The Brazilian Way of Open Banking Regulation

The Brazilian Way of Open Banking Regulation

Hakan Eroglu

Global Open Banking Lead, Advisors at Mastercard

Views 524

The Brazilian Way of Open Banking Regulation

18.12.2019 01:30 pm

Open Banking is unstoppable and is being discussed in almost every corner of the world – be it to increase competition, reduce cost, foster innovation or financial inclusion. In Open Banking, banks are opening up customer financial data and banking services to Third Party Providers (TPP) via Application Programming Interfaces (APIs). For sure not every country has an Open Banking strategy yet, but we have already seen regulatory-driven and market-driven initiatives. The regulatory-driven initiatives are those with the most impact to the banking and payments sector as banks are forced by the regulators to adopt. Europe started first with regulation – UK with CMA Open Banking (effective 13th January 2018) and European Union (EU) with PSD2 (“API and security part” of the regulation effective 14th September 2019).

Brazil paved the way to a new Open Banking ecosystem

I was traveling to Brazil in November 2019 to meet banks, PSPs and fintechs and to discuss the merits of Open Banking for Brazil. A lot has happened already: Banco Central do Brasil – the Central Bank of Brazil – has been discussing Open Banking since 2018 and came up with a plan to regulate Open Banking by mid-2020. Just recently, the Central Bank has published the draft regulation for public consultation on 28th November 2019 for duration of about 2 months – with the following timelines:

  • First half of 2019: Kick-off of Open Banking regulation process by Central Bank of Brazil (Announcement 33.445)
  • 28th November 2019: Publication of the draft regulation text for public consultation
  • 31st January 2020: Deadline for the industry to submit public consultation comments
  • End of second quarter of 2020: Publication of the final regulation after discussing market consultation inputs

The regulation is planned to be effective from the third quarter of 2020. It will include the roles, responsibilities and liabilities of licensed TPPs, PSPs and banks in a new Open Banking ecosystem. The regulation is a combination of PSD2, UK Open Banking and Hong Kong's HKMA approach: phased approach, target group, data scope, level of openness, market involvement, high level use cases and pricing. Most of the use cases will be free of charge for the participants.

Regulation plays an important role in the Open Banking journey…

The Brazilian regulation has a strong focus on payment and deposit accounts and functions – very close to the European approach. Banks are required – similar to the UK approach – to create a governance body that shapes Open Banking from a strategic, administrative and technical perspective. However there are some similarities to Hong Kong's HKMA Open Banking regulation which consists of 4 phases as well with some level of flexibility on timelines. A complete new approach in Brazil is the openness on both sides: a TPP has to open up for customer generated financial data if it uses regulated bank APIs. For the moment only the biggest institutions (around 10) are in scope of the data sharing (section I) and any account holding institution or payment initiation service for payment initiation (section II). Regulated entities that are not in scope can participate voluntarily.

The current draft of the Brazilian Open Banking regulation (under consultation) is split into 4 phases:

  • Phase 1 (product and services information) to be implemented 150 days and partially 360 days after publication: these include financial products characteristics (deposit, savings, loans, mortgages, credit cards, insurances etc.), pricing, contract terms and conditions, service station locator (branches, ATMs). These use cases can help to support comparison sites and increase competition
  • Phase 2 (customer information) to be implemented 240 days after publication: TPPs can request customer personal data such as name, national ID, address. These information could be used to develop KYC services
  • Phase 3 (account transaction information) to be implemented 240 days and partially 360 days after publication: TPPs can aggregate account balance and transaction data of accounts of the products and services in Phase 1 to create multiple use cases such as Personal Finance Managers, product recommendations, credit scoring etc. Transaction history of at least the last 12 months has to be provided.
  • Phase 4 (initiation of payments and submission of credit transaction) to be implemented 270 days after publication: TPPs can initiate payments on customer deposit and payment accounts. In the context of instant payments being implemented in 2020, payment initiation could become a game changer in the payments market. The submission of credit transaction allows to electronically request a credit proposal from a bank.

The first 2 phases can be seen as a test and learn phase for TPPs and banks to build API capabilities, infrastructure and hence a functioning API ecosystem. The real gamer changer will be Phase 3 and 4 which will trigger the most significant changes in the payments and banking industry for retail and SME banking.

