The many shades of open banking: A comparative analysis of rationales and models

Introduction

Open banking (OB) is generally defined as the sharing and leveraging of customer-permissioned data by banks with third-party developers and firms to build applications and services, greater financial transparency options for account holders, marketing, and cross-selling opportunities (Basel Committee on Banking Supervision, 2019).

In recent years, OB has gained increasing attention due to several legislative initiatives undertaken in different jurisdictions worldwide. Indeed, most countries have established (or are on the verge of introducing) specific frameworks for OB, allowing the sharing of banking account data via standardised and secure interfaces (APIs) at the request of clients (Babina et al., 2024; OECD, 2024; OECD, 2023a).¹Further, some countries have already considered extending these rules to financial services, thereby embracing Open Finance (OF) (OECD, 2023b).

Despite the growing interest in OB, it has been noted a lack of consensus on its definition (Briones de Araluze & Cassinello Plaza, 2022). Based on existing literature, four main connotations have been identified: the platformisation of the retail banking industry business model, a manifestation of the overall data-sharing trend applied to banking data, the interaction between the emergent ecosystem based on technological innovation (FinTech) and incumbent financial institutions, and the regulatory framework that, in some jurisdictions, bolsters the OB phenomenon (Briones de Araluze & Cassinello Plaza, 2022).

Nonetheless, as part of the broader framework of data policy initiatives aimed at empowering consumers with more control over their personal data, the unique features of OB have been investigated from many angles.

In particular, it has been noted that OB guarantees enhanced data privacy and security by replacing screen scraping as the most common method of accessing consumer data (Australian Government, 2023; US Consumer Financial Protection Bureau, 2023).²Additionally, by fostering consumer engagement and empowerment, OB can lead to more competitive markets (Borgogno & Colangelo, 2020a). In this regard, the idea of introducing interoperability through the so-called in situ data right (which allows users to use their data in its original location rather than moving it from the platform) has been seen as more effective from a competition policy perspective compared to simple data portability solutions (Martens, Parker, Petropoulos, & van Alstyne, 2021; Zetzsche, Arner, Buckley, & Weber, 2020).³It has been, therefore, suggested that OB may represent best practices and a blueprint to promote effective and workable interoperability beyond banking and financial industries, particularly in digital markets and Internet of Things (IoT) ecosystems (Borgogno & Colangelo, 2024). Moreover, insights from the UK experience have highlighted the importance of addressing the issue of the standardisation and technical definition of APIs (Dinçkol, Ozcan, & Zachariadis, 2023).

Overall, OB is expected to stimulate innovation, competition, and financial inclusion. Indeed, by putting customers in control of their data, OB provides opportunities to benefit from new, cheaper, and tailored services through FinTech (Babina et al., 2024). This would support more informed decisions, lower fees and switching costs, and ensure privacy and security.

Besides these benefits, potential risks have also been highlighted, suggesting that relevant trade-offs should be addressed when designing an OB framework. Indeed, each advantage coming from OB data-sharing rules goes hand in hand with a potential drawback. Notably, by empowering consumers to exploit their own data and thereby play an active role, OB also raises protection concerns, especially due to the lack of an adequate level of digital and financial literacy (Erel & Liebersohn, 2022; Wang Tok & Heng, 2022). This deficiency may expose vulnerable consumers to risks of manipulation and privacy and security harms. Similarly, on the competition policy side, data-sharing obligations imposed on banks also benefit non-financially regulated players, such as large online platforms (BigTechs) and data aggregators.⁴However, their entry may negatively affect competitive dynamics, financial stability, and monetary policy (Awrey & Macey, 2023; Croxson, Frost, Gambacorta, & Valletti, 2023; OECD, 2023c; de la Mano & Padilla, 2018).

Therefore, while OB policy goals are interconnected and can sometimes be mutually reinforcing, they may also involve significant trade-offs. Specifically, although empowering consumers by giving them control over their personal data can help achieve broader economic goals —such as fostering more competitive and innovative markets— the focus on competition and consumer empowerment may have unintended consequences for consumer protection, particularly in areas like privacy, security, and digital and financial literacy.

