KuppingerCole's Advisory stands out due to our regular communication with vendors and key clients, providing us with in-depth insight into the issues and knowledge required to address real-world challenges.
Unlock the power of industry-leading insights and expertise. Gain access to our extensive knowledge base, vibrant community, and tailored analyst sessions—all designed to keep you at the forefront of identity security.
Get instant access to our complete research library.
Access essential knowledge at your fingertips with KuppingerCole's extensive resources. From in-depth reports to concise one-pagers, leverage our complete security library to inform strategy and drive innovation.
Get instant access to our complete research library.
Gain access to comprehensive resources, personalized analyst consultations, and exclusive events – all designed to enhance your decision-making capabilities and industry connections.
Get instant access to our complete research library.
Gain a true partner to drive transformative initiatives. Access comprehensive resources, tailored expert guidance, and networking opportunities.
Get instant access to our complete research library.
Optimize your decision-making process with the most comprehensive and up-to-date market data available.
Compare solution offerings and follow predefined best practices or adapt them to the individual requirements of your company.
Configure your individual requirements to discover the ideal solution for your business.
Meet our team of analysts and advisors who are highly skilled and experienced professionals dedicated to helping you make informed decisions and achieve your goals.
Meet our business team committed to helping you achieve success. We understand that running a business can be challenging, but with the right team in your corner, anything is possible.
By giving access to customer’s online account (XS2A), PSD2 lays the foundation for new and exciting digital payments system. Many new opportunities arise through the innovative and wide-ranging usage of APIs which can be mutually beneficial for banks, TPPs and customers. In this session we will discuss the novel concepts for post-PSD2 financial ecosystem.
By giving access to customer’s online account (XS2A), PSD2 lays the foundation for new and exciting digital payments system. Many new opportunities arise through the innovative and wide-ranging usage of APIs which can be mutually beneficial for banks, TPPs and customers. In this session we will discuss the novel concepts for post-PSD2 financial ecosystem.
I'm I'm the founder and CEO of Pelican, who is, which is a payments and compliance service providers, provider to banks and large corporates worldwide. Hi, my name is Garrett Zerman. I'm responsible for international business development partnerships at condo. We are Swiss FinTech focused on data and analytics for banks. Having originally started from personal finance management, which also offer for, for business customers.
And yeah, we basically work with customers who know face the situations that they can integrate much more data, which we are going to understand. Hello, my late addition to the that's. Okay. I run my consultancy business infin space, working with banks and insurance companies, helping them with digital transformations, digital strategies. I didn't have period for my digit. So we are technology partner, so banks, best friends. So we make the bank piece ready and take the journey up to the open bank. What Paul has introduced before.
So one of our customer, the room two carbon L work is, has been named as the most innovative bank in Switzerland is facing all platform. And the specific thing we have adopted our P PC two model for the burning group in Germany to Smith standards. So we give them a ready model to compliant and also then to go for the open banking space. Okay. So to kind of set a context, clearly, if we're going to have open banking, we need to have some way for people to connect to the banks. And it was interesting yesterday to hear that tin actually reverse engineered the APIs in order to, to do that.
So what APIs are actually available, I mean, it's one thing to say, we need them, but are there any APIs available and what do we think of them? So where, where would we like to start? You start? So we take a wrong back. So there are lots of, and I don't see the issue on the, on the APIs. I don't see the issue on the fin. I would raise those issue on the bank's behavior and take German as FinTech scene is pretty innovative. We get every few weeks, a great partner. One of them great product. We call guests of freedom markets and we connect to our marketplace.
We connect order to 20, 30 RPS and fins, and we motor these services. One learned, there are great things in maybe not one API fits to the end to end solution. So you may have to multi these kind of services and that's something we taken care of. So we look for best of FinTech partner with them, and then data service that somewhere we can simplify integration to the bank processes and applications. I I'm fascinated about one particular bank, which is in my opinion, very good example, to show how APIs work. And this will be TBS, Singapore that is available in more than just Singapore.
They launched the digital bank in India, China in Indonesia, et cetera. And they actually build the whole concept on the, on the platform.
And then, you know, bringing just together, feed companies, one from IE, one from, you know, from risk management, cetera, put it together and just present it as bank. And they claim to have the, the, the wides selection of I APIs in the world apparently. And I haven't founded myself, but you know, it's a good Martin line, but definitely, definitely, you know, I've been tracking them for some time now. And I'm excited doing a really successful job with, with implementation of APIs To add on this point, but okay. Yeah.
