NCFA Canada | Mahi Sall | Aug 24, 2022

Thought Leadership Series of Expert interviews and insights related to a made-in-Canada open banking regime

The National Crowdfunding & Fintech Association of Canada (NCFA), true to its mission of providing education, industry stewardship, networking, growth, and funding opportunities for innovative financial technologies and related sectors, is pleased to launch a brand new thought leadership series on Open Banking led by Berlin-based NCFA ambassador and independent expert in Fintech-Bank Partnerships Mahi Sall.

NCFA is proudly contributing this thought leadership series to help shape a system that will bring profound changes in how financial services will be created, distributed, and consumed in Canada over decades to come.  Our hope is that Canada’s Open Banking system will improve economic outcomes, improve market efficiencies and competitiveness, and enable consumers to access new and innovative financial services in a way that is secure, efficient, and consumer-centric.

The series is called ‘Canada’s Open Banking Journey’ and aims to aggregate international and domestic perspectives of Open Banking/Finance expert practitioners from around the globe to advance dialogues, key considerations, and explore potential solutions for the development of a made in Canada open banking regime with the following timeline:

• Sep 2018:  Canada’s Open Banking journey officially began when the government established a multi-stakeholder Advisory Committee tasked to conduct a review into the merits of Open Banking
• Apr 2021:  Advisory committee publishes final recommendations
• Mar 2022:  Government appoints Abraham Tachjian – PwC Canada as Canada’s Open Banking lead responsible for convening industry, government and consumers in designing the foundation of the system of Open Banking for a launch in 2023.
• Oct 2023:  Phase 1 implementation expected

NCFA Canada's Open Banking Journey Series:

Interview Begins

“Banks need to change their mindset and start designing services with an API- FIRST approach. Because of their own complexity and all the regulation they have to cope with, banks are not as fast as the market requires it in an Open Banking environment that strives for speed.”

-- Carmela Gómez Castelao, Head of Global Open Banking Program & José Luis Navarro Llorens, Global Open Banking Strategy, BBVA

Mahi Sall: Please tell us about yourselves and BBVA.

Carmela Gómez Castelao / José Luis Navarro Llorens: We are Carmela Gómez Castelao & José Luis Navarro Llorens, Head of Global Open Banking Program and Global Open Banking strategy at BBVA respectively.

BBVA is a customer-centric global financial services group founded in 1857. With 715€ b in total assets (Q2, 2022), 85m customers and over 100k employees across more than 25 countries, the Group has a strong leadership position in the Spanish market, an important investment, transactional and capital markets banking business in the U.S, and leading franchises in South America (largest FI in Mexico) and Turkey. Awarded  'Western Europe’s Best Digital Bank,’ 'Latin America’s Best Bank for Corporate Responsibility,’ 'Mexico’s Best Bank' and 'Mexico’s Best Investment Bank' by Euromoney 2022, the institution rests on solid values: Customer comes first, we think big and we are one team. Its responsible banking model aspires to achieve a more inclusive and sustainable society.

Mahi Sall: Common Rules represent a key component of Open Banking System Design, with the premise that they create a level playing field which eliminates the need for bilateral arrangements between Open Banking participants.  

What situations would call for bilateral arrangements in an Open Banking environment that thrives on common rules?

Carmela Gómez Castelao / José Luis Navarro Llorens: Bilateral arrangements help to innovate and differentiate the offering from those only abiding by common rules. Common rules are important to get banks and third-party providers (TPPs) engaged with Open Banking and setting the framework for all parties to understand how to participate in the ecosystem. But they don’t favor innovation.

PSD2 in Europe set those common rules, and got banks started with Open Banking. Now most banks are exploring what can be done beyond PSD2 and it’s then when Open Banking is thriving. Regulated Open Banking is restricted to Account Information and Payment Initiation, whereas Open Banking is expanding into loans, insurance, forex, etc. Just by looking at what competitors are doing through bilateral arrangements with TPPs other banks get compelled to innovate and compete.