In this regard, concerns have been raised about the ability of OB to effectively protect users’ personal data (Wolters & Jacobs, 2019). While fostering innovation and competition, the platformisation of banking and financial services can enable targeted individual marketing, exploitation of consumers’ behavioral biases, misselling of financial services, and financial discrimination (OECD, 2022). Due to these negative externalities, some argue that the narrative of consumer technological empowerment overlooks the fact that technologies are often driven by industry interests and trends, rather than by a balanced assessment of their benefits and risks, and that the assumption that a liberalised market will provide better choices is flawed, as platformisation carries risks of monopolisation and market power abuses (Ferrari, 2022). Further, interpretative doubts and legal uncertainties arise concerning the interplay between OB regimes and data protection regulations. For instance, with respect to the EU landscape, several legal coordination issues have been identified, such as differing legal definitions of consent, ambiguity regarding their applicability to account data processing, the appropriate legal basis for account access and data processing, the sensitive nature of information in payment accounts, and the impracticality of separating it from other payment data (Ferretti, 2022).

Considering these trade-offs and the problems that need to be tackled for effective implementation, OB is not a single phenomenon but rather a highly differentiated one, with many shades depending on the country involved. Indeed, OB initiatives differ significantly, for instance, in terms of the type of regime (regulatory-driven v. market-led regime), the mandatory or voluntary nature of data sharing, eligibility rules and requirements for third parties seeking data access, the standardisation of APIs, and the provision of compensation for data access.

Rather than illustrating these differences, this paper aims to assess the consistency of OB policies. To this end, our analysis takes a novel perspective by investigating the primary rationales that have inspired OB regulatory initiatives in some major countries (i.e., the EU, the UK, Australia, the US, India, Singapore). The premise is that, if OB is motivated by different justifications or market failures, it is unsurprising that one size does not fit all, and some countries have embraced their own versions of OB. Defining these primary rationales is essential for evaluating whether the specific features of OB solutions implemented in a country are consistent with the intended policy goals. Furthermore, such a comparative analysis would assist policymakers in countries considering the introduction of OB in properly designing an OB model that best fits their needs.

The paper is structured as follows. Section 1 analyses the main drivers of OB, providing a classification of major countries based on the justifications that have inspired their initiatives. Section 2 illustrates the different regulatory models and standardisation approaches adopted. Section 3 assesses OB policies by comparing their primary rationales with the models and technological solutions implemented. The conclusions summarise the main findings and policy recommendations.

1. Primary rationales for OB in various jurisdictions

OB can pursue several policy goals, such as increasing competition and innovation in the market, empowering consumers with control over their financial data, promoting open and secure data-sharing practices, and fostering financial inclusion. These policy objectives are typical in all OB initiatives. However, while a particular objective might clearly motivate an initiative, others may arise as consequential outcomes of pursuing different priorities. For example, while financial inclusion could serve as the main impetus behind an OB policy, it could also result from efforts to foster greater market competition, innovation, and digitalisation (Morris, 2024; Bianco & Vangelisti, 2022).

Further, it is essential to consider that the OB regime in each jurisdiction is implemented within the context of the financial ecosystem, including factors such as the concentration of market power in the hands of major players (typically incumbents or legacy banks), the incentives for market players to share data, and the financial access and literacy of consumers. Therefore, although the intended goals of OB are similar, the regulatory and institutional approaches differ in each jurisdiction.

This Section elaborates on the main obstacle each jurisdiction faces in implementing the OB regime effectively. Policymakers focus on a primary rationale they aim to achieve through regulation, which determines their approach to implementing OB. These primary rationales can be divided into three categories: (a) promoting competition through technological innovation, (b) entrusting consumers with data rights as a key element of broader data policy initiatives, and (c) increasing financial inclusion.

