4 ms·

I didn't understand that article. Maybe I don't have enough context. "share their bank data with other parties" What? Who wants to share their what now with w

I didn't understand that article. Maybe I don't have enough context. "share their bank data with other parties" What? Who wants to share their what now with whom? Why would they do that? "Fintechs like Plaid, TrueLayer and Tink have founded their businesses on providing access to regulated banking data for a fee.." What data? Aggregated? Individual banking? What regulated data? What regulations? "Under current banking regulation, raw data must be provided for free to consumers via an official application programming interface (or API). As a result, the apps pick up the cost on behalf of their users." What? My bank doesn't offer an API. I have no idea what that last sentance even means. What cost? It really seems like the article assumes a lot of background knowledge. Anybody have an ELI5 link?

damagednoob 5y ago
> What? Who wants to share their what now with whom? Why would they do that? Barclays will send banking data directly to FreeAgent[1] which allows you to categorize the transactions and upload receipts. FreeAgent uses this information to calculate how much VAT and Corporation tax I owe to the government. Couldn't be simpler. [1] https://support.freeagent.com/hc/en-gb/articles/360006470520-How-to-set-up-a-bank-feed https://support.freeagent.com/hc/en-gb/articles/360006470520...
twic 5y ago
This is all about PSD2: https://www.ukfinance.org.uk/guidance/payment-services-directive-2-and-open-banking https://www.ukfinance.org.uk/guidance/payment-services-direc...
rojeee 5y ago
All banks in the EU must offer a data and payments API. The APIs are standardised and must allow third party service providers - which themselves must be regulated - to be able to build services using these APIs. With a user's authorisation, said service provider can view transaction data or initiate a payment, for example. The specific regulation is called "payment services directive 2".
- wrnr 5y ago
  This is exactly what I miss about PSD2, a small company still can't just use an api to do it's banking, checking what money comes in and optionally (semi) automate payments. You still need to lobby your country's ministry of finance to get a license. Great for all the hot customer payments startups but useless for a company that just want to do IBAN and cut out the middle man.
  - Nextgrid 5y ago
    This is exactly why I hate the name "Open" Banking.
    - keerthiko 5y ago
      Truly we need two tiers of API access, one which will only work with bank accounts we link to our API developer profile, which is easier to get access to, and another that is meant to handle third party bank data which requires ministry compliance and may need to wait longer for.
      - lmz 5y ago
        What's to stop people from building an integration that requires the API keys from the self-serve access flow? e.g. in the US people are OK with giving their password to Plaid?
        OJFord 5y ago
        > in the US people are OK with giving their password to Plaid? They absolutely shouldn't be. There are/were services like that here too, but what trust (or usefulness to be honest) they had will/has erode/d as a consequence. Also you don't have to be a literal bank, the better (/with enough of an EU/UK focus) services like that will just offer the proper authentication method instead, now (since 2016 I think?) that it's available.
      - OJFord 5y ago
ru552 5y ago
I work around this sector. Big banks sell data to data brokers the same as telcos do. It's unlike Facebook selling your data because the people buying it aren't trying to target you specifically. They are looking for market trends. You are usually aggregated around your demographic. Essentially, the banks are selling the spending behaviors of demographic X. This type of anonymous data is important to businesses like Nike and Coke because it informs their advertising messages.
- lazide 5y ago
  That is incredibly disturbing.
- alex_smart 5y ago
  I also know that there are several companies trying to build alternative credit risk models in markets like India and Colombia, where many people do not have a credit history so the usual credit scoring models do not really work. In this case the data is certainly being used to target, or rather score you specifically.
- Nextgrid 5y ago
  If this is actually true (because it has nothing to do with Open Banking), how does this comply with the GDPR?
  - slivanes 5y ago
    It complies because it's aggregated, no individual's data is involved.
- deleted 5y ago
  [deleted]
- jimhefferon 5y ago
  > Big banks sell data to data brokers the same as telcos do. Do they pay me for making money from me?
  - 5y ago
tormeh 5y ago
If memory serves it's an EU directive meant to decouple handling of money from access to banking information by forcing banks to provide APIs that third parties can use on a bank customer's behalf. So you can grant an app permission to see a live view of your account balance, for example. Not sure what applications the lawmakers have in mind. Credit rating seems like an obvious application. It would maybe make it easier to circumvent credit cards for money transfer, maybe? I suspect there's a lot of hand-wavy "startups will figure something out"
- Denvercoder9 5y ago
  > Not sure what applications the lawmakers have in mind. Accounting and budgeting services are the most common examples.
greatgib 5y ago
This article does not make a lot of sense. As you can see it is sponsored by Nordigen, and they try to say that open banking has some ugly and bad aspects in everything that is not the particular points of their marketing offer.
Nextgrid 5y ago
> What? Who wants to share their what now with whom? Why would they do that? Accounting or budgeting services for example. > What data? Aggregated? Individual banking? TrueLayer & Plaid are gateways that translate bank's individual APIs into a single common one, and their clients pay them for the privilege (typically a monthly fee per active account connected). > What regulated data? What regulations? There are EU regulations that force each bank to provide an API to any AISP (account information services provider) or PISP (payment initiation service provider). The (A|P)ISP can request the end-user's consent (typically via OAuth) to access this data. > My bank doesn't offer an API. This is why I dislike the name Open Banking. It's not actually open. You have to either to through tons of regulatory BS to become an AISP or go through a gatekeeper like TrueLayer or their competitors (which will happily "lend" you their AISP license). Fortunately, there are modern banks such as Monzo or Starling which allow the end-user to use the API to access their own account, but technically this has nothing to do with Open Banking (even though it's often the same API).
greggman3 5y ago
Not answering your question but, I ran into Plaid recently as Tesla wants you to use it to pay for your car. I said "GTFO" and got a cashier's check As others have pointed out, Plaid is service that lets people interface with your bank via one API, the Plaid API, Plaid deals with all the various banks. And Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want. I also found out (and this is old info) that ANYONE can take money from your bank account without your permission. There might be repercussions for them later or maybe the bank has to trust them but I found this out because I signed up for Apple Pay and Apple Pay wants me to pay my bill via ACH. https://en.wikipedia.org/wiki/Automated_clearing_house https://en.wikipedia.org/wiki/Automated_clearing_house What happened is I gave Apple my info (routing number and account number) and without the bank confirming with me that Apple had permission to take some money, Apple sucked money out of my bank account. That's crazy to me. Those 2 numbers are on every check I've ever written. I get that someone can charge money to me with my Credit Card info but AFAIK if it's fraud I'm only out max $50. Plus, it's not my money, it's the CCard company's money since it's effectively a loan and the fraud is their problem, not mine. I'm sure someone with more knowledge can tell me why the ACH system is safe but I find it super scary ATM.
- phoenixy1 5y ago
  > Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want. FWIW I think this is a slight misinterpretation of our privacy policy. The section on advertising basically just refers to our usage of cookies for advertising and analytics. Plaid does not share personal information without your explicit consent: https://plaid.com/how-we-handle-data/ https://plaid.com/how-we-handle-data/
- michael1999 5y ago
  No. You are correct. The US payment system is hopelessly insecure. Anyone who has your numbers can pull money from your account with no further authentication. Knuth had to stop writing checks for his bug bounties because of this. https://www-cs-faculty.stanford.edu/~knuth/news08.html https://www-cs-faculty.stanford.edu/~knuth/news08.html
- 5y ago