Mahi Sall: Another key component of Open Banking System Design is the Accreditation Process. Canada’s Advisory Committee on Open Banking recommended to exempt federally regulated banks from the accreditation process, and similar consideration for provincially regulated financial institutions to be discussed. 

What major frustration points relative to the accreditation process can be anticipated and how to address them? 

Carmela Gómez Castelao / José Luis Navarro Llorens: We think it’s positive to have an Open Banking framework yet we’d prefer that all non-bank TPPs go through a formal authorization process.

• On the positive side, it simplifies the identification and interaction with third parties, ensures minimum levels of technical and operational capabilities of the TPPs and in general clarifies the responsibilities of the ecosystem participants.

This would also reduce the potential data asymmetries between non-bank third parties holding non-financial information that can be combined with the information accessed through the Open Banking Framework.

• On the negative side, asking all TPPs to have a license limits the possibility of bilateral agreements with them for developing innovative and exclusive services.

See:  Go Beyond ROI With Return on Experience in Banking

Mahi Sall: The third key component of Open Banking System Design are Technical Specifications & Standards with two approaches currently dominating the landscape: single standard approach (e.g. UK, Australia) and multiple standards (e.g. US, EU). Canada’s Advisory Committee left both approaches open for exploration. 

Can you speak to the advantages and shortcomings of these approaches?

Carmela Gómez Castelao / José Luis Navarro Llorens: We understand that multiple standards if compatible are not a big issue, but it is preferable to have a single approach for consistency in facing the potential TPPs and for freeing the participants from having to decide the best standard to follow. We recommend using international standards and not developing new ones.

Mahi Sall: In the early days of Open Banking some European banks provided in addition to APIs a Modified Customer Interface (MCI) as alternative means for third party providers (TPPs) to get access to customer data. Would you foresee the need for Canadian banks to deploy fallback options to existing APIs? 

Carmela Gómez Castelao / José Luis Navarro Llorens: The simplest fallback option we found was to use embedded URLs pointing to customized landing pages, a stepping stone to allow the business in between the APIs to be ready. Not only as a fallback option but also as an anticipated measure until the API is ready, helping the end customer become familiar with the embedded world.

Mahi Sall: What are some of the lessons you’ve learned in terms of Open Banking test designs and implementation.

Carmela Gómez Castelao / José Luis Navarro Llorens:

1. Test thoroughly all cases and not only the happy path ones. Often in the test periods there are restrictions on customers or allowable transaction amounts that won’t allow all issues to appear until going fully in production.
2. Integration between banks and its partners needs to be technically light and easy enough to be executed without much technical background. Support from the bank is a must to ensure the best user experience when integrating APIs.

Mahi Sall: Financial inclusion is high on Canada’s Open Banking agenda. Please share examples where Open Banking failed to deliver on this metric. What are some of the key lessons learned that Canada could benefit from?

Carmela Gómez Castelao / José Luis Navarro Llorens: Usually, banks starting to offer Open Banking services have invested quite a lot of money to build platforms, reshape their legacy systems, build offerings, etc. and they become burdened by that cost, which results in prioritizing the higher yielding business cases. Although financial inclusion is one of the cases that can be achieved naturally through Open banking their business models are modest and difficult to prioritize over the rest. That can be solved through rewards or advantages given to those banks offering financial inclusion.

Mahi Sall: Chief among the factors affecting the take-off of Open Banking is low adoption by consumers. What could Canada do differently than other jurisdictions in order to pre-empt this risk?

Carmela Gómez Castelao / José Luis Navarro Llorens: Consumers are not familiar with Open Banking, yet they are keen to use it once they understand the benefits obtained through it. Low adoption is normal considering the lack of information about how Open Banking works and what if offers. For boosting adoption, it requires capital to promote Open Banking through the first use cases while focusing on customer benefits and the security of the data shared. It is also very important to have enough use cases on the market to meet a surge in demand, and a sustainable and fair business model that makes using the Open Banking framework attractive.

Mahi Sall: Drawing upon your observations, what are some of the quick wins in terms of Open Banking use cases that banks and fintechs should prioritize rolling out?

