Hello everyone, we're back with another Open Banking interview this week, this time with Lauren Jones. She is the Open Banking lead at Paylume. I'm going to be honest. I've seen her name and face at all kinds of events over the past few years, but this is actually the first time we've had a proper conversation. Now, Lauren, welcome to our show. Could you briefly explain how you got involved in the Open Banking landscape?

Hi Rik, thanks for having me on. That's a very nice introduction, I must say, hearing my name and seeing my face everywhere. Yeah, I mean, I've been in Open Banking since the early days of adoption in the UK and the EU. It was a bit of a coincidental entry into Open Banking, actually. So for those of your listeners who may have come from the UK market, they would remember that the early days of Open Banking were driven by Payments UK.

So, obviously, we know the UK has the Open Banking Implementation Entity (OBIE), which really drove the work. But before OBIE was set up, had a governance structure, and was in place by the market, Payments UK, the trade body at the time, was responsible for kick-starting the work because of the extremely short deadline set by our lovely regulators. I was head of standards at the time and largely kicked off the data work stream, which we then handed over to OBIE.

So it wasn't what I had originally been doing, and it's not what I got into the industry to do. Events can be funny things. And yeah, I've never looked back. I've been very privileged to work on Open Banking projects now, on pretty much all major continents and major markets. So it was a fortuitous coincidence.

I guess that is true for most people involved in Open Banking. Now, you work at Paylume, which, to my surprise, has quickly become quite influential in payments and Open Banking, hasn't it?

That's it. Paylume, in the past couple of years, we're nearing our two-year anniversary in September. I've made significant progress, and there's growing trust among the three founders. Our main focus is on payments and Open Banking.

Our clients are split between the public and private sectors. We work with the commercial banks and the PSPs on their payments and Open Banking strategies, as well as digital transformation. We also work very, very closely with the central banks.

We have clients in Latin America, the Balkans, and South Asia who are not only pushing for regulatory reforms but also actively implementing many of their instant payments within the Open Banking ecosystem. Over just a few years, they have achieved remarkable progress.

I'm pretty impressed. Now let's evaluate PSD2. If you look back over the past ten years, would you consider PSD2 and Open Banking today a success, compared with the initial goals the regulator set?

Yeah, I think it really depends on what we mean by success, right? And honestly, if you look at other initiatives—perhaps except for digital euro—they don't face as much scrutiny as our banking sector does. We handle some payments; it's infrastructure that operates in the background. We talk about adoption, but we don't scrutinise it as closely. Remember PSD2? Its original goal was to eliminate screen scraping. That's where it all started. Yes, exactly, it was the second significant shift. And on that note...

But also encouraged innovation to enhance competition and open the market to other players.

Regarding those two objectives, I believe we've been quite successful. While screen scraping still occurs, the majority now relies on APIs. We have TPPs that are exclusively API-based, actively promoting this approach. Currently, there are around mid-hundreds of TPPs in Europe, and including the UK, the total is roughly 550 to 600 across both regions. Therefore, new market entrants continue to emerge.

If we look at traditional products and services that are now being distributed and monetised in different ways, yes, I think you can say we're relatively successful at that. I think where we're less successful is in getting them into the hands of customers. The customer adoption side is still pretty low.

Unfortunately, this is a criticism of mine at EU level, and that is that we don't actually track usage. We're not tracking customer adoption in any meaningful way. So we're kind of flying blind when we think about the health of the ecosystem across Europe, unlike the UK, which does. We can point to successes and we can point to areas that need work.

Yes, the usage numbers in the UK are quite impressive, aren't they?

Very impressive, very impressive. But that also helps us to kind of catalyse around it because we see that success and we want to move it forward into the next iteration.

But in the EU, where we don't have that, we can always continue to say that it's a failure. I think the EU has done a bit of a disservice to the community by not tracking that. But I think that, by some metrics, it has been successful. It's now OK. Well, how do we provide that last mile and actually get it into the hands of customers so they feel they want to use it on a regular basis?

Looking back, let's make the evaluation a bit more concrete. What did we get right and what did we get wrong? I've already heard some of that. I think the evaluation, for example, could have been more effective in anticipating potential issues or concerns more quickly. But overall, what do you think went well in Europe, and what could have been better in terms of adoption of PSD2 and the Open Banking aspects of it?

