PSD2 was turning access to bank data from a strategic choice into an infrastructure question. Banks could treat APIs as a compliance burden, or use them to define their role in a more open financial system.
PSD2 puts the spotlight on the banks. It forces them to figure out cost effective ways they will need in order to implement the sharing of data. The reality is: It normally costs banks more to decide what technology to use and to get the relevant regulatory clearances than it does to build the technology itself.
So it boils down to the factors that banks think will make APIs more costly than manual file download. The costs can only be associated with the management of the new banking relationships that APIs bring to the table.
Bank arguments and the practical response
Bank logic A: Managing access and security
Reality check
This is where OAuth comes into play. The costs involved could be limited by the existence of well-tested open-source implementations.
Bank logic B: Vetting applications
Banks need to retain the right to vet applications before giving them a key to connect to the API, at a cost.
Reality check
Such a vetting platform could be shared among banks. Banks could increase their stake in an API ecosystem by controlling the vetting aspect and sharing the costs involved.
Bank logic C: Supporting developers
Banks would have to provide continued support to developers and third-party organizations at an added cost.
Reality check
This support management process would involve providing sample code, a curated support forum, a sandbox with dummy data and other developer resources, thereby helping to offset the costs.
Banks could either help shape the API ecosystem or enter it reluctantly under regulatory pressure.KEVIN MOSERI · EARLIER WORK
Open API Ecosystem: “For Banks, For Developers, For Customers, and For Society”
On the face of it, a simple API is not sufficient, but only a first step towards modern banking in a real customer context. That’s why you will find the premise of the Open Bank Project API very appealing. The Open Bank Project API is secure.
Why? Because you only ever log in through your bank itself. You are then free to grant the app read-only access to specific account details. The process is similar to when you let an app have access to your camera or your location.
What the Open Bank Project API is doing is make the financial system more dynamic and efficient for customers. Standards are the key to linking disconnected systems. The ultimate beneficiary is you and me, the customer.
Bottom line: banks need to decide whether to partner with FinTechs in a mutually beneficial API ecosystem or become unwilling participants because of requirements such as PSD2 (and potentially other future mandates).
Historical announcement in the original article: the Emirates NBD Group and Open Bank Project global competition for financial technology startups.