…and opens the door for new business model to grow the pie 

Open Banking can be seen as a threat to existing business models for banks and PSPs. However the Brazilian market is perfect to build new business models that satisfy the needs of untapped segments. Compared to other markets globally, the Brazilian Open Banking case could be quite powerful, considering the following factors:

  • A large market with ~210m citizens with a single legal framework across the country – unlike EU with multiple regulators and deviating implementations of PSD2 in the 28 EU Member States –
  • Widely young tech- and innovation savvy population (~127m connected online users and ~23% of the entire population between 15 and 29)
  • More than 150m online accessible bank accounts for Open Banking, and 45m unbanked to be tackled with Open Banking enabled use cases (financial inclusion)
  • Free access to customer data, transactions and payment initiation services
  • Regulators ambition to push for instant payments for 2020 can unveil new payment flows combining Open Banking
  • TPPs have to open up as well if they are using bank APIs


Standards and infrastructure are key to success of a functioning Open Banking ecosystem

Experience in Europe has shown that a highly prescriptive approach such as UK Open Banking might not fully meet market needs and increase cost for the implementation in the ecosystem. On the other hand PSD2 left it widely open to the market to come up with standards and infrastructure. As there is no mandated implementation body in the EU, different sets of standards have been proposed by standards bodies representing coalitions of European banks.

In the next steps of forming the Brazilian Open Banking landscape, learnings from other markets can help to shape a functioning ecosystem. The regulation could define a clear framework with guidelines, and at the same time leave the actual definition and implementation open to the industry – these areas to be defined are:

  • Centralised licensing with issuing TPP licenses for access to all regulated bank APIs
  • API standards and customer journey guidelines to ease adoption for banks, TPPs and consumers
  • Build API standards considering Brazilian LGPD (Brazilian data protections regulation effective from 15th August 2020) and apply privacy by design and data minimization concepts
  • Instant payments should be integrated into the API standards to allow new payment flows in an open ecosystem
  • API performance KPIs decide about success or failure: standards for response times are important to ensure a better customer experience and new business models
  • A unified consent model to manage access consent between banks and TPPs
  • Common dispute management infrastructure is needed allow a standard and easy way of resolving unintended or fraudulent transactions and increase consumer trust

What’s next?

From a global perspective, financial institutions will need to think differently about the future in order to create a safe and fully functioning Open Banking ecosystem where user security and safety are paramount. Markets across the world are beginning to realise that data is king, and that they need to change their own financial models if they are to be competitive in the future.

Banks and TPPs should work closely together within the industry to come up with solutions that work for everyone. Open Banking is about to grow the pie – the market conditions are given. The time is ticking!


Latest blogs

Stephan Wolf the Global LEI Foundation

Digital ID Management: Why the World Needs the LEI

It is the only open, standardized and regulatory-endorsed system capable of establishing digitized trust between all legal entities, everywhere. There is a fundamental principle which often hinders development in the digital economy: trust. How Read more »

Dmytro Volkov CEX.IO

Security Basics: 5 Signs of Phishing

A recent WatchGuard Technologies survey showed that 86% of UK companies expect an increase in cyberattacks in the next 12 months. One big threat in particular is phishing attacks linked to COVID-19, which have recently been gaining Read more »

Keith McGill Equifax UK

COVID-19 Is Shining Spotlight on Fraud and Identity Threats

The current pandemic has forced rapid and wholesale changes to our lifestyles and opened the digital doorway for opportunistic fraudsters, escalating threat levels to new highs. This in turn has accelerated the pace of digital transformation for Read more »

Ian Johnson Marqeta

Why Fraud Doesn’t Have to Be a Fact of Online Life

We are going through very unusual times, with most of the country having lived under state-imposed lockdown in the last few months. Against this backdrop, fraudsters are unfortunately thriving, and we have seen numerous warnings and scams being Read more »

Mario Mantrisi Kneip

PRIIPS: EU stalemate

Last week, the troika of European Supervisory Authorities sent a letter to the European Commission.  The Packaged retail investment and insurance products (PRIIPS) regulation is a piece of EU legislation with troubled origins. Last Read more »

Related Blogs

Mobey Forum Mobey Forum

Open Banking: Are consumers keeping an open mind?

Last September, the European Union’s regulatory requirement for banks to open up their payment accounts via application programming interfaces (APIs) came into effect. Since then, open banking has taken centre stage within European retail banking Read more »

Hakan Eroglu Mastercard

The Ambitious Path to Open Finance and Open Data ... How Europe is Leading The Way

Thanks to PSD2 in the EU, and open banking in the UK, Europe has been leading the way with its open banking initiatives. This significant development represents the beginning of a journey to democratise the financial services industry by allowing Read more »

Steve Morgan Pegasystems

New Banking Tribes as a Result of Open Banking Have Arrived

Open Banking has fundamentally changed the game for all of us in the banking and financial services sector. With shifts involving customer data, naturally there have been concerns as organisations transform, from how they can get a sufficient return Read more »

Christian Ball GFT Group

Cloud And The Open Banking Opportunity

Although open banking has legislative origins - and is compulsory in some countries - it is also a major catalyst to bank transformation. In addition to the opportunity to generate new revenue streams, improve services and attract new customers, Read more »

Carlos Figueredo Open Vector

Open Banking - An Opportunity for UK Banks

The appearance of open banking created an immediate concern within the banks as they would now have to share customer data, competition from challenger banks, etc. Even though it is a well-known statement these days that “innovation will come with Read more »

Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel