SlideShare une entreprise Scribd logo
1  sur  16
Télécharger pour lire hors ligne
White Paper - Open Banking - The Future of Payments 
Executive Summary
The world of retail banking and payments
has become a very exciting and dynamic
environment. We have seen new products and
servicesemergingoverthepastfewyearsaimed
at disrupting the status quo. The past 24 months
have also seen nascent FinTech organisations
developing products and services that will not
only complement incumbent providers but in
some cases are also designed to compete and
be disruptive.
For a market that has remained relatively
stable over the decades, we are on the verge
of witnessing great change. To facilitate this
change, current payment regulation needs to
be amended to give financial service providers,
new and old, the opportunity to access
systems and data so that they can participate
in the market and offer innovative products and
services.
It is not very often that you can view regulatory
bodies, or even the European Parliament, as
bastions of innovation, but on this occasion
they are with the Payment Services Directive
2 (PSD2).
One of the principles of PSD2 is to foster an
environment whereby customers wanting
to use value added services from Third
Party Providers (TPPs) can do so safely in
the knowledge that their personal security
credentials have not been shared with a third
party, and that the service provider can access
only the information for which the customer
has given explicit consent.
However, for these products and services to
become mainstream and widely adopted by
consumers, the TPP require access to the
customer’s online bank accounts to access
data in real time.
The mechanism by which this will be achieved
is through Access to Accounts, more commonly
referred to as XS2A, which is set out in PSD2.
It is anticipated that the EBA’s draft regulatory
technical standards will recommend the use
of Application Programming Interfaces (APIs)
to enable access to payment system users’
accounts, thus providing an automated and
secure mechanism for authorised payment
actors to access customer information where
the customer has given their explicit consent.
Under PSD2 all payments participants will be
required to comply with XS2A. However, it is
how an organisation embraces the concept
of XS2A that will define its business strategy
moving forward. Organisations need to decide
whether they simply fund the cost of regulatory
change, or they invest in future business
strategy, delivering data-rich services.
In addition to the regulatory requirements
for XS2A as outlined in the PSD2, the UK
Government made clear its intention for the UK
to be the global centre for financial technology
and to lead the world in open source data in
banking in its 2014 Autumn Statement. UK
Government wants the United Kingdom to
lead the world in open access to bank data via
APIs.
The payments industry is now facing not
only legislative change at a European level
(i.e. PSD2), but also domestically, with UK
regulation potentially going further than its
European counterpart.
Europe’sPSD2,XS2AandtheUKOpenBanking
API are going to have a big impact on existing
core and legacy systems for all payments
actors. New processes need to be adopted to
ensure that only qualified and approved TPPs
can access data where customers have given
explicit consent. Robust auditing systems
and processes are paramount to ensure that
customers remain confident that their data
is being used and shared in an agreed and
appropriate manner.
White Paper - Open Banking - The Future of Payments 
Forward-lookingorganisationswillberethinking
banking customer relationships and revenue
models to deliver compelling propositions that
attract and retain profitable customers.
PSD2 opens a world of new business
opportunity. PSD2 makes a distinction between
the various payment actors in the eco-system
but importantly, what it does not do, is dictate
which payment actors can facilitate what roles.
This is especially important in the context of
TPPs. New and existing payment actors could
become TTPs and offer additional value-added
servicestotheircustomers,drivingnewrevenue
opportunities to underpin their core services.
New payment regulation is coming in the form
of PSD2, and its first effects are already being
felt, as organisations assess the consequences
of the pending legislation and attempt to
understand the business, technical and
operational implications.
XS2A is going to radically shake up the
payments marketplace. Organisations need
to decide whether they simply fund change
to meet the regulatory requirements of XS2A,
or they view it as a strategic opportunity to
develop and broaden their businesses to
drive customer acquisition and engagement
and develop profitable opportunities with new
products and services.
Author and contact
Brendan Jones is a senior consultant with
The Human Chain. His focus is on strategy,
development and delivery of digitised services
within the financial services environment.
Brendan has more than 27 years’ experience
in the payments and cards industry ranging
from executive/senior management, business
development, strategy development and
execution, MA, business process re-
­‐engineering, product management and
marketing through to operational management
working for FinTech providers and technology
companies as well as financial service
providers.
Contact:
e:	 brendan.jones@thehumanchain.com
m:	+44 (0)7785 388 867
Brendan Jones
White Paper - Open Banking - The Future of Payments 
From a payments perspective, we are seeing two major themes develop:
Payment Initiation Services
Payment Initiation Service Providers (PISPs) initiate
internet payments on behalf of a customer via a
software bridge between a merchant’s website and
the customer’s online bank. The funds to cover
the purchase of goods are paid directly from the
customer’s bank account to the merchant’s in
real time. This payment option directly competes
with card-based payment methods, and from a
bank’s perspective it dilutes its reliance on the card
schemes; for merchants it provides another means
of payment and so offers customer choice. It also
allows a consumer to shop online even if they don’t
have a bank payment card, and provides access to
an alternative means of online payment that is safe,
convenient and cheap.
Account Information Service Providers (AISPs)
provide data aggregation services to customers.
AISPs aggregate customers’ financial transactions
into one place in real time, from multiple accounts
held at various financial institutions, and then use
that data to provide services. Examples include
next generation comparison services (i.e. bank
accounts, loans, mortgages etc), real-time advisory
tools providing push notifications, personal financial
planning and management tools, advanced loan
application processes etc.
Account Information Services
The world of retail banking and payments has
become a very exciting and dynamic environment.
From being a market that has seen the status quo
maintained for many years, there is now greater
competition, more market entrants, exciting new
products and services, increased financial inclusion
and greater transparency.
We have seen new products and services emerging
overthepastfewyearsaimedatdisruptingthestatus
quo. Examples include prepaid card programmes,
non-bank foreign exchange services for consumers
and businesses, non-bank international money
remittance services, crypto currencies such as
Bitcoin, blockchain/distributed ledger technologies,
non-bankconsumerbankcardpaymentapplications
(i.e. Apple Pay, Android Pay and Samsung Pay
etc), Payment Service Providers (PSPs) providing
greater choice in payment instruments… and the
list goes on.
The past 24 months have also seen nascent
FinTech organisations developing products and
services that will not only complement incumbent
providers but in some cases are also designed to
compete and be disruptive. So vibrant is this space
that we have seen governments actively encourage
FinTech acceleration, FinTech incubators launched
around the world and a number of international
banks (e.g. Citi Bank, Santander, UBS and Barclays
to name but a few) starting their own incubators
to foster innovation, gain early insights and aid
development.
For a market that has remained relatively stable
over the decades, we are on the verge of witnessing
great change. However, in order to facilitate this
change, current payment regulation needs to be
amended to give financial service providers, new
and old, the opportunity to access systems and
data so that they can participate in the market and
offer innovative products and services.
There is a wide variety of products and services
on offer in the market today, which provides
greater consumer choice, reduces the overall
costs of payments processing and fuels economic
development. No doubt there will be many more
exciting developments as companies continue to
innovate.
Open Banking - The Future of Payments
These services provide greater customer choice,
and no doubt as new ideas and innovations develop,
there will be even more choice. However, for these
products and services to become mainstream
and widely adopted by consumers, the service
providers require access to the customer’s online
bank accounts to access data in real time. These
accounts are typically run by authorised Credit
Institutions[1]
, referred to as Account Servicing
Payment Service Providers (ASPSP), with which
the service providers have no direct relationship.
White Paper - Open Banking - The Future of Payments 
Regulation can drive innovation
It is not very often that you can view regulatory
bodies, or even the European Parliament, as
bastions of innovation, but on this occasion
they are with the Payment Services Directive
2 (PSD2).
The aim of PSD2, and the original Payment
Services Directive 2007/64/EC (PSD), is to
harmonise the European payments landscape
from a regulatory perspective, ensuring that
all relevant organisations and activities are
adequately covered. This marks a shift towards
an integrated single market for safe electronic
payments that aims to support the growth of the
European Union (EU) economy and to ensure
that consumers, merchants and companies
enjoy choice and transparent secure payment
services so they fully benefit from the internal
market.
The first PSD, which targeted and regulated
a range of traditional payment organisations,
soon became out dated by rapid technology
development, delivering new products and
services in the payments industry. PSD2
extends this scope to include regulation of
new market participants such as Third Party
Providers (TPPs), FinTech companies and new
service providers, the so called PISPs and
AISPs.
The European Parliament has recognised,
in the world of payments, that technological
developments have led to a range of
complementary services emerging in recent
years, and these need to be covered by the
same regulation. Therefore enactment of PSD2
will repeal the original PSD 2007/64/EC.
PSD2’s vision is to ‘ensure continuity in the
market, enabling existing and new service
providers, to offer their services under a clear
and harmonised regulatory framework’[2]
.
One of its principles is to foster an environment
whereby customers wanting to use value added
services can do so safely in the knowledge that
theirpersonalsecuritycredentialshavenotbeen
shared with a third party, and that the service
provider can access only the information for
