A Summary of the new Hong Kong Open API Framework, and how it Compares with PSD2

Today, Open Banking is gaining increasing traction globally, through a combination of banks’ internal efforts, market initiatives, and regulations like the EU’s PSD2 and the UK’s CMA Open Banking. Now Hong Kong has also got on board, with the Hong Kong Monetary Authority (HKMA)’s launch of its draft Open API framework.

Publication of the framework – on 11th January – marked the start of a public consultation that will run until 15th March. Responses will feed into a final version that will be binding for the territory’s largest retail banks, although other banks will be able to join in the future.

So, what are the highlights of the HKMA’s Open API framework? It includes the following goals:

• Increase the competitiveness of Hong Kong’s banking sector
• Generate opportunities to reach out to untapped markets through better customer experience
• Define Open API use cases and deployment timeframes
• Recommend Open API technical standards
• Recommend Open API facilitation measures.

One of the most interesting aspects of the HKMA’s framework is the splitting of use cases into four phases with different product categories and timelines:

• Phase 1 – Product and Service Information: Access to frequently-used product information by customers from their bank on a "read only" basis, helping financial product comparison sites. Banks will be expected to implement these APIs within six months of the framework’s finalization.

• Phase 2 – Customer Acquisition/New Applications: Customer acquisition through online applications for credit cards, loans and some insurance products, including via Third Party Providers (TPPs). Banks will be expected to implement this within twelve months of finalization.

• Phase 3 - Account Information: Retrieval of both stand-alone and aggregated account information, helping TPP services that aggregate information for customers across multiple accounts and banks or perform analytics to gain customer insights. The timeline for this phase will be discussed later between HKMA and the banks in Q4/2018.

• Phase 4 – Transaction Processing: Enabling TPPs to communicate customers' payment instructions to banks. Again, the timeline will be discussed later between HKMA and the banks in Q4/2018.

Comparing the HKMA’s framework with the Regulatory Technical Standards (RTS) for strong customer authentication (SCA) under PSD2, one of the biggest differences is that the HKMA’s draft is a mixture of a regulatory paper with some initial timelines, recommendations on specific protocols and data formats, and high-level specifications for each product category. PSD2 is technology-agnostic and does not define any API standards, with other initiatives like Berlin Group and STET stepping in to fill this gap.

Other differences between HKMA and PSD2 include – e.g.:

• Only the largest retail banks are in scope, whereas PSD2 applies to all banks offering payment accounts accessible online.
• Banks remain gatekeepers of the customer relationship and data, and can choose what TPP to collaborate with. PSD2 requires banks to open up to all registered TPPs.
• HKMA presents various use cases for multiple products, going way beyond PSD2’s remit of account information, payment initiation, confirmation of funds.
• API standards and technical protocols are recommended, whereas PSD2 leaves banks to decide what type of interface is used.
• The timeline for phases 1 and 2 are set, but those for account information and transactions are vague. PSD2 interfaces must probably be provided by September 2019.
• A requirement for customer authentication is included, but – unlike PSD2 RTS on SCA – no rules on SCA and exemptions are included.
• TPP regulation, certification/registration and authentication rules are not specified. PSD2 will have TPP registration in place latest in September 2019 (RTS compliance) and regulates the Payment Service Providers (PSP) and TPPs.

While HMKA Open API has been inspired by Open Banking and PSD2, its approach is visionary and, in many ways, unique. It remains clear that a single API standard is vital for any economy to attract global innovation and avoid fragmentation. This is a lesson that HKMA is well-placed to take on board.