Open Apis and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

JOURNAL° THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION 04.2017 N 45

Opinion

Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

Thomas Egner

RECIPIENT OF THE APEX AWARD FOR PUBLICATION EXCELLENCE TRANSFORMATION EMPOWERING THE FINANCIAL WORLD

Pushing the pace of financial technology, we help our clients solve technology challenges for their business – whether it’s capital markets in Mumbai or community banking in Macon.

We leverage knowledge and insights from our clients around the world:

clients in towns everywhere are becoming 20,000 more efficient, modern and scalable.

transactions processed help solve clients’ 27 billion challenges – big and small.

moved across the globe in a single year $9 trillion empowers our clients’ communities to build storefronts, homes and careers.

hearts and minds have joined forces 55,000 to bring you greater capabilities in even the smallest places.

Empowering the Financial World FISGLOBAL.COM

Recipient of the Apex Award for Publication Excellence

Editor Shahin Shojai, Global Head, Capco Institute

Advisory Board Christine Ciriani, Partner, Capco Chris Geldard, Partner, Capco Nick Jackson, Partner, Capco

Editorial Board Franklin Allen, Nippon Life Professor of Finance, University of Pennsylvania Joe Anastasio, Partner, Capco Philippe d’Arvisenet, Adviser and former Group Chief Economist, BNP Paribas Rudi Bogni, former Chief Executive Officer, UBS Private Banking Bruno Bonati, Chairman of the Non-Executive Board, Zuger Kantonalbank Dan Breznitz, Munk Chair of Innovation Studies, University of Toronto Urs Birchler, Professor Emeritus of Banking, University of Zurich Géry Daeninck, former CEO, Robeco Stephen C. Daffron, CEO, Interactive Data Jean Dermine, Professor of Banking and Finance, INSEAD Douglas W. Diamond, Merton H. Miller Distinguished Service Professor of Finance, University of Chicago Elroy Dimson, Emeritus Professor of Finance, London Business School Nicholas Economides, Professor of Economics, New York University Michael Enthoven, Board, NLFI, Former Chief Executive Officer, NIBC Bank N.V. José Luis Escrivá, Director, Independent Revenue Authority, Spain George Feiger, Pro-Vice-Chancellor and Executive Dean, Aston Business School Gregorio de Felice, Head of Research and Chief Economist, Intesa Sanpaolo Allen Ferrell, Greenfield Professor of Securities Law, Harvard Law School Peter Gomber, Full Professor, Chair of e-Finance, Goethe University Frankfurt Wilfried Hauck, Chief Financial Officer, Hanse Merkur International GmbH Pierre Hillion, de Picciotto Professor of Alternative Investments and Shell Professor of Finance, INSEAD Andrei A. Kirilenko, Visiting Professor of Finance, Imperial College Business School Mitchel Lenson, Non-Executive Director, Nationwide Building Society David T. Llewellyn, Professor of Money and Banking, Loughborough University Donald A. Marchand, Professor of Strategy and Information Management, IMD Colin Mayer, Peter Moores Professor of Management Studies, Oxford University Pierpaolo Montana, Chief Risk Officer, Mediobanca Steve Perry, Chief Digital Officer, Visa Europe Derek Sach, Head of Global Restructuring, The Royal Bank of Scotland Roy C. Smith, Kenneth G. Langone Professor of Entrepreneurship and Finance, New York University John Taysom, Visiting Professor of Computer Science, UCL D. Sykes Wilford, W. Frank Hipp Distinguished Chair in Business, The Citadel Transformation

