12 ms·
How banks are getting around open banking and PSD2
- vegabook 10y agoIt seems to me that many of the banks' concerns are legit. I personally am not particularly keen on yet another API being made available to a bunch of rapacious VC-funded startups that facilitates my intimately personal financial info being spread around. Personally I bank with metro bank in the UK, they're new, competitive, and frankly pretty darn good, all for free. Do I need even more "financial services" thrown at me when there are apparently zillions of bricks and mortar operators already offering me everything from credit cards, subprime, insurance, car finance, re-mortgaging, yada yada yada yada ad infinitum? I would argue that in this case, the banks' and my interests are somewhat aligned. They're protecting my privacy! How many profit seeking entities on the internet can say that? I get it that fintech would dearly love to get its hands on people's money, but is there actual demand from said people for even more financial services? Or does this post simply amount to self-interested regulatory lobbying for a zero sum transfer of economic rents to the fintech space. Because you just know that if these APIs come about, fintech will find all sorts of dubiously "persuasive" ways to get people to allow access, possibly against their own interests.
- nimish 10y agoI bank with a major bank in the UK whose app is basically trash. I have a credit card with a different provider If I want a quick assessment of my accounts, either I need to log in to multiple accounts and add them together, or I can use an account aggregation service like yolt Unfortunately nobody supports secure delegated auth, so you risk compromise.
- dharma1 10y agoYou should be able to own your financial data, and access it in various ways. Incumbent banks have been incredibly bad at creating modern digital user experiences. To analyse my spending, I have to login to my online bank with a fob and various passwords, download statements in .csv format (month by month, no batch download) and plot them in excel. It's not great. I am really looking forward to more open banking API's. Monzo have one, a couple of others, but very few. I have been working on a side project for the kind of banking experience I would want [1] - but it won't be possible without banks opening up API's. [1] http://bixtr.com http://bixtr.com
- lhnz 10y agoYou should take a look at Teller [http://teller.io http://teller.io].
- aembleton 10y agoThat's a good looking webpage and phone shots.
- dharma1 10y agoThanks! Building the front end and ML layer at the moment and starting to show it to people
- Silhouette 10y agoIncumbent banks have been incredibly bad at creating modern digital user experiences. To analyse my spending, I have to login to my online bank with a fob and various passwords, download statements in .csv format (month by month, no batch download) and plot them in excel. It's not great. That is certainly true, but it's not as if the shiny new fintech startups are necessarily any better. You'd think it would be business finance 101 to be able to reconcile money that a payment service collects from your customers and then deposits in your bank account with the money you expected them to be collecting, but unless there's been yet another API change lately, none of the services we use support a simple, reliable way to do this.
- zAy0LfpBZLC8mAC 10y agoThe real WTF is that it seems to all be about APIs for third parties. First of all, they should provide an API for me, the customer, so that I can use the data and automate my banking.
- rocqua 10y agoThere is very little difference between an API for you and an API for third parties. Unless the API just for you requires full credentials, and has no tiered access control, you could just give someone else the same API. Eula's would be the greatest difference. It is sad though, that no start-up would consider building a self-hosted version that'd keep all data local, instead wanting to offer it in SaaS form.
- zAy0LfpBZLC8mAC 10y ago> Eula's would be the greatest difference. Or more generally contracts and regulations, yes. If you need to be registered with some regulatory authority with security audit requirements, say, in order to be able to gain access to the API, then you cannot use the API, whether you would technically be able or not.
- stefs 10y ago> It is sad though, that no start-up would consider building a self-hosted version that'd keep all data local, instead wanting to offer it in SaaS form. i don't think that'd be automatically true. if there were enough security conscious users to create a market for a product like this, someone would provide.
- rocqua 10y agoThe buisiness model really sucks though, because its hard to get people to pay for self-hosted stuff. On the other hand, people seem more amenable to a subscription. This has the added benefit of possible adds and even gathering data of users. The issue is exacerbated by the almost sure to be available open-source gratis software. Presuming the software is under-maintained.
- jasiek 10y agoCurrently, you'll need to be licensed by the Financial Conduct Authority in the UK to be able to use any of those APIs. That's a very high barrier to entry.
