INTRODUCTION Open Banking involves the use of open APIs (Application Programming Interface) which were earlier on seen as propriety, intellectual properties of financial institutions (Deposit Money Banks), to power digital financial transactions processed by other banks and licensed non-bank financial services providers. The Nigeria Open Banking initiative is largely influenced by the PSD2 (Payment Services Directive 2) Initiative as driven by the EU (European Union). At its heart, the concept is about unbundling the account and customer data and the financial services that have previously been tightly held by banks, and making them available via API to a wider ecosystem of financial services organisations, particularly in payments1.

These third party providers (TPP), as defined in the European Payments System Directive 2 (PSD2), include:

• Payment Initiation Service Providers (PISP) that can initiate a payment from a payer’s bank account and facilitate the transfer of funds to the recipient’s bank account.
• Account Information Service Providers (AISP) to who account servicing payment service providers (ASPSPs, e.g. banks) are obligated to provide access to the balance and transaction data on their customers’ payment accounts through APIs.
• Payment service providers issuing card-based instruments1.

However in the case of Nigeria such licensed TPPs include:

• Payments Services Solution Providers (PSSPs)
• Mobile Money Operators
• Other Financial Institutions such as MicroFinance Banks, Primary Mortgage Institutions, Finance Houses, Development Finance Banks
• Super Agents
• Payments Terminals Services Providers(PTSP)
• Web Portals
• Payment Services Banks

Indeed there are many other players in the Nigeria economy who desire to take advantage of Open Banking offerings to access bank customer data to improve their respective data analytics and enhance their service delivery to the public e.g. Mobile Network Operators, Electricity Distribution Companies, Accounting firms and a myriad of other utility service providers.

OpenAPIs are the spine that will not only hold together the open banking initiative back bone or framework, but also drive it e.g. NIBSS has operated successfully and seamlessly with inter-bank clearing/switching APIs such as specifications for NIP, BVN, NEFT, cheques, etc. Open Banking basically extends the inherent benefits to non-bank actors.

Originally, when PSD2 was being formulated, there was some concern among banks about the risks of disintermediation. But there is a counter-view evolving that TPPs are a new customer base for the bank that can develop and innovate in consumer-facing areas that the bank might not be resourced enough to tackle on multiple fronts. Yet the authentication and identity management part of this new evolving ecosystem still rests solely with the account holding banks.1

Open Technology Foundation (https://openbanking.ng/) is known to be in active advocacy for Nigeria Open Banking.

BENEFITS OF OPEN BANKING On the face of it, Open Banking threatens the monopoly that banks have over customer financial and non-financial data over the years. However it has so much benefit for society at large.

• Interoperability beyond the Bankers Clearing, Switching and Settlement ecosystem. TPPs become interoperable with banks.
• The banking public will enjoy new user experience never seen before as technology-savvy licensed operators are able to provide exciting user interfaces and functionalities which banks have not be able to do over the years as this is not banks’ area of core competence;
• Cost-saving for TPPs/Fintechs. Without Open Banking, TPPs will spend a lot of money, time and effort to connect to banks one after the other given the disparate interface specifications of individual banks. Open Banking enables a TPP to invest in the implementation of the approved industry API only thereby saving finance and gaining fast-to-market advantage.
• A new revenue stream for banks who would charge TPPs for customer data access, per transaction. However Open Banking threatens to relegate banks to mere customer financial and KYC data harvesters and keepers aside from liquidity safe-keeping;
• An effective partnership between Banks and Fintechs will enable banks to enjoy the benefit of the two worlds.

TYPICAL OPEN BANKING USE CASES

• API for Customer Account Opening: A licensed super agent who desires to let its agents open account in, say, 5 banks would spend money time and effort to run 5 projects to integrate its system to the core banking system of each of the 5 banks, whereas with open banking just one project is required thereby saving cost and time. Ditto for other use cases below.
• Credit Push
• Debit Pull
• Account Name Enquiry
• Consumer Credit score based on account transaction dynamics
• Customer address verification
• Customer Identity (BVN) verification
• Secure Bank Account Statement exchange
• Secure document exchange

