Below is a lightly edited transcript of the podcast:
MIRIAM CROSS: This is a promotional video from the Open Banking Implementation Entity, a company formed by the UK’s Competition and Markets Authority to explain and implement open banking. Open banking is one of those buzzwords you have probably heard over the past couple of years. The term can mean a couple of different things depending on where you are or the context, but in general it refers to customers having control over their banking data and the ability to provide it in real time to third-party vendors. And that access can bring with it certain benefits.
PROMO: They produce credit scores that reflect who you are calculated using rich, accurate and up to date information that enables lenders to offer more suitable tailored credit when needed. They help safeguard the financially vulnerable. Open banking services can analyze spending and identify unwanted patterns, helping to slow or prevent behavior that you or a loved one could rather do without.
CROSS: In Europe, Open Banking — capital O, capital B refers to a regulation that requires banks to share customer data with third parties at the customer’s request.
PROMO: Open banking exists to deliver better financial outcomes for you. With data shared securely and only ever with your consent, open banking, the future of money where you're in control.
CROSS: But in the United States, there is no such law or regulation, so what we have is open banking — lowercase o, lowercase b. There’s no uniform policy around sharing customer information, or even who that information belongs to, so our open banking is somewhat more aspirational or conceptual.
So is the United States ready to take on Open Banking with capital letters? And is it a good idea even if we were?
From American Banker, I’m Miriam Cross, and this is Bankshot, a podcast about banks, finance, and the world we live in.
ROLANDS MESTERS: The snow has melted on. There's a bit of sunlight every now and then every second day. But it's great. People are kind of losing it. It is almost t shirt weather, you see basically everyone wearing T shirts on the street already.
CROSS: That’s Rolands Mesters.
MESTERS: My name is Rolands Mesters, I am the CEO and cofounder of Nordigen. We are a licensed open banking institution.
CROSS: Nordigen, which is based in Riga, Latvia, is one of hundreds of open banking institutions licensed by national regulators to receive and manage bank customer data.
MESTERS: We have a license passported to 31 countries in Europe, and with this license, we can connect to official open banking API's built and maintained by the European banks. You can think of us as a connectivity hub for accessing bank accounts, data in Europe. Before open banking regulation, access to data for fintechs in general was very complicated. Basically banks had a monopoly over user data. For any third party application that you wanted to use as a user, that means that this application had to figure out a way for you to transfer your data from your bank to this application. Before open banking was regulated in Europe that was a very big nightmare. People were sharing bank statements, left and right. Like literally as in files.
CROSS: What do you mean, people were sharing bank statements?
MESTERS: This is really old school. Most banks that have an online banking interface which is I think today probably most banks in the world, you have a chance to download a report of your transaction history, and you can download that report, mostly, today in PDF or Microsoft Excel formats. Some banks or some financial institutions still require people to send in — typically through an email or through in an online form — to submit these bank statements to validate their income levels or to validate that they don't have any other loans that they might have not told the bank about. So a bank statement is still widely used as a document to validate someone's income levels and to validate that they don't have any active liabilities that are sort of not mentioned in their loan applications.
CROSS: Wow. All right, that does sound old school.
MESTERS: The weird thing is that it extends to some industries where, for example, in in Netherlands if you want to rent out an apartment, a landlord can ask you to send a bank statement to validate that you actually have income to pay for rent. So some people are just willingly sharing their bank statements with strangers, just to rent out an apartment.
CROSS: Some of this may sound familiar. We have budgeting apps and aggregators in the U.S. like PocketGuard, YNAB and Mint that allow you to connect your financial accounts and get an overview of your balances and transactions. But what we have isn’t quite Open Banking.
PAUL SCHAUS: In the U.S., there is no regulations defining open banking so its interpretation of what open banking is.
CROSS: This is Paul Schaus, president and CEO of CCG Catalyst Consulting. CCG Catalyst co-owns the Arizona Fintech Council, a coalition of banks, economic and technology groups that promote bank-fintech partnerships.