Carmela Gómez Castelao / José Luis Navarro Llorens: Simple use cases that don’t require too complex preparation from banks and fintechs, such as simulators for loans or insurances, enquiry for FX rates, account balances, and transactions. Leaving more complex transactions for later stages.

B2B use cases i.e. provide APIs for corporate clients to perform activities formerly solved by web services e.g. payments, treasury management etc. are faster and simpler to implement than B2B2B or B2B2C ones (aka having a third leg), thus should be prioritized.

See:  Fintech Reports and Research

Mahi Sall: What role does talent play in developing a thriving Open Banking system? 

Carmela Gómez Castelao / José Luis Navarro Llorens: Talent is always required. Although the biggest factors for the Open Banking system to succeed are:

• To have buy-in from financial and non financial institutions.
• Create an attractive environment for both providers and receivers of Open Banking.

Mahi Sall: What are some of Open Banking’s major incidents and how to risk manage them?

Carmela Gómez Castelao / José Luis Navarro Llorens: The Major problems of Open Banking are related to controlling Fraud and Risk. We suffered from prescriptor fraud in a case of checkout lending that forced us to cancel the service. Open Banking means a change in paradigm on how to use banking services (as they are provided outside of the banking environment) and inherently comes with risks such as:

• Identification of the customers, which in most cases won´t be bank customers but third party users. PEPs (Politically Exposed Persons), blacklists, and fraud are potential risks as APIs require online checks - Strong Customer Authentication (SCA) required.
• Due Diligence and monitoring process needed to watch and verify that the APIs are being used correctly by the third parties, as the bank has ultimate liability of the offerings.

Mahi Sall: Speak about Open Banking limitations and the most common misconceptions people have about it? 

Carmela Gómez Castelao / José Luis Navarro Llorens: Open banking should be fast for connecting and adapting to market trends. But for banks that are highly regulated the process to go live or make changes is still slow and tedious; they can’t keep up with the speed of the market.

Mahi Sall: What does Open Banking mean to banks and fintechs, and how does it affect the relationship between the two? 

Carmela Gómez Castelao / José Luis Navarro Llorens: It’s an opportunity for all stakeholders. Open Banking redefines the models of interaction among several players, banks, fintechs and third parties. Thanks to APIs and the services being exposed, banks and fintechs can compete or collaborate in the offering to third parties. We have seen several examples where the bank leverages the technology provided by a fintech company for offering a specific service, instead of building the capacity internally.

Mahi Sall: How could banks and TPPs best prepare for Open Banking and extract the most value out of it?

Carmela Gómez Castelao / José Luis Navarro Llorens: Prepare themselves to work into an ecosystem model i.e. being able to co-create solutions that benefit the end-customers, facilitating the financial transactions embedded into their daily  ‘journeys’. Bear in mind that what customers ultimately want is to achieve a goal, either buying an item, a trip, a car or a house. They don’t look forward to paying or requesting a loan, if not as a means of achieving their personal target. Banks and TPPs need to achieve a seamless integration between financial services and a customer’s journey. It’s only then when embedded finance will be accepted as an added value service for the customers.

Mahi Sall:  Given the very tight schedule of Canada’s Open Banking roadmap, where do you think the balance must be struck to meet deadlines without significant trade-offs? 

Carmela Gómez Castelao / José Luis Navarro Llorens: As stated previously, start by completing simple use cases first and create the habit of Open Banking in society before looking for higher achievements.

Mahi Sall: What must be thought of and accounted for at this early stage of Open Banking in Canada in order to ensure compatibility and interoperability at regional/international level?

Carmela Gómez Castelao / José Luis Navarro Llorens: In our experience the issue with international standards is that other countries may have a different approach to the treatment of Open Banking (how to treat TPPs, etc.). For us, a service agreement with a company in Spain may not extend directly to Mexico because they have stricter regulations and a narrower concept of TPPs (requiring them to be regulated as financial agents). Open Banking itself is technically compatible but may not be compatible from a regulatory perspective.

Mahi Sall: Any final thoughts?

Carmela Gómez Castelao / José Luis Navarro Llorens:  How about monetization of APIs?

