The paper explains what open banking is, why the Competition and Markets Authority adopted it as a remedy and describes the arrangements the CMA required the 9 largest current account providers in Great Britain and Northern Ireland to put in place in order to implement it. The paper provides examples of open banking products which have been launched, both to save consumers and small businesses time and money and also to provide help and advice for financially stretched or vulnerable consumers. There are already over 3 million consumers and small businesses using these products each month and take-up has been particularly rapid among small businesses. The paper concludes with some learnings from the UK experience, the main one being that in the particular circumstances that the CMA encountered, the UK’s burgeoning open banking ecosystem is unlikely to have been created on a voluntary basis.
By Adam Land & Bill Roberts1
I. INTRODUCTION
Open banking2 allows consumers and small businesses to share their bank transaction data securely with trusted third parties who can then use this information to provide them with services that save them time or money.
The UK was the first country in the world to implement open banking but now around 603 jurisdictions have either adopted it or are seriously considering doing so. This paper sets out the problems that the UK’s Competition and Markets Authority (“CMA”) was trying to address when we mandated open banking and the outcomes we were aiming for. It explains how we set about implementation, describes where we are now in terms of adoption and lists the lessons we have learnt along the way.
II. OUR AIMS
Since open banking measures have been adopted for a variety of reasons, it is worth noting at the outset that the CMA was seeking to address competition concerns in the retail banking market rather than, for example, seeking to bring more consumers or small businesses into the banking system or stimulate the Fintech sector, which have been important objectives in some other jurisdictions.
Unusually among competition regulators, as well as having the powers to prosecute cartels and review mergers between firms to see if they are likely to give rise to competition concerns, the CMA has the power to investigate certain markets if it considers that they are not functioning well. In 2014 it launched a Market Investigation into retail banking services provided to both consumers and small businesses. This investigation revealed that in 2016 the older and larger banks, which had accounted for over 80 percent of the retail banking market for many years, did not have to work hard enough to retain their existing customers and that it was difficult for new and smaller providers to attract new customers. It said that these failings were having a pronounced effect on certain groups of customers, particularly overdraft users and smaller businesses. It also meant that the sector was not as innovative or competitive as it needed to be. The CMA investigation concluded that banks would only invest in new products or services, or reduce their prices and improve service quality, if they expected to win business as a result, or feared losing business if they do not.
The idea of open banking had been around for a few years. In September 2014 the UK Treasury published a report it had commissioned from the Open Data Institute and Fingleton Associates entitled Data Sharing and Open Data for Banks. This concluded that greater access to data had the potential to help improve competition in UK banking and that current policy interventions to promote access to data were steps in the right direction but could be taken further by the application of more widely-used technologies and standards for data sharing.
A first iteration of data sharing had been launched in 2015 by the 6 largest UK banks.4 This was, however, difficult to use because it required customers to first locate the relevant data on their bank’s online banking site and then manually download a .CSV file of their data before uploading this data into an application they wanted to use. In addition, the software did not function on Apple devices. Consequently, take up of the service was very low.
A Government-Industry working group led by the Open Data Institute took the concept further and in 2016 published a guide to creating an open banking ecosystem based on common, open application programming interface (“API”)5 standards and recommended the Government adopt open banking as a policy.6
At the same time, the second EU payment services Directive (“PSD2”) was being rolled out. This would, in effect, require account providers like banks to enable customers to share their bank account transaction data with trusted third parties using APIs but under PSD2 banks and other payment account providers were not required to adopt common or interoperable standards: banks were free to choose which standards to adopt. While potentially pro-competitive, allowing each bank to create their own APIs raised barriers to widespread and timely adoption of open banking by customers and intermediaries. In these circumstances, developers would either have to build applications which were capable of working with many different standards or use a technical service provider7 to link them up with lots of different banks.
Open banking was given fresh momentum in the UK when it was adopted by the CMA as a remedy following its market investigation into retail banking. The CMA went beyond PSD2 by not just requiring the major banks to facilitate data sharing but requiring that they adopt common and open API standards, data formats and security protocols.
