthermore, a full collinearity assessment was conducted using PLS-SEM procedures. Variance Inflation Factor (VIF) values were examined at both the item and construct levels, and all values were below 3.3, suggesting that neither multicollinearity nor common method bias threatens the validity of the findings [42]. Overall, both the procedural and statistical assessments indicate that common method bias is unlikely to have materially influenced the study’s results.

4.2. Measurement Model Analysis

The reliability and validity of the measurement model were evaluated using the PLS-SEM measurement model assessment, including indicator loadings, Cronbach’s alpha, composite reliability (CR), average variance extracted (AVE), and discriminant validity. Table 2 presents the results of the PLS-SEM measurement model assessment. Internal consistency was assessed using Cronbach’s alpha and CR. Following, internal consistency was assessed using Cronbach’s alpha and Composite Reliability (CR). Every construct had the desired 0.70 threshold. The alpha coefficients were between 0.847 and 0.906, with CR coefficients between 0.847 and 0.924, which showed satisfactory internal consistency.

Table 2. Reliability & Convergent Validity Tests Summary.

Construct	α > 0.7	Composite Reliability > 0.7	Items	Indicators’ Reliability ≥ 0.7	AVE > 0.5
PDC	0.906	0.924	PDC1	0.873	0.842
			PDC2	0.937
			PDC3	0.941
PSA	0.874	0.876	PSA1	0.849	0.725
			PSA2	0.843
			PSA3	0.865
			PSA4	0.847
PUOB	0.847	0.847	PUOB1	0.874	0.765
			PUOB2	0.878
			PUOB3	0.872
TBFP	0.896	0.899	TBFP1	0.861	0.763
			TBFP2	0.900
			TBFP3	0.839
			TBFP4	0.891
WSFD	0.901	0.902	WSFD1	0.847	0.671
			WSFD2	0.827
			WSFD3	0.800
			WSFD4	0.845
			WSFD5	0.839
			WSFD6	0.753

Outer loadings were used to assess the indicator reliability. All items showed loadings above 0.70 [38], ranging from 0.753 to 0.941. Since all the indicators were within the desired level, no items were dropped, confirming that they are all sufficient to show their respective construct.

Average Variance Extracted (AVE) was used to test convergent validity. The values of AVE are between 0.671 and 0.842, which is higher than the minimum of 0.50 [38]. This implies that every construct accounts for a substantial amount of variance in its indicators.

Generally, the constructs PDC, PSA, PUOB, TBFP, and WSFD have a good level of reliability and convergent validity, which can be used in the structural model analysis.

Discriminant validity was also tested to ensure that the constructs were different by considering both the Heterotrait–Monotrait (HTMT) ratio and Fornell–Larcker criterion. According to Table 3, the entire set of HTMT ratios is significantly lower than the suggested cut-off of 0.90 [43]. The values fall within the range of 0.380 to 0.641, with the strongest correlation recorded between TBFP and WSFD (0.641). The results show that there is apparent separation of the constructs since none of the values are at the threshold.

Table 3. Heterotrait–Monotrait Ratio (HTMT).

Latent Variables	PDC	PSA	PUOB	TBFP	WSFD
PDC
PSA	0.380
PUOB	0.395	0.412
TBFP	0.414	0.462	0.428
WSFD	0.526	0.572	0.595	0.641

Additional evidence is presented by the Fornell–Larcker assessment presented in Table 4. The diagonal elements, which represent the square root of AVE, are consistently greater than the corresponding inter-construct correlations. For example, the diagonal values for PDC (0.918), PSA (0.851), PUOB (0.875), TBFP (0.873), and WSFD (0.819) all exceed their respective correlations with other constructs.

Table 4. Outcomes of Fornell–Larcker Criterion.

Latent Variables	PDC	PSA	PUOB	TBFP	WSFD
PDC	0.918
PSA	0.342	0.851
PUOB	0.349	0.358	0.875
TBFP	0.376	0.409	0.374	0.873
WSFD	0.481	0.511	0.521	0.578	0.819

Taken together, the findings from both approaches confirm that the constructs exhibit satisfactory discriminant validity and are conceptually distinct.