SCHAUS: Some companies will define it as a European standard just because they're doing business in Europe, but in the U.S., open banking — depending upon who you talk to, but generally speaking, it allows for the interconnectivity of different solutions that is controlled by the owner of the system. So in other words, if Bank A is trying to connect to Product B and C, it's more of an open standard to allow for the connectivity within a very short period of time.
CROSS: To what extent does that already exist here?
SCHAUS: It exists very little. In other words, in an open API world, you the bank and let's put it back to the customer level…the customer wants to share data between them and Vendor B. Why and the customer goes to the bank and says I want to share my data over, why is that a big project, why isn't there already connectivity there? Where there's an open standard, fine, we'll turn this on and you'll have it immediately? That's the difference between open banking and today's API infrastructure where Customer A wants to share data with Vendor B that turns into a project at a bank and the bank would even do it. It's really meaning that you have open standards for interconnectivity and not everything is a project to make it work. It's just turning on and off.
MESTERS: It's very similar to how logging in with Google accounts or logging in with Facebook, or logging with Apple ID, how it works, it is pretty seamless, so you just type in your bank credentials and there's a button that says, I agree to Terms and Conditions and I'm okay to share my data with this app, and then there's another screen that shows Hey, this is the information that I will be sharing with this application. This is for how long the application will have access to my bank account and that's it.
CROSS: But Open Banking as it exists in Europe didn’t happen overnight — it emerged after more than a decade of legal and regulatory deliberation. It started with PSD1 in 2009, an
But even though the U.S. doesn’t have those rules doesn’t mean it doesn’t functionally have open banking already — it’s just driven by the market.
TOM CARPENTER: Some parties would say, “Oh, the U.S. is so far behind in open banking or open finance,” and they would often say that because there's not a clear and present open banking regulatory structure. How we think about open banking is the concept of a consumer having the ability to share and use their data is really what determines whether open banking or open finance is present.
CROSS: This is Tom Carpenter.
CARPENTER: Tom Carpenter, and I am the Director of Public Affairs and marketing for the Financial Data Exchange.
CROSS: Can you describe for me what the Financial Data Exchange does?
CARPENTER: The easiest way that I like to describe FDX — the Financial Data Exchange — is if you think about the way that Bluetooth pulled together a lot of different industry segments in the consumer electronics marketplace, who came together and understood that the consumer doesn't want to just have to buy one segment or one company's array of products they want to buy a bunch of different products but they want them all to all work together. So what Bluetooth did is they defined a standard, so that all those products could be certified to that standard, and then all the consumer needed to see was that symbol, and they knew it would all work. So financial Data Exchange started in a similar way, about two and a half years ago, with an array of entities within financial services. So financial institutions, some fintechs, some financial data aggregators and other stakeholders that came together and said, “Gosh, the consumer really wants to use all these different tools. And so we need a way that they can share their data in a secure in a controlled in a transparent manner, that really just works.”
CROSS: This sounds very relevant to open banking.
CARPENTER: Yes it is. Open banking is our sweet spot. The U.S. is, you know, has an enormous marketplace. We estimate that in North America somewhere between 80 and 100 million consumers had shared data with a third party app or service either on a one-time basis or an ongoing basis. So from that perspective, open banking is absolutely happening in the U.S., we just have a different kind of structure that's enabling it right now.
CROSS: We’ll talk a little more about how the U.S. approaches open banking after this break.