101 The Power of “Negative Beta”: Why Every FinTech/RegTech Portfolio Should Include Private Equity Andrew Freeman, Iordanis Karagiannidis, 8 Opinion: Open APIs and Open Banking: D. Sykes Wilford Assessing the Impact on the European 111 Downside Risk Protection of Retirement Payments Industry and Seizing the Assets: A New Approach Opportunities Atanu Saha, Alex Rinaudo Thomas Egner 121 The Asset Management Industry, Systemic 14 Algorithmic Regulation: Automating Risk, and Macroprudential Policy Financial Compliance Monitoring and Claude Lopez Regulation Using AI and Blockchain Philip Treleaven, Bogdan Batrinca 129 The Role of Asset Owners in the Market for Investment Research: Where Are the 22 RegTech is the New Black – The Growth of Fiduciary Capitalists? RegTech Demand and Investment Alistair Haig, Neil Scarth Kari S. Larsen, Shariq Gilani 136 Risk, Data, and the Barcodes of Finance 30 From “Blockchain Hype” to a Real Business Allan D. Grody Case for Financial Markets Massimo Morini

41 Trade Finance Disrupted: A Blockchain Use Case Banking André Brunner, Nourdine Abderrahmane, Arjun Muralidharan, Patrick Halfpap, 159 Opinion: Risk Culture: Risk Prevention Oliver Süme, Stephan Zimprich Starts With the Individual Ulrich Hunziker 49 Towards a Standards-Based Technology Architecture for RegTech 164 The Troubled Future of Global Banking Tom Butler Brad Hintz, Roy C. Smith

60 Machine Learning: A Revolution in Risk 177 Policy Response Asymmetry and the Management and Compliance? Increasing Risks From Rising Government Bart van Liebergen Debt Level Blu Putnam, Erik Norland 68 Data-centered Dependencies and Opportunities for Robotics Process 187 Public Disclosure and Risk-adjusted Automation in Banking Performance at Bank Holding Companies Sandeep Vishnu, Vipul Agochiya, Ranjit Palkar Beverly Hirtle 207 What do New Forms of Finance Mean for Emerging Markets? Investments M. S. Mohanty

78 John Bull Can’t Stand Two Percent: QE’s Depressing Implications for Investment Jason M. Thomas

90 Do Credit Rating Agencies Inflate Their Ratings? A Review Kee-Hong Bae, Hamdi Driss, Gordon S. Roberts Opinion

Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

Thomas Egner – Secretary General, Euro Banking Association (EBA)

European banks are at a critical junc- payment service providers” (AS-PSPs), of payment accounts for third parties ture, with changes in the payment in- in particular. at the request of the customers hold- dustry requiring major strategic deci- ing the accounts. The intended effect sions. They need to decide whether to of both sets of regulations, in conjunc- become a banking service utility, sup- tion with SEPA Regulation 260/2012 porting other providers in their custom- THE REGULATORY AND TECHNOLOGY and previous legislations, has been to er-facing solutions, or play a central role DRIVE TOWARDS”OPENING increase competition as well as to pro- in the daily lives of consumers. In this UP” PAYMENT ACCOUNTS AND mote innovation and strengthen cus- context, the regulatory requirements to tomer rights with regards to the use of open up payment accounts via applica- SERVICES payment and account-related services. tion programming interfaces (APIs) play Since 2007, the European regulators a major role, since they are expected to have published two Payment Services The introduction of this regulatory help drive the industry towards a new Directives (PSDs) in order to create a framework for payment account access ecosystem shaped by the wider con- pan-European legal framework for pay- will encourage new players to enter the cepts of “Open Banking.” ments. PSD1 came into force in 2007 payments market and existing players to and paved the way for the introduction revise and expand their service propo- The aim of this article is to try to explain of SEPA in 2014, which aimed to har- sitions. In their capacity as AS-PSPs, the main aspects of this expected in- monize payments processing. PSD2, banks will need to offer and publish dustry evolution and describe the im- which entered into force in January an interface for third-party providers pact and key strategic challenges and 2016, further looked into providing a (TPPs) to use to access the payment opportunities this will entail for banks regulatory framework and the necessary accounts of customers held with a re- in their role as “account-servicing security requirements for an opening up spective bank. The Regulatory Technical