4.3. Model Fit Indices

Model fit was evaluated using several indices obtained from the PLS-SEM results. The SRMR value of 0.049 is below the recommended threshold of 0.08, indicating a good model fit. The discrepancy measures, d_ULS (0.504) and d_G (0.298), are within acceptable ranges, suggesting minimal difference between the empirical and model-implied covariance matrices. The chi-square value is reported as 710.418, which is expected to be sensitive to sample size in PLS-SEM. Additionally, the NFI value of 0.862 indicates an acceptable level of model fit. Overall, these results suggest that the model demonstrates a satisfactory fit to the data.

4.4. Structural Model Assessment (R², f², VIF, Q²)

After validating the measurement model, the structural model was examined using R², f², inner VIF, and Q² in line with PLS-SEM guidelines [38]. As reported in Table 5, the R² values indicate that PDC has a value of 0.217, while WSFD shows a higher value of 0.524. This suggests weak explanatory power for PDC and moderate explanatory power for WSFD based on the recommended thresholds of 0.25, 0.50, and 0.75 [38]. The adjusted R² values are quite near the initial estimates, and this shows that the model is stable.

Table 5. Results of Structural Model Assessment (R², f², VIF, Q²).

Statistical Indicators	Endogenous Variables	R Square		R Square Adjusted	Criteria
Coefficient of Determination (R2)	PDC	0.217		0.210	0.75: Substantial, 0.50: Moderate, 0.25: Weak [38]
	WSFD	0.524		0.519
Effect Size (f2)	Exogenous Variables	PDC		WSFD	0.35 = large effect 0.15 = medium effect 0.02 = weak effect [38]
	PDC			0.063
	PSA	0.031		0.079
	PUOB	0.041		0.105
	TBFP	0.052		0.156
Collinearity (Inner VIF)	Exogenous Variables	PDC		WSFD	VIF ≤ 3.3 [38]
	PDC			1.277
	PSA	1.276		1.316
	PUOB	1.235		1.286
	TBFP	1.293		1.361
Predictive Relevance Q2	Exogenous Variables	Q2 predict	RMSE	MAE	A Q2 value greater than zero shows that the exogenous constructs have predictive relevance for the endogenous construct. [38]
	PDC	0.198	0.900	0.712
	WSFD	0.482	0.722	0.559

The results of the effect size (f²) show that the majority of the relationships have small effects. For WSFD, TBFP shows a medium effect (0.156), while PUOB (0.105), PSA (0.079), and PDC (0.063) exhibit weak effects. In the case of PDC, none of the predictors, such as PSA (0.031), PUOB (0.041), or TBFP (0.052), has a strong contribution. These results are in line with known cut-offs of 0.02, 0.15, and 0.35 [38]. Inner VIF values were used to measure collinearity. The VIF scores are between 1.235 and 1.361, much lower than the level of 3.3, which implies that multicollinearity is not a concern in the model [38].

Q 2 was used to determine predictive relevance. The Q2 of PDC (0.198) and WSFD (0.482) are both positive, which proves the model has a sufficient predictive relevance [38]. Generally, the structural model has satisfactory explanatory power and forecasting.

4.5. Structural Model Results (Hypotheses Testing)

To test the hypothesized relationships, a bootstrapping procedure that used 10,000 resamples in SmartPLS 4 was used. Path significance was evaluated by [38], with the help of β, t-values, and p-values. Table 6 presents the results of the direct and mediation effects. These findings are shown in Figure 2.

Table 6. Structural Model Assessment.

Hyp. No.	Path.	Beta (β)	Standard Deviation	T Statistics	p Values	95% BC CI	Remarks
H1	PDC → WSFD	0.196	0.046	4.278	0.000	0.107–0.287	Supported
H2a	PSA → WSFD	0.223	0.041	5.396	0.000	0.143–0.305	Supported
H2b	PSA → PDC	0.177	0.062	2.850	0.004	0.053–0.298	Supported
H3a	TBFP → WSFD	0.318	0.038	8.397	0.000	0.240–0.391	Supported
H3b	TBFP → PDC	0.229	0.047	4.872	0.000	0.135–0.319	Supported
H4a	PUOB → WSFD	0.254	0.046	5.549	0.000	0.167–0.349	Supported
H4b	PUOB → PDC	0.200	0.050	3.983	0.000	0.104–0.297	Supported
H5a	PSA → PDC → WSFD	0.035	0.017	2.103	0.036	0.010–0.075	Partial Mediation Confirmed
H5b	TBFP → PDC → WSFD	0.045	0.015	2.969	0.003	0.021–0.080	Partial Mediation Confirmed
H5c	PUOB → PDC → WSFD	0.039	0.014	2.808	0.005	0.018–0.073	Partial Mediation Confirmed

Note: Partial mediation is confirmed because both the indirect paths (H5a, H5b, H5c) and the corresponding direct paths (PSA → WSFD, TBFP → WSFD, and PUOB → WSFD) are significant.