CROSS: There’s research suggesting that American consumers want open banking — either driven by the market as it is now, or driven by regulatory standards as it is in Europe. One
CARPENTER: So Experian is one of the credit bureaus in the U.S., obviously one of the keepers of credit scores. And what they realized early on, and I think what a lot of folks in open banking saw as well, is what do we do with this pool of people that either has a very thin credit file or really no credit file or credit score whatsoever, and then a traditional kind of analog market of financial services. Those people are largely outside of the traditional lending scope and kind of left only to go to other marketplace lenders where the rules are looser and the interest rates are much higher and the terms are more severe. And so what open banking and open finance has unlocked is, “Hey, even if somebody doesn't have all the makings of a traditional credit score, you can actually look at their banking data, their transaction data to understand is this a responsible credit worthy borrower? What do they have coming in versus what do they have going out. Are they paying their bills or their rent on time?” And so you can actually allow somebody — again, all this is consumer permission. Probably should have started with that — none of this happens without the consumer’s express consent and permissioning of their data for a set purpose. But a consumer can actually go and say, “Okay, I'm happy to give you access to my transaction data set, so you can actually go look and see, “Am I actually a more creditworthy borrower than say my credit score says?” And so Experian has a product called Experian Boost. It's powered by a relationship with one of our data aggregator members Finicity and they allow consumers to permission their data and oftentimes they'll see their credit score go up. And so to me that exemplifies the way that a consumer is really able to harness the power of their own data for their own financial good.
KAREN MILLS: This is true for consumers, but it's also particularly true for small business borrowers.
CROSS: This is Karen Mills.
MILLS: I'm Karen Mills, I'm a senior fellow at Harvard Business School, and I am the former administrator of the US Small Business Administration, and a member of President Obama's cabinet. So for instance, a small business owner has no idea about their future cash flow, and very often they get caught in a cash squeeze because a customer doesn't pay a bill. So they go to their bank and they say I want my line of credit increased, or I want a cash loan right away, and the bank says, “Well, I really can't make that judgment in a matter of a second, you have to fill out all this application, we need to take several weeks.” And that may not meet the small business owner’s needs. So imagine if there were a dashboard, and the dashboard was fed by API's, which took data from all kinds of financial sources, under a regime of open banking, so it would be able to suck your credit card data, your bank account data, even your tax returns, and create a cash flow projection of whether or not, if you took out a loan, you would be able to repay it, and actually how much your cash flow deficit would be so that you would know how big a loan he would want.
CROSS: And some banks are already putting this kind of thing in place. Live Oak Bank, an $8 billion bank in Wilmington, North Carolina that specializes in small business lending, began migrating its core systems
RENATO: Take for example a small business customers trying to use their practice management solution, and they want to basically upload all their banking information, real time or they want to use the practice management software that they're planning to execute the transaction. If we have connectivity to that practice management solution then there is one financial hub if you will, that our customers can use to manage their overall financials, instead of having to swivel chair back and forth across four five or six sometimes different applications.
CROSS: But
MESTERS: Now it's possible for a customer to migrate their account history from one place to another, they may be able to migrate their accounts or maybe have just more services, specialized services to solve a specialized problems like, international money transfers or maybe use a better credit card for a specific type of purchase. So all of this creates a more level playing field for the ecosystem. The banks that have most to lose are, of course, the
MILLS: Imagine the change in the products and services, and the speed at which you are going to be able to be served. You want a financial product, you'll be able to do it, you want to open a brokerage account and trade this, you'll be able to do, if you want to get a loan, you'll be able to do it, and you have too high a credit card rate over here, it's going to take all kinds of friction out of the system. That's a challenge to banks that are sort of making money on the friction right now.
CROSS: And eliminating that friction could make an already competitive U.S. banking landscape that much more competitive, particularly for banks that have not put a premium on innovation.
RENATO: Obviously, the banks that might be concerned with this are the ones who might not consider themselves in the forefront of innovation. Others who have fantastic solutions to their customers and we need to anticipate that customers will gravitate towards them, and they can become the hub. I think will be less concerned about this. But I like this development because it forces banks to try to innovate at an accelerated pace to become the hub, by which customers are going to be interfacing with.
CROSS: But open banking isn’t a risk-free proposition. Mark Nicholson, Marketplace Development and Financial Services Industry Leader at Deloitte, said that letting more entities access customer data means more opportunities for that data to be compromised.