8 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

Standards (RTS), specifying the require- space could not have grown so fast To start with basic definitions, APIs can ments for strong customer authentica- in the past decade without the busi- be seen as interfaces between software tion and common and secure commu- ness-accelerating capabilities of APIs. applications, both within as well as be- nication under the PSD2, which have a tween organizations. More specifically, strong bearing on this interface topic, Opening up to other market participants APIs enable communication between are expected to come into effect in late outside of one’s own organization cre- software applications where one ap- 2018 or early 2019. The common under- ates value for customers and benefits plication calls upon the functionality of standing in the industry seems to be that the surrounding ecosystem. Open APIs another. from this date on, the direct connection and Open Banking could change the between the customer’s bank and TPPs way the banking industry thinks about APIs represent a specific software-ar- should be enabled via APIs. products and distribution – two key di- chitectural approach that revolves mensions in every business. APIs, and around the view that interfaces should Regarding TPPs, the PSD2 distinguish- digitization in general, allow value to be be scalable, reusable, and secure, while es between “payment initiation service created in a distributed fashion, through offering ease of use for developers providers” (PISPs) and “account infor- an ecosystem of partners. Co-creating through self-service. APIs, therefore, mation service providers” (AISPs). One value is likely to prove to be a major hold the promise to reduce cost and key benefit for customers delivered by change and challenge for banks in the lead time of interfacing between sys- AISPs could be the ability to have ac- near future. tems, allowing faster, cheaper, and bet- cess to their banking information from ter innovation on a larger scale. multiple providers in the same place. The changes triggered by the move to To this effect, it is expected that a wide open APIs will also impact many of the Various business dimensions of APIs range of aggregator websites and apps traditional business models in the bank- can be identified, starting with the con- will emerge to provide this information to ing industry, in line with the experience cept of “openness” in relation to APIs. customers in an easy-to-use interface, that a variety of industries have already giving customers a more complete view gone through following the large-scale The level of API openness of all the accounts they hold with differ- adoption of open APIs. For banks, as determines potential reach ent banks, and helping them to better well as other players in this space, the APIs enable secure, controlled, and monitor and manage their finances. key to success will be to adapt to this cost-effective access to data and/or changing landscape by re-conceptual- functionality. If APIs can only be ac- In addition to the regulatory initiatives, izing their business models around the cessed within the boundaries of one advances in technology – including customer, and seize the opportunities organization, they are referred to as immediate payment infrastructures, of APIs as an enabler of new products “closed APIs” or “private APIs.” If they blockchain, and the Internet of Things and services. can also be accessed by third parties (IoT) – are creating new ways to pay (outside of the organizational boundar- in a digitized end-to-end value chain. ies), they are referred to as “open APIs.” Customer demands are also evolving It is relevant to stress that “open” does as more and more transactions are ini- RELEVANT CONCEPTS IN APIS not mean that every third party can ac- tiated via mobile devices, demanding a cess a bank’s system at their discretion. real-time, personalized, and seamless In order to fully understand the poten- There will always be some form of con- payment experience. tial impact of APIs, and especially open trol by the bank, in order to preserve APIs, on the payments industry, it is security, privacy, and contractual condi- Although the PSD2 regulates only the necessary to clarify a few relevant con- tions. This will be further detailed below. field of payment accounts and services, cepts relating to APIs. The significance the opportunities that open APIs and of the degree of openness of APIs, how In practice, different levels of API open- Open Banking hold for the financial ser- it relates to creating value through APIs, ness can be observed. This is import- vices industry in a digitalized market are and the extent to which this value de- ant because the level of openness very substantial and not limited to pay- pends on the level of standardization determines the potential number of ments only. After all, outside the bank- are key aspects in this regard, as is a parties with access and thus the po- ing industry, some of today’s globally widening of the scope from open APIs tential reach of the functionality offered operating corporate giants in the digital to Open Banking. through an API. For the purposes of the