(a) Competition: the EU and the UK

The EU was one of the first jurisdictions to make OB mandatory and, from the very beginning, it has been essentially guided by a competition policy goal. Indeed, as early as 2007, the first Payment Services Directive (PSD) aimed at enhancing competition in the retail payment market by harmonising payment transactions across the EU single market (Directive 2007/64/EC, 2007).

The emergence of new players due to the technical innovation driven by the FinTech evolution, along with the identified limitations of PSD in terms of legal certainty, security, and consumer protection, prompted EU institutions to revisit the Directive and establish a new, harmonised regulatory framework (Directive 2015/2366, 2015). In this context, the second Payment Services Directive (PSD2) introduced an access-to-account rule, mandating banks to provide access to customer account data to all authorised third payment service providers and to execute payment orders (Borgogno & Colangelo, 2020b; Polasik, Huterska, Iftikhar, & Mikula, 2020). This provision paved the way towards OB. Under PSD2, the European Central Bank and the European Banking Authority (EBA) are responsible for guaranteeing fair competition in the market.

The pro-competitive rationale is even more apparent in the UK, where the OB regime, based on the PSD2, has been operationalised by the antitrust authority, i.e. the Competition Markets Authority (CMA) (UK Competition and Markets Authority, 2017). Notably, OB in the UK was imposed as a remedy to address the adverse effects on competition in the retail and business banking sector, mainly to unbundle the services offered, remove incumbency advantages, and overcome consumer inertia (UK Competition and Markets Authority, 2016).

Therefore, the UK regime differs from the EU approach primarily in its technical implementation (Dinçkol, Ozcan, & Zachariadis, 2023). Indeed, while PSD2 is technology-agnostic, the UK promoted a standardised model of OB, requiring the largest nine banks to adopt common and open API standards, data formats, and security protocols provided by the OB Implementation Entity (OBIE) after consultations with the banks. This ensured an industry-wide standard, making it easier for other players to enter the market and for consumers to switch between different providers for various services.

(B) Data policy: Australia, Singapore, and the US

In other jurisdictions, OB emerged as part of data policies, resulting from broader governmental initiatives to create data-sharing frameworks. In this context, while some initiatives primarily focus on fostering consumer empowerment, others are justified on the grounds of ensuring security or promoting financial inclusion.

As previously mentioned, when examining the main rationales behind OB interventions, we do not wish to overlook their complementarity or their mutually reinforcing nature (Didenko, Jevglevskaja, & Buckley, 2024, pp. 12-16). However, trade-offs may sometimes arise between certain goals (e.g., competition and privacy; competition and financial inclusion). And even when these goals are closely interconnected, the primary justification advanced by policymakers to support a regulatory initiative may be crucial in evaluating the coherence of the means adopted to achieve it. This is particularly relevant in the case of competition and consumer empowerment. Indeed, empowering consumers with control over their data is expected to foster competition among different providers. Simultaneously, prioritising competition as a goal would provide consumers with more choices, thereby increasing their power.

However, regulation is not the primary tool to promote competition, but it may serve as a necessary means to facilitate data sharing, ensure certain standards of security, and foster digitalisation and financial inclusion. In terms of competition, regulatory intervention is instead justified only in cases of market failure, where it has been demonstrated that free and unrestricted competition is incapable of efficiently allocating resources, and the enforcement of traditional competition rules is likely to fail. This is precisely the scenario illustrated by policymakers in the EU and the UK.

In contrast, in Australia, the primary rationale for OB appears to be giving consumers the right to decide whether the data businesses hold about them should be shared with other providers.⁵Although the Australian government’s interest, following the example of the UK, initially focused on a review of the banking industry (2017), the scope of its final intervention has expanded beyond that specific sector (Buckley, Jevglevskaja, & Farrell, 2022). Indeed, it is intended to encompass other sectors, regardless of the existence of a market failure. This approach stems from the Australian Government Productivity Commission’s inquiry (2017) into the benefits and costs of options for improving availability and use of data which recommended the creation of a new economy-wide comprehensive data right.