“Monetization of APIs is required to encourage banks and TPPs to invest in Open Banking. Regulated APIs don’t help differentiation and are difficult to monetize.”

Monetization is key for banks to invest in Open Banking. Banks cannot monetize regulatory APIs easily. However banks can monetize non-regulatory APIs (although not always directly) depending on the third party and the agreement.  Monetization can be direct revenue (pay per call, fees per subscription or platform use, and integration fees) or indirect revenue (data acquisition, cross-sell, marketing or underlying service from the bank). In some cases and for large customer bases, the third party monetizes the use of APIs through models such as fee per customer acquired by the bank or revenue sharing.

# # #

Links you may be interested in:

• About BBVA

Mahi Sall is an Ambassador of the National Crowdfunding & Fintech Association of Canada “NCFA”, and an Expert on Fintech-Bank Partnerships. He is based in Berlin, Germany.

The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

Buying a Canadian MSB and Reviewing FINTRAC RPAA and Financial Due Diligence

Why MSCI Is Removing Strategy From Its Indexes

How Is Crypto Market Cap Calculated? What a Change in the Top Coins Really Tells You

What Happens When AI Agents Start Trading Together?

Canada’s VC Totals Are Reliant On Mega Deals

Why Canada Is Making It Cheaper to Leave Your Bank

CSA Tokenization Report Shows Where Canada May Scale First

Creative Ways to Boost Team Morale

Webull Adds Free Data as Canadian Brokers Compete Beyond Fees

BBVA Deploys Canadian AI for Derivatives Pricing

NCFA Canada | Mahi Sall | Aug 16, 2022

Thought Leadership Series of Expert interviews and insights related to a made-in-Canada open banking regime

The National Crowdfunding & Fintech Association of Canada (NCFA), true to its mission of providing education, industry stewardship, networking, growth, and funding opportunities for innovative financial technologies and related sectors, is pleased to launch a brand new thought leadership series on Open Banking led by Berlin-based NCFA ambassador and independent expert in Fintech-Bank Partnerships Mahi Sall.

NCFA is proudly contributing this thought leadership series to help shape a system that will bring profound changes in how financial services will be created, distributed, and consumed in Canada over decades to come.  Our hope is that Canada’s Open Banking system will improve economic outcomes, improve market efficiencies and competitiveness, and enable consumers to access new and innovative financial services in a way that is secure, efficient, and consumer-centric.

The series is called ‘Canada’s Open Banking Journey’ and aims to aggregate international and domestic perspectives of Open Banking/Finance expert practitioners from around the globe to advance dialogues, key considerations, and explore potential solutions for the development of a made in Canada open banking regime with the following timeline:

• Sep 2018:  Canada’s Open Banking journey officially began when the government established a multi-stakeholder Advisory Committee tasked to conduct a review into the merits of Open Banking
• Apr 2021:  Advisory committee publishes final recommendations
• Mar 2022:  Government appoints Abraham Tachjian – PwC Canada as Canada’s Open Banking lead responsible for convening industry, government and consumers in designing the foundation of the system of Open Banking for a launch in 2023.
• Oct 2023:  Phase 1 implementation expected

NCFA Canada's Open Banking Journey Series:

Interview Begins

I believe open source is a sustainable force for social good.  Open Bank Project was started in 2010 with the aim of raising the bar of financial transparency and enabling greater innovation around banks.

-- Simon Redfern, Founder of The Open Bank Project & CEO of TESOBE

Mahi Sall: who is Simon Redfern?

Simon Redfern: I’m a software engineer, entrepreneur, musician and father living in Berlin, Germany.

In February 2010 I gave my first talk about the Open Bank Project - and evangelized the idea that every bank should have a RESTful JSON API protected by OAuth. Since then, my company TESOBE has worked with banks, regulators and Fintechs around the world providing advisory and technology in both innovation and production settings. I’m a strong believer in open source being a force for social good as well as making good business and security sense.

Mahi Sall: Common Rules represent a key component of Open Banking System Design, with the premise that they create a level playing field which eliminates the need for bilateral arrangements between Open Banking participants.

