The New Digital Pact Between Clients and Banks

THE PSD2 ELECTRONIC PAYMENTS DIRECTIVE REVOLUTIONIZES THE BANKING INDUSTRY AND MAKES ACCOUNT HOLDERS FULLY AUTONOMOUS IN THEIR CHOICE OF PAYMENT PROVIDERS, WITH FINANCIAL DATA SECURITY ESTABLISHED AS A COMPETITIVE ASSET IN THE NEW MARKET SCENARIO

by Anna Omarini, Dept. of Finance, Bocconi
Translated by Alex Foti

 
To promote the use of electronic payment tools and promote the development of a more efficient and innovative market, as well as to increase security and enhance user protection, the PSD2 Payment Services Directive has been issued by the European Commission. Italy implemented it in its legislation at the end of 2016 and it will become applicable in January 2018. The Directive is part of the effort to harmonize the regulatory framework for payments.
 
Particularly important is the fact that with the EU Directive's coming into force, private and business customers of banks will have full freedom to choose the tools with which manage their finances, a scenario that may include payments via Facebook, Google, and so on, while still keeping their money on banking accounts. Banks and financial institutions will have to provide access to their clients' accounts through open Application Programming Interfaces (APIs), thereby enabling third parties to exploit banks' data and infrastructure to provide financial services. In fact, the legislature has sought to increase competition within the industry by introducing two new categories of operators, namely the Account Information Service Provider (AISP) and the Payment Initiation Service Provider (PISP), requiring existing financial operators to make available to these some of the transactions carried out by their customers, even in the absence of a contract between the parties. AISPs and PISPs, mostly belonging to the fintech sector, could represent an alternative to payment systems and account access services currently used by bank customers, creating  forces for the disintermediation of the industry.
 
So the control over financial data and funds passes into the hands of clients, who can decide if and when give third parties access to their current accounts, according to the new open banking model (we are talking about one billion banking accounts in the EU). In fact, customers will have to decide in absolute autonomy the innovative and user-friendly platforms via which they will manage their funds and make payments. The parties indicated are subject to the financial reserve requirements necessary for the provision of payment services. The Bank of Italy has identified the competent authority to regulate the provision of these services, including the granting of authorization, the startup phase of the business, oversight and control over the relevant lenders. Consequently, as stipulated by EU norms, third-party providers will be payment companies which have been appropriately authorized by the central bank and whose activities are specifically monitored.
 
It won't be just banks playing this competitive game, since market opportunities are open to anyone offering financial services. The new rules contained in the Directive will have a disruptive effect on the entire financial system, as they represent a challenge and an opportunity to develop financial products and services that can offset (and possibly overcome) the loss in revenues due to the decrease in payment fees. The new piece of legislation also requires banks to harmonize banking fees across EU countries. For banks, PSD2 also poses challenges of an economic nature; IT costs are likely to increase due to the heightened need for data security in the opening to APIs. With PSD2, banks will be called upon to offer new value in their traditional payment function, if they want to maintain their centrality in the sector, as well as in adjacent ones (credit and asset management).

Therefore, even if the requirements for opening accounts to third parties seem to be about technological implementation and data protection, the real challenge for banking institutions lies in their business model. At stake is the very future of the banking industry as we know it. As a matter of fact, new market players (coming from fintech and bigtech) are causing a  a radical change of the payments' value chain, engendering new business models, changes in customer expectations, and introducing the phenomenon of open banking, which represents a major challenge for traditional credit institutions. In this context, cybersecurity will be a matter of paramount importance.