- vegabook 10y agonot high enough if it's prepared to licence usurious b-tards like this: http://citywire.co.uk/wealth-manager/news/wonga-wins-fca-authorisation-under-new-pay-day-lending-rules/a874668 http://citywire.co.uk/wealth-manager/news/wonga-wins-fca-aut...
- adrr 10y agoIts about efficiency. One Example: Being in the financial industry i have submit monthly reports with all my statements and activity. Luckily compliance software can automate this for me.
- jasiek 10y agoFYI, Teller [https://teller.io/ https://teller.io/] in the UK, does what every developer would dream of.
- vosper 10y agoIt doesn't seem to be publicly available, and they only seem to have posted one (undated) blog entry ever. So... does it really work?
- lhnz 10y agoYes.
- sjtgraham 10y agolhnz is a Teller beta user.
- sjtgraham 10y agoHi founder here, Teller does work but only a very small amount of users have production access at the moment. We've been very cautious about broadening access in case banks responded aggressively and generally speaking they haven't. A lot of work has been put into making the service reliable when it essentially sits on private APIs the banks prefer no one but them uses. Teller will eventually support every bank but the banks we support currently are: - Barclays - Natwest - Nationwide - Santander - RBS - Ulster Bank - Isle of Man Bank Re the single blog post. We only blog when we have something to talk about that could potentially get to #1 on HN (as our only post did). We prefer to stay focused on building the product, but stay tuned for more posts soon. :)
- tixocloud 10y agoVery interesting idea. Congrats on making it this far! I've been in banking for several years and there's lots of exciting new technology with no real use case. However, there's definitely many use cases that I can see for this one.
- NKCSS 10y agoI created an app that would poll my transaction data from my bank's website and then send push messages to my phone if any new transaction comes in. I loved it. While doing groceries, having not left the line and packing up my goods, I'd get a push message of the transaction. This gave me a real feel for what happened on my bankaccount. When notifo stopped (free API to send push messages without having to write your own native app); I didn't re-implement it, but from time to time, I wished I did; maybe something I should look into again.
- cocoflunchy 10y agoYou could use IFTTT or Zapier to send push / SMS to your phone!
- wolfgke 10y agoSounds secure... not :-(
- lucaspiller 10y agoA lot of banks in the Middle East and Asia do this via SMS, as soon as the transaction is approved on the merchant's terminal you receive an SMS as confirmation.
- Humdeee 10y agoAre you sure it's not already a feature your bank supports by now? All the major banks I know of (at least here in Canada) have supported this for awhile and can easily set up within a few clicks. I have SMS for transactions over $20.00 or whatever threshold I want and it's very nice getting a SMS seconds after paying or auto-withdrawals from my accounts.
- NKCSS 10y agoMy bank can set SMS-alerts based on custom rules, but they charge €0.50 or something per SMS.
- 10y ago
- raesene6 10y agoI used to work in banking security and I can understand the bank's concerns. If they allow a 3rd party access to customer data and that customer data is subsequently leaked and used for fraud, who's liable? If a law could codify an acceptable answer to that problem, I think a lot of the security/regulatory problems could go away. Banks might still try to stop the process for competitive reasons, but they might not be able to lean on the crutch of "security" to do so. In the UK this problem isn't new, there were aggregator services 15 years ago that screen-scraped banking data to provide customers with a consolidated view of their finances and they required customer's to provide their credentials for them to do that. Banks understandably weren't too pleased about the idea of 3rd parties having those credentials.
- jasiek 10y agoScreen-scraping is how it's still done, even internally, within banks. I'm told it's the easiest way to get data out of systems.
- ethbro 10y agoAye. If you want to see some aged infrastructure, dig down to the bottom of banking's tech stack.
- saiya-jin 10y agothe reason is simple - IT is considered just annoying cost center that prevents rest of the bank to reach the stars... or something. budgeting reflects this accordingly
- dukeluke 10y agoWell they've gotten by with this archaic IT infrastructure with massive profits, so maybe they're onto something.
