Open finance: the next level for data sharing

Few con­sumers have like­ly heard of open bank­ing and even few­er of open finance. But behind the scenes, reg­u­la­tors have been busy design­ing new mod­els, stan­dards and infra­struc­ture that force banks to share data with third-par­ty providers like fin­tech com­pa­nies.

Reg­u­la­tors’ aim for open finance – the next stage in the open bank­ing jour­ney – is to encour­age inno­va­tion and com­pe­ti­tion by reduc­ing some of the con­trol banks have over valu­able cus­tomer data. 

The scope of open bank­ing in the UK has so far been lim­it­ed to pay­ment accounts. How­ev­er, open finance will force banks to make data avail­able to third par­ties with explic­it con­sumer con­sent on a wider selec­tion of con­sumer data, includ­ing mort­gages, sav­ings accounts, insur­ance, and more. This will be achieved via an appli­ca­tion pro­gram­ming inter­face (API), which estab­lish­es an online con­nec­tion between a data provider and an end user.

The move forms part of a wider gov­ern­ment ini­tia­tive on “smart data”, which looks at ways of unlock­ing data’s val­ue for con­sumers and the wider econ­o­my and ensure it’s used appro­pri­ate­ly. 

The Finan­cial Con­duct Author­i­ty is work­ing with the gov­ern­ment to help design future Smart Data leg­is­la­tion. It sup­ports indus­try-led efforts to devel­op com­mon stan­dards and roadmaps to open finance. 

Over 3 mil­lion indi­vid­u­als and busi­ness­es use open bank­ing prod­ucts, accord­ing to the Open Bank­ing Imple­men­ta­tion Enti­ty (OBIE), which is gov­erned by the Com­pe­ti­tion & Mar­kets Author­i­ty (CMA). Rather than a “big bang” roll-out, open finance is expect­ed to be imple­ment­ed in a “pro­por­tion­ate, phased” man­ner and be con­sumer-focused. 

Clear consumer consent

Open bank­ing is still in the imple­men­ta­tion phase, but the OBIE esti­mates a poten­tial annu­al ben­e­fit of £12bn for con­sumers and £6bn for small busi­ness­es, in terms of cost sav­ings. Con­sumers are expect­ed to enjoy sim­i­lar fis­cal ben­e­fits from open finance.

As with any dig­i­tal trans­for­ma­tion, there are con­cerns over data pri­va­cy and secu­ri­ty. Experts argue that any con­sent for open finance must be trans­par­ent, clear and in plain Eng­lish. But as is already appar­ent with the imple­men­ta­tion of GDPR and the data tracked by com­pa­nies through cook­ies, cook­ie con­sent has become long and com­plex. The requests are so per­va­sive that con­sumers rarely read them in full before giv­ing con­sent.

“For open finance to suc­ceed, we need to ensure that cus­tomers’ con­sents are clear and sim­ple to under­stand, can be tracked by con­sumers, and also pro­vide flex­i­bil­i­ty, so that con­sumers can opt out of shar­ing non-crit­i­cal data at their own dis­cre­tion,” says Nick Rap­er, head of UK at open bank­ing pay­ments pio­neer Nua­pay. 

Joce­lyn Paul­ley, part­ner at Gowl­ings law firm, is san­guine about open finance. “From the point of view of pri­va­cy, the shar­ing of the data is only hap­pen­ing when a con­sumer says, ‘yes, I want to engage with the ser­vice’. From my pri­va­cy practitioner’s point of view, this is all hap­pen­ing the right way round.”

Tighter security

Banks are some of the most reg­u­lat­ed busi­ness­es in the world and are used to con­trols and checks and new leg­is­la­tion like GDPR, so for now UK reg­u­la­tors want them to be the ulti­mate gate­keep­ers of open finance. 

“Ensur­ing that users are aware of what apps have access to what and what they need it for is crit­i­cal here,” says Nick May­nard, lead ana­lyst at Juniper Research. “If users are ful­ly aware of what is being shared when, then the risks are min­i­mal. Out­side of this, banks and oth­er par­ties must have sub­stan­tial con­trols in place from a cyber­se­cu­ri­ty point of view, but banks are already well estab­lished in this regard.”

Cyber attacks are viewed as one of the biggest risks in shar­ing con­sumer finan­cial data. How­ev­er, “it’s rare for a bank to suf­fer a ran­somware attack” due to their sophis­ti­cat­ed IT sys­tems, notes Hans Tes­se­laar, exec­u­tive direc­tor of Bian, a not-for-prof­it organ­i­sa­tion estab­lish­ing a com­mon archi­tec­tur­al frame­work for enabling bank­ing inter­op­er­abil­i­ty.

For open finance to suc­ceed, we need to ensure that cus­tomers’ con­sents are clear and sim­ple to under­stand

Pro­fes­sor Markos Zachari­adis, chair in finan­cial tech­nol­o­gy and infor­ma­tion sys­tems at the Uni­ver­si­ty of Man­ches­ter, says there are some hypo­thet­i­cal draw­backs in secu­ri­ty terms, because data open­ness in any sec­tor “may mean that fraud­sters may find a way to inter­vene some­how. But I think using APIs is a major advance­ment. Many of the open stan­dards that are used as part of the infra­struc­ture are quite sophis­ti­cat­ed.”

