New compliance requirements, such as the Payment Services Directive version 2 (PSD2) and the European General Data Protection Regulation (GDPR) are handing more power back to the consumer, giving them more control over how and who they transact with and what happens to their personal data. This new age of regulations could make or break financial institutions, depending on whether they take the necessary steps to keep up with the digital revolution in the industry.

GDPR

GDPR, for example, will give European consumers more control over their personal data and the information organisations can collect on them, while also setting out regulations to enforce better protection of such information. GDPR specifically stipulates that, when it comes to organisations gathering or sharing information on consumers, “opt out” measures are no longer sufficient. Instead, consumers will have to “opt in” to share their information or receive communications, and they will be able to expressly say whether or not their data can be shared with third parties.

PSD2

The second Payment Services Directive (PSD2) will fundamentally change how consumers access their financial data as well as how, and with whom, they transact. At the moment, consumers holding accounts at multiple institutions need to log into each account via that institution’s digital interface, whether this be via a mobile app or an online portal. But to promote competition in financial services and improve ease of use for consumers, PSD2 makes provision for data aggregators, which allow for a single view of accounts at multiple providers (insurance companies, payments services, credit card issuers, mortgage lenders, etc.). All account information, all financial products, and all transactions will be visible on a single dashboard. To make this possible, PSD2 will require banks and other financial service providers to open their data and payment initiation capabilities to third parties. In this way, PSD2 will open banking, offering consumers more freedom not only when it comes to accessing and sharing their financial data, but also for engaging in financial transactions.

Opening wide

With the introduction of PSD2, as well as the Competition and Markets Authority (CMA) mandating UK retail banks to ‘open up’ and adopt the new principles of open banking, banks are about to operate in an environment that is more competitive than it has ever been.

A key component of PSD2 is the requirement that banks must give third-party providers access to their payment services, and to an account holder’s data if said account holder consents. This will be done through open application programming interfaces (APIs), and will allow third parties to directly connect to customer accounts. The premise of ‘open banking’ will mean that the sheer volume of sensitive transactions is likely to increase significantly.

In an already complicated security landscape, this could pose an increased liability for banks. With requests for data access and payments originating from a range of third parties, cybercriminals will have new, and more, opportunities to exploit victims by committing fraud. Without measures in place that will enable them to offer additional digital services while prioritizing customers’ digital security, incumbent banks will struggle to compete against all the new entrants into their market. Technology which enables strong customer authentication (SCA), in a way that is compliant with PSD2 requirements, and also offers an enhanced mobile user experience, is ultimately imperative for future success. It will also be a key measure for managing the increased volume of user interactions which will be a direct consequence of open banking and PSD2.    

Securing customers’ trust

A post-PSD2 world will enable forward-thinking organisations to build customer-centric experiences that will empower their users to interact from virtually anywhere, at any given time–thus strengthening trust relationships with users, one interaction at a time. With open banking introducing many parties into the equation, and allowing them to interact with customers, it is vital for banks to become more than just standard “service providers”, and instead take on the role of the trusted keeper of customers’ digital assets. By putting a secure communications channel in place, which no other party can access, banks will be able to offer customers limitless digital services, and in the process, encourage existing customers to stay put while attracting new ones. With the increase in new digital banks and service providers such as Apple, Amazon and PayPal continuing to disrupt the traditional banking landscape, this is more important than ever.

Turning regulatory challenges into an opportunity

It would be easy for banks to have misgivings about these new regulations, but there is no need to fear–for there is also ample opportunity. Although there is a perception among bank that consumers tend to resist new technologies and extra “steps” in payments processes, recent research has indicated that consumers do want to take control of the security of their personal information.

If implemented with security and user experience in mind, the changes introduced in accordance with the new regulations, especially SCA, could present a chance for a bank to instil customer trust, leading to an increase in the number and the value of transactions - even as fraud is effectively eliminated.

The introduction of third-party providers will expose banks to unprecedented competition. Banks will no longer be the only parties that can make the most of their customers’ valuable data assets. Instead, they must anticipate new mobile and digital competitors using that very data to target banks’ most profitable functions. With millennials opting for slick and secure transaction services, and recent research showing consumers trust PayPal more than traditional retail banks, the time to act is now. Any bank that underestimates these threats and takes a complacent attitude to the new world of open banking that we are moving towards is at risk of simply becoming irrelevant.

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.