- branchless 10y ago
- vegabook 10y agothe author's "about" pages are a cringe-inducing hubris-fest, and that's being charitable. https://chrisskinner.global/#about-us https://chrisskinner.global/#about-us
- bitJericho 10y agoHaven't had a laugh that good in a long time.
- freekh 10y agoJust throwing this in here: https://github.com/OpenBankProject/OBP-API https://github.com/OpenBankProject/OBP-API
- ichaib 10y agoThanks for the shout out! Open Bank Project is an open source API solution for banks. We have a catalogue of 130 standard pre-built banking APIs & 6000 developers worldwide using our interfaces. Also, PSD2 is the hook. There are many more APIs bank can open up which are outside the scope of PSD2. In any case, Open Banking is definitely a global trend now, there are similar regulation efforts in the making in Australia, Singapore & South Korea. Feel free to ask, if you have any question on this topic
- sharemywin 10y agoI would like to see account numbers be portable like phone numbers are now.
- dforrestwilson1 10y agoHow would that work? Your money doesn't just sit in your account. The banks use it to fund loans. Loans that they make money on. That's the premise of the whole finance system...
- PanMan 10y agoYou are already allowed to leave your bank, and go to a different bank. The 'only' thing this would change is you would be able to take your account number with you. BTW, european banks have explicitly not enabled this with IBAN, as the bank's name is now part of the account number.
- ropiku 10y agoI don't think account numbers will get portable due to the issue you raised. However UK has kept pushing bank portability with "current account switch guarantee" which seamlessly transfers all your incoming/outgoing direct debits and the balance then closes your old account.
- EmielMols 10y agoIn The Netherlands almost all banks support a "forwarding service" when switching banks: direct debits to the old account will be forwarded for at least a year to the new bank (account). You can bet the banks didn't think of this themselves, but it was probably forced on them by a consumer protection law. It is, coincidentally, something most Dutch people don't know exists.
- endless1234 10y agoWhat does that have to do with your personal bank account number?
- JustSomeNobody 10y ago
- javiercr 10y agoBecause of this we created Bankscrap[1], a Ruby gem to access multiple banks. We basically find the APIs that the Banks are using for their mobile apps and expose them through a common Ruby library with an unified data model. Each bank has an open source adapter (this is different to Teller) and we encourage the community to help us building more adapters. So far we got adapters for 4 major banks in Spain, and 3 more are a work in progress. Whether PSD2 is going to happen or not, we believe public APIs for banks will happen (even if banks don't like it). IMHO banks arte not scared because of security concerns: they all have APIs in production already, they are just not documented. Their main concerns is basically how APIs used by third party services could affect their businesses. [1] https://github.com/bankscrap/bankscrap https://github.com/bankscrap/bankscrap
- slavoingilizov 10y agoSo who bears the legal responsibility? Is it the business which uses your gems or the customer? You're effectively breaking most banks' terms of service, at least in the UK. It's great that you've solved the tech challenge, but that's not the biggest one to solve.
- javiercr 10y agoFrom our understanding what we do is legal in the EU, according to the European Union Computers Programs directive 2009: > The person having a right to use a copy of a computer program shall be entitled, without the authorisation of the rightholder, to observe, study or test the functioning of the program in order to determine the ideas and principles which underline any element of the program if he does so while performing any of the acts of loading, displaying, running, transmitting or storing the program which he is entitled to do. There is in fact a EU proceeding against MathWorks for preventing a competitor to reverse-engineering their product to achieve interoperability [2] In any case, we currently offer no guarantee to our users and we encourage them to use our open source libraries at their own risk. [1] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:111:0016:0022:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2... [2] http://europa.eu/rapid/press-release_IP-12-208_en.htm http://europa.eu/rapid/press-release_IP-12-208_en.htm
- iffycan 10y agoAnd for this reason, there's the SimpleFIN spec and SimpleFIN Bridge[1]. Until banks implement the APIs themselves the SimpleFIN Bridge will bridge that gap. [1] https://bridge.simplefin.org https://bridge.simplefin.org
- jsudhams 10y agoYodlee Supports almost all the banks in the world, https://www.yodlee.com/ https://www.yodlee.com/
- javiercr 10y agoYoodle used to be the provider for Mint [1]. I assume they use some combination of authorized + non-authorized web-scrapping. It looks like something that makes sense for big companies. The pricing [2] is a bit weird: > Developers will find the Envestnet | Yodlee Aggregation API – our new and improved RESTful API architecture – easy to use, which will speed up integration and simplify data access. It will also enable developers to sign up on the developer portal for a $250 monthly fee and get immediate access to a testing and production environment. So $250/mo just to sign up... no idea about what's the pricing per API call. [1] http://money.cnn.com/2010/12/02/pf/mint_leaves_yodlee/ http://money.cnn.com/2010/12/02/pf/mint_leaves_yodlee/ [2] https://www.yodlee.com/blog/envestnet-yodlee-offers-new-quickstart-service-support-package-developers-formerly-using-intuits-financial-data-apis-cad/ https://www.yodlee.com/blog/envestnet-yodlee-offers-new-quic...