Figure 2. Bootstrapping Results.

The direct effects indicate that all the suggested relationships are positive and significant. H1 is supported, indicating that PDC significantly influences WSFD (β = 0.196, t = 4.278, p < 0.001). H2a and H2b are also supported, confirming that PSA has a significant effect on WSFD (β = 0.223, t = 5.396, p < 0.001) and PDC (β = 0.177, t = 2.850, p = 0.004). Similarly, H3a and H3b are supported, showing that TBFP significantly affects WSFD (β = 0.318, t = 8.397, p < 0.001) and PDC (β = 0.229, t = 4.872, p < 0.001). The results further support H4a and H4b, indicating that PUOB has a positive and significant impact on WSFD (β = 0.254, t = 5.549, p < 0.001) and PDC (β = 0.200, t = 3.983, p < 0.001).

The mediation analysis also reveals significant indirect effects. H5a shows that PSA → PDC → WSFD is significant (β = 0.035, t = 2.103, p = 0.036). Likewise, H5b confirms that TBFP → PDC → WSFD is significant (β = 0.045, t = 2.969, p = 0.003), and H5c indicates that PUOB → PDC → WSFD is also significant (β = 0.039, t = 2.808, p = 0.005).

Through the direct paths (e.g., PSA → WSFD, TBFP → WSFD, PUOB → WSFD), as well as the indirect paths through PDC, both the direct and the indirect ones are important, and the mediation can be referred to as partial. This implies that PDC is a complementary process by which PSA, TBFP, and PUOB affect WSFD, but their direct impacts are not eliminated.

In general, the findings have good empirical support for all hypothesized relationships and found both the mediated and the direct effects in the structural model.

4.6. Assessment of the Moderating Role of Prior Experience and Age; Multi-Group Analysis

The dataset has respondents of different age cohorts, as well as different backgrounds of prior experience in FinTech, which can affect the correlation between the study constructs. Disregarding such heterogeneity in PLS-SEM may have an impact on the validity of the results [38]. The differences may be evaluated with the help of moderator analysis or multi-group analysis [38]. To this end, two groups were formed from the sample on the basis of age, including Younger Customers (Age < 35 years) and Older Customers (Age ≥ 35 years). The two groups of customers consisted of 220 respondents (Younger Customers) and 164 respondents (Older Customers).

In like manner, the two groups were made based on previous experience in FinTech, with Lower FinTech Experience (Experience ≤ 3 years) and Higher FinTech Experience (Experience > 3 years). The less experienced group was 200 cases, and the more experienced group was 184 cases.

The two groupings met the minimum sample size requirements. With three paths leading to the most complex endogenous construct, Hair’s guideline suggests a minimum of 30 observations [38]. In addition, the recommended range of 85–130 cases based on G*Power (version 3.1.9.7) was exceeded in all groups, indicating sufficient statistical power for conducting MGA. Therefore, sample size does not pose a limitation in this analysis.

The study used two conditions to assess moderation effects, following [34]. First, the path coefficient is significant in one group but not in the other. Second, both coefficients are significant but differ in direction. These conditions guided the evaluation of moderation. Table 7 presents the MGA results based on prior experience groups, while Table 8 reports the results for age-based groups.

Table 7. Group Characteristics Based on Prior Experience.