Can you speak about situations that would call for bilateral arrangements in an Open Banking environment that thrives on common rules.

Simon Redfern: I can’t imagine that would be healthy.

Mahi Sall: Another key component of Open Banking System Design is the Accreditation Process. Canada’s Advisory Committee on Open Banking recommended to exempt federally regulated banks from the accreditation process, and similar consideration for provincially regulated financial institutions to be discussed.

What major frustration points relative to the accreditation process can be anticipated and how to address them?

Simon Redfern: In my opinion banks should have to jump through the same hoops as any other consumer of APIs. One of the first things banks will want to do is to consume each other’s APIs so that they can aggregate and provide a 360 view to their customers. Making banks also go through an accreditation process will encourage them to lobby for a simple process!

Mahi Sall: The third key component of Open Banking System Design are Technical Specifications & Standards with two approaches currently dominating the landscape: single standard approach (e.g. UK, Australia) and multiple standards (e.g. US, EU). Canada’s Advisory Committee left both approaches open for exploration.

Can you speak to the advantages and shortcomings of these approaches?

Simon Redfern: I’m familiar with both UK and PSD2 approaches for having implemented them and their variants.

PSD2 itself was a huge document (75 pages I seem to remember) and unnecessarily hard to navigate. It  (deliberately I guess) didn’t even mention the word API, let alone REST API. If a regulator doesn’t specify a standard, others will fill the gap like Berlin Group, STET, Polish API and possibly Open Bank Project did for PSD2.

Personally I’m in favor of explicit standards and I would even remove User Experience requirements (as specified in UK standard) which are fluffy and replace them with onboarding or consent APIs that banks use during the onboarding processes.

In other words, the standard should describe the whole journey with APIs, not just the part of the journey that actually gets data or initiates a payment.

Mahi Sall: In the early days of Open Banking some European banks provided in addition to APIS a Modified Customer Interface (MCI) as alternative means for third party providers (TPPs) to get access to customer data. Would you foresee the need for Canadian banks to deploy fallback options to existing APIs?

Simon Redfern: No, and why?

This was a hugely confusing part of the PSD2 document. I can only think it was there as a result of the bank's lobbying and the reluctance to update their authentication flows. Allowing screen scraping as an alternative would provide an excuse to degrade the quality of the API service and then 3rd parties would be forced to use screen scraping. Screen scraping also breaks the “no credential sharing” principle.  If a bank still provides screen scraping pages they should still have to provide first class APIs.

See:  Open Banking is Coming to Canada…Are you Ready for Change?

Mahi Sall: Please speak about lessons learned in terms of Open Banking test designs and implementation.

Simon Redfern: I don’t quite understand the question, but my 2 cents about testing would be:

1.  Provide Swagger / Open API files for the endpoints so that anyone can mock them.
2.  Provide very clear (no optionality) authentication / authorisation / consent flows.
3.  Provide clear guidance on the data quality returned via the endpoints.
4.  Provide a sandbox where 3rd Parties can test the above and read / comment on documentation.

Mahi Sall: As in other jurisdictions, financial inclusion is high on Canada’s Open Banking agenda. Please share examples where Open Banking failed to deliver on this metric. What are some of the key lessons learned that Canada could benefit from?

Simon Redfern: I’m not sure where it has failed but Open Banking does rather focus on accounts that exist. More could be done to provide APIs for helping customers improve / get a credit rating and applying for accounts. Endpoints for Products could help TPPs identify suitable products for the under banked.

Mahi Sall: Chief among the factors affecting the take-off of Open Banking is low adoption by consumers.  What could Canada do differently than other jurisdictions in order to pre-empt this risk?

Simon Redfern: Some Banks in the UK did publicly mumble about security which probably didn’t help - but probably the chief obstacle has been the (repeat) heavy authentication hoops that the customer has to jump through. Canada could provide different authentication / consent mechanisms depending on what can be done with the resulting token. Maybe customers could also be given some choice regarding how many hoops they are forced to jump through. It's the customer's data after all. Maybe they are OK with a very simple flow to get their balance. Or a simple flow to make a small payment.

