vaults are the data a bank has stored on its servers

MORE treasured than the bullion in its vaults are the data a bank has stored on its servers. Bankers know what their customers eat, where they shop and, increasingly, what they get up to online. It is possible for customers to share these data with others, but the process is cumbersome. In effect, banks enjoy a monopoly over data that has helped them get away with lousy service and fend off newcomers with better ideas. In Europe, at least, that is all about to change.

The source of this upheaval is a new set of regulations, snappily named the Second Payment Service Directive, or “PSD2”. The rules, which are being finalised and will be in force from January next year, will compel banks to share data easily with licensed third parties (if that is what their account-holders want). Bankers in Europe squeal that their profits and customer relationships are under threat. Fearing they could be next, America’s bankers are already lobbying their regulators to keep their data monopoly intact. Such reactions are predictable and wrong.  

Because that’s where the data are

Opening up banks, and the data they hoard, is good for consumers and competition. New providers will be better placed to offer all sorts of innovative services. Apps might ping users when they are spending too much on booze or shoes, or offer them a one-click option to put unspent monthly income into a pension plan. Analytical tools might swiftly aggregate a person’s financial data in one place, or combine banking data with other information to offer individuals the best mortgage or loan. The new rules, which also compel banks to share payment infrastructure with licensed third parties, should make online shopping simpler and cheaper, too.  Some concerns about PSD2 are legitimate. In particular, it is reasonable to wonder about the privacy and security implications of sensitive financial data being shared with third parties. But banks themselves are hardly invulnerable to cyber attack. And the way that European regulators propose to deal with these worries looks promising.  Third parties that want to use bank data will need to convince national regulators that their data defenses are solid and must submit to annual inspections. Newbies must also take out fraud insurance; their insurers will have a clear reason to demand state-of-the-art cyber-security. Many online payments will become more secure than they are today, because of the directive’s requirements for the use of a robust authentication process involving two-step verification. The gap between writing rules and implementing them is always large, so a few things are needed to make PSD2 a success. First, consent from customers to provide access to their bank data must be gained explicitly, not buried in pages of gobbledygook. The purposes for which data might be used should be clearly explained, and individuals’ consent to share their personal information should be easily revocable.  Second, regulators must be ruthless both in ensuring that banks open up their infrastructure to others and in withdraw-in the licenses of third parties that break the rules, particularly on cyber-security. Third, they must also be flexible enough to allow for change as the market evolves. Since the new entrants will not be licensed to engage in riskier forms of finance—such as lending money—it makes sense to regulate them with a lighter touch. But if some fintech providers do end up becoming systemically important (by, for instance, controlling a dominant digital wallet), higher standards of oversight might be necessary. More important now, however, is that regulators hold their nerve in response to bank lobbying. Opening up bank data gives fintech firms the opportunity to build new businesses and incumbent banks the incentive to improve their services. In both cases, the winner will be the consumer.