Security and compliance among concerns of banks in granting API access to fintechs

[SINGAPORE] Security and compliance concerns are top of the list when Singapore’s brick-and-mortar banks decide whether to grant fintechs Application Programming Interface (API) access to the financial data, particularly that of the banks’ small and medium-sized enterprises’ (SME) clients.

DBS, OCBC and UOB told The Business Times that they provide API access to only certain fintech platforms. BT understands that a critical mass of customers is needed before API access is considered, and that some banks provide this access for free to some platforms by bearing the costs of maintaining the API.

APIs are sets of protocols that allow for different software programs to talk and exchange data.

Fintechs, such as those seeking to give loans to SMEs, which have been barred from accessing the banks’ client data have resorted to manually processing spreadsheets and pdf documents from their SME customers. The process would be much smoother if these fintechs are able to just pull the data from their customers’ banks.

Think tank Fintech Nation on Jul 7 released a report highlighting this lack of API access to fintechs, which could hamper the growth of financial services for SMEs.

OCBC has set up API connections for fintech platforms with a more than 30 per cent share of total API calls, said Adriano Ortega, head of implementation and client services, global transaction banking at OCBC.

“When evaluating potential API connectivity with other parties, several key considerations come into play. These include the strength of the other party’s cybersecurity risk-management capabilities and the commercial viability of the business-use case,” he said.

Connecting via API has to provide meaningful benefits to OCBC’s business customers, while still maintaining security and reliability.

For DBS, data privacy is a key concern in whether the bank would open up API access to a platform. This is to ensure that information accessed is used responsibly.

“DBS has guardrails in place to ensure that only platforms with robust data privacy infrastructure can access our customers’ data. We provide access to our customers’ data via API integrations to platforms which meet these standards, and have done so for several years,” said a DBS spokesperson.

UOB offers API access for customers to support specific business operations. The bank did not elaborate which operations these were.

“Our active push for client digitalisation is in line with the nation-wide acceleration for enhanced digital connectivity. We also work together with the government and the industry to spearhead initiatives that advance the payment landscape,” said a UOB spokesperson.

The Monetary Authority of Singapore (MAS) views credit – including that given to SMEs – as a key function of the financial sector. The regulator says it regularly reviews the potential to enhance both banks’ and non-traditional lenders’ ability to underwrite loans; it does so by tapping various available data sources while maintaining financial stability.

MAS says that it is engaging banks, alternative lenders and SMEs as part of the review, and will welcome solutions from the industry.

“To deliver meaningful outcomes for SMEs, the proposed solutions must be commercially viable and sustainable, while carefully balancing costs and benefits for all parties involved,” said a MAS spokesperson.