OPEN BANKING CASE STUDIES

• BBVA launches open banking platform in the US. Finextra (www.finextra.com) in its post of October 17 2018 announced that BBVA has officially launched its Banking-as-a-Service platform in the US, using APIs to let firms offer their customers financial products without having to take on fulling banking themselves. Companies simply plug into a core digital platform and then access APIs including Move Money, Identity Verification, Account Origination, and Card Issuance services. Below is an extract from the Finextra White Paper1 showing other country examples.
• In Australia a new data sharing regime comes into effect in July 2019. It aims to give consumers greater access to, and control over, their data, permitting accredited third parties to receive banking data when customers provide express consent for it to be used for a specific purpose.
• In Hong Kong, the Hong Kong Monetary Authority’s Open Banking Framework, unveiled in 2017, has a similar set of objectives to PSD2. The major differences there are that it is only Hong Kong’s biggest banks involved, and they can pick and choose TPPs to work with rather than the mandatory access dictated by PSD2. Also the HKMA is being more prescriptive with the recommended API approach and standards, having published the first draft of its Open API Framework in July 2018.
• The White Paper1 further states that in Europe, the PSD2 is leaving API standardisation to industry bodies/working groups. There are several of these, such as the Berlin Group, UK Open Banking and PRETA, while some banks have chosen to develop bespoke APIs, either on their own or in partnership with others. This could cause challenges for interoperability in the short term, but there have been moves in some markets to create a central infrastructure that can manage communications and interoperability between banks and TPPs using the various evolving standards.

RISK CONCERNS Both PSD2 and the recently introduced General Data Protection Regulation (GDPR) have at their heart the idea that customers should have sovereignty of their data. But, in the quest for innovation, PSD2 requires much more be given up by banks, who must share not only with the customers whatever data they request, but also with any sufficiently licensed TPP, as authorised by the customer1

Therein lies Open Banking risks. Banks have responsibility for protecting customer data entrusted in their hands, from theft, unauthorized access and unathorised disclosure. A bank must emplace indisputable authentication mechanisms that ensures that the data requester is indeed the customer. Also the bank must execute necessary Non-Disclosure Agreement, Service Level Agreement with effective indemnity clauses that protect the bank from possible liabilities arising from data disclosure and security breaches through TPPs who the bank customer processes transactions through. TPPs and Fintechs are generally not strong on risk management. Regulations will put in place measures to safe guard the new relationship between the Customer and his bank, the bank and the Fintechs as well as the Customer and the Fintechs.

Regulations will bring in standardization which will help to achieve at least the following;

1. Encourage interoperability in the industry.
2. Reduce the amount of education needed to drive the process.
3. Aid monitoring.
4. Bring collaboration at least in the way for fighting fraud. Which may rise in the earlier stages.
5. Define, processes for dispute resolution and interoperability.
6. Specify and Enforce minimum risk mitigants

It is noteworthy that in the face of rise in volume and value of transactions occasioned by Open Banking, Fraud attempts/incidents will rise. In fact, collusion of fraudsters with TPPs personnel will create new fraud vulnerabilities. So 2FA (Second factor Authentication) and secure data exchange standards (e.g. PCI DSS, PA DSS) must be made mandatory and initiatives like biometric authentications will be necessary.

OTHER CONCERNS Open Banking and thus Open APIs discourse calls for a need for certain re-classifications and re-analyzing of our current framework(s). For instance,

• Seeing the FINTECHs, MMOs, PSSPs as digital financial services providers.
• Going beyond point to point VPN, considering that most FINTECHs run from the cloud.
• Will innovation be limited to Fintechs? As certain industry initiatives to jumpstart these kind of initiatives are rather seen as competition rather than as industry catalyst.
• The question of how do we stay secured in the near and far future needs to be clearing answered.
• Access Points: While the Idea of open banking sounds very exciting. The question of how these APIs will be exposed by the banks has to be addressed, so also is how the Fintechs will access these APIs.
• Will every Fintech connect to the banks of their choice, or be made to connect to the Banks through a central hub?
• Collaboration: This should be the heartbeat of this initiative, so that the banks, fintechs and the customer all win.
• Patents: The need to review patenting under the context of the Nigerian law, as a lot of players will illegally use this to ward off competition, thereby stifling the vigor in the market.

RECOMMENDATIONS There is no doubt that Open Banking has the immense potential to open up the digital financial services market to exciting times, with enhanced user experience for customers as it enables technology-savvy licensed DFS providers to provide better look and feel and more functionalities and service offerings for the banking public. Open Banking would take the banking system to the next level as banks partner TPPs in a careful and systematic manner to delight the discerning customer with innovative financial services.

However, banks must be mindful of customer data protection to manage the inherent financial and reputational risks. A proper Service Level Agreement, Non-Disclosure Agreement with the right indemnity clauses are highly essential to provide adequate protection for banks. Also, an appropriate regulation is required to ensure safe and secure Open Banking practice in Nigeria.

Also, it is essential for the Nigeria banking industry to evolve common API Standards to drive Open Banking Nigeria, to guarantee seamless interoperability with its attendant cost-saving, ease-of-implementation and security benefits. NIBSS will readily work with the industry to institute such API Standards given our experience in this area over the years.

– December 03, 2018.

REFERENCES

The Bank as Universal Digital Trusted ID Provider, a White Paper produced by Finextra in association with HID Global, October 2018 BBVA launches open banking platform in the US, Finextra publication, October 17 2018