Let's set aside the UK for now and focus on what we've achieved. Looking at Europe, I think we did some things right. At some point, you have to take action—like when screen scraping was happening on a large scale. The European Commission's decision to regulate it was a smart move; it has spurred market activity, even if implementation has lagged. Additionally, having a licensing system for TPPs and fintechs, where they must register with regulators and gain licenses that can be passported across the EU, is a significant advantage.

I see, the value of having that stamp of trust, so to speak.

This is a major issue in other markets, where such frameworks are often lacking and new legislation is needed, which can take years to enact. Central banks or regulators can't just create these regimes out of thin air.

Or they're very bank-dominated and don't want to adopt a softer licensing regime for non-bank fintechs. And this is often quite a sticking point. In some markets, this leads to bank-only data-sharing ecosystems in the beginning, which obviously have limited value.

So I think that move to formalising the TPP's role in the chain, exactly as you say, enables trust in the market. A bank has de facto the trust and the license, and I believe the Commission has done a great job moving forward with TPPs in this regard.

However, our less successful area is the lack of strict standards. The Berlin Group provides a useful framework, but it's not a formal standard. It has been implemented in various ways, even within individual countries and banks, leading to inconsistency.

Compared to the UK, where everyone adheres to a clear, standardised API, this approach is less concrete. I find it difficult to understand the Commission's reasoning, especially since, in other parts of the EU, such as payments and digital euro, there are established rulebooks that industries can develop against.

One jurisdiction, one standard. I guess the future looks brighter with the topic we'll discuss later, PSR, which is a regulation, no longer a directive.

Yes, exactly. There’s a clear lack of standards and effective supervision of bank APIs, especially in markets where API quality is known to be poor. This makes it difficult for fintechs to scale their services using subpar APIs. Hopefully, PSR and PSD3 will address this issue. Additionally, there’s a challenge with establishing a sustainable commercial model; the UK is also facing this problem.

The existence of a regulatory-free data set is beneficial for providing fair access to some data, but there’s limited understanding of how to develop that into a viable business model. As a result, banks tend to view Open Banking primarily as a cost centre.

I'm hoping that will start to change, but I think that's where we've been held back for the past decade or more on some of these broader conversations.

I'm actually surprised that after so many years, the lack of API quality is still an issue.

Yeah, I think it's because there's a real lack of supervision on that. Banks' risk appetite for these things is low anyway. Typically, at least from the fintech community in some markets I've spoken to, they won't go to the regulator and say, you know, these APIs are poor quality, can you please do something about it? Even though they're able to do that under PSD2 legislation, they don't.

And obviously the banks don't do the kind of self-attestation either. So, one, the regulators may not know it's happening. But equally, they're not proactively going out and checking. So the banks can continue to behave as they are.

If banks lack incentives, as I believe is more common in other markets where they act as data consumers, having access to good-quality data from banks is important for their own use when consuming APIs. However, this is less the case in Europe.

I see. In a recent blog post by you, I read “regulators need to consider that fintechs are likely to have weaker security measures compared to banks”. What immediately came to mind when reading that sentence was whether we can afford to accept these different standards when working with people's financial data?

Yeah, I think it's also a regulatory risk appetite question. It's a reality. Banks are huge institutions with very, very large security and compliance requirements. They have armies of security teams and systems of controls because they have to. Fintechs don't have, or haven't had until recently, the same obligations.

We analysed it from a balance perspective, and this issue extends beyond the EU or Open Banking. As digital financial services expand and non-bank fintechs enter the UK system, it becomes a matter of the regulator's risk appetite compared to their capacity to manage and mitigate those risks.

And I think that, in Europe, at least the likes of DORA, are putting fintechs in the same category as banks from an operational resilience point of view. So that's a good thing, putting a little more onus on fintechs than perhaps was the case pre-DORA. And we see other markets globally handling this in different ways.

In the US, there are strong accountability models for banking-as-a-service, making banks responsible for fintechs' vulnerabilities due to outsourcing. Banks are now adopting a zero-trust architecture, limiting the data they share. They deploy various security and encryption methods to reduce their own risks, understanding they can't always assess fintechs' security postures. This challenge exists globally. Some markets are highly risk-averse, refusing to include non-bank fintechs in their ecosystems because they can't effectively monitor them. Meanwhile, other regulators are taking different approaches, such as the EU's DORA regulation.