which the customer has given explicit consent
and only for an agreed period of time.
PSD2 is driving innovation and opening up
the payments market to value-added service
providers, collectively defined as Third Party
Providers (TPPs). The European Parliament, via
PSD2, is encouraging TPPs into the European
market, not only in their domestic market but
also across other EU member states through
the mechanism of Passporting, the exercise
by a company registered in the European
Economic Area (EEA) of a right to carry on
business in another EEA state.
Major step change
This is a major and complex change to the world
of payments. In order to provide an environment
in which participants can share customer data,
when explicit consent has been granted, with
each other in a secure, automated fashion
requires industry standards to be developed
and mandated within the EU.
As part of the PSD2, the European Parliament
has directed the European Banking Authority
(EBA) to develop draft regulatory technical
standards for common and secure open
standards of communication for the purpose of
identification, authentication, notification and
information, as well as for the implementation of
security measures between all payment actors
(i.e. Credit Institutions, PSPs, PISPs etc).
The EBA has been given 12 months to develop
the draft regulatory technical standards and
present back to the European Commission (EC),
for consideration and ultimately adoption.
White Paper - Open Banking - The Future of Payments 
Consented access
Financial Service Provider
(ASPSP)
(1) I want to provide you
access to specific account
data for an agreed period
(2) Please provide access to
this customer’s account data
as per customer request
Service Provider (AISP)
Customer
(3) Do you want to grant
access to this company
for your account data
- What data
- Duration
(4) Agree
to provide
access
- Specified data
- Duration
Fig 1: Data aggregation services
The mechanisms to allow customers to
approve TPPs access to their accounts
without disclosing their security credentials is
also commonplace in other industries, such as
online payments, search engines and social
media, e.g. PayPal, Google and Twitter etc.
To achieve this, one approach some
organisations have implemented is an open
standard for authorisation called OAuth[6]
,
which provides a secure authorisation and
approval method. OAuth enables users to
grant third-party access to their resources
(i.e. data) without sharing their passwords. It
also provides a way to grant limited access,
in both scope and duration. It provides client
applications with a ‘secure delegated access’
to server resources on behalf of a resource
owner. An example of how OAuth operates in a
data aggregation scenario is shown in (Fig 1).
What does this mean in reality?
The mechanism by which this will be achieved
is through Access to Accounts, more commonly
referred to as XS2A, which is set out in PSD2.
It is anticipated that the EBA’s draft regulatory
technical standards will recommend the use
of Application Programming Interfaces (APIs)
to enable access to payment system users’
accounts, thus providing an automated and
secure mechanism for authorised payment
actors to access customer information where
the customer has given their explicit consent.
APIs have been used for some time. Many
companies use them to securely pass data
between organisations, and open APIs have
been developed for specific industries[3]
such
as social media and search engines e.g.
Twitter, Facebook and Google. There has been
a proliferation of organisations publishing APIs
so third parties can access their data and
services[4]
, to help drive new and innovative
services, such as MasterCard with its Open
API programme [5]
.
White Paper - Open Banking - The Future of Payments 
Once the information provider (i.e. financial
service provider) has received permission from
the customer that they are willing to share
their account data with the TPP (i.e. service
provider), the information provider then supplies
the service provider with an access token[7]
,
a cryptographically generated number that
represents specific scopes and durations of
access to data, granted by the resource owner
(i.e. customer), which the service provider
presents via the API every time he requests
information for that specific customer (Fig 2).
Service Provider (AISP)
Financial Service Provider
(ASPSP)
(5) Access token to
access customer data
(6) Data request presented
with access token
(7) Data provided in line
with customer consent
Fig 2: Authorised data transfer
OAuth is used by major network services such
as Google, LinkedIn, Facebook and Twitter.
OAuth has arguably become a de facto open
standard for authentication and authorisation
on the web, and therefore is a strong contender
to include in the EBA regulatory technical
standards. However, there are competing
standards that should also be considered,
such as Security Assertion Markup Language
(SAML), Central Authentication Service (CAS),
LemonLDAP::NG etc.
Innovation drives business opportunities
Under PSD2 and individual member states’
transposition of the Directive, all payments
participants (i.e. Credit Institutions, Payment
Institutions, PSPs etc) will have to comply with
XS2A, with the exact date for this yet to be
determined.
However, it is how an organisation embraces
the concept of XS2A that will define its business
strategy moving forward.
Therewillbecostsassociatedwithimplementing
the regulatory standards API, ranging from
the technical implementation, setting of new
policies and procedures, and supporting the
day-to-day management and operation of the
data flows, through to the ongoing security
requirements necessary to ensure that only
authorised parties access the data with the
appropriate approvals.
Organisations need to decide whether they
simply fund the cost of regulatory change,
or they invest in future business strategy,
delivering data-rich services that will drive
acquisition and retention and gain a strategic
business advantage.
White Paper - Open Banking - The Future of Payments 
UK HM Treasury call for evidence on data sharing
and open data in banking
In addition to the regulatory requirements
for XS2A as outlined in the PSD2, the UK
government made clear its intention for the UK
to be the global centre for financial technology
and to lead the world in open source data in
banking in its 2014 Autumn Statement[8]
.
It published a report in December 2014, ‘Data
Sharing and Open Data for Banks[9]
’, which
considers in detail how financial technology
firms can make better use of bank data on
behalf of customers through APIs and open
data, and sets out the benefits that could come
from adopting these more widely in banking.
HM Treasury published a ‘Call for evidence
on data sharing and open data in banking’,
updated 18 March 2015, seeking views from
interested parties on how the recommendations
set out in the report should be developed, what
benefits more open data in banking could bring
to consumers and, in particular, how an open
API standard in UK banking could best be
delivered.
What is evident from the report is that its aim
for the UK to lead the world in open access to
bank data via APIs is much greater than that
outlined in PSD2.
Unlike PSD2, the report also draws a distinction
between customer data and open data (i.e.
non-personal data such as interest, savings
and exchange rates etc), and the use of open
data to develop a richer environment for new
products and services.
It details many potential use cases for APIs
and ways in which external APIs can create
added or new value for banks. These include
enhanced security using OAuth APIs, account
history porting, digital sign-up and identification
verification for opening new banks account. It
also notes that banks could provide customer
identification verification as a service to other
organisations. Banks (acting as ASPSPs) hold
a wealth of customer information (i.e. payment
profiles, KYC information, finance history etc),
which could potentially be provided as a service
and monitised with a customer’s consent.
The report identifies the strategic value of banks
being a platform for third party innovation. Table
1showsasampleselectionofthe100orsoapps
connected to the Open Bank Project (OBP)[10]
.
The OBP, an organisation based in Germany,
enables banks to offer an ecosystem of third
party apps and services to their customers. It
provides an open source, developer-friendly
API for banks that developers and companies
can use to build innovative applications
and services based on the account holder
transaction data. While these apps do not
yet connect to any live bank data through the
OBP platform, they demonstrate the appetite
of developers to access customer data and
develop innovative and compelling consumer
propositions.
At the request of the UK government, the
Open Data Institute (ODI)[11]
formed the Open
Banking Working Group (OBWG), a collective of
banking, open data and FinTech professionals
tasked with developing a framework for
adopting an open API standard across banking,
and exploring how open banking will impact
consumers, regulators and industry.
The objectives of the OBWG [12]
are to:
l	 Deliver a framework for the design of an
open API standard in UK banking focusing on 	
personal and business current accounts.
l	 Evaluate how increased levels of open data
in banking can benefit consumers, businesses	
and society.
l	 Publish recommendations in a paper by end
of 2015 outlining how an open API standard
can be designed, delivered and administered,
alongside a timetable and implementation
roadmap for achieving this.
The payments industry is now facing not
only legislative change at a European level
(i.e. PSD2), but also domestically, with UK
regulation potentially going further than its
European counterpart.
White Paper - Open Banking - The Future of Payments 
The Impact on core and legacy systems
Europe’s PSD2, XS2A and the UK Open
Banking API are going to have a big impact
on existing core and legacy systems for all
payments actors.
Organisations are going have to identify the
appropriate channel(s) for creating the third
party interfaces to allow for data access via
APIs. They will have to build, implement and
test the APIs to ensure that they are fit for
purpose and meet technical, security and
regulatory requirements.
There will no doubt be technical challenges
integrating the requirement for real-time data
access from TPPs with batched-based legacy
core banking systems. Opening up access to
data and functionality in legacy systems, that
have typically operated in silos, will prove
challenging. This is coupled with the fact that
the opening up of access has to be delivered in
a robust and secure manner in order to maintain
integrity of systems and customer confidence.
As part of building the APIs, the customer
experience will need to be considered. New
terms and conditions, consent application
forms and notifications are going to have to
be developed to inform customers of their
rights regarding the disclosure of information.
They will also require education to understand
who is liable for what data when it has been
disclosed; inbound call centre staff could well
beoverwhelmedwithquestionsfromcustomers
in the early days.
New processes need to be adopted to ensure
that only qualified and approved TPPs can
access data where customers have given
explicit consent. Robust auditing systems
and processes are paramount to ensure that
customers remain confident that their data
