In today’s world, there’s one asset that trumps all others – the one commodity that you can’t put a price on. It’s the fuel driving innovation in the 21st century and the coveted key to surviving and thriving in competitive markets. For many businesses, it’s worth even more than oil! Any guesses?
Yes, it’s the word that makes the world go round: Data!
In a digital world where 9 in every 10 people own at least one device, data is perhaps the world’s most powerful currency. Looking at the MENA region alone, rising mobile connectivity and smartphone penetration is propelling the region’s digital economy.
And the numbers just keep getting more compelling. In 2021, mobile internet users in MENA exceeded 300 million. About 270 million of those were 4G connections. As 5G technology picks up pace, pundits predict 116m 5G connections in MENA by 2025.
This penetration of mobile technology is also reflected in the region’s digital economy. Estimates suggest that in 2022 it came in hot at USD 100 billion. And it is poised to reach USD 500 billion in 2023.
These numbers are staggering. And they clearly show that customers want speed and convenience. They want frictionless digital solutions that are customised to their needs. This home truth is pushing businesses in every industry to hunt for data and pair it with the right technology to offer innovative products. And banking and fintech are no exception.
Data in banking and the need for security
Data is at the heart of banking. Every payment a customer makes, every investment they authorise, and every loan they take out – it’s all recorded on a bank’s data server and becomes part of their financial history and profile. Every single transaction is a precious data point and banks are sitting on heaps and piles of this priceless treasure.
But something is changing. Now everyone else wants in as well.
Fintechs need the customer data that banks possess. They need it to power their solutions, innovate new products, personalise customer experiences, and ultimately, grow their businesses and their bottom lines. This is where data security becomes a critical challenge.
A customer’s financial data is sensitive. And traditionally, it’s always been banks who’ve had control of this data. However, without proper data-sharing mechanisms and regulated protocols, security concerns arise when a customer wants to share their banking data with external third parties such as fintechs. A customer needs to give access either manually or share their bank login credentials and allow the fintech to extract information directly. This is known as screen scraping. At best, it’s tedious and at worst, it’s a security risk.
Thankfully, technology is reinventing how customer banking data is shared and accessed across the ecosystem! Open banking is making its way into mainstream banking and the fintech eco-verse, and it is reinventing data transfer, sharing, and use. And spoiler alert – it’s much more secure than all other conventional alternatives. In fact, it’s the most secure data-sharing method out there.
And we can prove it …
What is open banking and how does it work?
Open banking was first introduced in the EU and UK with PSD2. PSD2 is a regulatory directive that outlines the rules around banking data collection, transfer, and use. Luckily for all of us, open banking has crossed the European continent into other markets as well. It is now becoming mainstream in many parts of the world, including key GCC and MENA countries. have already introduced their versions of PSD2, and open banking has taken their markets by storm. The UAE is getting ready to enter the space with its own set of open banking regulations soon.
Open banking revolves around customer financial data. Under an open banking ecosystem, the customer owns the data (not the bank!) and is free to share it with any third party. The bank holding the customer’s account information and financial history has to share the data to comply with regulations. But what makes open banking different from conventional methods (and safer, as we’ll see in a minute) is the data transfer method it uses – APIs.
APIs or Application Programming Interfaces are communication methods that connect two parties virtually and enable the free flow of data and information between them. We think of APIs as the data-sharing bridge between a customer’s bank and other businesses and institutions.
(Learn more about Open Banking and how it works here).
Are open banking APIs secure?
Yes! APIs are a more secure method of digital communication between two parties. Unlike conventional methods such as screen scraping, APIs are encrypted and don’t require customers to share sensitive bank login information with third parties. With open banking, customers simply have to provide their consent and the API grants the third-party access to the relevant account information by authenticating the identity of the customer directly with the bank.
What else makes open banking safe?
But the implications of data enrichment are quite powerful. Banks and fintechs can use open banking to not only access raw customer transaction data, which includes the description, timestamp, amount, and payment type, but also enrich it beyond simple categories. We can further split expenses into different buckets such as:
Encrypted APIs are just one aspect that ensures the safety and integrity of customer financial data in an open banking landscape. But there are other things that also make open banking safe. Here are the 4 main ones that you should know…
-
Robust regulations
Open banking is highly regulated everywhere it’s in practice. It’s got clear rules for handling customer financial data for both banks and third parties. These regulations lay out the different types of APIs and use cases of open banking. And the number one priority of the regulators is to ensure the security of customer data.
Here’s a list of regulations in practice in the GCC:
In addition, there are stringent data protection and privacy laws in place as well. Think of the EU’s famous GDPR guidelines. In Bahrain, there’s a similar directive known as Personal Data Protection Law (PDPL). All open banking providers are required to comply with these laws.
-
Consent-driven control
One key aspect of regulated open banking is putting both consent and control in the hands of the customer. They control how much data is shared and with whom. And, they can opt out of data sharing or limit access to any previously approved third party at any given time without any impact on the safety of their information.
This is clearly demonstrated in the two main use cases of open banking – Account Information Services (AIS) and Payment Information Services (PIS). In the case of AIS, customer consent expires after a certain period and has to be renewed (the timeframe varies with jurisdiction). In the case of PIS, customer consent is provided for a single payment, although Variable Recurring Payments (VRPs) are being developed as well.
The important thing is the customer is in the driver’s seat when it comes to open banking. And that makes it more secure than screen scraping or other conventional methods.
-
Strong customer authentication
Even the consent provided by the customer under open banking is secured in different ways. Strong Customer Authentication (SCA) is a security system that uses a combination of two or more protection elements to confirm the identity of the customer providing consent. These elements include a password, phone device authentication, face recognition, etc. In line with SCA, if one of these elements is compromised, the others remain intact.
-
Verified third parties
We’ve established that open banking makes the actual transfer of data safe through APIs. The customer controls the data transfer. The regulators govern it. We already trust the banks and their systems. But what about the third-party providers (TPPs) like fintechs that are getting the data?
Under open banking, TPPs are verified before they are onboarded by open banking providers as well as banks. They enter into a commercial agreement that involves extensive due diligence. Therefore, the likelihood of fraud is minimised.
What customer information is being shared exactly?
That’s up to the customer! When it comes to payments through open banking, only the account information is briefly shared in order to complete the payment. However, in the case of AIS, businesses and financial institutions can access read-only data from the payment account the customer has authorised. This includes:
- Account information such as name, and number
- Transaction data and history
- Balance information
- Payment orders and subscriptions
- Restricted card information
Are there any caveats?
Of course. No online transaction or data transfer is 100% secure. BUT, open banking reduces the margin of error to the bare minimum – better than any other method! With open banking, all bases are covered, and customer data is secured to the fullest extent possible.
The APIs are encrypted, the ecosystem is regulated, the customer controls it all, and there are authentication and verification protocols in place for all kinds of contingencies.
Looking to launch your next big financial experience?
Secure access to financial data is critical to build, test, and go-live with unique experiences that meet user expectations. Tap into a wealth of local financial data from the region and build the best financial experiences with us!
Sign up to our Developer Portal today to start building the features your customers want.