Hyp.	β (H.F.E.)	β (L.F.E.)	t Value (H.F.E.)	t Value (L.F.E.)	p Value (H.F.E.)	p Value (L.F.E.)	Remarks
PDC → WSFD	0.136	0.273	2.096	4.540	0.036	0.000	Moderation Not Confirmed
PSA → WSFD	0.216	0.238	3.978	3.941	0.000	0.000	Moderation Not Confirmed
PSA → PDC	0.136	0.201	1.560	2.192	0.119	0.028	Moderation Confirmed
TBFP → WSFD	0.370	0.266	6.076	5.674	0.000	0.000	Moderation Not Confirmed
TBFP → PDC	0.256	0.202	4.034	2.913	0.000	0.004	Moderation Not Confirmed
PUOB → WSFD	0.286	0.200	4.765	2.993	0.000	0.003	Moderation Not Confirmed
PUOB → PDC	0.149	0.247	2.247	3.090	0.025	0.002	Moderation Not Confirmed
PSA → PDC → WSFD	0.019	0.055	1.029	1.961	0.303	0.050	Moderation Confirmed
TBFP → PDC → WSFD	0.035	0.055	1.695	2.216	0.090	0.027	Moderation Confirmed
PUOB → PDC → WSFD	0.020	0.067	1.450	2.385	0.147	0.017	Moderation Confirmed

H.F.E.: Higher FinTech Experience, L.F.E.: Lower FinTech Experience.

Table 8. Group Characteristics Based on Age.

Hyp.	β (O.C.)	β (Y.C.)	t Value (O.C.)	t Value (Y.C.)	p Value (O.C.)	p Value (Y.C.)	Remarks
PDC → WSFD	0.187	0.225	2.437	3.739	0.015	0.000	Moderation Not Confirmed
PSA → WSFD	0.258	0.204	4.350	3.458	0.000	0.001	Moderation Not Confirmed
PSA → PDC	0.114	0.205	1.299	2.369	0.194	0.018	Moderation Confirmed
TBFP → WSFD	0.320	0.297	4.782	6.599	0.000	0.000	Moderation Not Confirmed
TBFP → PDC	0.317	0.183	4.692	2.931	0.000	0.003	Moderation Not Confirmed
PUOB → WSFD	0.217	0.309	3.256	5.370	0.001	0.000	Moderation Not Confirmed
PUOB → PDC	0.137	0.233	1.935	3.216	0.053	0.001	Moderation Confirmed
PSA → PDC → WSFD	0.021	0.046	0.916	1.841	0.360	0.066	Moderation Not Confirmed
TBFP → PDC → WSFD	0.059	0.041	2.117	2.004	0.034	0.045	Moderation Not Confirmed
PUOB → PDC → WSFD	0.026	0.052	1.327	2.388	0.185	0.017	Moderation Confirmed

O.C.: Older Customers, Y.C.: Younger Customers.

4.6.1. Prior-Experience Group Specific Characteristics (H6a)

As indicated by the results in Table 7 below, moderation effects based on prior FinTech experience were observed in four paths: PSA → PDC, PSA → PDC → WSFD, TBFP → PDC → WSFD, and PUOB → PDC → WSFD, where the group differences met the required criteria.

PSA → PDC (Perceived Security Assurance → Perceived Data Control):

The Beta for the Higher FinTech Experience group (β = 0.136, p = 0.119) is positive but not significant, while for the Lower FinTech Experience group (β = 0.201, p = 0.028), it is positive and significant. It shows the effect of moderation, with the perceived security assurance and perceived data control having a stronger and more significant correlation amongst users with lower FinTech experience. The large impact on the lower experience group indicates that such users depend more on security assurances in order to believe that they have control over their financial information. Conversely, the relationship is less strong and non-significant in the case of more experienced users, who can already have confidence or familiarity and thus need not be dependent on security cues.

PSA → PDC → WSFD (Indirect Effect):

The Beta of the Higher FinTech Experience group (β = 0.019, p = 0.303) is positive and not significant, and that of the Lower FinTech Experience group (β = 0.055, p = 0.050) is positive and marginally significant. This suggests a moderation effect, which means that the indirect relationship between an increase in perceived security assurance and willingness to share financial data in the form of perceived data control is greater among lower-experience users. This implies that in the case of less experienced users, security assurance boosts perceived control and subsequently makes them more willing to share financial data. For more advanced users, this indirect route is insignificant and can be bypassed.