is being used and shared in an agreed and
appropriate manner.
As stated previously, organisations need to
decide whether they simply fund the cost
of regulatory change, or they invest in future
business strategy. Banks that want to become
TPPs in their own right will also have to define
their data requirements for the collection of
third party data.
Forward-lookingorganisationswillberethinking
banking customer relationships and revenue
models. As customers demand more from their
financial service providers, organisations are
going to have to review their current product
offerings, implement new product development
plans and repurpose existing services and
products. They will need to (re)define their core
proposition and deliver products and services
that meet or exceed the ever-increasing level
of customer expectation.
Historically, financial service providers have
wanted to provide the full gambit of services
directly, without involvement from third party
organisations. Some will no doubt continue
down this route as it is ingrained in their
corporate DNA. Others, though, will embrace
thepotentialofworkingwithpartners,redefining
their business models and processes to deliver
compelling propositions that attract and retain
profitable customers.
White Paper - Open Banking - The Future of Payments 10
Business models
Merchant
Customer Bank B
Customer Bank A
(PISP)
Customer
Inter Bank
Payment Network
Merchant’s Bank
Fig 3: Credit Institution acting as a PISP
PSD2 makes a distinction between the various
payment actors in the eco-system. It highlights
the roles of Credit Institutions, PSPs, AISPs,
ASPSPs and TPPs. Importantly, what PSD2
does not do is dictate which payment actors
can facilitate what roles. This is especially
important in the context of TPPs.
TPPs could easily be seen as new market
entrants providing innovative products and
services using disruptive technology. Indeed
this will no doubt be the case in certain
circumstances.
However, there is no reason why a Credit
Institution or ASPSP could not become a TPP
in their own right. Given PSD2’s definition of
PISPsandAISPs,thereisnoreasonwhyaCredit
Institution/ASPSP could not offer additional
value-added services to their customers as a
TPP.
They could facilitate transfers from other
ASPSPs to any other third party (Fig 3). They
could operate a PISP service that would permit
a customer to execute transfers from the
customer’s accounts at other ASPSPs and to
merchants directly.
White Paper - Open Banking - The Future of Payments 11
Providing PISP as well AISP services would
allow Credit Institutions/ASPSPs to consolidate
a customer’s financial information in one
place, thereby providing additional added
value, creating loyal customers, driving greater
engagement and generating new revenue
opportunities through better understanding of
their customers (Fig 4).
Customer Bank D
Mortgage
Customer Bank C
Investments
Customer Bank B
Savings Account
Customer Bank A
Current Account
Customer Bank A
AISP
Direct Account Access
Third Party Access
Customer
Fig 4: Consolidating all the customer’s financial data
Combining these types of services together
would create an opportunity for the Credit
Institution/ASPSP to control a significant
proportion of the online and payment
interactions undertaken by the customer,
allowing for greater insight and understanding
of clients.
Forward-thinking organisations recognise
the importance and value to customers in
delivering real-time, relevant and consumable
data. Banks today hold a wealth of information
on their customers. This data can be applied
to build trust, convenience and competitively
priced services. This, combined with the new
understanding they could gather from providing
other payment services (i.e. PSP and/or AISP),
will place them in an ideal position to be the
customer’s financial services provider of
choice.
White Paper - Open Banking - The Future of Payments 12
Customer
Customer Bank D
Mortgage
Customer Bank C
Investments
Customer Bank B
Savings Account
Customer Bank A
Current Account
Customer Bank A
AISP
Direct Account Access
Third Party Access
Social Media
Networks
Foreign Exchange
Services
News Feeds
Fig 5: Delivering financial services and relevant content
These should be viewed as value-added
propositions. There is no requirement, or
need, for these services to be linked directly
to customer’s personal current account, held
with the Credit Institutions/ASPSP offering
these services. Therefore, the potential target
audience for these new services is greater than
just an organisation’s existing customer base.
Delivering AISP services should not be limited
to financial services alone. There is significant
scope for banks to connect content from third
party partners with complementary products
and services, open data sources (i.e. share
prices, financial indices etc), and social media
and news feeds that would enhance the core
service offering, and underpin the bank’s
standing and its brand in the customer’s mind
(Fig 5).
White Paper - Open Banking - The Future of Payments 13
Conclusions
New payment regulation is coming in the
form of PSD2, and its first effects are already
being felt, as organisations assess the
consequences of the pending legislation and
attempt to understand the business, technical
and operational implications. When XS2A
will become a regulatory requirement is still
a matter of debate. Until the EBA submits its
draft regulatory technical standards to the EC in
early 2017, and the EC approves and issues the
regulatory technical standards, member state
regulators and payment system actors will not
be in a position to assess the full complexity
and effects of implementing XS2A.
Not withstanding this, XS2A is going to radically
shake up the payments marketplace. There will
be new market entrants offering new products
and services that use customer data to facilitate
the delivery of innovative consumer products
and services.
These can, and no doubt will, be far reaching in
terms of application and usage.
Revenues generated in the payments market
are not infinite; therefore, if new market
entrants arrive and start to win business from
the incumbent players, existing revenues will
be challenged.
New market entrants have a distinct advantage
over traditional payment actors, in that they are
not constrained by legacy infrastructure. This
makes them much more agile in developing
and launching new services and solutions to
meet market demand. However, they lack
the brand reputation and customer trust that
many established players enjoy today, and are
entering into a highly regulated market in which
they must remain familiar.
Organisations need to decide whether they
simply fund change to meet the regulatory
requirements of XS2A, or they view it as a
strategic opportunity to develop and broaden
their businesses to drive customer acquisition
and engagement and develop profitable
opportunities with new products and services.
Importantly, PSD2 does not preclude any
regulated organisation from becoming a PSP,
PISP, AISP or ASPSP.
There is a strong argument that organisations
that provide value-added services create more
loyal customers, drive greater engagement and
generate new revenue opportunities through
better understanding of their customers.
Ignoring the opportunities that XS2A offers
could push a payments company into simply
becoming an ASPSP, comparable to Mobile
Network Operators becoming mere dumb pipe
providers.
The world of ‘Open Banking‘ has arrived!
White Paper - Open Banking - The Future of Payments 14
[1]	 https://www.handbook.fca.org.uk
[2]	 European Parliament Revised Directive on Payment Services (PSD2), Text of 		
	 Revised Directive, Clause 33
[3]	 http://www.programmableweb.com/apis/directory
[4]	 http://letstalkpayments.com/41-apis-­making-waves-in-fintech/
[5]	 https://developer.mastercard.com/portal/display/api/API
[6]	 http://oauth.net
[7]	 The OAuth 2.0 Authorization Framework
[8]	 https://www.gov.uk/government/uploads/system/uploads/attachment_data/ 		
	 file/382327/44695_Accessible.pdf (page 47, Section 1.171)
[9]	 Data Sharing and Open Data for Banks, A report for HM Treasury and Cabinet 		
	 Office, published by the Open Data Institute and Fingleton Associates 2014
[10]	 https://openbankproject.com
[11]	 http://theodi.org
[12]	 Open Banking Working Group OBWG Terms of Reference
References
AISP		 Account Information Service Provider
ASPSP	 Account Servicing Payment Service Provider
Credit Institution	 An organisation which receives deposits or other repayable 		
		 funds from the public and grants credits for its own account
Payment Actor	 A regulated participant organisation in the payments
		 eco-­system.
Payment Institution	 A regulated organisation that can offer customers the following 	
		 services:
		 •	 Executing payment transactions (including credit transfers, 	
			 direct debits, through payment cards or a similar device)
		 •	 Issuing and/or acquiring of payment instruments
		 •	 Money remittance
		 •	 FX services
		 •	 Ancillary services
		 Granting of credit for a maximum of 12 months if this credit is 	
		 closely linked to a payment service provided.
PISP		 Payment Initiation Service Provider
PSP		 Payment Service Provider.
Glossary
White Paper - Open Banking - The Future of Payments 15
App		 Description
Paygel	 Provides an easier, faster and safer eCommerce checkout 		
		 experience. It enables users to shop on TV, a laptop or tablet, 	
		 and then links the purchase to a smartphone payment 		
		 application using, for example, a QR code.
Kids View	 A PFM for children that provides them with a categorised 		
		 money trail of their transaction history.
Selfie Bank	 Secure payments using your face without exchanging bank 		
		 information, just using a selfie.
Mortgage Masher	 A dashboard showing you how to pay off your mortgage faster 	
		 and smarter.
Jamjars	 Banking for the unbanked that manages income allocation and 	
		 budgeting for people with low incomes.
Bank data aggregator	 Share aggregates of transaction data with firms and friends.
Spendapenny	 A digital way of donating odd pennies to charity.
TimeBalance	 Enables you to see your account balance next to your MacOS 	
		 clock.
DonationBundle	 Lets users decide how much they want to donate every month 	
		 and to which causes.
Fritz		 An app that lets family members approve online purchases or 	
		 payments on behalf of other members, for example parents 		
		 approving their children’s expenses.
Goal		 Analyses spending habits, to help you reach your goals in life.
CrowdFundMatcher	 CrowdFunding comparison site with bank co-­funding options.
Perfect Shopper	 Helps small shops send targeted personal offers to consumers,	
		 based upon their previous purchases, personal preferences, 		
		 location and their latest social media posts.
Money Score	 Manage expenses related to other people and split bills.
PayDutch	 Debt overview amongst friends.
AlamPay	 A micro-­financing service that provides online payment and 		
		 POS transactions, focusing on developing countries.
Denary	 Allows anyone to receive money through multiple payment 		
		 methods in a matter of seconds.
Regulation Detective	 Identifies suspicious transactions.
Source: Open Bank Project
Table 1: Apps developed for the Open Bank Project
The Human Chain Ltd, Magdalen Centre, The Oxford Science Park, Oxford, OX4 4GA, United Kingdom
Tel: +44(0)1865 784386 Fax: +44(0)1865 784387 www.thehumanchain.com www.digitalservicestoolkit.com