9 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

present article, the following levels of “API openness” are to be distinguished: CLOSED API OPEN API PRIVATE PARTNER MEMBER ACQUAINTANCE PUBLIC ■■ Private APIs: private APIs are closed Closed API that Open API that Open API that Open API that Open API that is accessible to is accessible to is accessible is accessible is accessible to APIs, and, therefore, exclusively ac- banks only banks’ preferred to members to anyone anyone. Typically partners. belonging to complying with involves some cessible by parties within the bound- Likewise for the a community. a predefined set sort of basic aries of the organization. bank’s developers Likewise for the of requirements registration bank’s developers (i.e., a contract). ■■ Partner APIs: APIs that are open to Likewise for the bank’s developers selected partners based on bilateral agreements. Like Private APIs, Part- Figure 1 – Levels of API openness ner APIs are exclusively accessible at the discretion of the provider of the APIs. Bilateral agreements on specific data exchanges between, Creating value with open APIs videos, product recommendations, for instance, a bank and an enter- Most digital players have used API and website links to contacts with- prise resource planning (ERP) soft- technologies to meet their business ob- in a social network. Social sharing ware provider is an example of a jectives and ultimately create customer is highly effective for branding and Partner API. value. They have discovered that us- marketing purposes and for gener- ■■ Member APIs: this type of API ing APIs in opening up systems (to the ating web traffic. Banks could use is open to everyone who is a for- outside world) is essential for driving social sharing principles to build mal member of a community with traffic to one’s assets, for co-creating user communities, retain or increase a well-defined set of membership end-customer value in the ecosystem, brand awareness, and increase rules. When becoming a member of and for sharing the burden and bene- brand loyalty. such a community, the API provid- fits (including the profits) between the ■■ Syndicate products and services er allows access to the community parties involved when unlocking new across different platforms: ex- members who comply with commu- markets. amples include eBay and Google. nity membership rules and regula- Syndication occurs when multiple tions. Account information and pay- Value co-creation through APIs can be players work together to co-create ment initiation services as defined categorized as follows: and provide a service to a customer. under the PSD2 fall in this category, Each player provides distinct fea- since only authorized or registered ■■ Enabling third parties to build ap- tures to create the value provided TPPs can obtain access. plications “on top” of the platform: by the service. The fees paid by the ■■ Acquaintance APIs: this type of examples include Facebook, Ama- customer are distributed amongst open APIs is inclusive, as they are zon, eBay, PayPal, Twitter, and Goo- the syndicate membership. open to everyone complying with a gle. Developers can reuse existing predefined set of requirements. De- functionality or use data sources to The models described above not only veloper portals distribute this type enrich their own applications. This enable and promote cooperation be- of API, which also comes with some lowers costs and speeds up time to tween different parties but also make it form of standardized agreements. market, but also creates additional possible to create attractive and com- Merchant access to point-of-sale dependencies on third-party devel- pletely new value propositions. Ease of (POS) APIs is an example in this cat- opers. For API providers, this way of use, product and information aggrega- egory. value co-creation provides a wider tion, and direct communication are key ■■ Public APIs: Public APIs are inclu- distribution network, creating traffic for catalyzing this process. sive and can thus be accessed by and minimizing innovation costs, anyone, typically with some form of which are carried by third-parties. Financial APIs require registration for identification and au- ■■ Social sharing for marketing pur- agreement on the scope and thentication purposes. poses: examples include Flickr, De- breadth of standardization licious, Twitter, YouTube, LinkedIn, In the financial world, defining technical The levels of API openness are depict- and Facebook. Social sharing is interfacing only is not enough for col- ed in Figure 1. about sending, for example, photos, laboration across organizations. Where