Notably, drawing on the UK experience, the Australian Competition and Consumer Commission (ACCC) required the four major banks to share product reference data with accredited data recipients and mandated the adoption of a single set of API standards. However, from the outset, concerns regarding Australia’s banking sector extended beyond the market power of the banks to include issues such as poor financial advice, the maladministration of life insurance claims, and market manipulation (Australian Parliament, 2016, p. 2). The initial report on OB emphasised that data sharing was introduced specifically to empower consumers by enhancing price transparency (Australian Parliament, 2016, p. 39). Similarly, the final report underscored the importance of giving consumers greater control over their information, resulting in increased choice and convenience (Australian Parliament, 2017). Accordingly, within the broader framework for reviewing the banking sector, the OB policy was explicitly designed to be “customer-focused” and to “be seen from the customer’s perspective” (Australian Parliament, 2017, p. 5).

Therefore, despite adopting the UK model, the Australian policy maker aims to introduce an economy-wide data-sharing framework, known as the Consumer Data Right (CDR), which empowers consumers to share their data with any service provider they choose. The CDR focuses on OB as an information-gathering service, with the banking sector serving as the testing ground of this new framework, which is applicable across different sectors, including energy and telecommunications (Leach & McKay, 2022).⁶

As of now, the implementation of the CDR in the banking sector is complete, covering nearly 100% of the sector by household deposits. The roll-out in the energy sector began in 2022, with product data sharing starting on 1 October 2022, and consumer data sharing following on 15 November 2022 for initial energy retailers. However, the expansion into the telecommunications sector has been paused. Notably, in November 2021, the Australian Government (2021) released Treasury’s final sectoral assessment report, which recommended that telecommunications be the third sector designated for the CDR. Nonetheless, in the 2023–24 budget, the Government committed to prioritising OF with non-bank lending (Australian Government, 2023a), while pausing the CDR’s implementation in the telecommunications sector (as well as in superannuation and insurance sectors) to allow time for the framework to mature in the initial sectors targeted. A strategic assessment is planned for the end of 2024 to guide future expansions and the implementation of action initiation (Australian Government, 2023b). An independent review commissioned by the Department of the Treasury revealed that the compliance costs associated with the CDR framework have significantly exceeded the original regulatory estimates, raising concerns about the continued pace of change (Richards, 2023). Consequently, the government announced a reset of the CDR and launched a new consultation on how to improve the CDR (Jones, 2024).

In a similar vein, the primary rationale behind OB in Singapore was to provide consumers with the ability to aggregate their financial information from different financial institutions in one place. OB has been enacted through the data portability obligation under the Personal Data Protection Act. However, Singapore’s regime differs from those in the other jurisdictions examined, as it is a market-led collaborative approach promoted by the Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore (ABS) by publishing a non-binding API playbook to encourage banks to participate (Association of Banks in Singapore and Monetary Authority of Singapore, 2016; see also Remolina, 2019). Notably, the MAS, in collaboration with the financial institutions, developed an open public infrastructure known as the Singapore Financial Data Exchange (SGFinDex).⁷This gave consumers a consolidated view of their financial information for better financial planning. Therefore, in Singapore, OB essentially aimed to strengthen the digitalisation of the sector (Leong & Gardner, 2021).

Both Australia and Singapore have adopted a whitelist approach to OB, detailing implementation specifics related to data protection (Yeong & Hardoon, 2022). Despite similar goals and implementation, a key distinction exists between the two frameworks: Australia’s OB is rights-based, while Singapore’s is duty-based (Leong, 2020). Although data protection and consumer empowerment are related goals, Singapore’s OB was developed primarily as a data policy focused on protecting consumer information by restricting banks from using consumer data without consent. In contrast, in Australia, data-sharing was enacted as a consumer right with safeguards embedded in the data protection regime. This difference may stem from the fact that, in Singapore, banks voluntarily began sharing data with fintech companies to improve consumer services. As a result, protecting data became a stronger priority than fostering competition and innovation. Consequently, Singapore’s competition authority plays no role in implementing OB mandates.