Yes, in the same blog you made the point, and I believe we've discussed this before: regulators do not always play the same role in shaping the Open Banking market. Could you clarify what you mean by that and what role you think regulators should have in Europe?

Yeah, and I think it's the word regulator. You know, we think of the (European) Commission, largely, or central banks in most of the markets. Open Banking is driven by the central banks in the UK. It's the competition regulator, likewise in Australia, but in most markets it's the central bank, which, if you think about payments, actually takes on an operational role. A lot of them run payments infrastructure, whether it's high-value retail, whatever. They have an operational role as well as a regulatory one. So, you know, in lots of markets, some of those countries are thinking, well, actually, do we have another role to play in Open Banking that's not just setting the policy, you know, like we've seen in Europe and the UK?

It reminds me of another conversation I recently had about the ECB and the role it plays in TIPS, as well as the digital euro, etc. To what extent should it start playing a more commercial role as well? Is that healthy? Should it stick to regulation?

Yeah, I mean, central banks around the world operate payments infrastructure. The Bank of England operates CHAPS, and the Central Bank of Brazil operates PIX. It's pretty normal. We have a different architecture in Europe because, obviously, we have our national central banks as well. The ECB usually sits above that.

Their role in TIPS was quite interesting. Currently, central banks managing payments infrastructure or market infrastructures like Switzerland's SIX, though bank-led, are contemplating their potential roles in developing an Open Banking ecosystem. These roles vary along the chain.

One option is to act as a standards-setting body, leaving industry players to handle bilateral connections between banks and fintechs, as seen in many markets.

Alternatively, they could expand their involvement by offering operational capabilities, such as dispute management, liability models, or centralised billing systems.

And that's very much like the role that the Bank of Brazil kind of plays in the Brazilian model. They set the standards. They also provide some centralised operational capabilities, like trust frameworks as well. But still, the banks and the fintechs connect bilaterally to each other with some central services.

And then a step further is, OK, well, actually, we don't really care about the banks and fintechs connecting directly. It's expensive and difficult to scale. We'll provide essentially a data-sharing utility in the middle, where the banks connect on one side and the fintechs connect on the other, which makes it easier to scale and is not too dissimilar from a payments infrastructure. It has rules and standards. It shares messages and data, and we can essentially offer a similar capability for Open Banking.

I believe the next phase of Open Banking is heading in this direction. In less developed Open Banking markets, where rapid market entry is crucial, they favor a more centralised approach. This allows banks to develop swiftly and fintechs to gain quick access, which can be very effective in certain markets. And indeed, this approach makes a lot of sense.

Yes, it depends on the role they're expected to play in the market. If rapid progress is desired, applying force is necessary. We explained in the blog shared during this week's interview that, as in Brazil, brute force can significantly speed things up. However, in the long run, the question is whether this approach enhances governance or remains the right strategy. I believe that's more of a philosophical question than a practical one.

Yeah, I believe it's very market-specific. In the UK, it might have followed that path, but it didn’t, and what we currently have works. In other markets, a centralised utility can make more sense. It’s also similar to past discussions in the payments industry, many years ago, where the key point was that we shouldn't compete on standards, like ISO 20022 in the payment space, but on the value-add.

We're not competing on the underlying payment itself. The money has to move from one place to another, but what value are you adding on top? That's where the competition is. From an Open Banking perspective, I think we can learn from those conversations that we shouldn't really be competing on the standard itself or on how the APIs are implemented. It's okay. What value are you providing to the end customer by having access to those APIs?

And if an essential utility makes access more standardised and more affordable, then, really, I think it's an interesting approach. The UAE has gone down that route. They're very centralised, so I think it has merit. But yeah, exactly as you say, it's on a case-by-case basis and very market-dependent.

Let's refocus on Europe. The next phase in Open Banking is the PSR, which is now a regulation rather than a directive. This means it will standardise practices more than current measures. It also assesses what worked and what didn't with PSD2. Do you believe the PSR can effectively address the issues of PSD2, or is it merely a step in the right direction?