Regarding the APIs, I think the, the P to started January 13, I think the banks have taken the excuse of not implementing cause of SCA, which is not yet defined. So thing that we track on until two 19, I think end two. So I think there are APIs that, of published standards, but there not many times you'll come up with those India except few banks in UK because they obliged to do that in January. Yes.
Well, that, that was interesting because in the UK, there is this open banking implementation entity, the O V I E, which has published APIs. So does anybody have I interesting in your opinions on those and are they actually real from your perspective? So I think there nine banks were obliged to start. I think at least half of them have started. Some of them are missed. Yeah. Some of them missed, but I think they are catching up in next two, three months. I why cuz they, that is the most advanced country in comes of case most advancing case implementation. Yeah.
So I'm, I'm investing again. I see. I tracker closely. So out of 96 missed, they have one year to catch up. So it's quite a long time. So they didn't quite take it very seriously, unfortunately, which is quite a big problem for, for challenger brands because the challenger brands and the other FinTech companies were very much relying on, on, you know, that's why they set them up in the UK first because they knew that open banking is coming first. So they will be able to, you know, to test the ground and then go, you know, Europe-wide or worldwide or whatnot. Right.
And they're hitting one by one, they hit by Brexit, which they, you know, passporting is the issue. Now they hit by, you know, UK missing the deadline. So now they cannot test the solution before they can go European. So it's like quite, quite a how to say tense time, really for, for, for feedback in that space. And I think in general, like whether in the UK or in other countries, it also very much mirrors the both ambition as well as confidence level of banks.
So I think there's a very few like outstanding ones that have really like grabbed the opportunity and that are making like large steps forward. The rest is more seeing it as a threat. They know that, okay. By opening the other players who are much more used to actually work on data, they will take advantage while they are stuck with their own legacy and processes and culture internally. So for them, of course like the, the perceived opportunity is very little. So they try to really like slow it down as long as possible.
And as long as they're, as long as there's no really like harsh consequences, it's, it's probably a good batch for them however much we would like it differently. So yeah. So Jerry, do you have anything to add? I think the major points, I was surprised on the, the period. I thought they have three months to get back at the opening, but you may be right there. I think general, I was happy when UK pushed forward robot and some other countries really still waiting for an RTS and description. I think that's the wrong approach.
Cause open bank's about taking the advantage and not waiting for the PC two description. I think it's the wrong approach. And coming to the APIs back, there's so much technology in and we already moved the last two years from crediting enrichment of APIs to more deposit and asset management and all is already real time. And AI comes in my intelligence in, I think that the great things in, and it doesn't matter if you are totally automated advisor, you take this partially to, to physical advice. It's a very smart combination where it has a huge value to the brands and to the consumers.
And that's why I think you case on right way as Europe, continental stays behind, but still that's a good challenge here. We have. I think we have to keep getting closed and hopefully support banks also to get with the much faster. So I I'm interested by the answers cause you one answer could've been well there APIs, but they are technically inadequate. And nobody really seemed to in mentioning the technical side of things Analyst, but what was coming out was first of all, a geopolitical issue to do with the tensions of Brexit, Brexit, and passporting.
But the other one, which we, we didn't really dive into is the, the, the sort of threat perception by the banks. So what do we think are the, some people are telling me that the banks are all embracing platforms because that's going to give you bigger markets. And then other people are telling me, in fact, actually the banks are trying to retrench because they are front that the APIs are going to steal their cheese, so to speak.
So what, what's the panel's opinion about You? I think that the biggest risk that I face on the banks is building digital silos. Cause they're not fully secured, they're not under control and they are one part not scaling up, but also they are not somewhere reaching to a graph and they have a visibility monitor and tracking. And hopefully with PC two, this, this takes place. An API platform is one of these things you have to integrate. There's no excuses, don't have to be our platform, but you have to go on API management. Why otherwise you're losing control.
And if you talk to digital ads, they have done two or three projects, which are silos and you ask them about security. So what's my crash first.
So yeah, we have a VPN connectivity, but you know how to protect what comes from FinTech said, not aware of that, of service tech via FinTech can access your cross systems. And also the FinTech maybe is a risk on one specific process where you may prefer to have an update on the process that instead of few milliseconds, if something is out of service, you may take an auto ruling to another functions. I think there is some on the architectural, the interprise architectural, there's some issues.