While the CMA’s focus was on tackling the particular competition problems it had identified, open banking opened up the possibility of something a bit more radical: market transformation, by creating a new ecosystem of innovative products and suppliers, forcing incumbent banks to raise their own performance, benefitting customers.
III. HOW DOES THIS WORK?
At its simplest level, open banking facilitates choices between banking services offered by different providers, not all of whom will be banks. A small business, for example, could potentially save money by using an intermediary to whom it had granted access to its account history to calculate what bank charges it would have incurred if the transactions it had performed over the previous 12 months had been with another bank.8 If that small business used a cloud-based accounting system like Quickbooks or Xero it could automatically import bank and credit card transactions, saving time compared with doing this manually. And if it was looking for finance, by sharing its bank transaction data it could quickly be directed to lenders whose eligibility criteria it met.
Similarly, consumers can make use of open banking services to identify money saving opportunities through switching bank accounts and can check their eligibility for a mortgage with different lenders.9 Additionally, there are use cases which are aimed at protecting the more vulnerable (eg alerting carers to unusual purchase behaviour by the people they are looking after10) and facilitating access to financial services (eg helping people with a thin credit file borrow money at lower cost).11
As well as making it easier to compare options, the inclusion of payment services within the scope of open banking makes it easier for customers to act on opportunities to secure better value. The CMA identified sweeping services as an example of this type of application, with the potential to be a particularly powerful source of competitive pressure on incumbent banks.
Sweeping services allow account holders to instruct an intermediary to automatically transfer cash balances out of their current (checking) accounts (which typically do not pay interest in the UK) into other accounts they hold, including those held at other banks, which do pay interest (eg savings accounts) when that cash is not needed.12 Further, customers can avoid bank overdraft charges, which can be around 40 percent for retail consumers, by arranging for a short term loan from the intermediary concerned, if that intermediary guarantees that its rates will always be lower than the bank’s.
The CMA considered that this was a particularly important use-case from a consumer perspective, since consumers who retained large cash balances in their current accounts and who make frequent use of overdrafts had a powerful incentive to use these services in order to save money. They were also some of the banks’ most profitable customers so rivals targeting these customers would be likely to provoke a sharper competitive response from the larger, longer established banks.
Open banking would also enable new, more flexible and cheaper payment services to be made available to consumers and merchants in competition with card payments and thus putting competitive pressure on the interchange fees that banks charge on card transactions.
IV. IMPLEMENTATION
The CMA’s remedies, like those of economic and other regulators, usually specify in detail the obligations they are imposing on firms. In this case, however, the CMA was not in a position to specify the detailed technical standards that the banks should adopt since this was a major task that could not be completed within the statutory deadline for publishing the Order which provided the legal force behind the remedy package.
It chose, therefore, to create a forum in which the banks, third-party providers of open banking services, small business and consumer representatives could debate the appropriate standards and which would be supported by a technical staff who would draft the standards and manage their adoption by the 9 banks subject to the Order.13 This organisation, the Open Banking Implementation Entity (“OBIE”), was designed as a special purpose vehicle created purely for the purposes of delivering open banking implementation.
The Order required the “CMA9,” as they became known, to make their best endeavours to reach agreement but it also obliged them, in the absence of a consensus, to accept the decision of an Implementation Trustee, whose appointment the CMA would approve, and who would play the role of executive chair of the OBIE.
The OBIE was created and the Implementation Trustee appointed in late 201614 and, at the time of writing, the implementation process, as set out in its “Roadmap,”15 is nearing completion.
V. WHERE WE ARE NOW IN TERMS OF ADOPTION
For the open banking ecosystem to develop and flourish it required adoption by banks, including both those who were required to comply with the CMA Order and also those who saw voluntary adoption as a business opportunity; by Fintech intermediaries who could provide open banking services that deliver value sufficient to overcome consumers’ natural caution over sharing sensitive personal information; and by end-users, whose adoption would provide the incentive to providers to enter and expand their open banking business.
