Open Banking: Friend of consumer and business. Enemy of banks and the US?

What is PSD2 and how will it help me?

No, it’s not R2D2’s cousin. PSD2 is the second iteration of an EU banking directive, and its main aim is to protect consumers. Now we all know that banking legislation isn’t usually considered exciting, but PSD2 is arriving in 2018 to shake up the system and give bank customers control of their financial data, and businesses an opportunity to compete in the financial services. With PSD2, you will be able to allow licensed, third-party providers of financial services to access your banking information (with explicit consent), which they can use to analyse your spending and present you with budgeting advice, or guide you towards a cheaper mortgage or higher interest savings account. Third parties will also be able to provide payment services that extend across country borders into the whole of the EU and EEA territory, which means faster verification and fewer fees for consumers. So if you imagine you want to become a merchant and sell products throughout the EU. Or want to move from one European country to another. You will be able to do both of these immediately. You won’t need a new, foreign bank account as you can permit your financial data to be shared across borders and make payments throughout the EU. And your identity and reputation can be easily verified. In this article, we're going to look at why PSD2 is needed, how it works, what it will mean for consumers, businesses and banks, plus how it will affect the EU and the USA.

There are two new types of licenses for third-party providers

Account Information Service Providers (AISP’s) - These can provide users with aggregated information about one or more of their payment accounts in one single place, to help consumers better manage their finances. This can include transaction history, current account balances, savings accounts, direct debits and other deposits and payments. Payment Initiation Service Providers (PISP’s) - These are services that facilitate the use of online banking to make a payment. This can be an online transfer of funds between accounts, direct debits, credit transfers and transactions via debit or credit cards, amongst others. This is a game-changer when it comes to avoiding credit card fees and other transaction costs.

Why do we need PSD2?

The first directive, PSD1, was drawn-up before the 2008 financial crash. The world has, unsurprisingly, changed a lot since then. Politically, there is unrest in the EU fueled by the resulting austerity policies and high unemployment. Economically, the EU is behind in growth. Digitally, the continent has no big corporate powers to challenge those in the US, which means that as we are purchasing digital and technological products and services from America. Therefore, EU cash is filling US accounts and valuable data is continually flowing into US servers with much less consumer-friendly data protection laws. The ulterior motive of PSD2 is to deregulate and give digital businesses in the EU a competitive edge - and rapidly boost the EU economy. Following the 2008 crash, EU leaders have reportedly also been unhappy with how much power the banks have. With exclusive access to their customer's data, they were the only ones who could monetise it by selling financial services to their customers, and that has often meant high fees. This monopoly on client data earned EU banks an estimated €128 billion in 2015, a quarter of their retail banking income. Another reason for these high fees is outdated and expensive administrative and security systems. Millions of people make formal complaints about their banks every year. The recent success of FinTech and blockchain companies in the EU has proven that opening up the financial services to third-parties will mean more competition, opportunities for innovation and better security - all while costing less for consumers.

Financial Technology is nothing new

70% of EU customers use an app for online banking, and 40% have software to make mobile payments. Companies such as Sofort, iDEAL and other FinTech firms conduct over half of online payments in the Netherlands and Germany. In the UK, you can ‘ping’ small payments to your friends by using just their phone number. However, there are many other services that FinTech companies could provide if they had access to customer transaction information. Currently, most banks cooperate with these data requests, but they can be slow to respond or sometimes block them entirely. PSD2 will make it compulsory to both share the data and also build systems capable of making this trade real-time. A massive win for consumers and businesses. And FinTech is only going to get bigger. According to data from KPMG, investment in FinTech totalled $24.7 billion in 2016. This is likely to be topped this year as PSD2 creates more opportunities in the sector.

What about security?

Security will be tight with all third-party providers. They must be licensed, insured, regulated and supervised. For example, Holvi, a Finnish startup that helps companies to track workflow and invoices, is regulated and licensed as a Payment Institution to operate across the EU by the Financial Supervisory Authority of Finland. It is supervised by the same authority as traditional banks and insured against losses from fraud. All customer funds are also kept separate from company assets, so in the event of insolvency your money is safe and can be withdrawn any time. Protecting the consumer is the priority of this directive. With improvements in artificial intelligence, fraud will be easier to detect. This will save retailers and merchants billions of euros in losses from false declines online caused by incorrect fraud detection. False declines also cause the loss of many patrons, as it’s estimated about a third of users whose payments are refused do not return to an online retailer. Often the cost of the lost business outweighs the potential losses from fraud. And it’s not just the companies getting checked. One of the significant changes from the PSD1 directive is the need for SCA, Strong Customer Authentication. Each time you want to use one of these third-party services you will have to complete a more robust, 2-step authentication comprised of a combination of two of these three components:

Something you have - for example a mobile phone or IoT device like a PINsentry card reader
Something you know - like a PIN, personal or secret information
Something you are - biometrics like fingerprints or facial recognition

Companies will also need to take responsibility for protecting consumer data with methods like encryption, obfuscation, root and jailbreak protection, device binding and key protection. The EU itself will also need to develop a Blockchain-style distributed ledger infrastructure for identity verification and transaction authentication. These techniques can already be hard to implement but are even harder to make user-friendly, which is why banks should be looking to FinTech companies for help.

What does PSD2 mean for banks?