Zachari­adis says most of the risks are around “the use cas­es where the data demands aren’t matched by suf­fi­cient con­sumer ben­e­fits. Think, for exam­ple, of the ben­e­fit you get from Face­book in response to the data you’re shar­ing on Face­book.”

It’s clear that robust data man­age­ment, such as time lim­its on data usage and the abil­i­ty to revoke access, must be in place to pro­tect con­sumers and ensure that the promised ben­e­fits of open finance actu­al­ly reach them.

“We’ve been giv­ing access to data gen­er­ous­ly with­out real­ly think­ing about the impli­ca­tions and ways to con­trol access have only very recent­ly come into play with cer­tain court cas­es. With open bank­ing and finance you need to have a sophis­ti­cat­ed con­trol sys­tem of data,” Zachari­adis says.

Strong con­sumer adop­tion of open finance will depend on the finance indus­try, which must edu­cate con­sumers on the ben­e­fits and risks of the con­cept.  Tes­se­laar says the adop­tion rate has been slow for con­sumers. “Banks should edu­cate con­sumers about open finance. They should be the engine for adop­tion.”

Experts argue that con­cerns about exclu­sion are some­what exag­ger­at­ed because open finance is about con­sumer choice and enabling indi­vid­u­als to ben­e­fit from shar­ing their data. If they don’t want to share their data, they won’t gain the con­sumer ben­e­fits. It remains, on the sur­face, a mat­ter of con­sumer choice. 

Digi­ti­sa­tion is already boost­ing finan­cial inclu­sion around the world. Dig­i­tal pay­ments have accel­er­at­ed since the arrival of Covid-19, with dig­i­tal finance already becom­ing a force for inclu­sion in coun­tries such as Sin­ga­pore, Kenya and Brazil.

 “We see open finance as an oppor­tu­ni­ty to bring greater finan­cial inclu­sion into the mar­ket­place, espe­cial­ly after the pan­dem­ic has caused finan­cial stress for a sig­nif­i­cant pro­por­tion of the pop­u­la­tion,” says Rap­er.  

Power shift?

Anoth­er con­cern is that open finance will sim­ply shift pow­er from the old to the new: from the entrenched banks to the big tech com­pa­nies like Ama­zon, Face­book and Google.

In the­o­ry, a big tech com­pa­ny could become an ASP (Account Ser­vic­ing Provider) or PSP (pay­ment ser­vice provider) through the open bank­ing infra­struc­ture. Big tech com­pa­nies are dig­i­tal natives, bet­ter at han­dling data and using it strate­gi­cal­ly, as well as cre­at­ing algo­rithms and nar­ra­tives around arti­fi­cial intel­li­gence. Some like Apple already have dig­i­tal wal­lets. 

Zachari­adis is slight­ly sur­prised that no big tech giant has as yet reg­is­tered to become an ASP or PSP in the UK. How­ev­er, he says the tech giants may already be cre­at­ing their own pro­pri­etary prod­ucts. “They’re already equipped with enough finan­cial data, more than the banks have, so there’s no need for more data.”

How­ev­er, Tes­se­lar doesn’t antic­i­pate big tech mov­ing into this space any time soon, because the com­pa­nies would have to com­ply with strin­gent finan­cial reg­u­la­tions, and “that would be too much of a restraint for them”.

We’ve been giv­ing access to data gen­er­ous­ly with­out real­ly think­ing about the impli­ca­tions

As open finance is phased in, the main entry point is like­ly to be social media, where big tech already has the monop­oly. The chal­lenge for banks will be lur­ing con­sumers to their own plat­forms where they can sell their open finance prod­ucts.

 “By enabling open APIs, any inter­me­di­ary can begin to offer aggre­ga­tion or pay­ment ini­ti­a­tion ser­vices, once appro­pri­ate­ly licensed,” says May­nard. “This can threat­en to dis­in­ter­me­di­ate banks, but this can be man­aged by banks offer­ing strong ser­vices around open finance.”

Tes­se­laar says it’s like­ly there “could be dif­fer­ent entry points for dif­fer­ent age groups because young peo­ple share so much on social media. It will depend on where you are in matu­ri­ty as a per­son.”

As with any indus­try trans­for­ma­tion, open finance promis­es a new world of oppor­tu­ni­ty, but also pos­es risks. A lot is at stake. How­ev­er, data is here to stay. Unless all parts of soci­ety find ways to ben­e­fit, the com­mer­cial­i­sa­tion of data will con­tin­ue – with­out actu­al­ly help­ing con­sumers.

There are many issues to iron out first. Data secu­ri­ty, pri­va­cy and man­age­ment must be water­tight before reg­u­la­tors and con­sumers will be com­fort­able with wide­spread data shar­ing. But the inno­va­tion and trans­for­ma­tion of finan­cial ser­vices is already hap­pen­ing and promis­es excit­ing returns for all.

---