And, but I, I don't see the major issue on the API itself, cuz they may be limited on some functions, but most of what I've seen is a fair setup and not technology in general. I work quite a lot about on PSE to strategies, an wave banks. And I don't hear so much of technology issue, but I definitely hear something which I would say is on merge of communication slash legal type of issues.
So they say, okay, so we, you know, we need to go through the really due diligence and proper process because if something happens at the end, we, the company that we integrated, the customers will come to bank anyway. So we will not be able to explain then that it was the third party on our architecture, working with us. It's it's our fault at the end, which is with PS two and, and open banking journal.
That's, that's the biggest fear that banks have. And I feel connected to that. What we can see open banking went live, but one of the challenges in the UK is that communication was so poor customers don't know what they can expect and what's what's happening, et cetera.
So again, you know, banks kind of offer this, but don't tell customer like kind of like, you know, under, rather a little bit it's a little bit, you know, strange that way, because then the question is what's, what's really D full potential. Why, why are we doing that? Right?
No, I mean, I would maybe also the communication part, maybe I would also link to what, what path said before, like in this presentation at one point about the democratization of, of data. And I think democratization has been traditionally not something that banks have been very front of, but they have been really like big ego protective of their customers and more like most a shark pool of competition. So how do you communicate that you open up now when actually you would rather like to get access to, to, to gather banks assets.
I mean, in Switzerland we see it. So Switzerland is, is a bit behind on all these initiatives.
I mean, they are very small ecosystem. Traditionally. They they've, they lived off the conservation often and now they are like, they know that over time they will have to harmonize, but they also try to keep it to keep down. But all the banks are asking how they could get access to the others already. So I think that's just a very unilateral interest or in one direction, Think among the comments, first thing we all have to accept that banks do not like open banking or daily.
They, they will do minimally what they have to do. So I think that is, most of the banks will have they take that approach. But I think there are the, the APIs wise, there are no problems, technical problems, but there are, there are, I see there are two problems. One is the APIs, the lots of them.
So I mean, technically each bank can come up with their own API and P two will be, they still meet P two compliance. So I think that is one problem. What I see is that there are going be few groups of mean there are three, I think three to 10 standards will remain and banks will choose one of these standards, maybe country by country. They'll go like UK will go all, go with open banking.
W WG, Netherlands or Germany will go with some Berlin standard or something like that. France will go state standard, things like that. So that is only a problem. So through pan European, I will not be there. That is one issue. And then second thing is that the PPP, all the fintechs and PPPs have to register at one place. So my question is how will, if I register as a PPP in the UK, how will Germany know about it and how will Deutche bank allow me to access that?
So I think ideally that should automatically happen, but there is no ecosystem there, which is kind of harmonized and things are still in a mess. Yes. Okay. So Let me raise one topic. It's data management and GDPR is things. Cause if you deal with switch FinTech in 2017 and you like to deal with 30 FinTech and APIs on 2018 and your FinTech are hungry in data, there's a big challenge on data management perspective and somewhere I'll always give you standard thing on the data who holds data, who owns the, a data has access to data.
And especially when it gets to consumer data and that's somewhere where we are. And PSC two are really reflected in the bank, has an audit issue, pretty fast have to find the whole control of, and that somewhere. I think that somewhere banks will get more sensitive to and they, we try to really optimize these, these processes. Cause there are also fintechs in the market, which are not holding there themselves and give the banks the control, what they're doing.
Yes, I, I was going to say, as, as a UK person, I can say that the communication from my banks has been that they sent me updating terms and conditions. That is really all I received All the Germans to, They obviously had to send these out, but they didn't tell me that it was anything good. We going out, it was just these sort of, oh, by the way, we've updated your terms and conditions.
So it, maybe they're just hoping that the fin checks will go away and die. But also all the contracts you have in the past has been really time ago and they have been against a P PC two, please, we find that it's your data and you have the right to give your data to a third party and you agree, the bank tells you that you're not allowed to give more data. And if you, if you type in access account functions to give a read access to a bank account, you against your contract with the bank. So there was a paying or a need for the last 18 months, already two years to change it.
And, but if you who's reading the contract, what is sent to your desk? Well, I, I, I was, let me, let me say another thing.
This, perhaps another topic that, that related only in the last few weeks, I went to a major meeting of the chief risk of the major banks in London. And I, I was intrigued to see what they were talking about and they weren't talking about PSD two. They were talking about myth, which is kind of, sort of it's as though sort of, there's a lack in this. And when you talked about things like PSD two, this was made mainly seen as, oh, heavens, this is just another risk that we don't know about and it's introducing more risks.