A. Banks
As would be expected, adoption by the CMA9 is close to 100 percent16/a> but it is significant that they have almost all also launched open banking services themselves. In the main, these are “aggregator” services which allow customers to view transaction information relating to bank and credit card accounts they hold with other providers,17 through the bank’s retail banking app. Some have also begun providing payment services using open banking (as an alternative to card payments, for example) including the ability to initiate a payment from an account held at another bank.18
As was envisaged by the CMA, current account providers other than those mandated to do so have adopted the open banking standards. The CMA reasoned that since these account providers would need to adopt APIs in order to comply with PSD2 it was likely that they would adopt the (free) standards rather than develop their own. As a result, close to 99 percent of current account consumers are using account service providers who have adopted the open banking standards.
B. Fintechs
The number of third-party providers (“TPPs”) who are now active in the ecosystem is also extremely important to the effectiveness of the remedy as it is these new market participants who will be offering innovative services which put competitive pressure on incumbent providers. In March 2021 there are just over 130 TPPs with products generally available in the market, approximately 70 percent of whom provide account information services (such as aggregators or apps which assess creditworthiness or loan eligibility) and the remainder payment initiation services, enabling users to make single immediate or future or regular payments not using card systems but sending money directly from their bank account to the recipient’s.
Payment initiation services have been slower to develop but as the payment functionality of open banking has improved, with for example the addition of a refund capability, more PISPs have entered the market, including, as noted above, two bank and the major card companies.19 We expect open banking payment services to grow rapidly and, over the coming years, to put significant pressure on providers of card services.
C. End Users
Consumer adoption has been harder to measure accurately and initially OBIE and the CMA relied upon the volume of API calls to provide an indicator, albeit an oblique one. As can be seen from the diagram below, call volumes have increased steadily since launch and are now running at over 700 million calls a month.
More recently the OBIE has tried to measure individual active users on a monthly basis and its current estimate is that around 3 million people and businesses a month20 are using open banking.
SME penetration is almost certainly higher than in consumer markets with perhaps 50 percent21 of SMEs using products that rely on open banking, driven particularly by the benefits that they can derive from automating input to their cloud-based accounting systems from their bank accounts and the ability of their advisors to model cash flows.
Adoption by SMEs is likely to be driven further still as the UK’s taxation authority (Her Majesty’s Revenue and Customs) starts accepting payments via open banking channels.22
VI. SOME LESSONS LEARNED
Much of the “heavy lifting” to introduce open banking in the UK has now been done, with considerable potential for future growth of the ecosystem, benefitting UK customers. Given the international interest in open banking, and the appetite for data-sharing interventions in other sectors, we conclude this piece with a few reflections on the implementation of open banking over the past six years.
- Jurisdictions have had different reasons for adopting open banking: financial inclusion/widening the tax net; boosting the Fintech Sector; stimulating competition. In the UK’s case the aim was to increase the competitive pressure faced by the major UK banks both from other banks and from non-banks offering banking services. In such circumstances it seems unlikely to us that a purely voluntary approach to the introduction of open banking would have succeeded, since the firms whose active cooperation is required to put in place open banking had both the ability and the incentive to frustrate it. Similar considerations also apply to the specification of individual parts of the ecosystem design. For example, if the design of a crucial element of the customer journey is left to an entity whose interest is in making that journey more difficult, it is likely to do so unless prevented. The mandatory implementation of open banking, including the role of OBIE, was one way of overcoming this conflict of incentives,
- SME adoption of open banking is likely to be faster than consumer adoption. The functionality that open banking offers SMEs can be easily added to and will enhance the performance of tools that SMEs are already using, for example cloud-based accounting systems. Such use cases do not therefore involve a big leap for SMEs and will immediately deliver benefits by making frequently performed tasks simpler, thus saving time.
- Both the risks and the benefits associated with payment initiation services are higher than those with account information services. As customers are allowed by open banking to grant PISPs the authority to move money safely out of their bank account to a merchant or savings account say, the possibilities of money going astray or being perceived as having gone missing, are greater. However, the “disruptive” nature of such service may mean they are likely to have a bigger competitive impact on the market and thus represent a greater commercial threat to incumbent banks, both directly (e.g. in putting pressure on overdraft charges) and indirectly (eg by allowing customers to avoid paying the interchange fees that card transactions generate). For these reasons, regulators will probably have to “push” harder to ensure that payment initiation delivers its full potential, that high standards of customer protection are maintained and that beneficial proposals, particularly relating to functionality, are not watered down in the face of industry opposition.