10 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

funds and sensitive data are involved, The report by the U.K. Open Banking APIs against the wider horizon of Open trust needs to be created. An addition- Working Group1 provides explicit rec- Banking and their positioning in that al dimension is provided by the various ommendations on the use of standards broader emerging ecosystem, which is ways in which data may be handled, in the field of Open Banking. facilitated by, but not limited to, a grow- this includes different requirements for ing usage of open APIs across the fi- reading versus writing of data as well In addition to the dimension of technical nancial services industry. as for different types of data. Person- standardization, the governance in the al customer data require different pro- field of standard setting is of utmost im- There are several definitions in use visions than bank data or aggregated portance for the use of, and acceptance for Open Banking, coming, for ex- (anonymous) customer data. A higher by, the users. The following governance ample, from the Open Bank Project2 level of control is, therefore, needed. levels could be distinguished: and the U.K. Open Banking Working However, banks already have experi- Group.3 In both cases, Open Banking ence with controlled third-party access. 1. Organization: this is the smallest revolves around the standardization of unit of governance, as it concerns how banks share their own data, but The financial services industry has a a single bank. Company policies, also how they allow customers more long tradition of applying control and guidelines, and Member APIs fall choice and sharing of their data for use standardization beyond technology, under this category. in third-party (FinTech) applications in when creating infrastructures, such as 2. Community: standards are ac- a secure and resilient fashion. Open for payments and securities, and when cepted and adopted by a group Banking can be characterized as a interfacing with clients and other third sharing common characteristics technology-driven evolution of banking, parties. In a fully digitized world (i.e., or interests, such as national com- and this includes Open APIs. As such, in a machine-to-machine environment munities, processors, banks, etc. Open Banking is a movement “bridg- without any foreseen human interven- The pan-European e-authorization ing two worlds,” i.e., making it possible tion), standardization becomes even solution MyBank is an example in for customers to use their banking ser- more important. We distinguish four this category, as well as the recent vices in the context of other (FinTech) agreement and standardization dimen- work done by the U.K. Open Bank- services, thereby combining innovative sions (scope) in the banking industry: ing Working Group. functionalities from banks and non- 3. Industry: standards are accepted banks with reach through infrastructure. 1. Legal: rights and obligations of and adopted by a complete indus- concerned parties for creating try on a regional or global scale. Functionally, Open Banking is about trust among the parties involved. The SWIFT standards are an ex- how banks share their own products 2. Operational: the agreements ample of an industry standard. The (i.e., services, functionality, and data) needed for running an API (after SEPA Schemes also fall into this and how they enable their customers to implementation): performance, up- category. share their data and account functional- time, service levels, support, etc. 4. Universal: standards are accepted ity with third-party (e.g., FinTech) appli- 3. Functional: aspects related to the and adopted by multiple industries cations in a secure and resilient fashion. user functionalities, data seman- around the world. Any standard As customers drive the actual uptake tics, etc. defined by an international organi- of such innovations, the concept of 4. Technical: all aspects relating to zation such as ISO, ITU or IEC fall “customer ownership” or “product cen- technical implementation. into this category (HTTP/HTTPS tric” is changing towards a concept of used for Internet communication is “customer centric” between banks and Industry infrastructures and business one practical example). third-party developers. networks, such as today’s payment systems (and financial systems in general), From open API to Open cannot function without agreements on Banking all of these dimensions, either between From a strategic point of view, pay- individual banks or within communities. ments industry players in general – and Consequently, financial APIs need at account-servicing payment service 1 http://bit.ly/1nYWjv4 the very minimum a similar scope when providers, such as banks, in particular 2 http://bit.ly/2mSAa1E it comes to agreements and standards. – should consider their use of (open) 3 http://bit.ly/1nYWjv4

11 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

The real challenge of customer centric- Open Banking redefines both product Distribution ity through Open Banking is to move and distribution as the principles (re-us- away from the product-driven push and able, scalable, secure, self-service), to develop the corporate capabilities to technologies, and agreements of Open 2. PRODUCER 4. PLATFORM truly understand the customer’s stated Banking allow for new possibilities. Fig- and tacit needs, to generate new ones, ure 2 demonstrates where APIs fit in be- Third-party distribution and to provide highly personalized solu- tween products and distribution. tions and experiences. Achieving customer centricity is a journey, an iterative Using APIs for interfacing between 1. INTEGRATOR 3. DISTRIBUTOR

one that may have significant impacts product and distribution enables banks Own distribution on the entire organization. It will require to decouple these functions. The com- Own product creation Third-party product creation Closed banks to holistically rethink the way the bination of decoupling and opening-up Product creation business is conducted, starting from its allows banks to play different roles in customers. the financial value chain with regards Figure 3 – Potential roles in the digital value chain to the offering of products and the distribution of these products. Two funda-