TBFP → PDC → WSFD (Indirect Effect):

The Beta of the Higher FinTech Experience group is positive but unimportant (β = 0.035, p = 0.090), whereas the Beta of the Lower FinTech Experience group (β = 0.055, p = 0.027) is positive and significant. This establishes a moderation effect, where the indirect correlation between trust in banks and FinTech providers and readiness to share financial data by perceived data control is stronger among less experienced users. The meaningful outcome suggests that trust will translate to a higher willingness to share the data, as the perceived control will be enhanced among less experienced users. Conversely, the mechanism is less potent in the case of more advanced users.

PUOB → PDC → WSFD (Indirect Effect):

The Beta for the Higher FinTech Experience group (β = 0.020, p = 0.147) is positive but not significant, whereas for the Lower FinTech Experience group (β = 0.067, p = 0.017), it is positive and significant. This indicates a moderation effect, suggesting that the indirect impact of perceived usefulness of open banking on willingness to share financial data through perceived data control is more relevant for users with lower FinTech experience. This implies that less experienced users depend more on perceived usefulness to build a sense of control, which then drives their willingness to share data, while this pathway is less influential for experienced users.

Overall, these findings show that moderation occurs mainly in the mediated relationships, with users having lower FinTech experience being more sensitive to mechanisms involving perceived data control when forming their willingness to share financial data.

4.6.2. Age Group Specific Characteristics (H6b)

As shown in Table 8, moderation effects based on Age were identified in three paths, namely PSA → PDC, PUOB → PDC, and PUOB → PDC → WSFD, where the group differences satisfied the required criteria.

PSA → PDC (Perceived Security Assurance → Perceived Data Control):

The Beta for Older Customers (β = 0.114, p = 0.194) is positive but not significant, while for Younger Customers (β = 0.205, p = 0.018), it is positive and significant. This demonstrates a moderation effect, as the relationship between perceived security assurance and perceived data control is stronger and more significant for younger customers. The high impact among the younger population indicates that the young population depends more on security assurances as a means to feel in command of their financial information. Conversely, among older customers, this relationship is less strong and significant, which suggests that security assurance does not play a significant role in perceived control among older customers.

PUOB → PDC (Perceived Usefulness of Open Banking → Perceived Data Control):

The Beta of Older Customers (β = 0.137, p = 0.053) is a positive and non-significant value, but in the case of Younger Customers (β = 0.233, p = 0.001) is a positive and significant value. This helps moderate the effect, meaning that perceived usefulness is more influential on perceived data control in younger customers. This indicates that younger users are more inclined to translate the advantages of open banking into higher levels of control over their data, whereas older users are not affected by this perception as much.

PUOB → PDC → WSFD (Indirect Effect):

For Older Customers (β = 0.026, p = 0.185), the Beta is positive but not significant, whereas for Younger Customers (β = 0.052, p = 0.017), the Beta is significant and positive. This establishes a moderating effect, as the indirect relationship between perceived usefulness of open banking and willingness to share financial data in terms of perceived data control is greater among younger customers. The large effect shows that among younger users, perceived usefulness increases willingness to share the data by making them feel more in control. Conversely, this is an indirect route that is not as potent or persuasive to older customers.

In general, these results show that younger customers will be more susceptible to security assurance and perceived usefulness in forming their opinion about the control of data and, consequently, the desire to provide financial information.

5. Discussion

The paper explored the effects of Perceived Security Assurance, Trust in Banks and FinTech Providers, and Perceived Usefulness of Open Banking on Willingness to Share Financial Data and the mediating effect of perceived data control. The results give strong confirmation of the Privacy Calculus Theory lens of the study, where it is believed that there is a balance of benefits, risk, and control perceptions in the decision of disclosures. Previous open banking research has primarily focused on regulation, technology adoption, and customer loyalty, while comparatively less attention has been devoted to explaining the psychological mechanisms underlying customers’ willingness to share financial data. The present findings extend Privacy Calculus Theory by demonstrating that perceived data control is a central psychological mechanism through which perceived security assurance, trust, and perceived usefulness influence financial data-sharing behaviour in the open banking context. The current findings fill that knowledge gap and expand the body of open banking literature in a Saudi context.

