16 ms·

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofb

by dewey 8y ago

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofbanking/2018/06/27/openbanking/ https://thenextweb.com/worldofbanking/2018/06/27/openbanking... Already right now in Germany there are a lot of banks that share a common API format which is why there are a lot of banking apps where you can just log into your bank and don't need bank specific apps. It's called HBCI / FinTS (https://en.wikipedia.org/wiki/FinTS https://en.wikipedia.org/wiki/FinTS) and it's great to have that possibility without doing some web-scraping to get your data out. One example of another german bank API would be: https://api-docs.fidor.de/v1/introduction/welcome-text https://api-docs.fidor.de/v1/introduction/welcome-text

AhtiK 8y ago
Is this new initiative strictly for an API between the official banks or there's a chance that a regular company or, let's say a private person, can use it to access its own data & submit transfers? In a related note, I do hope that the German "lastschriftmandat"/direct debit gets also replaced with something more transparent and with a better control. Similar to an e-invoice concept used by a few other countries like Estonia.
- TomMarius 8y ago
  It's not completely public, but it's open to all companies and people. Your application needs to meet certain requirements and needs to be approved etc.
kozziollek 8y ago
Similar thing in Poland: https://polishapi.org/en/ https://polishapi.org/en/
Rjevski 8y ago
PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to APIs, you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requires even more paperwork. I also said APIs because the regulation does not mandate any kind of API format, so every bank has their own with different capabilities as far as what data is returned and in which format. Some of them are truly awful. And finally, “open” banking still does not allow you to get a personal access token for your own account.
- solenya 8y ago
  "...the regulation does not mandate any kind of API format.." That isn't true. Anybody which wants to be in the UK Open Banking Group (mandatory for the 9 biggest banks) must follow these very strict specs: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...
  - sjtgraham 8y ago
    Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.
    - solenya 8y ago
      Sounds like a problem with the conformance suite then? A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.
      - sjtgraham 8y ago
        It's a problem with governance.
- close04 8y ago
  So you take issue with the fact that there's a high bar when dealing with personal data and real money? Especially when this gives you access to do it en-masse? It's open, just not the "open" you imagine. Like anyone from the street being allowed to do it.
  - Rjevski 8y ago
    The problem is that the value of an API is in the fact that it is open as in open, not "open" like "open banking". An API that can only be accessed by a few huge players is next to useless. Those guys have already figured out a workaround for the lack of APIs, mainly screen-scraping. However the real innovation comes from small startups, sometimes originating from a one-man side-project - this "open" banking completely forgets that. And finally, my problem is that it does not even allow access to your own account. Let's forget about accessing other accounts for a second - I just want to do whatever I want with my own account.
pbreit 8y ago
I've always kind of wondered if XML/JSON delivered over SMTP was a viable webhook approach?

by dewey 8y ago

AhtiK 8y ago

Is this new initiative strictly for an API between the official banks or there's a chance that a regular company or, let's say a private person, can use it to access its own data & submit transfers? In a related note, I do hope that the German "lastschriftmandat"/direct debit gets also replaced with something more transparent and with a better control. Similar to an e-invoice concept used by a few other countries like Estonia.

TomMarius 8y ago
It's not completely public, but it's open to all companies and people. Your application needs to meet certain requirements and needs to be approved etc.

kozziollek 8y ago

Similar thing in Poland: https://polishapi.org/en/ https://polishapi.org/en/

Rjevski 8y ago

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to APIs, you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requires even more paperwork. I also said APIs because the regulation does not mandate any kind of API format, so every bank has their own with different capabilities as far as what data is returned and in which format. Some of them are truly awful. And finally, “open” banking still does not allow you to get a personal access token for your own account.

solenya 8y ago
"...the regulation does not mandate any kind of API format.." That isn't true. Anybody which wants to be in the UK Open Banking Group (mandatory for the 9 biggest banks) must follow these very strict specs: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...
- sjtgraham 8y ago
  Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.
  - solenya 8y ago
    Sounds like a problem with the conformance suite then? A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.
    - sjtgraham 8y ago
      It's a problem with governance.
close04 8y ago
So you take issue with the fact that there's a high bar when dealing with personal data and real money? Especially when this gives you access to do it en-masse? It's open, just not the "open" you imagine. Like anyone from the street being allowed to do it.
- Rjevski 8y ago
  The problem is that the value of an API is in the fact that it is open as in open, not "open" like "open banking". An API that can only be accessed by a few huge players is next to useless. Those guys have already figured out a workaround for the lack of APIs, mainly screen-scraping. However the real innovation comes from small startups, sometimes originating from a one-man side-project - this "open" banking completely forgets that. And finally, my problem is that it does not even allow access to your own account. Let's forget about accessing other accounts for a second - I just want to do whatever I want with my own account.

pbreit 8y ago

I've always kind of wondered if XML/JSON delivered over SMTP was a viable webhook approach?