mental strategic questions need to be Level of platformization OPEN BANKING FROM A BANK’S looked at in this context: (customer control) High(er) PERSPECTIVE PLATFORM 1. Who distributes the products that Facilitate third-party business Open Banking challenges traditional are made accessible via an API to by acting as matchmaker assumptions by creating new opportu- existing and new customers? PRODUCER nities in product creation and distribu- 2. Who creates the products that Offer more products via open APIs tion. Traditionally, banks have not only need to be distributed to a bank’s DISTRIBUTOR provided their customers with products customer base? Distribute and/or aggregate but have also been responsible for the products from third parties distribution of these products, i.e., the Based on these two questions, four ge- INTEGRATOR bank distributed its payment products neric roles in the financial value chain Low(er) Low(er) High(er) through its own banking channels, such may be defined as illustrated in Fig- Openness as mobile, web, and branches. In this ure 3: integrator, producer, distributor, traditional scenario, the bank controls and platform. Figure 4 – The four platformization levels of the entire product and distribution Open Banking chain. Most of the larger financial institutions already play roles 1, 2, and 3 (integrator, producer, and distributor) at the same model. Criteria to consider when eval- time (often assigned to different busi- uating the level of strategic change ness lines or products), whereas role 4 include customer choice and control, (platform) is still at a very early stage of customer loyalty, market propositions, CUSTOMER its development. The roles could also cost efficiencies, innovation culture, indicate the platformization levels of employer attractiveness, business and Open Banking. Each level correlates IT alignment, available means for in- DISTRIBUTION with increasing customer control when vesting, and possibly outsourcing. looking at things from the customers’ perspective (Figure 4). Given this wide range of criteria and po- API API API tential consequences to consider, deci- Embracing a new role in the financial sion-makers within banks are faced with PRODUCTS (SERVICES, FUNCTIONALITY, AND DATA) value chain with a limited or extended significant strategic challenges. Open- level of platformization entails trans- ing up and giving customers more con- formational challenges, as it requires trol can have a positive impact on rev- Figure 2 – APIs are the pivot between products and distribution changes in the business and operating enues (and profits) as successful open

12 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION Open APIs and Open Banking: Assessing the Impact on the European Payments Industry and Seizing the Opportunities

(platform) models in the non-financial industry have shown in the recent past. Risks, in terms of increased compliance challenges and increased competition, are mounting as well, all potentially to be mitigated and adequately managed by changes in the operating model. Each level of platformization comes with varying challenges, where the pur- suit of a “doing nothing” strategy is not an option.

CONCLUSION

The above elaborations describe the strategic crossroads that every account-servicing payment service provider could face in the next one to three years, when confronted with choices on how to approach or embrace Open Banking and apply API technology. The minimum engagement in “opening-up” is what the PSD2 will prescribe in terms of access-to-account, i.e., a limited “producer role” and thus limited level of platformization, while the current FinTech and innovation initiatives pose growth challenges regarding business strategies for partnering and product propositions towards third-parties.

The ever-changing customer expecta- tions – driven by the experiences customers make in their digital life – will increase this need for more advanced levels of platformization, enabling ul- timate customer choice and control options. It will be up to each individual player in the market to rise up to the challenge of meeting these expecta- tions and seizing the opportunities offered by the industry’s move towards open APIs and Open Banking.

13 THE CAPCO INSTITUTE JOURNAL OF FINANCIAL TRANSFORMATION

Layout, production and coordination: Cypres – Daniel Brandt, Kris Van de Vijver and Pieter Vereertbrugghen

All rights reserved. All product names, company names and registered trademarks in this document remain the property of their respective owners. The views expressed in The Journal of Financial Transformation are solely those of the authors. This journal may not be duplicated in any way without the express written consent of the publisher except in the form of brief excerpts or quotations for review purposes. Making copies of this journal or any portion thereof for any purpose other than your own is a violation of copyright law.

217 BANGALORE BRATISLAVA BRUSSELS CHICAGO DALLAS DÜSSELDORF EDINBURGH FRANKFURT GENEVA HONG KONG HOUSTON KUALA LUMPUR LONDON NEW YORK ORLANDO PARIS SINGAPORE TORONTO VIENNA WASHINGTON D.C. ZURICH