Contenu connexe

Tendances

Open bank project api days-presentation-dec2013
Open bank project api days-presentation-dec2013Open bank project api days-presentation-dec2013
Open bank project api days-presentation-dec2013
Ismail CHAIB
 

Tendances (20)

apidays LIVE India - Banking Redefined - Decoding the API era for Indian bank...
apidays LIVE India - Banking Redefined - Decoding the API era for Indian bank...apidays LIVE India - Banking Redefined - Decoding the API era for Indian bank...
apidays LIVE India - Banking Redefined - Decoding the API era for Indian bank...
 
Open bank project api days-presentation-dec2013
Open bank project api days-presentation-dec2013Open bank project api days-presentation-dec2013
Open bank project api days-presentation-dec2013
 
360 degrees of FinTech (R)evolution
360 degrees of FinTech (R)evolution360 degrees of FinTech (R)evolution
360 degrees of FinTech (R)evolution
 
The Future of Open Banking, beyond January 2018
The Future of Open Banking, beyond January 2018  The Future of Open Banking, beyond January 2018
The Future of Open Banking, beyond January 2018
 
Global CIO Banking Summit - Workshop Cultural Changes to Survive Digital Disr...
Global CIO Banking Summit - Workshop Cultural Changes to Survive Digital Disr...Global CIO Banking Summit - Workshop Cultural Changes to Survive Digital Disr...
Global CIO Banking Summit - Workshop Cultural Changes to Survive Digital Disr...
 
APIdays Open Banking & Fintech: Workshop - Financial Services Use Cases for APIs
APIdays Open Banking & Fintech: Workshop - Financial Services Use Cases for APIsAPIdays Open Banking & Fintech: Workshop - Financial Services Use Cases for APIs
APIdays Open Banking & Fintech: Workshop - Financial Services Use Cases for APIs
 
FABRIC - Open Banking Teaser
FABRIC - Open Banking TeaserFABRIC - Open Banking Teaser
FABRIC - Open Banking Teaser
 
APIdays Singapore 2019 - Introduction to essential elements of Open Banking F...
APIdays Singapore 2019 - Introduction to essential elements of Open Banking F...APIdays Singapore 2019 - Introduction to essential elements of Open Banking F...
APIdays Singapore 2019 - Introduction to essential elements of Open Banking F...
 
Global Open Banking Landscape
Global Open Banking LandscapeGlobal Open Banking Landscape
Global Open Banking Landscape
 
aplonAPI Product Presentation
aplonAPI Product PresentationaplonAPI Product Presentation
aplonAPI Product Presentation
 
The Power Of Open Banking Coupled With Artificial Intelligence
The Power Of Open Banking Coupled With Artificial IntelligenceThe Power Of Open Banking Coupled With Artificial Intelligence
The Power Of Open Banking Coupled With Artificial Intelligence
 
HOW OPEN APIS WILL CHANGE THE FUTURE OF BANKING
HOW OPEN APIS WILL CHANGE THE FUTURE OF BANKINGHOW OPEN APIS WILL CHANGE THE FUTURE OF BANKING
HOW OPEN APIS WILL CHANGE THE FUTURE OF BANKING
 
apidays LIVE Australia 2021 - API Economy in Financial Services by Siddhant A...
apidays LIVE Australia 2021 - API Economy in Financial Services by Siddhant A...apidays LIVE Australia 2021 - API Economy in Financial Services by Siddhant A...
apidays LIVE Australia 2021 - API Economy in Financial Services by Siddhant A...
 
Why you will choose the aplonAPI™ platform, to empower your Open banking proj...
Why you will choose the aplonAPI™ platform, to empower your Open banking proj...Why you will choose the aplonAPI™ platform, to empower your Open banking proj...
Why you will choose the aplonAPI™ platform, to empower your Open banking proj...
 
Singapore Fintech Report 2021
Singapore Fintech Report 2021Singapore Fintech Report 2021
Singapore Fintech Report 2021
 
Banking as a Service - An Overview
Banking as a Service - An OverviewBanking as a Service - An Overview
Banking as a Service - An Overview
 
APIdays Singapore 2019 - Promoting Financial Inclusion with an Open Banking M...
APIdays Singapore 2019 - Promoting Financial Inclusion with an Open Banking M...APIdays Singapore 2019 - Promoting Financial Inclusion with an Open Banking M...
APIdays Singapore 2019 - Promoting Financial Inclusion with an Open Banking M...
 
Neobanking Market Size Worth $333.4 billion by 2026 - KBV Research
Neobanking Market Size Worth $333.4 billion by 2026 - KBV ResearchNeobanking Market Size Worth $333.4 billion by 2026 - KBV Research
Neobanking Market Size Worth $333.4 billion by 2026 - KBV Research
 
5 ideas to Kick-Start Platform Oriented Banking
5 ideas to Kick-Start Platform Oriented Banking5 ideas to Kick-Start Platform Oriented Banking
5 ideas to Kick-Start Platform Oriented Banking
 
Beyond Open Banking : Uncovering The Opportunities Ahead- 21st april 2021 - N...
Beyond Open Banking : Uncovering The Opportunities Ahead- 21st april 2021 - N...Beyond Open Banking : Uncovering The Opportunities Ahead- 21st april 2021 - N...
Beyond Open Banking : Uncovering The Opportunities Ahead- 21st april 2021 - N...
 

En vedette

[KDB대우증권] 기업분석 KG이니시스
[KDB대우증권] 기업분석 KG이니시스[KDB대우증권] 기업분석 KG이니시스
[KDB대우증권] 기업분석 KG이니시스
KGinside
 
Lo spazio della cerimonia del tè - The space of the tea ceremony
Lo spazio della cerimonia del tè - The space of the tea ceremonyLo spazio della cerimonia del tè - The space of the tea ceremony
Lo spazio della cerimonia del tè - The space of the tea ceremony
Francesco Montagnana
 
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking WaterLab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
Distributor Service Incorporated
 
Raul bravo, director de eae madrid, participa como jurado en los premios capi...
Raul bravo, director de eae madrid, participa como jurado en los premios capi...Raul bravo, director de eae madrid, participa como jurado en los premios capi...
Raul bravo, director de eae madrid, participa como jurado en los premios capi...
EAE Business School
 
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
IndiaNotes.com
 
BIELA NOC KATALOG
BIELA NOC KATALOGBIELA NOC KATALOG
BIELA NOC KATALOG
Biela Noc
 
El trabajador social entre la complejidad social y las profesiones de lo social
El trabajador social entre la complejidad social y las profesiones de lo socialEl trabajador social entre la complejidad social y las profesiones de lo social
El trabajador social entre la complejidad social y las profesiones de lo social
Xavier Úcar
 
Expertos digitales
Expertos digitalesExpertos digitales
Expertos digitales
juanca-11
 
IAA Accredited Institutes at 1 14 2015
IAA Accredited Institutes at 1 14 2015IAA Accredited Institutes at 1 14 2015
IAA Accredited Institutes at 1 14 2015
Alvaro Rivera
 