Finally, after representing the main country embracing a market-led approach to OB, the US has switched to a regulatory-driven regime by mandating the sharing of financial data (Colangelo, 2024). In particular, activating the dormant Section 1033 of the Dodd-Frank Act enacted by the US Congress in 2010, the Consumer Financial Protection Bureau (CFPB) has recently adopted a rulemaking on “Personal Financial Data Rights” to facilitate the portability of consumer banking and financial data (US Consumer Financial Protection Bureau, 2024). The new rules require data providers to establish and maintain a developer interface for third parties to access consumer-authorised data under certain prescriptive performance and security specifications. Further, rather than dictating technical standards, the regulation supports industry standards appropriately developed within a data access framework. Finally, unlike most of the OB regimes, the US rule does not require data providers to initiate payments.

The policy priority inspiring the regulatory initiative is to protect consumers against fraudulent activities, rather than to foster market contestability. Indeed, with regard to market features, the US differs significantly from the EU and the UK, being the world’s largest, most fragmented, and most diverse financial services industry (Awrey & Macey, 2023). The CFPB explicitly acknowledges this, noting that any differences between its approach and those of other jurisdictions are appropriate given “the particular market and regulatory frameworks applicable to the U.S.” (US Consumer Financial Protection Bureau, 2024, pp. 57-58). Notably, “American consumers already expect third party data access capabilities, and the US market consists of a higher number of depository institutions (and card issuers) than most other jurisdictions.” (US Consumer Financial Protection Bureau, 2024, p. 181).

Against this backdrop, the CFPB’s intervention aims to promote data sharing by ensuring trust and security for consumers, moving the market away from risky data collection practices. Accordingly, the main justification for this top-down intervention is to outlaw screen scraping, which is considered problematic for data privacy, security, and accuracy (Chopra, 2022). From a comparative perspective, it is noteworthy that the recent evaluation report on the European regime highlights its success in protecting user data and enhancing the security of remote payments through the introduction of strong customer authentication (SCA). This system requires two authentication factors, which can be based on knowledge (e.g., a password), possession (e.g., a card), or inherence (e.g., a fingerprint) (European Commission, 2023a). For example, an analysis of the Italian market, using data reported by payment service providers to the Bank of Italy, estimates that SCA reduces the risk of fraud by 60 percent for card-based remote payments and by 80 percent for e-money transactions (Cologgi, 2023).

(C) Financial inclusion: India

In an emerging economy like India, where a significant part of the population does not have access to financial services, the OB’s primary rationale is, instead, to increase financial inclusion (Carrière-Swallow, Haksar, & Patnam, 2021). As a result, the OB framework is a part of the government’s initiative to build a digital public infrastructure (DPI), also known as the India stack (Alonso et al., 2023). Under this initiative, the first step in enhancing financial inclusion was to create a verifiable identity (known as Aadhaar), which was then used as a foundation for other financial infrastructure, the most influential being the interoperable payment infrastructure, known as the Unified Payments Interface (UPI). The stack comprises three layers of infrastructure: (i) the identity layer for digitalisation of documentation and verification, (ii) the payments layer UPI, and (iii) a data or consent layer (Desai, Manoharan, Shiva Jayanth, & Zack, 2024).

Like Singapore, India’s OB system has been developed by the Central Bank, specifically the Reserve Bank of India (RBI). However, unlike Singapore, India did not have a data protection framework in place at the time OB was adopted. As a result, OB was developed under the Data Empowerment and Protection Architecture (DEPA), a joint public-private initiative aimed at improving data governance (NITI Aayog, 2020).