- pinky07 10y agoWe use Yodlee for Odoo Accounting: https://www.odoo.com https://www.odoo.com It's a crappy service, but the only one that support a wide range of banks in different countries: - costs a lot: we pay around $20,000 / year - we have a lot of support tickets from users who can't connect to their bank. We usually forward the issue to Yodlee and they fix it within a few days. They scrap bank websites, but their algorithms do not seem very robusts. If the bank change a little detail in their UI, it breaks Yodlee's connector. Sometimes, the bank interface depends on user preferences (e.g. language, business/personal account), so the user has to configure his preferences before succeeding to sync Yodlee. As an example; they have a PayPal interface too. Initially we thought of using them to connect to PayPal, but we noticed they scrapped the Paypal website too, instead of using their API. So, we had issues with some users who did not have a Paypal business account Unfortunatelly, it's the only solution that supports a wide range of banks (~24,000 banks), so we are still using it. (for U.S. users, we use Plaid that is more reliable but support less banks)
- jdeibele 10y agoI've been frustrated by some time that there's not a generic "look but not touch" function available to 3rd party programs. I'm a lot less concerned about a 3rd party leaking info about my assets than I am about them being able to do things with them. So far, every program or website that wants access to info also gets full rights to sell, buy, transfer, etc.
- iffycan 10y agoI feel the same way. I made http://www.simplefin.org http://www.simplefin.org
- djrogers 10y agoThis kind of thing would definitely guide my decision as to what bank I keep my money at. If my bank killed digit for example, I'd switch in a heartbeat. I think big banks will learn pretty quickly that they are commodities, and they will need to compete on more than inertia alone.
- Bombthecat 10y agoSince I'm doing API gateways. I can tell banks plan or want to offer PSD2 services. Either by a third party or offering them on there own. What you might get though is a terible ugly interface to the inner part of the bank. I also just read the newest version of the PSD2 proposal. There is (sadly or luckily) still no plan for further specification what a bank needs to offer or how. But all in all PSD2 won't change the world of payment.it will be still easier to just use PayPal:)
- stefs 10y agosecurity isn't the only problem. banks do not want the users to be fully informed. if you overdraw your account, they make more money. personally, i'd love to write my own open source clients you can verify and compile yourself that provide better information and heuristics - but that'd hurt the banks. there are several kinds of of users: those who make the bank money (the uninformed that do not care much) and those who are actually interested in their statements. the latter are loss leaders. for consumer banks, the latter seem to be in the majority. an app that informs you with the best intention (warning: if you continue your spending for the rest of the month like you did this week, you'll pay a lot extra!) would shift the balance even more.
- sly010 10y ago> Application Programming Interfaces (APIs) with a tokenized or alternative authentication method [...] can be inconsistent among financial institutions That sounds like a made up argument. How is structured data less consistent than the scraping that is currently happening? A more realistic argument is that banking systems are old and outdated, the cost of upgrade is enormous and no banks wants to be first. Worse, some banks actually have standard APIs (e.g. OFX) than are used by commercial accounting softwares (e.g. mint, quicken) but the banks (e.g. Chase) charges a monthly fee to enable it.