50 trucos para convertirte en “experto” de photoshop
50 trucos para convertirte en “experto” de photoshop50 trucos para convertirte en “experto” de photoshop
50 trucos para convertirte en “experto” de photoshop
Luis Muñoz
 

En vedette (20)

Sibos 2016 - Access to Account
Sibos 2016 - Access to Account Sibos 2016 - Access to Account
Sibos 2016 - Access to Account
 
Future digital payments in the EU PSD2 & XS2A 1.1
Future digital payments in the EU PSD2 & XS2A 1.1Future digital payments in the EU PSD2 & XS2A 1.1
Future digital payments in the EU PSD2 & XS2A 1.1
 
Nationwide Building Society: Embracing Open Banking
Nationwide Building Society: Embracing Open BankingNationwide Building Society: Embracing Open Banking
Nationwide Building Society: Embracing Open Banking
 
[KDB대우증권] 기업분석 KG이니시스
[KDB대우증권] 기업분석 KG이니시스[KDB대우증권] 기업분석 KG이니시스
[KDB대우증권] 기업분석 KG이니시스
 
Payments Disruption
Payments DisruptionPayments Disruption
Payments Disruption
 
Will Open Banking trigger the API of Me? (Chris Wood)
Will Open Banking trigger the API of Me? (Chris Wood)Will Open Banking trigger the API of Me? (Chris Wood)
Will Open Banking trigger the API of Me? (Chris Wood)
 
Lo spazio della cerimonia del tè - The space of the tea ceremony
Lo spazio della cerimonia del tè - The space of the tea ceremonyLo spazio della cerimonia del tè - The space of the tea ceremony
Lo spazio della cerimonia del tè - The space of the tea ceremony
 
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking WaterLab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
Lab Test Shows TIGG GAC Removes TTHMs from Municipal Drinking Water
 
Raul bravo, director de eae madrid, participa como jurado en los premios capi...
Raul bravo, director de eae madrid, participa como jurado en los premios capi...Raul bravo, director de eae madrid, participa como jurado en los premios capi...
Raul bravo, director de eae madrid, participa como jurado en los premios capi...
 
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
Monthly Technical Stock Pick: Buy Anant Raj, target Rs65
 
Expositores displays Pamplona portacarteles ¡Diseño y fabricación a medida! R...
Expositores displays Pamplona portacarteles ¡Diseño y fabricación a medida! R...Expositores displays Pamplona portacarteles ¡Diseño y fabricación a medida! R...
Expositores displays Pamplona portacarteles ¡Diseño y fabricación a medida! R...
 
BIELA NOC KATALOG
BIELA NOC KATALOGBIELA NOC KATALOG
BIELA NOC KATALOG
 
El trabajador social entre la complejidad social y las profesiones de lo social
El trabajador social entre la complejidad social y las profesiones de lo socialEl trabajador social entre la complejidad social y las profesiones de lo social
El trabajador social entre la complejidad social y las profesiones de lo social
 
Expertos digitales
Expertos digitalesExpertos digitales
Expertos digitales
 
Muensterland reisefuehrer
Muensterland reisefuehrerMuensterland reisefuehrer
Muensterland reisefuehrer
 
IAA Accredited Institutes at 1 14 2015
IAA Accredited Institutes at 1 14 2015IAA Accredited Institutes at 1 14 2015
IAA Accredited Institutes at 1 14 2015
 
Användarhandbok minpension.se
Användarhandbok minpension.seAnvändarhandbok minpension.se
Användarhandbok minpension.se
 
REVISTA FUTBOL FEMENINO ABRIL 2015
REVISTA FUTBOL FEMENINO ABRIL 2015REVISTA FUTBOL FEMENINO ABRIL 2015
REVISTA FUTBOL FEMENINO ABRIL 2015
 
50 trucos para convertirte en “experto” de photoshop
50 trucos para convertirte en “experto” de photoshop50 trucos para convertirte en “experto” de photoshop
50 trucos para convertirte en “experto” de photoshop
 
Benchmark of ecommerce solutions (short version, english)
Benchmark of ecommerce solutions (short version, english)Benchmark of ecommerce solutions (short version, english)
Benchmark of ecommerce solutions (short version, english)
 

Similaire à The Human Chain Open Banking - The Future of Payments White Paper V1.1

Direct Benefits White Paper_April 2016
Direct Benefits White Paper_April 2016Direct Benefits White Paper_April 2016
Direct Benefits White Paper_April 2016
Alex Reddish
 
Oracle-Financial-Services.pdf
Oracle-Financial-Services.pdfOracle-Financial-Services.pdf
Oracle-Financial-Services.pdf
mario boxing
 
Accenture-Banking-Opportunities-EU-PSD2-v2
Accenture-Banking-Opportunities-EU-PSD2-v2Accenture-Banking-Opportunities-EU-PSD2-v2
Accenture-Banking-Opportunities-EU-PSD2-v2
Petri Syvänne
 
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
Ilkka Ruotsila
 
banks news and trands in globalhghk.docx
banks news and trands in globalhghk.docxbanks news and trands in globalhghk.docx
banks news and trands in globalhghk.docx
ChetanBariya4
 
Legal Framework for Doing Business of FinTech in India
Legal Framework for Doing Business of FinTech in IndiaLegal Framework for Doing Business of FinTech in India
Legal Framework for Doing Business of FinTech in India
EquiCorp Associates
 

Similaire à The Human Chain Open Banking - The Future of Payments White Paper V1.1 (20)

Payments innovation is Critical for Every Global Enterprise
Payments innovation is Critical for Every Global EnterprisePayments innovation is Critical for Every Global Enterprise
Payments innovation is Critical for Every Global Enterprise
 
Direct Benefits White Paper_April 2016
Direct Benefits White Paper_April 2016Direct Benefits White Paper_April 2016
Direct Benefits White Paper_April 2016
 
White Paper: Banking as a Platform
White Paper: Banking as a Platform White Paper: Banking as a Platform
White Paper: Banking as a Platform
 
Oracle-Financial-Services.pdf
Oracle-Financial-Services.pdfOracle-Financial-Services.pdf
Oracle-Financial-Services.pdf
 
Accenture-Banking-Opportunities-EU-PSD2-v2
Accenture-Banking-Opportunities-EU-PSD2-v2Accenture-Banking-Opportunities-EU-PSD2-v2
Accenture-Banking-Opportunities-EU-PSD2-v2
 
Exploring Open Finance .pdf
Exploring Open Finance .pdfExploring Open Finance .pdf
Exploring Open Finance .pdf
 
Rethinking distribution: Smart solutions for smart customers
Rethinking distribution: Smart solutions for smart customersRethinking distribution: Smart solutions for smart customers
Rethinking distribution: Smart solutions for smart customers
 
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
PSD2 Strategic options for banks_Accenture Strategy and Accenture Payment Ser...
 
1_Open Finance Meetup_Arnaud Sirtaine_Pulse Consult.pptx
1_Open Finance Meetup_Arnaud Sirtaine_Pulse Consult.pptx1_Open Finance Meetup_Arnaud Sirtaine_Pulse Consult.pptx
1_Open Finance Meetup_Arnaud Sirtaine_Pulse Consult.pptx
 
Global payments community 2017
Global payments community 2017Global payments community 2017
Global payments community 2017
 
banks news and trands in globalhghk.docx
banks news and trands in globalhghk.docxbanks news and trands in globalhghk.docx
banks news and trands in globalhghk.docx
 
Why Banks Must Become Smart Aggregators in the Financial Services Digital Eco...
Why Banks Must Become Smart Aggregators in the Financial Services Digital Eco...Why Banks Must Become Smart Aggregators in the Financial Services Digital Eco...
Why Banks Must Become Smart Aggregators in the Financial Services Digital Eco...
 