To begin with, Willingness to Share Financial Data was positively and significantly influenced by Perceived Data Control. This result reinforces the argument that has been built in the manuscript that customers are more willing to give out financial information if they perceive that they can monitor, manage, and revoke access to the information. It is thus aligned with Privacy Calculus Theory and previous research that perceived control decreases vulnerability and enhances disclosure confidence [9,10,11,17]. This finding suggests that customers’ disclosure decisions are influenced not only by favourable evaluations of the open banking environment but also by their confidence that they retain meaningful control over their financial information throughout the data-sharing process. Instead of refuting earlier studies, this finding supports recent arguments according to which classical models of privacy calculus are not complete without considering control as a key psychological aspect of disclosure.

Second, the Perceived Security Assurance had a strong positive impact on the Perceived Data Control and Willingness to Share Financial Data. This contributes to previous research that indicates that positive security perceptions minimise risk and make people more willing to use digital finance [6,7]. What is more important, the discovery confirms the argument of the manuscript that security is not the only effective predictor. It also enhances the confidence of users that data-sharing procedures are under control and secure. This indicates that security mechanisms reduce perceived uncertainty by strengthening customers’ confidence that they can safely authorise and manage access to their financial data. In this sense, the result moves beyond earlier linear models and gives empirical support to the proposed indirect route through control.

Third, Trust in Banks and FinTech Providers also had significant positive effects on both Perceived Data Control and Willingness to Share Financial Data. This finding aligns with prior open banking and FinTech studies that place trust at the centre of digital service use and reduced uncertainty [6,8,11]. The result also supports the manuscript’s view that trust is not limited to traditional banks, but extends to third-party providers operating in open banking ecosystems. At the same time, the positive path from trust to perceived control adds to the literature by showing that trusted institutions not only lower perceived risk, but also make customers feel that consent and data governance mechanisms are reliable and under their command. Accordingly, trust contributes to disclosure not only by reducing uncertainty but also by reinforcing customers’ confidence that they remain in control of their financial information.

Fourth, Perceived Usefulness of Open Banking had a significant impact on Perceived Data Control and Willingness to Share Financial Data. This aligns with previous literature demonstrating that perceived benefits, including enhanced financial advice, personalization, and increased value of service, are the motivators to adopt digital banking and open banking [5,9,15]. The current outcome confirms, but does not refute, this line of study. Nevertheless, it does this by making it longer and demonstrating how usefulness also enhances the feeling that data sharing is a dynamic, valuable, and manageable decision. It is significant as it demonstrates that customers are not only sensitive to the value of open banking, but also whether they can achieve it in the circumstances of their personal control. This finding indicates that customers are more willing to disclose financial information when the perceived benefits of open banking are accompanied by confidence that data sharing remains voluntary and manageable.

Lastly, the mediation findings indicate that Perceived Data Control partially mediates the impacts of Perceived Security Assurance, Trust in Banks and FinTech Providers, and Perceived Usefulness on Willingness to share financial data. These results are a significant contribution to the main argument of the manuscript that control is a major missing element in open banking behaviour models. Security, trust, and usefulness have an indirect and direct impact on disclosure since both the direct and indirect effects are significant, and they act upon disclosure through two mechanisms: they impact willingness directly, and they do so through perceived control. These findings extend recent open banking research by demonstrating that security, trust, and usefulness influence disclosure behaviour through both direct and indirect pathways, with perceived data control serving as the central psychological mechanism.

Besides the primary effects, the multi-group analysis would contribute additional information regarding the differences in the relationships between the groups of users based on their previous experience with FinTech and their age. The findings indicate that moderation predominantly appears in the routes that entail perceived data control. Perceived usefulness and perceived security assurance have stronger and more significant influences on perceived data control among less experienced FinTech users and younger customers and, in turn, willingness to share financial data. However, these effects are less strong or not important in the case of more experienced users and older customers. This implies that less experienced and younger users are more dependent on outside indicators like safety and utility to develop a feeling of control, which subsequently leads to their data-sharing decisions. Older and more experienced users seem less reliant on these mechanisms, which may be because they are more familiar with them, have more confidence in them, or trust digital financial systems. These results extend the Privacy Calculus perspective by demonstrating that the role of perceived data control is not universal across users but is more pronounced among individuals with less FinTech experience or greater sensitivity to digital environments. These findings further suggest that the influence of perceived data control is contingent upon user characteristics, reinforcing the importance of considering individual differences when applying Privacy Calculus Theory to open banking.