Mahi Sall: Drawing upon your observations, what are some of the quick wins in terms of Open Banking use cases that banks and fintechs should prioritize rolling out?

Simon Redfern: Quick wins would mean Bank’s own data as open data e.g. Products (financial inclusion use case), Branches & ATMs. Then Account Application (financial inclusion use case).  In terms of Customer data, get balance, get transactions.

Mahi Sall: What role does talent play in developing a thriving Open Banking system?

Simon Redfern: There’s a virtuous circle of Talent builds APIs -> Talent builds Apps -> Consumers enjoy Apps -> Bank wants more APIs.

Talent is needed at the TPP to build exciting and easy to use Apps and at the bank to enable the API platform.

Mahi Sall: What are some of Open Banking’s major incidents and how to risk manage them?

Simon Redfern: Not that I know of - but don’t let hackathon participants near your data center with cameras and twitter accounts!

Mahi Sall: Speak about Open Banking limitations and the most common misconceptions people have about it?

Simon Redfern: That it's only about customer data and not the bank’s own data. In my opinion banks should be mainly API driven, thus opening up many areas of their business to innovation.

See:  So what is financial exclusion in the era of Open Finance?

Mahi Sall: What does Open Banking mean to banks and fintechs, and how does it affect the relationship between the two?

Simon Redfern: Well, banks will end up being Fintechs too, in that they will consume other Banks’ APIs. In the end there will be little difference.

Mahi Sall: How could banks and TPPs best prepare for Open Banking and extract the most value out of it?

Simon Redfern: Use a sandbox, code an App calling the API complete with dynamic data, onboarding and authentication and watch customers use it.

Mahi Sall:  Given the very tight schedule of Canada’s Open Banking roadmap, where do you think the balance must be struck to meet deadlines without significant trade-offs?

Simon Redfern: Use API versioning, be very explicit about Auth flows. Start with limited scope (read only / banking open data) for the first release.

Mahi Sall: What must be thought of and accounted for at this early stage of Open Banking in Canada in order to ensure compatibility and interoperability at regional/international level?

Simon Redfern: Use https, REST and JSON, OAuth, MTLS etc. The “rest” doesn’t really matter as it will never be identical.

Mahi Sall: Any final thoughts?

Simon Redfern:

• One thing I’ve seen regulators miss out or ignore is the copyright / attribution of the standard. I’ve several times seen a Swagger file which is clearly based on the UK standards having the copyright set to TBC. Maybe the question could be “Under what license would you like the resulting standard to be provided ?” Related: “Under what license should customer / bank data be provided?”
• Another thing would be to consider multiple financial institutions, banks or brands within one API host. This is not catered to in either the UK or Berlin group standards, which forces implementers to use different hosts or path prefixes which muddies the URL space / naming conventions. Single FI per host might result from strict certificate requirements but you might ask the question: ”Should the API standard cater to different bank or financial institution brands being served from one host?” - Aggregators might do this anyway, so why not build it into the standard.
• Lastly : “How should the API standard deal with optional JSON fields?” Important: “How should we monitor Quality of Service and Availability?”

# # #

Links you may be interested in:

• About the Open Bank Project
• About TESOBE

Mahi Sall is an Ambassador of the National Crowdfunding & Fintech Association of Canada “NCFA”, and an Expert on Fintech-Bank Partnerships. He is based in Berlin, Germany.

The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org

Buying a Canadian MSB and Reviewing FINTRAC RPAA and Financial Due Diligence

Why MSCI Is Removing Strategy From Its Indexes

How Is Crypto Market Cap Calculated? What a Change in the Top Coins Really Tells You

What Happens When AI Agents Start Trading Together?

Canada’s VC Totals Are Reliant On Mega Deals

Why Canada Is Making It Cheaper to Leave Your Bank

CSA Tokenization Report Shows Where Canada May Scale First

Creative Ways to Boost Team Morale

Webull Adds Free Data as Canadian Brokers Compete Beyond Fees

BBVA Deploys Canadian AI for Derivatives Pricing