PSD2: Three years after the introduction, financial innovations are still scarce

Indeed, new applications based on the PSD2 data have emerged. Yolt (a subsidiary of ING) provides services in several countries based on AIS and PIS. There are several comparison sites, such as ABN AMRO’s Grip housekeeping book, and aggregation apps, where multiple banks are used in one overview. BBVA, Santander, Deutsche Bank and Barclays have invested heavily in Open Banking services, mainly in the form of aggregation apps.

There are also promising initiatives from new payment institutions such as Flow (personal finance management, budgeting) and Buddy Payments (a Dutch app that supports debt counseling). But we can safely say that the expectations of the Commission have not yet been met.

Why is that? We see several reasons for the lack of pace in most European countries. For many of these, the UK is the favourable exception: 173 AISP / PIS licenses have now been issued in the UK. In the Netherlands there were 17 (at the end of 2020).

PSD2 is still primarily seen as a cost item and compliance obligation

PSD2 was mainly approached by the banks on the European mainland as a compliance issue instead of a serious business opportunity. They were more or less forced to develop an expensive infrastructure and make it available to third parties free of charge. Moreover, they ran the risk that those parties would take over the primary customer relationship. The spectre has long been that PSD2 could potentially roll out the red carpet for Fintechs and Big Tech companies that could parasitise the banking infrastructure with the help of a PSD2 license. In other words: PSD2 as a threat instead of an opportunity.

Lack of central coordination

Most European countries have central bodies or organisations in the field of payments, in which joint developments are coordinated. In the Netherlands, these are, for example, the Betaalvereniging Nederland and Currence. However in the case of PSD2, the realisation is largely left to the individual banks.

The situation is different in the UK, where the Competition and Markets Authority (CMA) took the initiative early on, in 2016, to establish a central Open Banking Implementation Entity (OBIE, https://www.openbanking.org.uk), sponsored by the nine largest banks. The OBIE created and maintains the API standards and documentation, provides information, stimulates use and takes action in disputes (1). Partly because of this, key data are available for the UK market, and they look mature: more than 650 million API calls per month (November 2020). Incidentally, less than 10% is related to PIS calls (one explanation could be the lagging quality of the home banking apps, which makes British citizens more in need of financial apps that excel in clear information).
The availability of the API infrastructure of the UK banks is consistently above 97.5%.

Technical standards for PSD2 differ per bank

Instead of agreeing on a technical standard for the API calls in advance, as in the UK, the continental banks based their technical API solutions on their own interpretation of the EBA’s Regulatory Technical Standards. The consequence is that they differ greatly from one another. EBA’s RTS documents mainly deal with security requirements such as the application of SCA (Strong Customer Authentication). The EBA left it to the banks to choose which standard they use for the data exchange, because the prescription of a specific standard would be too rigid and also too difficult to verify. As a result, the API request and response formats (2), the length of the transaction history, the account types, the availability of the data, the authentication protocol, the geographic scope (whether or not restricted to SEPA countries), the currency types, the availability of detailed technical documentation, they can all differ per country and per bank, unlike in the UK.
This makes it difficult for TPPs to develop a PSD2 service: they have to develop, test, implement and maintain different technical solutions for a multitude of banks.

Standardisation of API calls has been on the agenda of the so-called Berlin group (3), alongside STET and UK Open Banking, for years. However, the discussion is dragging on, as is typically the case with more interbank consultations within Europe. The ECB has now started a consultation round that may accelerate this.

European consumers and companies keep a wait and see approach

Perhaps it is still too early, consumers and businesses still have to get used to it. According to research by the Dutch central bank in 2020, a quarter of the people surveyed gave permission to use their payment details in exchange for new services (4). Young people are more likely to give consent than elderly. Consumers indicate that they have mainly given permission to the bank of their main payment account. Only 2% said they were willing to share their payment information with parties other than banks (with less than 2% willing to share them with Google, Facebook, etc.).
In the UK, the adaptation of Open Banking by consumers is going faster, given the number of API calls. Also, Open Banking user numbers have doubled since January 2020. There has been a steady increase at a rate of around 160.000 users per month (5). Undoubtedly this has to do with the stimulating role of the OBIE.

 Applying for a PSD2 license is difficult

TPPs wishing to offer PSD2 products must apply for a license from a licensor (usually the central bank). This requires quite a few administrative and legal steps, a tough cookie that innovative startups with an entrepreneurial corporate culture may have little appetite for. The thresholds for this type of application are lower in the UK. The FCA (Financial Conduct Authority), the UK licensor, is seen as less demanding.
Partnering with an already established licensee can be an attractive solution for startups to speed up the process.