9 ms·

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to APIs, you need to become an “AISP” (

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to APIs, you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requires even more paperwork. I also said APIs because the regulation does not mandate any kind of API format, so every bank has their own with different capabilities as far as what data is returned and in which format. Some of them are truly awful. And finally, “open” banking still does not allow you to get a personal access token for your own account.

solenya 8y ago
"...the regulation does not mandate any kind of API format.." That isn't true. Anybody which wants to be in the UK Open Banking Group (mandatory for the 9 biggest banks) must follow these very strict specs: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...
- sjtgraham 8y ago
  Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.
  - solenya 8y ago
    Sounds like a problem with the conformance suite then? A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.
    - sjtgraham 8y ago
      It's a problem with governance.
close04 8y ago
So you take issue with the fact that there's a high bar when dealing with personal data and real money? Especially when this gives you access to do it en-masse? It's open, just not the "open" you imagine. Like anyone from the street being allowed to do it.
- Rjevski 8y ago
  The problem is that the value of an API is in the fact that it is open as in open, not "open" like "open banking". An API that can only be accessed by a few huge players is next to useless. Those guys have already figured out a workaround for the lack of APIs, mainly screen-scraping. However the real innovation comes from small startups, sometimes originating from a one-man side-project - this "open" banking completely forgets that. And finally, my problem is that it does not even allow access to your own account. Let's forget about accessing other accounts for a second - I just want to do whatever I want with my own account.
  - close04 8y ago
    Maybe the problem arises from this different interpretation for "open" that different people have. Look, the Linux source code is open. But doing something meaningful with it takes a huge effort. A one man team can't build Android out of Linux. This doesn't make it less open. The bar is higher because those companies will literally have access to to all of you financial information and your money. And not just yours, but of all the customers of all the banks. There simply must be some framework in place that sets clear regulation as to what and how things will be done. Otherwise you're flirting with disaster. Lack of proper bank supervision is what triggered the last financial crisis. You think a 3rd party will fare better if left to their devices? All the responsibility the bank has towards you, the client, should be mirrored to the 3rd party. You have high expectations of the bank, why would you accept less from the middle man? As for the "do what I want with my own account", you can to a degree. All banks provide you with internet banking, an app, a website, a person behind a desk. You have access to all of your data, just not how you want it. And the how is sensitive enough to require regulation. P.S. The requirements are in no way unachievable for a small startup. It takes a bit of effort, I agree. But if those requirements are what stop you then you're in the wrong business. The bar in fintech is set a bit higher than other industries as it should be.
IshKebab 8y ago
Ha I knew it was bullshit! Thanks for confirming my suspicions.
sjtgraham 8y ago
> If you want to gain access to APIs, you need to become an “AISP” It's more complicated than that. Banks can give unregulated entities access to their APIs, but they don't because IMO providing API access is directly opposed to their interests. If you want to be statutorily entitled to API access you need to be a registered AISP or PISP. Unfortunately what an AIS is is very specific, i.e. showing the account owner aggregated information, before or after processing, about one or more payment accounts. If your product doesn't do this, e.g. credit scoring using the user's bank transactions instead of credit bureaux, then you're not performing a regulated activity, therefore the regulator has nothing to authorise, and you can't enjoy the resulting entitlement of API access. This means there are whole classes of (unregulated) applications that won't be allowed to exist by banks if they adopt the position of granting access only to regulated entities. > this requires a certification and a load of other nonsense akin to PCI-DSS AIS and PIS have become regulated activities as a result of PSD2. This is not the same as PCI-DSS. Becoming a (P|A)ISP means becoming supervised by the local regulator as an authorised financial institution. This involves a lot of paperwork, a £1,500 application fee, insurance, fees for any professional services you needed to complete the application (lawyer), and 3 months (longer if your application is incomplete or has other issues). > for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requires even more paperwork. And €50,000 own capital requirements. > I also said APIs because the regulation does not mandate any kind of API format, so every bank has their own with different capabilities as far as what data is returned and in which format. Some of them are truly awful. This is true at the moment for Europe but notionally incorrect for the 9 largest banks in the UK, which are subject to parallel domestic measures ordered by the Competition and Markets Authority. There is a spec, but there are many problems with the governance, implementation, etc.
- abraae 8y ago
  To be honest those requirements sound perfect for a scrappy startup. Just enough of a moat to deter 99% of drive by hackers, but within the reach of any reasonably serious startup. - £1,500 application fee - €50,000 own capital requirements If you're aiming to play in this league you really should be able to scrape together this kind of money. - 3 months wait Can also be seen as a 3 month delay imposed on your competitors. Of course if you're aiming to use the API for your own personal needs only- then yeah, these requirements suck.
Nursie 8y ago
So you need to be vetted and approved before being allowed access to some of people's most private and secure data. Why is this a problem exactly?
- sjtgraham 8y ago
  Do you think it's appropriate an app doing something as trivial as calculating much you spend on Starbucks each month is now a regulated activity? I don't.
  - baloki 8y ago
    If that app has access to all my other transaction history, maybe a little, yes.
- Rjevski 8y ago
  My problem is that it does not even allow access to your own account. Nobody has a problem with access to others' accounts being regulated. I just want to do whatever I want with my own account.
  - miracle2k 8y ago
    If you are allowed to access your data, then you can grant that access to third parties (pass along the API token). I happen to think that is great, but we live in a time where the idea of my sharing my Facebook account with an app is considered a problem, because it has a list of my friends. My financial history contains a lot of metadata about third parties. This is exactly the intersection between this overlay strict interpretation of privacy and my right to share my side of the data with third parties.
    - Rjevski 8y ago
      At the moment you can already grant third parties access to your data - you can pass along your online banking credentials and they will scrape the web UI (there is an entire industry built on that - companies like TrueLayer will take any bank’s credentials and some cash and give you JSON in exchange, scraping the online banking UI behind the scenes). Stupid people will be stupid and will find a way to shoot themselves in the foot; doesn’t mean I should be prevented from accessing my own data.
ummonk 8y ago
So you are saying Cambridge Analytica wouldn't be able to get access to people's banking data by marketing some sort of convenience app to them?
- TeMPOraL 8y ago
  It sound more like Cambridge Analytica will be able to get access to people's banking data by making themselves an AISP, while I still have to scrap my fucking bank site to automate my own finanses. This is totally backwards, but that's profit motive for you.
- repolfx 8y ago
  Cambridge Analytica didn't make or market such an app to them. It was some academic who made the app and then turned around and sold the data. This academic has now been largely erased from the story, presumably because journalists tend to like academics and anyway "one guy screwed up" is not a story whereas "clash of the corporate titans" is.
mcintyre1994 8y ago
I've only just joined so this isn't exactly a recommendation, but Monzo looks super exciting because of two features: instantly reporting transactions, and an API that lets you access your own transactions. If you've only ever used a shit bank, look how amazing this looks: https://docs.monzo.com/#list-transactions https://docs.monzo.com/#list-transactions (caveat: I haven't tried it yet!)
- Rjevski 8y ago
  I have Monzo and they are amazing indeed.
AndrewDucker 8y ago
Good. I absolutely do not want any old hacker to be building software that can talk to bank accounts. I want a minimal level of regulation and insurance, to make sure that they aren't doing terrible things with it, and that they are easy to track down and deal with when they mess it up.

solenya 8y ago

"...the regulation does not mandate any kind of API format.." That isn't true. Anybody which wants to be in the UK Open Banking Group (mandatory for the 9 biggest banks) must follow these very strict specs: https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385802/Specifications https://openbanking.atlassian.net/wiki/spaces/DZ/pages/16385...

sjtgraham 8y ago
Not true. The spec is loose, many fields are not mandatory, and the "conformance suite" only tests the security profile, not anything related to the schema. Even with that minimal level of scrutiny as of last month none of the CMA9 were compliant with the CS.
- solenya 8y ago
  Sounds like a problem with the conformance suite then? A number of the CMA9 were given a deadline extension, so there is no reason for them to be compliant yet.
  - sjtgraham 8y ago
    It's a problem with governance.

close04 8y ago

So you take issue with the fact that there's a high bar when dealing with personal data and real money? Especially when this gives you access to do it en-masse? It's open, just not the "open" you imagine. Like anyone from the street being allowed to do it.

Rjevski 8y ago
The problem is that the value of an API is in the fact that it is open as in open, not "open" like "open banking". An API that can only be accessed by a few huge players is next to useless. Those guys have already figured out a workaround for the lack of APIs, mainly screen-scraping. However the real innovation comes from small startups, sometimes originating from a one-man side-project - this "open" banking completely forgets that. And finally, my problem is that it does not even allow access to your own account. Let's forget about accessing other accounts for a second - I just want to do whatever I want with my own account.
- close04 8y ago
  Maybe the problem arises from this different interpretation for "open" that different people have. Look, the Linux source code is open. But doing something meaningful with it takes a huge effort. A one man team can't build Android out of Linux. This doesn't make it less open. The bar is higher because those companies will literally have access to to all of you financial information and your money. And not just yours, but of all the customers of all the banks. There simply must be some framework in place that sets clear regulation as to what and how things will be done. Otherwise you're flirting with disaster. Lack of proper bank supervision is what triggered the last financial crisis. You think a 3rd party will fare better if left to their devices? All the responsibility the bank has towards you, the client, should be mirrored to the 3rd party. You have high expectations of the bank, why would you accept less from the middle man? As for the "do what I want with my own account", you can to a degree. All banks provide you with internet banking, an app, a website, a person behind a desk. You have access to all of your data, just not how you want it. And the how is sensitive enough to require regulation. P.S. The requirements are in no way unachievable for a small startup. It takes a bit of effort, I agree. But if those requirements are what stop you then you're in the wrong business. The bar in fintech is set a bit higher than other industries as it should be.

