Open Banking: Secure, Customer-Permissioned Data Sharing

1Introduction

In its 2019 report, the Basel Committee on Banking Supervision describes open banking as the sharing and use of customer-permissioned bank data by third-party developers and firms to build more efficient and transparent banking services. APIs are the main tool for this sharing.

2Discussion

According to the World Bank, the UK was one of the first to formalise it: open banking went live there in January 2018 with the first account-information API. In the EU, PSD2 recognised payment-initiation and account-information services by third parties and required strong customer authentication for online payments.

Approaches differ. In Europe, industry bodies such as the Berlin Group defined a voluntary common standard, while in Brazil the central bank plays a central role and mandates its own standardised APIs for payment initiation.

3Conclusion

Alongside the benefits, the Basel Committee flags challenges: risks to banks’ business models and reputation, data privacy, cyber security and third-party risk management. Success therefore depends on clear API standards, strong authentication and informed, revocable customer consent.