So is that, is it really introducing more risks or is this just a perception of swiveled sticking the word dinosaurs? I would maybe say like, maybe not with reference to method, but more to GDPR. I mean that you have now two major regulations that to some extent, feel like they're a bit like opposed. So one is forcing you to open.
So, you know, okay. There will be companies that work with your customers data. So you know that you also have to get more into data analytics on the other side, GDPR actually makes it much more or puts much more constraints on you and asks you to actually not just publish some, some terms and conditions that no one reads, but that you have to present them in a way that people actually will read them.
So, and I think that's now a major challenge that we also, at least in Germany, gets a lot from banks that they say, okay, yes, we have to do something, but actually we have to get the content again and while having to open up and they're really struggling to, to balance that. Yes, well, this morning we had a lot of discussion about consent and, and the data and so forth. But going back to the ADIs, you, you, you said the first question you asked is about security. Would you like to just expand on this issue, the issues to do with security around APIs?
Is it all great or is It, I would prefer the first question before what hasn't been answered was the, what's the question about it, speak to a risk. And I think the risk is not to be proactive. There's not a risk, it's just a pain. You have to somewhat control and open your, your core system, which is an application out of the 89, which is not prepared. So it's a pain on the I, a pain on the process.
It's an investment, a resource discussion, but it is only a risk not to follow and not to be proactive and think about and agile business decision back from cuz with open banking, I'm not calling a bank as the open banking approach today. It's just building the ability or the readiness to have decision of the board and make it ready tomorrow. If I look on, on, on, on the I banks, each of, if you deal with, I think any project takes nine or 10 months and you always compet against compliances. So from my perspective, the risk is not a piece to itself.
The risk is only really not to be prepared and not to capture the market protection. Okay. If you want say something yes.
On the, On the Risk basis and, and approach. When I talk to banks, one challenge, I see when they look at all this, you know, open two and not they business models and their products are just not fit for that, you know, idea at all. Cause in first place, the idea of tradition, PhD two, and then open banking is to give more freedom for customers to give more choice for customers. It wasn't like how banks built a private proposition. They wanted to be protective, built everything around the strong brand, right? You choose my grant.
And then because you trust my grant, you would trust all my products from mortgage to deposit to what, what problem is that the whole world is changing to the point that is almost becoming secondary in a way to the, to the value proposition that you offer in a version. I recommend watching the very short video prepared by I think KPMG, okay, called meet Eva. It's a video, which in one and a half minutes shows you how the, the system will work in the future.
It's all voice based where this David wakes up and you know, Eva overcomes him and says like, oh, actually I assess your gold portfolio and you know, and your pension, right, etcetera. And it's all like talk right. There is no brand. She doesn't mention what product investment products. She just got him. She says the best on the market.
You know, like there's no brand. So when, when banks start realizing that the, it all is about relationship, but not the brand HSSBC name or Barclay's name or Lloyds or whatnot, then they are okay. So we do need to open because we do need to start thinking about products differently and, and prepare differently value, valuable position. And this is where this is where they wake up when they realize exactly that, that it's not the brand would not be enough going forward.
So if, And maybe with speaking about risks relating to PST two, I would maybe also pull like the, the perspective away from the bank, but also to the consumer. So by the banks shying away from actually educating the consumer, I think they're also taking the risk that the uneducated consumer will give access to his bank data. And then afterwards blaming the bank, for instance, like for not having told them like what it actually means to give someone access. And I think that's, yeah, again like a, quite a substantial risk for Bank. Yes.
Educating the consumer that the, the next app that they see on Facebook for their banking may not actually be the most secure. I think the secure customer authenticated se standard, which has been published that is quite secure. I think this has not yet implemented. And I think there is a, there is a discussion going on that the, what is going the user experience because of the strong customer authentication. Cause sometimes it is considered too stringent and too technically you need to take out tokens and everything.
Every time you authenticate something and the authentication has to happen per payment per beneficial. So for each every payment, you have to keep on authenticating that. So suppose you are a small business and you need to send, say hundred payments. You can't use PST two, you have to use some other planning. Otherwise you have to authenticate each and every payment hundred times. So that is a tradeoff between SCA versus the user experience. So I think that is like you baby going on that, Okay.