- The implementation model adopted in the UK (an implementation entity overseen by a Trustee with the power to require the adoption of particular standards in the absence of consensus) worked well for us but this may have been due to the particular circumstances we faced. As the first jurisdiction to adopt open banking we had little or no precedent to rely on and were therefore to an extent “feeling our way.” In the event, the technical side of standards adoption was relatively straightforward and the UK “tech stack”23 has now been adopted in other jurisdictions. However, there were nonetheless elements of the process which had characteristics in common with the practice of creating a “minimum viable product” as the first step in the development journey.
- We found that some banks were able to adopt open banking standards faster than others, usually because of the configuration, including security standards, of their main banking platforms. We therefore faced a choice: should we set stretching targets and accept the fact that some banks would continually be in breach of our Order? Or should we set targets that all of them could meet? We chose the former and were quite explicit that we did not intend to move at the pace of the slowest provider. Had we not done so, implementation would have taken, literally, years longer.
- As we have noted more than once, the CMA’s objective in adopting open banking was to stimulate competition in retail banking, including providing tools for relatively “technologically savvy” consumers to use to save themselves money. However, a significant number of applications have been developed whose aim it is to protect the interests of more vulnerable consumers.24 Regulators introducing open banking, and developers contemplating possible avenues of research, should be mindful of these opportunities that open banking presents for helping consumers who may not have been well-served by traditional models of supply.
1 Adam is a senior director at the Competition and Markets Authority (“CMA”), where he leads the Remedies, Business and Financial Analysis professional group. Bill is Head of Open Banking at the CMA.
2 In Canada the term “Consumer Directed Finance” is more commonly used, following the publication of the Advisory Committee on Open Banking’s report in January 2020.
3 Australia, NZ, HK, Singapore, Malaysia, Vietnam, the Philippines, Indonesia, Japan, Korea, Taiwan, China, India, Pakistan, the Gulf States (Bahrain, Kuwait. UAE, Saudi Arabia, Qatar, Oman), Egypt, Israel, Nigeria, Ruanda, Kenya, S Africa, Brazil, Colombia, Chile, Mexico, Dominican Republic, USA, Canada, the EU, UK.
4 See the assessment of the consumer testing magazine Which?.
5 APIs allow applications to talk to each other and share data and functionality. It was intended that they would replace “screen-scraping” which requires consumers to disclose their online credentials to third party intermediaries providing services based on data-sharing. APIs provided a much more secure way of sharing customer data.
7 Firms like Plaid, Truelayer and OpenWrks provide such services.
8 Swoop, for example, offers this service.
9 See Are we on the cusp of an open banking and mortgage revolution?, Mortgage Finance Gazette.
11 For example Credit Kudos or Tully.
13 The banks (and 1 building society/mutual) were the largest providers of current accounts in Britain and Northern Ireland respectively.
14 Sadly, the first Trustee, Andrew Pinder, died a few months after taking up the post. He was replaced by a new Trustee, Imran Gulamhuseinwala, in March 2017.
15 In the Order this is described as the Agreed Timetable and Project Plan, the current version of which is here.
16 Several banks found the initial timetable challenging and one the smallest banks has not yet fully adopted all of the requirements in Northern Ireland but the majors, whose collective market share is over 80 percent, have all fully met the obligations of the Order.
17 Over 40 percent of consumers in the UK have more than one current account. FCA, Sector Views, January 2019, p 19.
18 For example Payit from NatWest and the equivalent service from Barclays.
19 For example the American Express Bank Transfer product.
20 See Openbanking.org.uk.
21 See OBIE survey of December 2020.
22 HMRC awarded the contract to provide it with open banking payments services in February 2021.
23 OAuth 2.0, ID Connect and FAPI.
24 For some examples see the OBFG (open banking for good) website. For more see the open banking website listing consumer applications classified under a variety of headings.