NICHOLSON: I think the most obvious risk is the disbursement and fragmentation of data that exposes data across a variety of dimensions. And so you've got data protection concerns, you've got clients that are customers that might not realize that their private data is being used by as many different enterprises as it will be. There are ethical concerns. For example, if there is an AI-driven model, how do we know that it's not enforcing some type of bias, whether that be, particularly to the disadvantages of a particular set of clients. Also, are there controls that are adequate across all of the variety of services that are then accessing the data and the third parties, the ecosystem and the supply chain is becoming so broad, that just exponentially exposes the access to data, which then causes additional challenges in terms of the use of that and whether or not the usage of the data is appropriate and is properly controlled.
CROSS: If open banking necessitates an exponential increase in opportunities for data access, then it follows that the marketplace would benefit from a standard set of rules and expectations around what happens if there is a data breach. That’s where regulation comes in handy.
MILLS: In the UK open banking scheme, for instance, it creates a clear train of liability on the data. So if in the U.S., a screen scraping app comes in and I give permission to that app, that it takes my data, it's not clear that the bank is free of liability if that data gets exposed somehow. But in the UK, there are very clear rules about if a bank allows a regulated third party to take that data. I think people have realized in today's world of cyber issues that that's a very important clarification in regulatory stuff and it benefits the banks.
RENATO: I am a firm believer and we are both the protection of our customer data, and also the creation of information sharing agreements standards across institutions both of these are critical, and could benefit from regulation. I think you would benefit, especially having a common structure for information-sharing agreements standards across different types of financial institutions and aggregators, instead of people trying to develop their own standards or having to make, if you will, changes or adaptations to how they read and interpret information from other institutions that could help further accelerate to the rate of innovation.
CROSS: But that leads to more questions: how do we get there? Which US regulators would oversee open banking? Is this even a priority?
MILLS: That is the gazillion-dollar question. We have new regulators, and not all of them are in place, and I would be very curious to know the answer as to where this is in the priority list. We have seven regulators for banking In the U.S. at the federal level and 50 state banking regulators. So that's 57. And one of the key questions is, which piece of which regulator is taking this on. The last time I had a deep discussion about this with the UK folks, which was a year and a half ago, there were extensive conversations going on with some of the U.S. regulators who are being, you know, brought in inside the UK system and shown what's working, what's not working.
CROSS: Because the promise of open banking is that it can allow consumers to access and allow access to all kinds of financial information, it means that many different regulators of the many different kinds of financial transactions would have to get on the same page for an open banking rule to work.
CARPENTER: The regulatory landscape is complex, not only do you have the state and federal regulation, but even at the federal side, There's a lot of different regulators that can claim a little bit of jurisdiction in and around open banking issues so whether it's the OCC or the FDIC, the CFPB or the FTC or even the SEC, a lot of acronyms there. There are a lot of different parties at the table and so I think everyone would agree that the CFPB really has the lead in terms of defining what regulation might accompany open banking or open finance in the U.S. But the important piece is there has to be some harmonization, CFPB can't require financial institutions to do one thing, if it conflicts with something that the OCC requires on the other side, or vice versa.
CROSS: But there’s good reason for those regulators to try to get it right, not just for the financial services world, but the economy as a whole.
CARPENTER: If successful, and it looks like it is going to be successful, it really changes the game for a whole bunch of industries. And so we talked about open banking, and then the next step is open finance, and then, ultimately, we think we get to open data. And so you think about the kind of implications of pretty sensitive data, somebody's financial information is probably right up there with your health care data or other PII, and you wonder, like, what does this make possible if I can really easily and securely and seamlessly share financial data and get a lot of benefit from it? What does that mean for, like, healthcare? Or what does that mean for regulatory compliance, or any other industry where data sharing becomes easy and digital and defined and seamless? And it just takes a ton of friction and cost out of the marketplace. I spent 20 years in Washington working on policy and the promise of electronic medical records. It continues to be unfulfilled. I mean, I still don't have an app on my phone where my manila folder really sits so that I can take it from doctor to doctor as I go around and seek health care. But if we get this right with financial services and we're able to demonstrate the, “Yeah you can do this securely, you can make sure that a consumer is fully aware of how and for what purpose they're sharing their data,” it really opens up the possibilities of what happens in the future with a broad range of data.