FOREX Magazine

“Banks view the way credentials are shared
in the marketplace as high risk,” Fakhraie
said. “It’s not only that customers are sharing
credentials and they’re out there, but also
the friction and the unreliability of the screen
scraping practice. And customers don’t get
to choose which accounts they want to
share.”
Under the Financial Services Information
Sharing and Analysis Center’s Durable Data
API standard, which the Financial Data
Exchange espouses, consumers are in
control, Fakhraie said.
For example, when a consumer wants to start
using a new fintech app and link a bank or
brokerage account to it, they are passed to
a secure server at the financial institution,
where they are presented with the financial
institution’s consent page and they authorize
the data they want to share with the new
app.
After authenticating, the consumer is passed
back to the app. Data sharing between data
aggregators or fintechs and financial
institutions is done through a virtual token that
identifies the consumer and their accounts.
The standard gives the customer visibility and
control, Fakhraie said.
“They can come to mobile or online banking,
view what data is being shared, and turn that
off and on at any time they choose,” she
said.
But the Durable Data API standard doesn't
directly resolve all such disagreements.
In one recent dispute, a bank claimed a
data aggregator would not agree to delete
data even after a person had stopped being
a customer or using a service. In this case, the
data aggregator also wanted to be able to
obtain routing numbers and move money in
and out of bank accounts which the bank
didn't want to allow.
The Durable Data API standard doesn't
resolve these issues.
“But we think it will solidify and pave the way
for how data is shared,” Fakhraie said. The
FDX is also thinking of creating a governance
framework for the privacy and security of
data sharing, she said.
Another complaint data aggregator have at
times made is that banks make them sign
onerous bilateral agreements that put too
much liability on the aggregator, not enough
on the bank.
“Those are issues that will continue to be in
the forefront of the minds of organizations
tasked with maintaining the security of
consumers’ data,” he said.
Finicity has signed a number of bilateral
agreements with banks including Wells Fargo
and USAA, Smith noted.
“We have always as an organization
suggested the bank is a custodian of their
customers’ data, and needs to maintain the
security of that data and needs to be
concerned about that data,” he said.
Some data-sharing disputes may be settled
by simply having all parties hash them out in
FDX meetings. The group has been holding
monthly board meetings and it meets in
person quarterly.
A data aggregator working group has also
been meeting regularly.
“I think this will be a great forum for the
interchange of ideas, discussion and
progressive development of standards for
the industry,” Smith said.
“We’ve been in this space for about four
years, and this has been refreshing to be able
to have that conversation, not only with
other financial institutions but also with
aggregators and other players within the
ecosystem,” Fakhraie said. “We all share a
common goal, which is sharing data in a
more secure, reliable way where a customer
has control over it.
43