I created these slides in early 2016 to explain PSD2 regulation at a very high-level.

1. PSD2 101
Bharat Bhushan
Industry Technical Leader
Banking and Financial Markets, IBM UK
@_bharat_

2. Josh
Bank a Bank n Credit
Card
Provider
Building
Society
Bank …

3. Josh
Bank a Bank n
Third
Party
Credit
Card
Provider
Building
Society
Bank …
Key points
 Josh can authorise
3rd parties to
access “payment”
account
information from
account service
providers
 Josh then does not
need to use the
bank’s app to view
balances or
statements
 3rd party may
access and cache
data even when
Josh is not using
the app
 An account service
provider cannot
charge a third
party any more
than they charge
the Josh

4. Merchant
Josh
Josh’s
Bank
Merchant’s
Bank
Acquirer
VISA/ MC
/ AMEX
1
2
3
4 5
6
7

5. Recap
 Josh did not have
to enter any card
details
 His experience of
buying a product
with a merchant
had less
“friction”
 3rd party
authorised by Josh
initiated the
payment
instruction
 3rd party can
prove that Josh
carried out the
transaction
 Traditional
acquirers and card
networks were not
involved (Merchant
paid less fee)
 Money is pushed
out of Josh’s
account(s) rather
than being pulled.
IoU is trusted by
Merchant
Josh
Account
Providers
Merchant’s
Bank
12
3
4
Payment confirmation £99.99
Third Party
5
6
7

6. Challenges
• Losing a degree of
direct interaction
with their customers
• Lower ROI on
investments in the
front office
capabilities
• Unpredictable
workloads
• Customers’ data is
no longer behind
firewalls
• Increased potential
for financial fraud
and capital
requirement
• No contract with
third parties
• Increased liability,
risk and fraud
PaymentInitiationAggregation

7. Unknowns
• Standards for APIs
and Security
• Third party
security, on-
boarding, risk and
liability
PaymentInitiationAggregation
Challenges
• Losing a degree of
direct interaction
with their customers
• Lower ROI on
investments in the
front office
capabilities
• Unpredictable
workloads
• Customers’ data is
no longer behind
firewalls
• Increased potential
for financial fraud
and capital
requirement
• No contract with
third parties
• Increased liability,
risk and fraud

8. Opportunities
• Embracing digital in its
entirety; transformation to
digital banking
• Become the TPP (AISP and/
or PISP)
• Monetise data and home-
grown systems and platforms
(KYC, AML, Identity…)
• Provide/ improve financial
advice
• Create and deliver value-
added services using
partnership/ ecosystem
services
PaymentInitiationAggregation
Challenges
• Losing a degree of
direct interaction
with their customers
• Lower ROI on
investments in the
front office
capabilities
• Unpredictable
workloads
• Customers’ data is
no longer behind
firewalls
• Increased potential
for financial fraud
and capital
requirement
• No contract with
third parties
• Increased liability,
risk and fraud
Unknowns
• Standards for APIs
and Security
• Third party
security, on-
boarding, risk and
liability

9. Building
Blocks
What Next?
Value add to your clients; needs led instead of
product-led
Assess your enterprise Data, API and security maturity
Experiment and build early prototypes – FAST!
Form your business and IT Strategy and perform gap
analysis
Expose and Consume API
- Self service
- Sandbox environments
- Documentation
- Policy
- Hackathon
Infrastructure
- Scalable/Flexible
- Payments
- Testing your own
Infrastructure
Security
- Identity
Mgmt
- Token Mgmt
- Fraud
detection
- Crypto
- Policy
Org Culture
- Customer focused
- Design thinking
- Governance
- Agile/ devOps
- Support desk for
Customers and TPPs
Open Banking
Block chain
Ask Us For More Details!
Opportunities
• Embracing digital in its
entirety; transformation to
digital banking
• Become the TPP (AISP and/
or PISP)
• Monetise data and home-
grown systems and platforms
(KYC, AML, Identity…)
• Provide/ improve financial
advice
• Create and deliver value-
added services using
partnership/ ecosystem
services
Challenges
• Losing a degree of
direct interaction
with their customers
• Lower ROI on
investments in the
front office
capabilities
• Unpredictable
workloads
• Customers’ data is
no longer behind
firewalls
• Increased potential
for financial fraud
and capital
requirement
• No contract with
third parties
• Increased liability,
risk and fraud
Unknowns
• Standards for APIs
and Security
• Third party
security, on-
boarding, risk and
liability