I see it as more of a positive step forward rather than a complete overhaul. Both PSR and PSD3 contribute positively in specific areas, such as encouraging banks to make their APIs more accessible and higher quality. I’m not sure how they’ll enforce this in practice, but the intention is clear. Features like permissions dashboards empower customers to better manage their consent, which is a valuable improvement and a refinement of aspects of PSR and PSD3.

Some of the key challenges I mentioned earlier won't be fully addressed by that. I believe, and we'll likely discuss this, that the FiDA regulation is more capable of making a significant difference on those issues. In contrast, PSR, PSD3 seem more like minor adjustments rather than causing a meaningful change in how Open Banking will operate in the future.

One of the points you mentioned earlier was the remuneration for using APIs. In that respect, there has been an initiative called the SPAA Scheme, the SEPA Payment Account Access Scheme, which provides access to premium APIs from banks that are adhering to the scheme. I think it started very promisingly, but I'm not sure it will have a long life going forward. Do you know what went wrong, or perhaps make a brief evaluation of the SEPA Payment Account Access Scheme and whether it has a chance of success going forward?

Yes, the intention was good, as you mentioned. PSD2 allowed access to free data sets, and SPAA aimed to go further by providing premium, value-added APIs beyond those datasets. They also included additional features not available in Open Banking. Participation was voluntary, with banks and TPPs involved in developing the scheme.

But as with anything with commercial value attached, people have different opinions on it, and I think it's always very difficult for banks to collaborate on those aspects. As nice an idea as it was, I can understand why the TPPs want to do that. But from the bank side, particularly among those already doing a lot of this today, many banks across Europe are already providing premium APIs or premium functionality that goes beyond PSD2, and have done so in their own ways.

To shoehorn that into SPAA is a challenge retrospectively, especially when you have looming regulation, which, as we say, may or may not happen around FiDA. What that might look like from a commercial model perspective is difficult. I also think it's something that's overlooked.

I talked to other markets. Switzerland is an interesting one as well, and Brazil went through a similar conversation about at what point it is appropriate to charge. So a lot of people in the market and the industry underestimate the cost of standing up a billing infrastructure for essentially cents, not even for API calls, you know?

I can imagine that applies to both sides: on the one hand, charging, and on the other hand, being charged.

Indeed, the cost of that is pretty extensive. And if you are not experiencing a very high volume of API calls, it may not be worth it. And I think the metrics and the economics of that are very difficult to prove. I know that the Brazilian market went through a similar exercise, with a whole fees and charges working group looking at this, and then it eventually didn't go anywhere.

And the Swiss model is not regulated; it's entirely voluntary. All the banks are connected to this kind of central infrastructure utility that I was talking about. It has a billing mechanism. Banks can charge, but they don't, because they want volumes to grow to a certain point. And potentially charging disincentivises some of that usage in the early days.

Obviously, we're not in the early days in Europe anymore, so it's not as simple as saying this is a premium API and therefore we should charge for it. Determining what it's worth is also difficult. How much do you actually charge for an API?

Yes, and how much ownership do you hand over to someone else?

Developing ecosystems is highly complex; it's one of the most challenging tasks, especially when considering the future of banking in the UK. Discussions around the sustainable commercial model for Open Banking have persisted for years, highlighting ongoing difficulties. I believe our regulated markets we've got quite right yet.

Yes, I believe that's a right nuance because when I look back at the interviews from the past few months, banks explained the the changing mindset as the biggest success of PSD2, and the fact that, since they were developing APIs driven by legal requirements, it prompted new initiatives. While much of this development likely relies on bilateral agreements, it also touches on the premium aspect of API access. Introducing an SPAA somewhere in the process makes sense, especially as banks will soon need to comply with additional regulations.

Perhaps FiDA represents more of an opportunity than a threat to the scheme, and hopefully, it will endure because FiDA also involves some form of API usage remuneration. Though often not classified as a payments regulation because its scope extends far beyond that, it might be an ideal area to develop SPAA.

Yeah, and I want to touch on your first point before we get into FiDA. I think it's an interesting one. Some of the banks in Europe, and some of them have been quite vocal about this, used PSD2 to invest heavily in their API architecture. As we all know, I think there are some statistics that go around the market that say 80% of a bank's budget goes to compliance. They might have 20% for some nice, fun things, but that is shrinking. So they utilised the PSD2 mandate to invest in API-ready infrastructure.