Harman_International_Payments_Whitepaper.pdf
Harman_International_Payments_Whitepaper.pdfHarman_International_Payments_Whitepaper.pdf
Harman_International_Payments_Whitepaper.pdf
 
The Most Recommended Fintech Solution Providers 2020
The Most Recommended Fintech Solution Providers 2020The Most Recommended Fintech Solution Providers 2020
The Most Recommended Fintech Solution Providers 2020
 
An API Model for Open Banking Eco-Systems
An API Model for Open Banking Eco-SystemsAn API Model for Open Banking Eco-Systems
An API Model for Open Banking Eco-Systems
 
MTBiz January 2018
MTBiz January 2018MTBiz January 2018
MTBiz January 2018
 
Legal Framework for Doing Business of FinTech in India
Legal Framework for Doing Business of FinTech in IndiaLegal Framework for Doing Business of FinTech in India
Legal Framework for Doing Business of FinTech in India
 
Servicios financieros BT: un mercado que crece en Colombia y Latinoamérica
Servicios financieros BT: un mercado que crece en Colombia y LatinoaméricaServicios financieros BT: un mercado que crece en Colombia y Latinoamérica
Servicios financieros BT: un mercado que crece en Colombia y Latinoamérica
 
Open Banking : The Rise of the Cloud Platform
Open Banking : The Rise of the Cloud PlatformOpen Banking : The Rise of the Cloud Platform
Open Banking : The Rise of the Cloud Platform
 
Top Ten Challenges for Investment Banks 2015: Revolution: Challenge 8
Top Ten Challenges for Investment Banks 2015: Revolution: Challenge 8Top Ten Challenges for Investment Banks 2015: Revolution: Challenge 8
Top Ten Challenges for Investment Banks 2015: Revolution: Challenge 8
 

