The Brazilian way of Open Banking regulation

Open Banking is unstoppable and is being discussed in almost every corner of the world – be it to increase competition, reduce cost, foster innovation or financial inclusion. In Open Banking, banks are opening up customer financial data and banking services to Third Party Providers (TPP) via Application Programming Interfaces (APIs). For sure not every country has an Open Banking strategy yet, but we have already seen regulatory-driven and market-driven initiatives. The regulatory-driven initiatives are those with the most impact to the banking and payments sector as banks are forced by the regulators to adopt. Europe started first with regulation – UK with CMA Open Banking (effective 13th January 2018) and European Union (EU) with PSD2 (“API and security part” of the regulation effective 14th September 2019).

Brazil paved the way to a new Open Banking ecosystem

I was traveling to Brazil in November 2019 to meet banks, PSPs and fintechs and to discuss the merits of Open Banking for Brazil. A lot has happened already: Banco Central do Brasil – the Central Bank of Brazil – has been discussing Open Banking since 2018 and came up with a plan to regulate Open Banking by mid-2020. Just recently, the Central Bank has published the draft regulation for public consultation on 28th November 2019 for duration of about 2 months – with the following timelines:

• First half of 2019: Kick-off of Open Banking regulation process by Central Bank of Brazil (Announcement 33.445)
• 28th November 2019: Publication of the draft regulation text for public consultation
• 31st January 2020: Deadline for the industry to submit public consultation comments
• End of second quarter of 2020: Publication of the final regulation after discussing market consultation inputs

The regulation is planned to be effective from the third quarter of 2020. It will include the roles, responsibilities and liabilities of licensed TPPs, PSPs and banks in a new Open Banking ecosystem. The regulation is a combination of PSD2, UK Open Banking and Hong Kong's HKMA approach: phased approach, target group, data scope, level of openness, market involvement, high level use cases and pricing. Most of the use cases will be free of charge for the participants.

Regulation plays an important role in the Open Banking journey…

The Brazilian regulation has a strong focus on payment and deposit accounts and functions – very close to the European approach. Banks are required – similar to the UK approach – to create a governance body that shapes Open Banking from a strategic, administrative and technical perspective. However there are some similarities to Hong Kong's HKMA Open Banking regulation which consists of 4 phases as well with some level of flexibility on timelines. A complete new approach in Brazil is the openness on both sides: a TPP has to open up for customer generated financial data if it uses regulated bank APIs. For the moment only the biggest institutions (around 10) are in scope of the data sharing (section I) and any account holding institution or payment initiation service for payment initiation (section II). Regulated entities that are not in scope can participate voluntarily.

The current draft of the Brazilian Open Banking regulation (under consultation) is split into 4 phases:

• Phase 1 (product and services information) to be implemented 150 days and partially 360 days after publication: these include financial products characteristics (deposit, savings, loans, mortgages, credit cards, insurances etc.), pricing, contract terms and conditions, service station locator (branches, ATMs). These use cases can help to support comparison sites and increase competition

• Phase 2 (customer information) to be implemented 240 days after publication: TPPs can request customer personal data such as name, national ID, address. These information could be used to develop KYC services

• Phase 3 (account transaction information) to be implemented 240 days and partially 360 days after publication: TPPs can aggregate account balance and transaction data of accounts of the products and services in Phase 1 to create multiple use cases such as Personal Finance Managers, product recommendations, credit scoring etc. Transaction history of at least the last 12 months has to be provided.

• Phase 4 (initiation of payments and submission of credit transaction) to be implemented 270 days after publication: TPPs can initiate payments on customer deposit and payment accounts. In the context of instant payments being implemented in 2020, payment initiation could become a game changer in the payments market. The submission of credit transaction allows to electronically request a credit proposal from a bank.

The first 2 phases can be seen as a test and learn phase for TPPs and banks to build API capabilities, infrastructure and hence a functioning API ecosystem. The real gamer changer will be Phase 3 and 4 which will trigger the most significant changes in the payments and banking industry for retail and SME banking.

…and opens the door for new business model to grow the pie 

Open Banking can be seen as a threat to existing business models for banks and PSPs. However the Brazilian market is perfect to build new business models that satisfy the needs of untapped segments. Compared to other markets globally, the Brazilian Open Banking case could be quite powerful, considering the following factors:

• A large market with ~210m citizens with a single legal framework across the country – unlike EU with multiple regulators and deviating implementations of PSD2 in the 28 EU Member States –
• Widely young tech- and innovation savvy population (~127m connected online users and ~23% of the entire population between 15 and 29)
• More than 150m online accessible bank accounts for Open Banking, and 45m unbanked to be tackled with Open Banking enabled use cases (financial inclusion)
• Free access to customer data, transactions and payment initiation services
• Regulators ambition to push for instant payments for 2020 can unveil new payment flows combining Open Banking
• TPPs have to open up as well if they are using bank APIs

Standards and infrastructure are key to success of a functioning Open Banking ecosystem

Experience in Europe has shown that a highly prescriptive approach such as UK Open Banking might not fully meet market needs and increase cost for the implementation in the ecosystem. On the other hand PSD2 left it widely open to the market to come up with standards and infrastructure. As there is no mandated implementation body in the EU, different sets of standards have been proposed by standards bodies representing coalitions of European banks.

In the next steps of forming the Brazilian Open Banking landscape, learnings from other markets can help to shape a functioning ecosystem. The regulation could define a clear framework with guidelines, and at the same time leave the actual definition and implementation open to the industry – these areas to be defined are:

• Centralised licensing with issuing TPP licenses for access to all regulated bank APIs
• API standards and customer journey guidelines to ease adoption for banks, TPPs and consumers
• Build API standards considering Brazilian LGPD (Brazilian data protections regulation effective from 15th August 2020) and apply privacy by design and data minimization concepts
• Instant payments should be integrated into the API standards to allow new payment flows in an open ecosystem
• API performance KPIs decide about success or failure: standards for response times are important to ensure a better customer experience and new business models
• A unified consent model to manage access consent between banks and TPPs
• Common dispute management infrastructure is needed allow a standard and easy way of resolving unintended or fraudulent transactions and increase consumer trust
  
  

What’s next?

From a global perspective, financial institutions will need to think differently about the future in order to create a safe and fully functioning Open Banking ecosystem where user security and safety are paramount. Markets across the world are beginning to realise that data is king, and that they need to change their own financial models if they are to be competitive in the future.

Banks and TPPs should work closely together within the industry to come up with solutions that work for everyone. Open Banking is about to grow the pie – the market conditions are given. The time is ticking!