Knowing, you know, quite honestly, they're not going to make money from you and me on Open Banking. We're not going to pay for these types of services. Businesses might, corporates might, merchants, but individual consumers probably less so.

You know, when you look at some of the banks in the Nordics, think of OP Bank in Finland, which has been quite vocal. They get 40,000 corporate API calls a day for their corporate API set. Those are not small numbers.

So yeah, they might get zero on the retail side, which is probably not zero, but it's probably low. But on the corporate side, where they can now leverage the API investments they've made under PSD2, they're obviously monetising that.

And elsewhere, like Deutsche Bank, it's one of my favourite use cases; they are a TPP for the major airlines in Europe from a payment initiation perspective.

There is money being made; it's just not in the way I think we had all imagined it would be, where we're all consuming these services and paying for them. But yeah, when it comes to FiDA, from my perspective, I know there are various voices in the industry that think very differently to me, which is fine. That's what makes it a healthy debate. We absolutely need something like FiDA, perhaps not in its current form, but the market needs a clear direction of travel towards Open Finance.

We are aware that screen scraping occurs on data beyond the scope of the PSD2 mandate. The primary goal of PSD2 was to eliminate screen scraping. Therefore, we must move towards a secure method of accessing other financial information. Honestly, payment transactional account data alone isn't highly valuable; you need the customer's wider financial overview. We should establish a clear roadmap toward genuine Open Finance.

I believe that, although I see the intention behind the commission's attempt to address some earlier mistakes—such as implementing schemes and standards related to the commercial side of things, which is great, it's still extremely disorganised in how it expects the industry to execute these ideas.

This disorganisation echoes the failure of PSD2, which lacked a proper coordination mechanism for industry collaboration in designing these schemes. While they mentioned schemes, it remains unclear how many there should be: possibly one scheme per industry vertical per country, leading to hundreds of schemes.

It's very unclear how they expect the industry to coordinate around that. Additionally, the data sets in scope are huge. The impact on the banks is extreme, and it's not just banks, obviously, but other financial services providers, including insurers, in scope. It’s a multi-regulator environment, with EIOPA, which does insurance and pensions, the FISMA for payments, and capital markets as well.

If it takes off, you'll surely know what to do in the Open Banking space. Maybe Paylume shouldn't be limited to pay by then.

Hahaha, yes, exactly. So I think FiDA, the intention is good. I think it needs to be scaled back a bit. I think it needs to be more focused on actual implementation. Like I say, in other parts of the industry, we have very clear guidance on how it expects the industry to deliver. And I think we need a clear roadmap associated with that.

One thing as well, which is often overlooked, is that regulators need to do much more in industry engagement. If we look at the digital euro, as I said at the beginning, it is probably the only one that comes under as much scrutiny. Obviously, lots of market participants hate it. But both the Commission and the ECB have done a lot of heavy lifting to bring the market along with them. And we've seen a lot of that kind of negative commentary around the digital euro diffuse slightly, not entirely, but slightly.

However, regarding Open Banking and Open Finance, there is no effort in processes, communication, or marketing to explain their significance and to engage the industry. I believe that addressing these areas would greatly increase FiDA's chances of success, as the current approach makes it very challenging.

We've been discussing data sharing for half an hour without mentioning AI, which seems almost rude. Do you believe AI has a role in Open Finance, or is it just a side element? It might be just consuming data without actively contributing to pulling it in.

Yeah, I mean, the next generation, although I'm not even sure if it's the true next, it's more like the current generation in some markets for Open Banking will combine both: Open Banking, finance, and AI.

Essentially, Open Banking is really just a secure way of accessing a standardised set of data. That's it. We talk about it as if it's this man thing, but it's really just a secure way of accessing a standardised set of data. You know, ultimately, you still need to do something with that data. You still need to take action, whether that's providing a loan facility or moving money to a savings account.

And AI is going to make that process much more automated and intuitive, especially when we think about real-time analysis. But I think this is already happening. The market has been evolving for some time. So if you take markets in Asia, for example, like Singapore, which is usually quite advanced, they're already combining Open Finance data, such as investments and mortgages, as well as payment accounts, with AI and behavioural analytics to provide some really fantastic in-app experiences.

