Two years of PSD2 open banking looking back and thoughts for the year ahead.
Although PSD2 was transposed into law in January 2018, the European Banking Authority’s (EBA’s) RTS came into force on 14 September 2019. The RTS required Financial Institutions to comply with strong customer authentication and secure communications.
As we near the end of 2021, we’ve looked back at the European trends and progress in open banking from September 2019 to September 2021 and discuss what we’re likely to see as we move into 2022.
- The total number of TPPs has more than doubled over the period, rising from 237 to 518. Of the 20 countries with licensed TPPs in 2019, only 7 didn’t double their count.*
- 312 new TPPs were authorised to provide open banking services, but with 31 TPPs having their regulatory status withdrawn, the net increase over the two years was 281.
- The average number of TPPs operating in a country has doubled, rising from 47 to 95.
Macro Trends and Predictions
Open banking is undoubtedly accelerating. As API volumes increase and the number of users rises, we are likely to see more innovative use cases being launched into the market.
- In Q3 2019, there were 237 TPPs operating in Europe. By the end of Q3 2020, there had been an increase of 173 TPPs, and Q3 2021 saw a further increase of 108 TPPs.
- In December 2019, we estimate that there were 570 million API calls a month. By December 2021, we expect this to be over 2 billion.
- Customers are driving demand for open banking and leading to the prominence of use cases such as BNPL and variable recurring payments.
- Competing API models in Europe and different standards have led to inevitable delays. However, regulatory change and customer demand are laying the foundations for open finance.
“Banks are beginning to realise open banking is not just a compliance issue, but a business model shift, and are embracing the opportunity.”
PSD2 Compliance
- Established ASPSPs have led the way in open banking. Konsentus data suggests around two-thirds of banks are PSD2 open banking compliant, but some smaller financial institutions are still to implement open banking APIs.
- Over 2022, we expect regulators to begin enforcement actions which should lead to full PSD2 compliance within the next two years.
- Following on from the FCA’s change to the 90-day reauthentication rule, the expectation is that the EBA will continue to make amendments to the RTS and other regulations.
“The COVID-19 pandemic has accelerated the adoption of electronic payments and digital subscriptions, but from a regulatory standpoint it has delayed open banking, as regulators prioritised financial stability over PSD2 compliance.”
Open Finance and Open Data
Open Banking is just the start of the ‘open’ journey. The European Retail Strategy will review PSD2 regulation and is expected to have drawn up a legislative proposal for a new open finance framework by mid-2022 and open finance legislation being implemented by mid-2023.
But where are we today? Research conducted by Open Banking Europe (OBE) estimates that there are currently around 1,200 banks operating in the capacity of TPPs. With the new commercial opportunities and breadth of use cases in the market, it will not be long before many more banks follow suit and start acting in the capacity of TPPs.
However, the speed of implementation may not be the same across all financial sectors. Many pension and insurance providers still rely on legacy IT systems and printed correspondence. So, there may be delays with these companies implementing open APIs for their customers.
“It is important that the move into open finance is handled with care. Konsentus has a role in protecting all parties.”
What is clear however is that financial products and services of the future will be shaped by consumer demand and will eventually be delivered by mainstream brands rather than by banks. Also, when it comes to regulation, companies holding large amounts of data are likely to be regulated in the same way as financial institutions.
The Rise in Passporting
Passporting is the movement of services under EU legislation enabling TPPs to operate outside their home state. Any TPPs wishing to passport products or services into another country must be authorised by their home state to do so. The approved passporting status for each of these countries must then be recorded in the TPP’s Home NCA register, though in practice this does not happen across all EEA NCAs.
The rise in passporting over the past two years has been recorded in the Konsentus TPP open banking tracker. All EEA countries now have active TPPs which are regulated by another country’s NCA.
Since September 2019 the following trends have been observed:
- The average number of TPPs passporting into a country has increased from 39 to 79.
- In the EEA, the minimum number of TPPs passporting into a country has increased from 30 to 54.
- Although there was a drop in passported TPPs after Brexit, numbers have been steadily rising again and should surpass pre-Brexit levels by June 2022.
Market Differences
PSD2 open banking legislation affects all 30 countries of the EEA, but there are marked differences in each country’s speed of adoption:
- In 2019, no countries in the EEA had over 100 TPPs. Now, there are 9: Belgium, Finland, France, Germany, Italy, Netherlands, Poland, Spain, and Sweden.
- The Nordic and Baltic countries have far more home regulated TPPs than those around the Mediterranean. For instance, Spain, Italy and Portugal combined have fewer TPPs (22) than Lithuania alone (26), a country with only 2 million people.
- In Portugal and Spain, competing highly established alternative payment methods are in place so TPPs providing payment initiation services have struggled to enter the market.
- In the Nordics, up-to-date infrastructure and technology have facilitated a quicker uptake of open banking services.
- In 2019, Germany had the highest number of authorised TPPs in the EEA (33) and although it still has the most TPPs (37), growth over the past two years has been slow.
- Although there are still a handful of countries with no Home regulated TPPs, TPPs from more mature markets are expanding into other countries through passporting rules. For instance, Portugal has no domestic TPPs, but there are still 89 TPPs who can provide open banking products and services.
Types of Services and Institutions
There has been very little movement over the last two years in the types of services being provided.
Most TPPs provide both AIS and PIS services and payment initiation still only accounts for 5.8% share. However, Konsentus research suggests that this is set to change: payment initiation services will dramatically rise over the next two years precipitating a rise in open banking calls.
Maturity of the Market: EEA and UK
The EEA is now into its third year of open banking, but thanks to the CMA order, the UK had a head start and, as such, serves as an important blueprint for future EEA growth.
- In November 2019, there were 269 million API calls in the UK. By the end of 2021, this number had surpassed 1 billion.**
- In the last two years, total TPPs in the EEA increased from 118 to 302 (156% increase). In the UK, TPPs increased from 119 to 216 (82% increase). UK growth has slowed whereas the EEA has increased its overall TPP market share.
- As the European market develops, there is likely to be a consolidation of TPPs. Licences will expire, TPPs will become unauthorised, and competition will inevitably lead to some business models failing.
Opportunities, Risks and Future Trends
Although it has taken time, the foundations of open banking have been set, and the market will continue to grow exponentially. The three big trends to look out for over the next two years are:
- Consolidation of the market and the withdrawal of more TPPs, alongside a wave of new TPPs being approved to provide services;
- Increase in complexity as we transition to open finance;
- More innovative use cases stemming from increased consumer demand.
With constant change, increased volumes and growing end user adoption, there will inevitably be instances of data misuse and disputes. According to Forrester’s European Predictions 2021, fraud is expected to reach an all-time high. Security and trust therefore must remain a core priority for banks.
3 in 5 customers are concerned about open banking; all these are privacy and security related. – Global Open Banking Survey, Mambu
“At Konsentus, we will continue securing the open banking ecosystem and its transition to open finance, ensuring that consumers, banks and fintechs can interact safely and instantly.”
Appendix
*This paper focuses on ‘pure-play’ TPPs: fintech companies which have emerged in the open banking ecosystem. This number does not include the multitude of banks acting in the capacity of TPPs. All numbers are taken from September 2019 to September 2021 unless otherwise specified.
**The API transaction figures are estimated from UK data and anecdotal evidence.