2. Regulatory and technical solutions

Against the overview of OB’s primary rationales, this Section explores if and how these rationales have influenced policymakers’ decisions regarding the implementation of the OB regime in their respective jurisdictions. Notably, the Section elaborates on the regulatory and technical solutions adopted and their alignment with the rationale and the financial ecosystem of the jurisdiction at issue. In this regard, the discussion focuses on various endorsed approaches concerning the nature of data-sharing obligations (voluntary vs. mandatory) and the standardisation process (top-down vs. market-led), which are summarised in Table 1.

From the very beginning, it is worth noting that the implementation of the Australian OB regime is similar to that of the UK. In both countries, OB is mandatory and the standards are set by a regulated body. However, the implications of the different primary rationale are evident in the scope of implementation. For example, Australia’s primary rationale was to create a data-sharing framework, so OB applies to more entities, unlike the UK’s limited applicability to only banks. Additionally, in Australia, OB serves as the testing ground for fostering data sharing across several sectors. Accordingly, a reciprocal obligation to share data is also imposed on data recipients.

In Singapore, despite sharing the same policy goal as Australia, the approach to OB differs. This difference reflects the fact that the banking sector was already competitive due to existing regulatory policies and a highly developed infrastructure. Therefore, OB was not made mandatory as major players had already adopted it independently. For example, DBS Bank created the largest API developer platform (DBS Bank, 2017). Consequently, OB emerged as a market-led initiative. Nonetheless, although the participation is voluntary, the MAS fosters a conducive environment for a smooth transition to an open-architecture banking sector. This is achieved by publishing non-binding API standards and providing enabling infrastructure through SGFinDex, which ensures privacy by design with encrypted user financial data that SGFinDex cannot read or store. These mechanisms helped MAS bring together various players to build the necessary ecosystem (Kwan Chow & Fan Pei, 2019).

As OB has been introduced in the EU and the UK by the same legislative initiative (i.e., PSD2), they share both the competitive rationale and the mandatory nature of the data-sharing obligation. However, they differ significantly in their standardisation approaches. Indeed, as opposed to the top-down solution adopted in the UK, the EU has refrained from publicly mandating API standardisation, allowing banks to create their own data-sharing interfaces or participate in privately-led standardisation initiatives. This decision was based on the concern that a common API standard could hinder innovation and dynamic competition between standards.

Interestingly, the US is following the EU’s approach regarding the nature of the data-sharing obligation and the standardisation process, despite the legislative initiative being inspired by a different rationale. Further, it has been noted that these similarities with EU solutions contrast with the unique features of the US market (Colangelo, 2024; Awrey & Macey, 2023). Notably, OB already exists in the US without a regulatory obligation. In addition, the US banking and financial sector is highly fragmented. Consequently, although institutions have undertaken initiatives to promote API standards (including private standard-setting bodies like the Financial Data Exchange), these efforts have been considered controversial and the market is characterised by a relatively concentrated share of data aggregators, which raises different competitive concerns compared to those addressed in the EU (US Consumer Financial Protection Bureau, 2023).

In this scenario, India has adopted a unique combination of data-sharing obligations and standardisation solutions. Indeed, OB is facilitated through an account aggregator (AA) framework (Reserve Bank of India, 2016). AAs are data fiduciaries, registered and regulated by the RBI, acting as intermediaries between Financial Information Providers (FIPs), such as banks, insurance providers, tax platforms, and Financial Information Users (FIUs), which include entities regulated by financial sector regulators. AAs connect customers to multiple FIPs through standardised API interfaces developed by the Reserve Bank Information Technology Private Limited (ReBIT), a subsidiary of the RBI. The information transmitted from FIPs to AAs, and subsequently to FIUs, is encrypted. Further, to mitigate the risks of data misuse, AAs cannot use or access data for any other purpose.