When I told my colleague recently, I mentioned I've never desired a banking app before. You get one because you have to, usually quite dull and offering little beyond basic functions. They're generally similar and just part of having a bank account. However, some apps I've seen in Asia are so impressive that I genuinely wish I had them. They look fantastic.

It's predictive; it's not just looking back. And that's where AI plays its role.

Did it stimulate more competition there? Is it really about providing a better service to the customer?

It's both a customer acquisition tool and a point of differentiation. Initially, it helps stand out, but over time, when everyone adopts it, that advantage diminishes. However, it's also crucial for customer retention—providing greater value to existing customers. European banks tend to be a bit slower in this area.

There is a general wariness about it in Europe, although banks are indeed adopting these practices. In contrast, in Asia, there's a stronger focus on innovative data usage, combining AI with behavioural analytics to predict consumer behaviour, which offers greater value. Most personal financial management tools in Europe are quite basic: they only show recent spending or suggest simple actions like saving. They are quite old-fashioned and lack sophistication.

Indeed, it's all pretty old-school, isn't it? And it never really succeeded or took off. I don't know. I checked the graph once, and then the fun was over.

Yeah, exactly. Some Asian banking apps tend to be much more proactive. They might say, 'I see you've spent this much and on what, but have you considered this?' They can suggest moving money there to optimise your investments. Do you have a specific purchase you're saving for?

It feels much more intuitive regarding my personal needs. Over the years, we've discussed in the industry how services should be tailored to the customer, especially at critical moments. This is now happening. I believe AI has a role to play here, and I hope these two will work hand in glove.

Let’s bring it back to Europe: how big is the chance, according to you, that a big AI firm starts setting the standards for tomorrow's Open Banking development by partnering with a major bank and, in doing so, sets the path for smaller ones to follow?

There's always some risk involved. The industry tends to move slowly, but this isn't just about AI companies. In fact, some large fintech firms, especially in the US, are now bigger than smaller banks and are setting the pace for banking and Open Finance. It's not only AI companies driving change. Looking closer to home, in Europe, many fintechs, especially TPPs, have created their own standards for scenarios that aren't currently handled by existing API standards, like the Berlin Group.

So, you know, if we talk about where we are today with Open Banking, there is no refund API. So current APIs do not have a standardised refund, and only payment initiation is available. So if you're a merchant and you're like, yeah, I really like the look of this Open Banking thing, but obviously I need to know that I can make a refund to my customers.

The TPPs have already started, and they have proprietary solutions around that, and they're not necessarily interoperable. So if a merchant decides to unplug from one TPP and switch to another, it's not standardised. I think there's a lot of fragmentation in the standards space.

AI companies could potentially push ahead. I think that's a lower risk. I think some of the very large TPPs could be at greater risk of developing these proprietary solutions. I think the standards piece, for me, is one of the major things we're lacking as a global market, and we're now talking about interlinking Open Banking systems together, but there is no standardised framework for that.

Last question: we've already discussed many elements, but looking at Europe, what are you most excited about in the near future of Open Finance?

I am excited about the combination of Open Banking and AI, as we discussed, and about using that data to become more sophisticated. I think some AI models are now at a point where we can start to do that, because many of the products and services offered through Open Banking, particularly to me as a consumer, haven't been the most exciting.

Yes, we can facilitate faster, more affordable payments for merchants. While corporates can expand their capabilities, as an individual consumer, I haven't really seen the advantages of Open Banking. I find it somewhat dull because of the static nature of the data.

I'm looking forward to now, with some of these AI models becoming more sophisticated and the banks and the fintech community not just more open to using them but also more sophisticated in how they use them. We'll start to see the trickle-on effects we have hoped for, bringing us back to your first question 10 years ago, where we actually start to reap the rewards now because we can unlock that data in a much more meaningful way.

Laura, I will close the interview now. I want to thank you for what was likely the longest Open Banking Interview we've had in this series so far. I learned a lot, and I'm confident our listeners, viewers, and readers did too. Thank you again, and we'll definitely stay in touch. Hopefully, we can meet at one of our The Banking Scene events soon.

If you prefer to hear Lauren's insights directly, you can watch the full interview below or follow along on your favourite podcast platform here. Whichever you choose, don't forget to subscribe to the platform of your choice to keep up with future insights from industry experts!