damagednoob 5y ago

> What? Who wants to share their what now with whom? Why would they do that? Barclays will send banking data directly to FreeAgent[1] which allows you to categorize the transactions and upload receipts. FreeAgent uses this information to calculate how much VAT and Corporation tax I owe to the government. Couldn't be simpler. [1] https://support.freeagent.com/hc/en-gb/articles/360006470520-How-to-set-up-a-bank-feed https://support.freeagent.com/hc/en-gb/articles/360006470520...

twic 5y ago

This is all about PSD2: https://www.ukfinance.org.uk/guidance/payment-services-directive-2-and-open-banking https://www.ukfinance.org.uk/guidance/payment-services-direc...

rojeee 5y ago

All banks in the EU must offer a data and payments API. The APIs are standardised and must allow third party service providers - which themselves must be regulated - to be able to build services using these APIs. With a user's authorisation, said service provider can view transaction data or initiate a payment, for example. The specific regulation is called "payment services directive 2".

wrnr 5y ago
This is exactly what I miss about PSD2, a small company still can't just use an api to do it's banking, checking what money comes in and optionally (semi) automate payments. You still need to lobby your country's ministry of finance to get a license. Great for all the hot customer payments startups but useless for a company that just want to do IBAN and cut out the middle man.
- Nextgrid 5y ago
  This is exactly why I hate the name "Open" Banking.
  - keerthiko 5y ago
    Truly we need two tiers of API access, one which will only work with bank accounts we link to our API developer profile, which is easier to get access to, and another that is meant to handle third party bank data which requires ministry compliance and may need to wait longer for.
    - lmz 5y ago
      What's to stop people from building an integration that requires the API keys from the self-serve access flow? e.g. in the US people are OK with giving their password to Plaid?
      - OJFord 5y ago
        > in the US people are OK with giving their password to Plaid? They absolutely shouldn't be. There are/were services like that here too, but what trust (or usefulness to be honest) they had will/has erode/d as a consequence. Also you don't have to be a literal bank, the better (/with enough of an EU/UK focus) services like that will just offer the proper authentication method instead, now (since 2016 I think?) that it's available.
    - OJFord 5y ago

ru552 5y ago

I work around this sector. Big banks sell data to data brokers the same as telcos do. It's unlike Facebook selling your data because the people buying it aren't trying to target you specifically. They are looking for market trends. You are usually aggregated around your demographic. Essentially, the banks are selling the spending behaviors of demographic X. This type of anonymous data is important to businesses like Nike and Coke because it informs their advertising messages.