Nonetheless, despite such a top-down standardisation approach, participation in the OB (i.e., the AA framework) is voluntary. This is because, unlike in other jurisdictions, India’s banking sector was competitive even before the adoption of OB. As a result, much like in Singapore, India’s competition authority plays no role in regulating OB policies. Moreover, data access is reciprocal, therefore, if an entity is a FIU, then it also needs to be registered as a FIP. This stands in stark contrast to most of the other experiences analysed in this paper, where data-sharing provisions are instead asymmetric. Despite the purported goal of ensuring a level informational playing field, fostering digitalisation, and promoting data sharing to empower consumers, other countries merely impose on banks the duty to grant access to third-party providers.

3. Looking for consistency in OB regimes: matching rationales and models

By mapping primary rationales (supra Section 1) and models in terms of data-sharing obligations and standardisation solutions (supra Section 2), the comparative analysis reveals the many nuances of OB. While some countries adopt similar models despite different rationales (i.e., the EU and the US), others share the same rationale but employ different models in terms of a regulator-led or market-led approach (i.e., the EU vs. the UK, and Australia vs. Singapore). Additionally, some countries represent unique experiences, such as India.

Therefore, the variation in models and approaches among the examined jurisdictions does not necessarily reflect different policy goals pursued through the OB regime. Further, starting from each primary rationale supporting OB initiatives, it is still necessary to assess the consistency of OB policies by evaluating whether the regulatory and technical solutions endorsed fit with the intended rationale.

When the primary rationale is to increase competition in the market, it makes sense to have a mandatory obligation to share data, as seen in the EU and the UK. However, in both cases, the obligation is asymmetric as it is only imposed on banks. Such an approach is at odds with the policy goal as a reciprocal data-sharing obligation on data recipients would promote greater competition and enhance innovation by fostering the development of new products and services (Australian Government, 2017). A reciprocal obligation would also help to alleviate competition concerns by preventing disadvantages for banks mandated to share data with new players (e.g., FinTechs, BigTechs, and data aggregators), who might gain an advantageous position over time (Carr, Pujazon & Urbiola, 2018; de la Mano & Padilla, 2018).

In such a scenario, the UK’s top-down standardisation approach has proven to be more effective than the European market-led alternative. While the evaluation report revealed limits to PSD2’s effectiveness in achieving a level playing field and mixed success in the uptake of OB in the EU (European Commission, 2023a), the UK celebrates the success of its model, citing significant take-up and accelerating growth (UK Joint Regulatory Oversight Committee, 2023; UK Government, 2022). Further support for the UK solution comes from the recent EU proposal to introduce Open Finance (European Commission, 2023b). Indeed, as the consultation indicated the lack of standardisation as a major obstacle to data sharing in finance (European Commission, 2023c), the proposal includes a requirement for market participants to jointly develop common standards for customer data and interfaces as part of financial data-sharing schemes.

If the primary goal is consumer empowerment, implementing a mandatory data-sharing obligation appears essential as well. However, the voluntary approach adopted in Singapore may be an acceptable exception, given the widespread adoption of OB in the country. Additionally, when considering the nature of this obligation, consumer empowerment does not necessarily require reciprocity. As previously mentioned, a reciprocal data-sharing obligation mainly serves to promote market competition. Rather, in this case, it seems appropriate to broaden the scope of the obligation with reference to both the entities and the data covered. Finally, regarding technical solutions, a top-down approach seems preferable. High standardisation would empower consumers by making it easier for them to exercise their data rights and receive offers from other providers.

A mandatory data-sharing obligation is unnecessary and should not be imposed when the primary rationale for the OB initiative is to ensure data privacy and security. Indeed, it is unclear how imposing a data-sharing obligation would address this issue. The same doubt applies to the nature (reciprocal or asymmetric) of such an obligation.