The Human Chain Open Banking - The Future of Payments White Paper V1.1

  • 1.
  • 2. White Paper - Open Banking - The Future of Payments Executive Summary The world of retail banking and payments has become a very exciting and dynamic environment. We have seen new products and servicesemergingoverthepastfewyearsaimed at disrupting the status quo. The past 24 months have also seen nascent FinTech organisations developing products and services that will not only complement incumbent providers but in some cases are also designed to compete and be disruptive. For a market that has remained relatively stable over the decades, we are on the verge of witnessing great change. To facilitate this change, current payment regulation needs to be amended to give financial service providers, new and old, the opportunity to access systems and data so that they can participate in the market and offer innovative products and services. It is not very often that you can view regulatory bodies, or even the European Parliament, as bastions of innovation, but on this occasion they are with the Payment Services Directive 2 (PSD2). One of the principles of PSD2 is to foster an environment whereby customers wanting to use value added services from Third Party Providers (TPPs) can do so safely in the knowledge that their personal security credentials have not been shared with a third party, and that the service provider can access only the information for which the customer has given explicit consent. However, for these products and services to become mainstream and widely adopted by consumers, the TPP require access to the customer’s online bank accounts to access data in real time. The mechanism by which this will be achieved is through Access to Accounts, more commonly referred to as XS2A, which is set out in PSD2. It is anticipated that the EBA’s draft regulatory technical standards will recommend the use of Application Programming Interfaces (APIs) to enable access to payment system users’ accounts, thus providing an automated and secure mechanism for authorised payment actors to access customer information where the customer has given their explicit consent. Under PSD2 all payments participants will be required to comply with XS2A. However, it is how an organisation embraces the concept of XS2A that will define its business strategy moving forward. Organisations need to decide whether they simply fund the cost of regulatory change, or they invest in future business strategy, delivering data-rich services. In addition to the regulatory requirements for XS2A as outlined in the PSD2, the UK Government made clear its intention for the UK to be the global centre for financial technology and to lead the world in open source data in banking in its 2014 Autumn Statement. UK Government wants the United Kingdom to lead the world in open access to bank data via APIs. The payments industry is now facing not only legislative change at a European level (i.e. PSD2), but also domestically, with UK regulation potentially going further than its European counterpart. Europe’sPSD2,XS2AandtheUKOpenBanking API are going to have a big impact on existing core and legacy systems for all payments actors. New processes need to be adopted to ensure that only qualified and approved TPPs can access data where customers have given explicit consent. Robust auditing systems and processes are paramount to ensure that customers remain confident that their data is being used and shared in an agreed and appropriate manner.
  • 3. White Paper - Open Banking - The Future of Payments Forward-lookingorganisationswillberethinking banking customer relationships and revenue models to deliver compelling propositions that attract and retain profitable customers. PSD2 opens a world of new business opportunity. PSD2 makes a distinction between the various payment actors in the eco-system but importantly, what it does not do, is dictate which payment actors can facilitate what roles. This is especially important in the context of TPPs. New and existing payment actors could become TTPs and offer additional value-added servicestotheircustomers,drivingnewrevenue opportunities to underpin their core services. New payment regulation is coming in the form of PSD2, and its first effects are already being felt, as organisations assess the consequences of the pending legislation and attempt to understand the business, technical and operational implications. XS2A is going to radically shake up the payments marketplace. Organisations need to decide whether they simply fund change to meet the regulatory requirements of XS2A, or they view it as a strategic opportunity to develop and broaden their businesses to drive customer acquisition and engagement and develop profitable opportunities with new products and services. Author and contact Brendan Jones is a senior consultant with The Human Chain. His focus is on strategy, development and delivery of digitised services within the financial services environment. Brendan has more than 27 years’ experience in the payments and cards industry ranging from executive/senior management, business development, strategy development and execution, MA, business process re- ­‐engineering, product management and marketing through to operational management working for FinTech providers and technology companies as well as financial service providers. Contact: e: brendan.jones@thehumanchain.com m: +44 (0)7785 388 867 Brendan Jones
  • 4. White Paper - Open Banking - The Future of Payments From a payments perspective, we are seeing two major themes develop: Payment Initiation Services Payment Initiation Service Providers (PISPs) initiate internet payments on behalf of a customer via a software bridge between a merchant’s website and the customer’s online bank. The funds to cover the purchase of goods are paid directly from the customer’s bank account to the merchant’s in real time. This payment option directly competes with card-based payment methods, and from a bank’s perspective it dilutes its reliance on the card schemes; for merchants it provides another means of payment and so offers customer choice. It also allows a consumer to shop online even if they don’t have a bank payment card, and provides access to an alternative means of online payment that is safe, convenient and cheap. Account Information Service Providers (AISPs) provide data aggregation services to customers. AISPs aggregate customers’ financial transactions into one place in real time, from multiple accounts held at various financial institutions, and then use that data to provide services. Examples include next generation comparison services (i.e. bank accounts, loans, mortgages etc), real-time advisory tools providing push notifications, personal financial planning and management tools, advanced loan application processes etc. Account Information Services The world of retail banking and payments has become a very exciting and dynamic environment. From being a market that has seen the status quo maintained for many years, there is now greater competition, more market entrants, exciting new products and services, increased financial inclusion and greater transparency. We have seen new products and services emerging overthepastfewyearsaimedatdisruptingthestatus quo. Examples include prepaid card programmes, non-bank foreign exchange services for consumers and businesses, non-bank international money remittance services, crypto currencies such as Bitcoin, blockchain/distributed ledger technologies, non-bankconsumerbankcardpaymentapplications (i.e. Apple Pay, Android Pay and Samsung Pay etc), Payment Service Providers (PSPs) providing greater choice in payment instruments… and the list goes on. The past 24 months have also seen nascent FinTech organisations developing products and services that will not only complement incumbent providers but in some cases are also designed to compete and be disruptive. So vibrant is this space that we have seen governments actively encourage FinTech acceleration, FinTech incubators launched around the world and a number of international banks (e.g. Citi Bank, Santander, UBS and Barclays to name but a few) starting their own incubators to foster innovation, gain early insights and aid development. For a market that has remained relatively stable over the decades, we are on the verge of witnessing great change. However, in order to facilitate this change, current payment regulation needs to be amended to give financial service providers, new and old, the opportunity to access systems and data so that they can participate in the market and offer innovative products and services. There is a wide variety of products and services on offer in the market today, which provides greater consumer choice, reduces the overall costs of payments processing and fuels economic development. No doubt there will be many more exciting developments as companies continue to innovate. Open Banking - The Future of Payments These services provide greater customer choice, and no doubt as new ideas and innovations develop, there will be even more choice. However, for these products and services to become mainstream and widely adopted by consumers, the service providers require access to the customer’s online bank accounts to access data in real time. These accounts are typically run by authorised Credit Institutions[1] , referred to as Account Servicing Payment Service Providers (ASPSP), with which the service providers have no direct relationship.
  • 5. White Paper - Open Banking - The Future of Payments Regulation can drive innovation It is not very often that you can view regulatory bodies, or even the European Parliament, as bastions of innovation, but on this occasion they are with the Payment Services Directive 2 (PSD2). The aim of PSD2, and the original Payment Services Directive 2007/64/EC (PSD), is to harmonise the European payments landscape from a regulatory perspective, ensuring that all relevant organisations and activities are adequately covered. This marks a shift towards an integrated single market for safe electronic payments that aims to support the growth of the European Union (EU) economy and to ensure that consumers, merchants and companies enjoy choice and transparent secure payment services so they fully benefit from the internal market. The first PSD, which targeted and regulated a range of traditional payment organisations, soon became out dated by rapid technology development, delivering new products and services in the payments industry. PSD2 extends this scope to include regulation of new market participants such as Third Party Providers (TPPs), FinTech companies and new service providers, the so called PISPs and AISPs. The European Parliament has recognised, in the world of payments, that technological developments have led to a range of complementary services emerging in recent years, and these need to be covered by the same regulation. Therefore enactment of PSD2 will repeal the original PSD 2007/64/EC. PSD2’s vision is to ‘ensure continuity in the market, enabling existing and new service providers, to offer their services under a clear and harmonised regulatory framework’[2] . One of its principles is to foster an environment whereby customers wanting to use value added services can do so safely in the knowledge that theirpersonalsecuritycredentialshavenotbeen shared with a third party, and that the service provider can access only the information for which the customer has given explicit consent and only for an agreed period of time. PSD2 is driving innovation and opening up the payments market to value-added service providers, collectively defined as Third Party Providers (TPPs). The European Parliament, via PSD2, is encouraging TPPs into the European market, not only in their domestic market but also across other EU member states through the mechanism of Passporting, the exercise by a company registered in the European Economic Area (EEA) of a right to carry on business in another EEA state. Major step change This is a major and complex change to the world of payments. In order to provide an environment in which participants can share customer data, when explicit consent has been granted, with each other in a secure, automated fashion requires industry standards to be developed and mandated within the EU. As part of the PSD2, the European Parliament has directed the European Banking Authority (EBA) to develop draft regulatory technical standards for common and secure open standards of communication for the purpose of identification, authentication, notification and information, as well as for the implementation of security measures between all payment actors (i.e. Credit Institutions, PSPs, PISPs etc). The EBA has been given 12 months to develop the draft regulatory technical standards and present back to the European Commission (EC), for consideration and ultimately adoption.
  • 6. White Paper - Open Banking - The Future of Payments Consented access Financial Service Provider (ASPSP) (1) I want to provide you access to specific account data for an agreed period (2) Please provide access to this customer’s account data as per customer request Service Provider (AISP) Customer (3) Do you want to grant access to this company for your account data - What data - Duration (4) Agree to provide access - Specified data - Duration Fig 1: Data aggregation services The mechanisms to allow customers to approve TPPs access to their accounts without disclosing their security credentials is also commonplace in other industries, such as online payments, search engines and social media, e.g. PayPal, Google and Twitter etc. To achieve this, one approach some organisations have implemented is an open standard for authorisation called OAuth[6] , which provides a secure authorisation and approval method. OAuth enables users to grant third-party access to their resources (i.e. data) without sharing their passwords. It also provides a way to grant limited access, in both scope and duration. It provides client applications with a ‘secure delegated access’ to server resources on behalf of a resource owner. An example of how OAuth operates in a data aggregation scenario is shown in (Fig 1). What does this mean in reality? The mechanism by which this will be achieved is through Access to Accounts, more commonly referred to as XS2A, which is set out in PSD2. It is anticipated that the EBA’s draft regulatory technical standards will recommend the use of Application Programming Interfaces (APIs) to enable access to payment system users’ accounts, thus providing an automated and secure mechanism for authorised payment actors to access customer information where the customer has given their explicit consent. APIs have been used for some time. Many companies use them to securely pass data between organisations, and open APIs have been developed for specific industries[3] such as social media and search engines e.g. Twitter, Facebook and Google. There has been a proliferation of organisations publishing APIs so third parties can access their data and services[4] , to help drive new and innovative services, such as MasterCard with its Open API programme [5] .
  • 7. White Paper - Open Banking - The Future of Payments Once the information provider (i.e. financial service provider) has received permission from the customer that they are willing to share their account data with the TPP (i.e. service provider), the information provider then supplies the service provider with an access token[7] , a cryptographically generated number that represents specific scopes and durations of access to data, granted by the resource owner (i.e. customer), which the service provider presents via the API every time he requests information for that specific customer (Fig 2). Service Provider (AISP) Financial Service Provider (ASPSP) (5) Access token to access customer data (6) Data request presented with access token (7) Data provided in line with customer consent Fig 2: Authorised data transfer OAuth is used by major network services such as Google, LinkedIn, Facebook and Twitter. OAuth has arguably become a de facto open standard for authentication and authorisation on the web, and therefore is a strong contender to include in the EBA regulatory technical standards. However, there are competing standards that should also be considered, such as Security Assertion Markup Language (SAML), Central Authentication Service (CAS), LemonLDAP::NG etc. Innovation drives business opportunities Under PSD2 and individual member states’ transposition of the Directive, all payments participants (i.e. Credit Institutions, Payment Institutions, PSPs etc) will have to comply with XS2A, with the exact date for this yet to be determined. However, it is how an organisation embraces the concept of XS2A that will define its business strategy moving forward. Therewillbecostsassociatedwithimplementing the regulatory standards API, ranging from the technical implementation, setting of new policies and procedures, and supporting the day-to-day management and operation of the data flows, through to the ongoing security requirements necessary to ensure that only authorised parties access the data with the appropriate approvals. Organisations need to decide whether they simply fund the cost of regulatory change, or they invest in future business strategy, delivering data-rich services that will drive acquisition and retention and gain a strategic business advantage.