lazide 5y ago
That is incredibly disturbing.
alex_smart 5y ago
I also know that there are several companies trying to build alternative credit risk models in markets like India and Colombia, where many people do not have a credit history so the usual credit scoring models do not really work. In this case the data is certainly being used to target, or rather score you specifically.
Nextgrid 5y ago
If this is actually true (because it has nothing to do with Open Banking), how does this comply with the GDPR?
- slivanes 5y ago
  It complies because it's aggregated, no individual's data is involved.
deleted 5y ago
[deleted]
jimhefferon 5y ago
> Big banks sell data to data brokers the same as telcos do. Do they pay me for making money from me?
- 5y ago

tormeh 5y ago

If memory serves it's an EU directive meant to decouple handling of money from access to banking information by forcing banks to provide APIs that third parties can use on a bank customer's behalf. So you can grant an app permission to see a live view of your account balance, for example. Not sure what applications the lawmakers have in mind. Credit rating seems like an obvious application. It would maybe make it easier to circumvent credit cards for money transfer, maybe? I suspect there's a lot of hand-wavy "startups will figure something out"

Denvercoder9 5y ago
> Not sure what applications the lawmakers have in mind. Accounting and budgeting services are the most common examples.

greatgib 5y ago

This article does not make a lot of sense. As you can see it is sponsored by Nordigen, and they try to say that open banking has some ugly and bad aspects in everything that is not the particular points of their marketing offer.

Nextgrid 5y ago

> What? Who wants to share their what now with whom? Why would they do that? Accounting or budgeting services for example. > What data? Aggregated? Individual banking? TrueLayer & Plaid are gateways that translate bank's individual APIs into a single common one, and their clients pay them for the privilege (typically a monthly fee per active account connected). > What regulated data? What regulations? There are EU regulations that force each bank to provide an API to any AISP (account information services provider) or PISP (payment initiation service provider). The (A|P)ISP can request the end-user's consent (typically via OAuth) to access this data. > My bank doesn't offer an API. This is why I dislike the name Open Banking. It's not actually open. You have to either to through tons of regulatory BS to become an AISP or go through a gatekeeper like TrueLayer or their competitors (which will happily "lend" you their AISP license). Fortunately, there are modern banks such as Monzo or Starling which allow the end-user to use the API to access their own account, but technically this has nothing to do with Open Banking (even though it's often the same API).

greggman3 5y ago

Not answering your question but, I ran into Plaid recently as Tesla wants you to use it to pay for your car. I said "GTFO" and got a cashier's check As others have pointed out, Plaid is service that lets people interface with your bank via one API, the Plaid API, Plaid deals with all the various banks. And Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want. I also found out (and this is old info) that ANYONE can take money from your bank account without your permission. There might be repercussions for them later or maybe the bank has to trust them but I found this out because I signed up for Apple Pay and Apple Pay wants me to pay my bill via ACH. https://en.wikipedia.org/wiki/Automated_clearing_house https://en.wikipedia.org/wiki/Automated_clearing_house What happened is I gave Apple my info (routing number and account number) and without the bank confirming with me that Apple had permission to take some money, Apple sucked money out of my bank account. That's crazy to me. Those 2 numbers are on every check I've ever written. I get that someone can charge money to me with my Credit Card info but AFAIK if it's fraud I'm only out max $50. Plus, it's not my money, it's the CCard company's money since it's effectively a loan and the fraud is their problem, not mine. I'm sure someone with more knowledge can tell me why the ACH system is safe but I find it super scary ATM.

phoenixy1 5y ago
> Plaid mines your account advertising (as it says in their TOS/Privacy policy) and shares that info with whoever they want. FWIW I think this is a slight misinterpretation of our privacy policy. The section on advertising basically just refers to our usage of cookies for advertising and analytics. Plaid does not share personal information without your explicit consent: https://plaid.com/how-we-handle-data/ https://plaid.com/how-we-handle-data/
michael1999 5y ago
No. You are correct. The US payment system is hopelessly insecure. Anyone who has your numbers can pull money from your account with no further authentication. Knuth had to stop writing checks for his bug bounties because of this. https://www-cs-faculty.stanford.edu/~knuth/news08.html https://www-cs-faculty.stanford.edu/~knuth/news08.html
5y ago