However, as discussed, data privacy and security may be negatively impacted by the externalities generated in the pursuit of competition goals, which are often prioritised particularly in countries with highly concentrated markets and persistent competitive challenges (such as the EU and UK, unlike the US). Similarly, an empirical study of the EU credit market found that an excessive focus on data policies may limit the long-term impact of OB on fostering greater competition and innovation (Lauridsen, 2024). In these scenarios, it is essential to strike a balance between promoting competition and ensuring a high level of security in data access and exchange. In this regard, the solution proposed by the European Commission (2023d) in its PSD2 reform appears compelling. It aims at prohibiting screen scraping by requiring the use of dedicated interfaces for OB purposes and eliminating the option for third-party providers to rely on fallback interfaces (see also Wolters & Jacobs, 2019).⁸As a result, access to consumer data would be restricted to a standardized interface and secured by a multi-factor authentication system, similar to one successfully implemented by the PSD2. In such a case, a top-down standardisation approach may help.

An outright ban on screen scraping, along with the availability of a standardised interface, would be especially crucial in markets with a significant presence of data aggregators. In this scenario, it might also be beneficial to look at the Indian OB regime, where data is encrypted, and account aggregators cannot access or use the data for any other purpose. This is again achieved through a top-down solution, i.e., an enabling infrastructure provided by the regulator and the requirement for each player to be licensed, ensuring compliance with data security and privacy safeguards.

Finally, if the policy goal pursued is to enhance financial inclusion, the promotion of OB involves relevant trade-offs. While technological innovation in banking and finance can promote financial inclusion and help consumers make informed choices, it also raises risks of discrimination, manipulation, and exploitation of vulnerable customers, particularly in areas with low levels of digital and financial literacy. Therefore, as highlighted in the literature, the policy goal of promoting innovative entry can sometimes come into conflict with the financial inclusion and the customers who benefit the most may be those who already have credit access (Babina et al., 2024; Croxson, Frost, Gambacorta & Valletti, 2023; Preziuso, Koefer & Ehrenhard, 2023; OECD, 2022; Wang Tok & Heng, 2022; Philippon, 2019). These limitations do not justify introducing a mandatory data-sharing obligation in an OB regime that aims to promote financial inclusion.

Our findings, summarised in Table 2, should help both policymakers evaluating amendments to their current regime (e.g., European Commission, 2023d; European Commission, 2023e) and policymakers in countries considering the introduction of OB to design a model that best suits their needs. About the latter case, for instance, the Canadian Government Department of Finance has recently launched a consultation on ‘Strengthening Competition in the Financial Sector’ (Government of Canada, 2023) and the Competition Bureau urged policymakers to prioritise an OB regulatory design aimed at nurturing competition and innovation in the financial sector by challenging established providers and enabling new service providers (Canadian Competition Bureau, 2024).

Given the concerns on concentration and competition in Canada’s banking sector reported by the Department of Finance and the Competition Bureau, the primary rationale of a prospective OB regime is clearly identified. According to our analysis, Canadian policymakers should therefore be inspired from the UK experience but should also introduce a relevant adjustment by imposing a reciprocal data-sharing obligation on all financial service providers involved. This is exactly what the Competition Bureau suggested to the Canadian Government. Specifically, the adoption of a common API standard with principles and oversight established in legislation, and the promotion of a reciprocal access to in-scope data among participants.

Concluding remarks

Despite its growing success and widespread adoption around the world, OB struggles to present a coherent identity. Each country has seemingly developed its own approach to OB, leading to various models based on different rationales, data-sharing obligations, and standardisation processes.

Against this backdrop, this paper has drawn insights from experiences in the EU, UK, Australia, the US, India, and Singapore to evaluate the consistency of OB policies. To achieve this, the paper first identified the primary rationales supporting OB initiatives in these countries and then examined their data-sharing and standardisation approaches. After all, if OB is driven by various justifications or market failures, it’s not surprising that a single approach doesn’t work for every jurisdiction.

Our comparative analysis served as the foundation for proposing regulatory and technical solutions that better align with the intended policy goals of an OB regime. The findings suggest significant revisions to current regimes and offer guidance to policymakers evaluating initiatives to promote OB. For instance, in Canada, where there is an ongoing discussion about OB regulatory design, our findings fully support the recommendations made by the Competition Bureau to the government.