IshKebab 8y ago

Ha I knew it was bullshit! Thanks for confirming my suspicions.

sjtgraham 8y ago

> If you want to gain access to APIs, you need to become an “AISP” It's more complicated than that. Banks can give unregulated entities access to their APIs, but they don't because IMO providing API access is directly opposed to their interests. If you want to be statutorily entitled to API access you need to be a registered AISP or PISP. Unfortunately what an AIS is is very specific, i.e. showing the account owner aggregated information, before or after processing, about one or more payment accounts. If your product doesn't do this, e.g. credit scoring using the user's bank transactions instead of credit bureaux, then you're not performing a regulated activity, therefore the regulator has nothing to authorise, and you can't enjoy the resulting entitlement of API access. This means there are whole classes of (unregulated) applications that won't be allowed to exist by banks if they adopt the position of granting access only to regulated entities. > this requires a certification and a load of other nonsense akin to PCI-DSS AIS and PIS have become regulated activities as a result of PSD2. This is not the same as PCI-DSS. Becoming a (P|A)ISP means becoming supervised by the local regulator as an authorised financial institution. This involves a lot of paperwork, a £1,500 application fee, insurance, fees for any professional services you needed to complete the application (lawyer), and 3 months (longer if your application is incomplete or has other issues). > for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requires even more paperwork. And €50,000 own capital requirements. > I also said APIs because the regulation does not mandate any kind of API format, so every bank has their own with different capabilities as far as what data is returned and in which format. Some of them are truly awful. This is true at the moment for Europe but notionally incorrect for the 9 largest banks in the UK, which are subject to parallel domestic measures ordered by the Competition and Markets Authority. There is a spec, but there are many problems with the governance, implementation, etc.

abraae 8y ago
To be honest those requirements sound perfect for a scrappy startup. Just enough of a moat to deter 99% of drive by hackers, but within the reach of any reasonably serious startup. - £1,500 application fee - €50,000 own capital requirements If you're aiming to play in this league you really should be able to scrape together this kind of money. - 3 months wait Can also be seen as a 3 month delay imposed on your competitors. Of course if you're aiming to use the API for your own personal needs only- then yeah, these requirements suck.

Nursie 8y ago

So you need to be vetted and approved before being allowed access to some of people's most private and secure data. Why is this a problem exactly?

sjtgraham 8y ago
Do you think it's appropriate an app doing something as trivial as calculating much you spend on Starbucks each month is now a regulated activity? I don't.
- baloki 8y ago
  If that app has access to all my other transaction history, maybe a little, yes.
Rjevski 8y ago
My problem is that it does not even allow access to your own account. Nobody has a problem with access to others' accounts being regulated. I just want to do whatever I want with my own account.
- miracle2k 8y ago
  If you are allowed to access your data, then you can grant that access to third parties (pass along the API token). I happen to think that is great, but we live in a time where the idea of my sharing my Facebook account with an app is considered a problem, because it has a list of my friends. My financial history contains a lot of metadata about third parties. This is exactly the intersection between this overlay strict interpretation of privacy and my right to share my side of the data with third parties.
  - Rjevski 8y ago
    At the moment you can already grant third parties access to your data - you can pass along your online banking credentials and they will scrape the web UI (there is an entire industry built on that - companies like TrueLayer will take any bank’s credentials and some cash and give you JSON in exchange, scraping the online banking UI behind the scenes). Stupid people will be stupid and will find a way to shoot themselves in the foot; doesn’t mean I should be prevented from accessing my own data.

ummonk 8y ago

So you are saying Cambridge Analytica wouldn't be able to get access to people's banking data by marketing some sort of convenience app to them?

TeMPOraL 8y ago
It sound more like Cambridge Analytica will be able to get access to people's banking data by making themselves an AISP, while I still have to scrap my fucking bank site to automate my own finanses. This is totally backwards, but that's profit motive for you.
repolfx 8y ago
Cambridge Analytica didn't make or market such an app to them. It was some academic who made the app and then turned around and sold the data. This academic has now been largely erased from the story, presumably because journalists tend to like academics and anyway "one guy screwed up" is not a story whereas "clash of the corporate titans" is.

mcintyre1994 8y ago

I've only just joined so this isn't exactly a recommendation, but Monzo looks super exciting because of two features: instantly reporting transactions, and an API that lets you access your own transactions. If you've only ever used a shit bank, look how amazing this looks: https://docs.monzo.com/#list-transactions https://docs.monzo.com/#list-transactions (caveat: I haven't tried it yet!)

Rjevski 8y ago
I have Monzo and they are amazing indeed.

AndrewDucker 8y ago

Good. I absolutely do not want any old hacker to be building software that can talk to bank accounts. I want a minimal level of regulation and insurance, to make sure that they aren't doing terrible things with it, and that they are easy to track down and deal with when they mess it up.