So I'd like to take up what kind of brought up there, which is the risk to the banks and not embracing this. So maybe you can all think about this. Is there a future for the banking platform or will the banking platforms, as we know them just disappear into these small fintechs.
What, what is the, what is the future? How is this going to affect the whole, the whole business? I think it, I mean, as I said, in my presentation, it depends on the bank. Are they going to be just compliant or they going to be, be proactive and take a opportunity?
Cause if, if they really take all the way they can do everything that fintechs are doing, nothing is stopping them. They can do actually do more. And they have the data. They already have millions of customers as a starting point and they have money and financial resources. Whereas fintechs don't have anything. They don't have customers. They don't have money. They have to keep on borrow and things like that. So I think if banks want to take a proactive, strategic approach, they can be the winners, but they have to go all the way. They have to go all the way.
So, And in the ends, I mean, banks will just simply buy the fintechs, which are usually ready to accept hundred million dollar check. So I think the, the, the worst competition probably comes more from the GERS in the future. Of course.
I mean, they will not take like the majority of the customers for financial services tomorrow. But I think the, the banks have probably like the best, one of the best strategic choices, like to take the winners, the perceived winners of the fintechs while they are still small enough to buy and integrate them. Instead of like trying to, to capture the opportunity by themselves where they might be struggling.
And also the, the other part is like banks will, or banks may change like their shape, but yeah, as there's a need for banking services, I think it will not be like the, the big dying that, that some people always claim to happen. I Agree with a lot what Was said and want to add one thing. I had the chance to run PhD program for European banks last year out four. So there were at European banks like LAR and city bank and a few others maybe you would know on the program. And there were several slots.
The first one was cybersecurity, where we were looking for startups to solve the cybersecurity challenges for the banks. And you could see everybody was cooperating, sharing the knowledge, sharing the experience, putting things together because it wasn't seen as a competitive advantage. Everybody has the same security problems let's solve them. We came with PhD two with the same energy. We were hoping for the same kind of like sharing knowledge collaboration. And it was quiet. Everybody was like, I'm not telling anything I'm doing in PSE tool, but what are you doing?
So it was very interesting to see. So on one hand they want to be, you just compliant most cases really. But on the other hand, they are still checking. Is this kind of competitive advantage? I can win with that, but they don't know really where to validate it. So it's like one looking at the other, the other, and third, and only when there will be really, you know, few winners like for big winners, like I said, DBS, but also, you know, B, B, B, I understand that's a lot in, in API space, et cetera.
One, those will show the road. The others would probably then, you know, follow with much more aggressively than they Don know. Thank You. Fully agree. VVA invited me, I think was one ago. It showed me the marketplace. And how many marketplace we in Germany?
Yeah, I think it's depends on the bank. We define five steps for PC two to open banking. The final step is the ecosystem. And is the app store has any bank to run an extra? I don't believe cuz there are B2B banks or infrastructure banks. So I think that's all fine, but we have to find your answer. And definitely I give the banks a big chance cause top brand good market presence. Some believe in, especially I think the younger generations are a little more challenged to trust in the bank, but I think still the brand is there and there's a huge potential to go from ecosystem map builder.
And I see services that are coming beside the core competencies service from is our, of the store and ecosystem. And the banks have the revenue and can share this and bring this to innovation. So there was no excuse not to go for. It's just an opportunity for, I talked to one bank we invite for an store and Dory have developed by them. So 50 APIs five, oh, I was surprised you add the market APIs and what potential and it's, it's a French one and they're good banks in, so you don't have to buy all of them. Very good. So you've got two minutes left.
So perhaps I could ask each of you to make a final comment of what your, your opinion and advice would be in two minutes. So starting with you, Gary PC two is not the answer open banging is the answer and it's a topic for today and there is no cues not to go for. Thank you.
I, I fully agree as a customer. I want to see open banking immediately. And as a bank, I, I, I will always vote for those who are, you know, forward fingers and we will go for open banking. I would also see Peter and saying like, there's a big opportunity from open banking for you as a bank. Just don't try to develop it from, from scratch, but try to find partners but have experience with it.
And yeah, start to be to, to think more like a platform where you use individual bits and pieces and make as a gatekeeper, maybe to, to clients. I would say that open banking is a, I think is a strategic opportunity. And I think the focus is changing from the data, which is still valuable to customer engagement. And I think that is what customer simplicity is important and we should be focusing on the customer and use the data best, best, possible manner to start, start the Customer. Thank you very much, indeed. So thank you very much for the panel, please.