6. Implications

6.1. Theoretical Implications

This paper contributes to theory in a number of ways, especially to the use of Privacy Calculus Theory (PCT) in open banking. First, it builds on PCT by making Perceived Data Control a key mediating variable instead of just disclosure being a risk-benefit trade-off. The perceived risk, trust and usefulness have been the main predictors of disclosure intention, as examined in prior studies. In this work, the factors are demonstrated to act in the form of a cognitive control process too. This gives PCT more depth, in that the users are not evaluating outcomes alone, but also their capacity to control their outcomes.

Second, the results address an evident gap in open banking literature that is found in the manuscript. The available literature is concentrated on adoption intention or the problems at the ecosystem level. This paper changes focus to the more basic behaviour of willingness to share financial data, the fundamental action that will make open banking a reality. In doing this, it narrows the scope of behavioural interest in digital finance research and subordinates it to the way open banking systems work in reality.

Third, the research is valuable in that it incorporates security, trust, and usefulness as a single construct that has direct and indirect impacts. Earlier models tend to model these constructs separately or to make assumptions of simple linear relations. In the current results, the interactive relationship between these variables is found in Perceived Data Control, which provides a more stratified account of user behaviour. This echoes current demands for more extensive behavioural models in FinTech and open banking environments.

The multi-group analysis also builds upon Privacy Calculus Theory by demonstrating that the perceived data control role is not the same among users. The results show that the control-based mechanisms have more power in users who have less experience in FinTech and younger clients, whereas more experienced and older customers engage with them less. It underscores the importance of introducing user heterogeneity to PCT since the trade-offs between security, usefulness, and control will differ across segments. It implies that models in the future ought to go beyond the aggregate approach to analysis and take into account group-specific differences in behaviour.

Lastly, the research contributes to the contextual value of the research since it provides evidence in a developing open banking environment. Most of the current research is founded on mature markets. The research enhances the external validity of the PCT and demonstrates the applicability of control-based mechanisms in various regulatory and cultural contexts by testing the model in Saudi Arabia.

6.2. Implications to Practice

The findings of this study provide practical guidance for banks, FinTech companies, regulators, and policymakers involved in the implementation of open banking in Saudi Arabia. The results demonstrate that Perceived Data Control (PDC) is a central mechanism through which perceived security assurance, trust, and perceived usefulness influence customers’ willingness to share financial data. Therefore, financial institutions should treat customer control over personal financial information as a core design principle rather than merely a regulatory requirement. Open banking platforms should incorporate intuitive consent management dashboards, granular permission settings, real-time notifications of data access, access history, and simple mechanisms for modifying or revoking data-sharing permissions. Such features can strengthen customers’ perception of control and encourage greater participation in open banking services.

The significant direct and indirect effects of Perceived Security Assurance (PSA) suggest that financial institutions should focus not only on implementing robust technical security measures but also on making these protections visible and understandable to customers. Security mechanisms such as multi-factor authentication, real-time fraud alerts, encryption indicators, and transparent explanations of data protection practices should be clearly communicated through digital banking applications. Increasing customers’ awareness of these safeguards can enhance both their confidence in the security of the platform and their perceived control over financial data sharing.

The findings also highlight the importance of Trust in Banks and FinTech Providers (TBFP) in promoting customers’ willingness to share financial data. Since trust significantly enhances perceived data control, banks and FinTech providers should strengthen transparency in data governance by clearly communicating how customer data are collected, shared, stored, and protected. In addition, institutions should establish rigorous governance and certification standards for third-party providers, disclose partnership arrangements, and respond promptly to security incidents. These initiatives can reinforce customer confidence in the entire open banking ecosystem rather than in individual service providers alone.

The significant influence of Perceived Usefulness of Open Banking (PUOB) indicates that customers are more willing to share financial information when they perceive clear and immediate benefits from doing so. Accordingly, banks and FinTech companies should develop customer-centric services that deliver tangible value, such as personalized financial advice, intelligent budgeting tools, integrated payment solutions, automated investment recommendations, and consolidated financial management platforms. Clearly demonstrating these benefits can increase customers’ willingness to authorize financial data sharing and promote sustained engagement with open banking services.