  • 8. White Paper - Open Banking - The Future of Payments UK HM Treasury call for evidence on data sharing and open data in banking In addition to the regulatory requirements for XS2A as outlined in the PSD2, the UK government made clear its intention for the UK to be the global centre for financial technology and to lead the world in open source data in banking in its 2014 Autumn Statement[8] . It published a report in December 2014, ‘Data Sharing and Open Data for Banks[9] ’, which considers in detail how financial technology firms can make better use of bank data on behalf of customers through APIs and open data, and sets out the benefits that could come from adopting these more widely in banking. HM Treasury published a ‘Call for evidence on data sharing and open data in banking’, updated 18 March 2015, seeking views from interested parties on how the recommendations set out in the report should be developed, what benefits more open data in banking could bring to consumers and, in particular, how an open API standard in UK banking could best be delivered. What is evident from the report is that its aim for the UK to lead the world in open access to bank data via APIs is much greater than that outlined in PSD2. Unlike PSD2, the report also draws a distinction between customer data and open data (i.e. non-personal data such as interest, savings and exchange rates etc), and the use of open data to develop a richer environment for new products and services. It details many potential use cases for APIs and ways in which external APIs can create added or new value for banks. These include enhanced security using OAuth APIs, account history porting, digital sign-up and identification verification for opening new banks account. It also notes that banks could provide customer identification verification as a service to other organisations. Banks (acting as ASPSPs) hold a wealth of customer information (i.e. payment profiles, KYC information, finance history etc), which could potentially be provided as a service and monitised with a customer’s consent. The report identifies the strategic value of banks being a platform for third party innovation. Table 1showsasampleselectionofthe100orsoapps connected to the Open Bank Project (OBP)[10] . The OBP, an organisation based in Germany, enables banks to offer an ecosystem of third party apps and services to their customers. It provides an open source, developer-friendly API for banks that developers and companies can use to build innovative applications and services based on the account holder transaction data. While these apps do not yet connect to any live bank data through the OBP platform, they demonstrate the appetite of developers to access customer data and develop innovative and compelling consumer propositions. At the request of the UK government, the Open Data Institute (ODI)[11] formed the Open Banking Working Group (OBWG), a collective of banking, open data and FinTech professionals tasked with developing a framework for adopting an open API standard across banking, and exploring how open banking will impact consumers, regulators and industry. The objectives of the OBWG [12] are to: l Deliver a framework for the design of an open API standard in UK banking focusing on personal and business current accounts. l Evaluate how increased levels of open data in banking can benefit consumers, businesses and society. l Publish recommendations in a paper by end of 2015 outlining how an open API standard can be designed, delivered and administered, alongside a timetable and implementation roadmap for achieving this. The payments industry is now facing not only legislative change at a European level (i.e. PSD2), but also domestically, with UK regulation potentially going further than its European counterpart.
  • 9. White Paper - Open Banking - The Future of Payments The Impact on core and legacy systems Europe’s PSD2, XS2A and the UK Open Banking API are going to have a big impact on existing core and legacy systems for all payments actors. Organisations are going have to identify the appropriate channel(s) for creating the third party interfaces to allow for data access via APIs. They will have to build, implement and test the APIs to ensure that they are fit for purpose and meet technical, security and regulatory requirements. There will no doubt be technical challenges integrating the requirement for real-time data access from TPPs with batched-based legacy core banking systems. Opening up access to data and functionality in legacy systems, that have typically operated in silos, will prove challenging. This is coupled with the fact that the opening up of access has to be delivered in a robust and secure manner in order to maintain integrity of systems and customer confidence. As part of building the APIs, the customer experience will need to be considered. New terms and conditions, consent application forms and notifications are going to have to be developed to inform customers of their rights regarding the disclosure of information. They will also require education to understand who is liable for what data when it has been disclosed; inbound call centre staff could well beoverwhelmedwithquestionsfromcustomers in the early days. New processes need to be adopted to ensure that only qualified and approved TPPs can access data where customers have given explicit consent. Robust auditing systems and processes are paramount to ensure that customers remain confident that their data is being used and shared in an agreed and appropriate manner. As stated previously, organisations need to decide whether they simply fund the cost of regulatory change, or they invest in future business strategy. Banks that want to become TPPs in their own right will also have to define their data requirements for the collection of third party data. Forward-lookingorganisationswillberethinking banking customer relationships and revenue models. As customers demand more from their financial service providers, organisations are going to have to review their current product offerings, implement new product development plans and repurpose existing services and products. They will need to (re)define their core proposition and deliver products and services that meet or exceed the ever-increasing level of customer expectation. Historically, financial service providers have wanted to provide the full gambit of services directly, without involvement from third party organisations. Some will no doubt continue down this route as it is ingrained in their corporate DNA. Others, though, will embrace thepotentialofworkingwithpartners,redefining their business models and processes to deliver compelling propositions that attract and retain profitable customers.
  • 10. White Paper - Open Banking - The Future of Payments 10 Business models Merchant Customer Bank B Customer Bank A (PISP) Customer Inter Bank Payment Network Merchant’s Bank Fig 3: Credit Institution acting as a PISP PSD2 makes a distinction between the various payment actors in the eco-system. It highlights the roles of Credit Institutions, PSPs, AISPs, ASPSPs and TPPs. Importantly, what PSD2 does not do is dictate which payment actors can facilitate what roles. This is especially important in the context of TPPs. TPPs could easily be seen as new market entrants providing innovative products and services using disruptive technology. Indeed this will no doubt be the case in certain circumstances. However, there is no reason why a Credit Institution or ASPSP could not become a TPP in their own right. Given PSD2’s definition of PISPsandAISPs,thereisnoreasonwhyaCredit Institution/ASPSP could not offer additional value-added services to their customers as a TPP. They could facilitate transfers from other ASPSPs to any other third party (Fig 3). They could operate a PISP service that would permit a customer to execute transfers from the customer’s accounts at other ASPSPs and to merchants directly.
  • 11. White Paper - Open Banking - The Future of Payments 11 Providing PISP as well AISP services would allow Credit Institutions/ASPSPs to consolidate a customer’s financial information in one place, thereby providing additional added value, creating loyal customers, driving greater engagement and generating new revenue opportunities through better understanding of their customers (Fig 4). Customer Bank D Mortgage Customer Bank C Investments Customer Bank B Savings Account Customer Bank A Current Account Customer Bank A AISP Direct Account Access Third Party Access Customer Fig 4: Consolidating all the customer’s financial data Combining these types of services together would create an opportunity for the Credit Institution/ASPSP to control a significant proportion of the online and payment interactions undertaken by the customer, allowing for greater insight and understanding of clients. Forward-thinking organisations recognise the importance and value to customers in delivering real-time, relevant and consumable data. Banks today hold a wealth of information on their customers. This data can be applied to build trust, convenience and competitively priced services. This, combined with the new understanding they could gather from providing other payment services (i.e. PSP and/or AISP), will place them in an ideal position to be the customer’s financial services provider of choice.
  • 12. White Paper - Open Banking - The Future of Payments 12 Customer Customer Bank D Mortgage Customer Bank C Investments Customer Bank B Savings Account Customer Bank A Current Account Customer Bank A AISP Direct Account Access Third Party Access Social Media Networks Foreign Exchange Services News Feeds Fig 5: Delivering financial services and relevant content These should be viewed as value-added propositions. There is no requirement, or need, for these services to be linked directly to customer’s personal current account, held with the Credit Institutions/ASPSP offering these services. Therefore, the potential target audience for these new services is greater than just an organisation’s existing customer base. Delivering AISP services should not be limited to financial services alone. There is significant scope for banks to connect content from third party partners with complementary products and services, open data sources (i.e. share prices, financial indices etc), and social media and news feeds that would enhance the core service offering, and underpin the bank’s standing and its brand in the customer’s mind (Fig 5).
  • 13. White Paper - Open Banking - The Future of Payments 13 Conclusions New payment regulation is coming in the form of PSD2, and its first effects are already being felt, as organisations assess the consequences of the pending legislation and attempt to understand the business, technical and operational implications. When XS2A will become a regulatory requirement is still a matter of debate. Until the EBA submits its draft regulatory technical standards to the EC in early 2017, and the EC approves and issues the regulatory technical standards, member state regulators and payment system actors will not be in a position to assess the full complexity and effects of implementing XS2A. Not withstanding this, XS2A is going to radically shake up the payments marketplace. There will be new market entrants offering new products and services that use customer data to facilitate the delivery of innovative consumer products and services. These can, and no doubt will, be far reaching in terms of application and usage. Revenues generated in the payments market are not infinite; therefore, if new market entrants arrive and start to win business from the incumbent players, existing revenues will be challenged. New market entrants have a distinct advantage over traditional payment actors, in that they are not constrained by legacy infrastructure. This makes them much more agile in developing and launching new services and solutions to meet market demand. However, they lack the brand reputation and customer trust that many established players enjoy today, and are entering into a highly regulated market in which they must remain familiar. Organisations need to decide whether they simply fund change to meet the regulatory requirements of XS2A, or they view it as a strategic opportunity to develop and broaden their businesses to drive customer acquisition and engagement and develop profitable opportunities with new products and services. Importantly, PSD2 does not preclude any regulated organisation from becoming a PSP, PISP, AISP or ASPSP. There is a strong argument that organisations that provide value-added services create more loyal customers, drive greater engagement and generate new revenue opportunities through better understanding of their customers. Ignoring the opportunities that XS2A offers could push a payments company into simply becoming an ASPSP, comparable to Mobile Network Operators becoming mere dumb pipe providers. The world of ‘Open Banking‘ has arrived!
  • 14. White Paper - Open Banking - The Future of Payments 14 [1] https://www.handbook.fca.org.uk [2] European Parliament Revised Directive on Payment Services (PSD2), Text of Revised Directive, Clause 33 [3] http://www.programmableweb.com/apis/directory [4] http://letstalkpayments.com/41-apis-­making-waves-in-fintech/ [5] https://developer.mastercard.com/portal/display/api/API [6] http://oauth.net [7] The OAuth 2.0 Authorization Framework [8] https://www.gov.uk/government/uploads/system/uploads/attachment_data/ file/382327/44695_Accessible.pdf (page 47, Section 1.171) [9] Data Sharing and Open Data for Banks, A report for HM Treasury and Cabinet Office, published by the Open Data Institute and Fingleton Associates 2014 [10] https://openbankproject.com [11] http://theodi.org [12] Open Banking Working Group OBWG Terms of Reference References AISP Account Information Service Provider ASPSP Account Servicing Payment Service Provider Credit Institution An organisation which receives deposits or other repayable funds from the public and grants credits for its own account Payment Actor A regulated participant organisation in the payments eco-­system. Payment Institution A regulated organisation that can offer customers the following services: • Executing payment transactions (including credit transfers, direct debits, through payment cards or a similar device) • Issuing and/or acquiring of payment instruments • Money remittance • FX services • Ancillary services Granting of credit for a maximum of 12 months if this credit is closely linked to a payment service provided. PISP Payment Initiation Service Provider PSP Payment Service Provider. Glossary
  • 15. White Paper - Open Banking - The Future of Payments 15 App Description Paygel Provides an easier, faster and safer eCommerce checkout experience. It enables users to shop on TV, a laptop or tablet, and then links the purchase to a smartphone payment application using, for example, a QR code. Kids View A PFM for children that provides them with a categorised money trail of their transaction history. Selfie Bank Secure payments using your face without exchanging bank information, just using a selfie. Mortgage Masher A dashboard showing you how to pay off your mortgage faster and smarter. Jamjars Banking for the unbanked that manages income allocation and budgeting for people with low incomes. Bank data aggregator Share aggregates of transaction data with firms and friends. Spendapenny A digital way of donating odd pennies to charity. TimeBalance Enables you to see your account balance next to your MacOS clock. DonationBundle Lets users decide how much they want to donate every month and to which causes. Fritz An app that lets family members approve online purchases or payments on behalf of other members, for example parents approving their children’s expenses. Goal Analyses spending habits, to help you reach your goals in life. CrowdFundMatcher CrowdFunding comparison site with bank co-­funding options. Perfect Shopper Helps small shops send targeted personal offers to consumers, based upon their previous purchases, personal preferences, location and their latest social media posts. Money Score Manage expenses related to other people and split bills. PayDutch Debt overview amongst friends. AlamPay A micro-­financing service that provides online payment and POS transactions, focusing on developing countries. Denary Allows anyone to receive money through multiple payment methods in a matter of seconds. Regulation Detective Identifies suspicious transactions. Source: Open Bank Project Table 1: Apps developed for the Open Bank Project
  • 16. The Human Chain Ltd, Magdalen Centre, The Oxford Science Park, Oxford, OX4 4GA, United Kingdom Tel: +44(0)1865 784386 Fax: +44(0)1865 784387 www.thehumanchain.com www.digitalservicestoolkit.com