There are some scary statistics around; Goldman Sachs has already weighed in and estimated that traditional banks could lose out on as much as $4.7 trillion in revenue, to the benefit of FinTech companies. However, most financial analysts and commentators seem to agree that banks should be looking at PSD2 favourably and as an opportunity for innovation. FinTech’s can provide individual components, but banks will have a head start, particularly when creating premium utilities concerning identity and data (which they currently own), and capital (which they currently have). Some banks have already chosen to embrace the changes PSD2 will bring. BBVA, a Spanish bank, has acquired Holvi and will work with them to provide new utilities. Other banks have hired specialist research and development departments, innovation and incubation teams, begun unbundling their out-of-date IT systems and even sponsored hackathons. SME’s now operate on a worldwide scale and are much more tech-savvy, from using accounting and payroll software to raising capital through crowd-funding rather than obtaining loans. It’s important for banks to cater to the ever-changing needs of SME’s and to keep on top of financial innovations to avoid competitors gaining an advantage or losing connections with customers when they begin using a third-party provider. Facebook Messenger has plans to provide a service to allow users to make small payments to friends across their social network. If every one of the two billion active monthly Facebook users were to sign up to this service and enter their bank account details, it could potentially have one of the biggest financial consumer networks in the world in an incredibly short period when compared to centuries-old traditional banks hard-won client bases. Legally, banks will be required to give third-parties access to data, but will still be liable for the security of that information. They will also be responsible for facilitating balance checks, statement checks and payment initialisations for these new competitors.

How will it work?

The most widely-agreed solution to connecting the banks and their data to third-parties is with an API, an Application Programming Interface. It is essentially a way of plugging one server, mobile app or website into another and allowing them to speak to each other, while still working independently. In this case, it can control how a bank wants to receive data requests and how a finance app designers want to receive that data, to best communicate it to customers. Usually, most big commercial websites will want to keep their code secret as they don’t want developers stealing code they have paid a lot to develop. However many have realised that by releasing certain parts of their code to developers, they will often be rewarded with the production of better products and services. An API is the part of their code that they do expose. So the banks will be able to get lots of new features from the developer community, and the developers get a chance to build on top of some costly professional code and a huge platform to promote their work. API’s also help to solve the problem of how to connect the new ecosystem of banks, FinTech’s, retailers, social networks and anyone else planning to provide financial services. Banks will currently already have proprietary IT systems, which may or may not be connected to a cloud infrastructure. Concerning security and regulations, it isn’t safe to move the entire structure to a cloud. But neither does integrating new and diverse components when the number of operations needing to cooperate with each other will only keep increasing. The result will almost certainly mean an expensive and time-consuming technical debt as increasingly complex systems are developed on top of one another. Therefore, the answer seems to lie in hybrid integration that uses a cloud system connected with the current, in-house systems already set up in banks. New FinTech partners will be able to join up with core structures instantly over the internet, without the need for time-consuming onboarding. By incorporating a cloud system, banks will also have the benefit of immediate additional capacity, which will be invaluable with the new and increased demand for real-time data and transactions PSD2 will bring.

What is happening in the Netherlands?

Aside from all of the benefits described above, the directive will be especially exciting in the Netherlands, which is home to many FinTech startups, incubators and accelerators. With Brexit fast approaching, many companies are looking for locations outside of the UK. Dutch cities like The Hague and Rotterdam are attractive options, and Amsterdam is already home to several FinTech startups, many of the top Ethereum developers and the EU headquarters of BitPay. Adyen, a Dutch FinTech startup, is one of the top funded companies in the whole of the EU. Its current value stands at $2.3 billion. The firm provides a “friction-less payment experience” with 250 different payment options, from credit cards to Apple Pay, in one system. Clients include Netflix, LinkedIn, Spotify, Uber, Etsy and Groupon. In Amsterdam, there is already a robust technology ecosystem in place that makes it the perfect place for PSD2 to make a difference to not just FinTech but several other sectors. From high-speed broadband and a LoRaWAN IoT network to government-led initiatives, incubators and accelerators for startups, and the universities and researchers dedicated to innovation. In just a few weeks, EIT Digital will open a FinTech Innovation Center in the city, supported by the municipality, CWI (the Center of Mathematics and Informatics), ING Bank, Philips and TNO (the Netherlands Organisation for Applied Scientific Research). Believing it is “important for the Dutch knowledge economy to invest in digital business”, the centre will focus on researching, educating and innovating in financial blockchain technology, artificial intelligence and cybersecurity.

Will PSD2 affect American banking?

The short answer is no. It only applies to parts of the payment transaction that are carried out within the EU. However, PSD2 will operate what is called a ‘one leg out’ policy. This means that the directive will impact a Payment Service Provider as soon as funds are credited to an entity within the EU. With outgoing payments, the Payment Service Provider is obliged to adhere to PSD2 until the clearing account in the EU is debited. The longer answer is yes, albeit indirectly. This is related to the competitive nature of the directive. Europe has always taken a much more progressive stance towards personal data protection than the US, which generally places the EU as ‘anti-big corporate tech’ when you consider cases such as the ‘Right to be Forgotten’ ruling against Google in 2006. Currently, US financial corporations such as Visa and Mastercard have laid payment infrastructures all around the world and in the EU. If a company or consumer wants to use these frameworks, they have to pay fees. If the EU can use PSD2 to create the planned robust verification and direct account-to-account payment system, the American system will become slow, expensive and irrelevant within European e-commerce. The EU will be able to flip the fees and charge companies outside of its borders to use their new infrastructure instead.