The moderating effects of age and FinTech experience further suggest that customer engagement strategies should be tailored to different user segments rather than adopting a uniform approach. Younger and less experienced users may benefit from simplified consent interfaces, guided onboarding processes, educational tutorials, and enhanced communication regarding security and privacy protections. Conversely, older and more experienced users are likely to place greater emphasis on advanced functionality, service integration, reliability, and long-term institutional trust. Segment-specific communication and service design can therefore improve customer confidence and increase adoption across diverse user groups.

Finally, the findings offer important implications for policymakers and regulators responsible for advancing Saudi Arabia’s open banking initiative. Beyond establishing technical standards, regulatory authorities should promote standardized consent management practices, transparent data-sharing protocols, certification frameworks for third-party providers, and public awareness campaigns that improve consumers’ understanding of open banking. Such initiatives can strengthen trust, enhance perceived data control, and accelerate the sustainable adoption of open banking services. Overall, the findings suggest that successful open banking implementation requires an integrated strategy that simultaneously strengthens security assurance, trust, perceived usefulness, and customer control over financial data, thereby fostering greater customer participation and supporting the long-term sustainability of the open banking ecosystem.

7. Limitations and Future Research Avenues

There are a number of limitations associated with this study. To begin with, the data was gathered through a cross-sectional survey that captures perceptions at a given time. This leads to the cautious drawing of causal inferences. Longitudinal designs can be used in the future to study the changes in perceptions of security, trust, usefulness, and data control over time, particularly with the maturation of open banking in Saudi Arabia.

Second, the research is based on self-reported data and thus is subject to common method bias and social desirability effects. Though they took standard procedures to reduce bias, it is possible to use multi-source data or behavioural data, like actual usage or data-sharing logs, to enhance validity in future studies.

Third, the sampling method was narrowed down to users with prior experience of using digital banking and FinTech services. Although this suits the study context well, it might restrict the generalizability to less digitally literate populations or non-users. In future studies, it is possible to incorporate wider groups, including those who have never used the platform or those who are less exposed to digital technology, in order to gain a clearer insight into the obstacles to adoption.

Fourth, the research was done in Saudi Arabia. Though this offers a great understanding of an open banking landscape that is developing at a fast pace, the cultural, regulatory, and technological aspects might vary in various nations. The model can be replicated in other regions to emphasize the strength of the model and its cross-cultural validity in future studies.

Lastly, the proposed model does not exhaust all potential factors influencing customers’ willingness to share financial data. Although age and prior FinTech experience were incorporated as theoretically grounded moderating variables, other demographic and behavioural characteristics were not included in the model. Future research may incorporate variables such as gender, education, awareness of open banking, digital banking usage, and digital literacy as control variables to further examine their influence on customers’ willingness to share financial data and to assess the robustness of the proposed model across different user groups. In addition, future studies may extend the model by incorporating other theoretically relevant constructs, such as perceived risk and privacy concerns, to provide a more comprehensive understanding of financial data-sharing behaviour in open banking environments.

8. Conclusions

This paper explored the factors that influence the willingness to disclose financial information in open banking through the incorporation of perceived security assurance, trust in banks and FinTech providers, and perceived usefulness into a Privacy Calculus framework. The results indicate that these attributes affect data-sharing behaviour directly and indirectly, as perceived data control and disclosure decisions are not made solely on risks and benefits analysis but on the level of user control over personal data. The findings indicate that perceived data control is a key factor that determines user behaviour. Customers become more confident to share their data when they think that they can monitor and manage it. This supports the thesis statement that control is a major psychological process in open banking, as opposed to a minor consideration. Moreover, the research indicates that the three components of security, trust, and usefulness do not work independently. They both reinforce perceived control and subsequently lead to the intention to provide financial information. The multi-group analysis also offers additional richness in that these relationships differ amongst user segments. Perceived control is more impacted by security and usefulness when the user has less experience with FinTech and when the customer is younger. This indicates that user attributes affect data-sharing choices, and perceived control is more significant among less experienced or more sensitive individuals to online settings. In general, the paper provides a more exhaustive description of customer behaviour in open banking by integrating direct, mediated, and moderated relationships. It pushes the level of knowledge beyond adoption intention in general and the actual decision of behaviour that facilitate open banking systems. The insights have merit for theory and practice, especially in new digital finance settings where customer engagement is one of the main issues.