This article first appeared in Digital Edge, The Edge Malaysia Weekly on August 8, 2022 - August 14, 2022

Now that digital banking licences have been issued and the hunt for talent is well underway, Malaysia could be ready for a more significant foray into open banking.

Defined as the use of open application programming interfaces (APIs) that enable third-party developers to build solutions based on customer data from financial institutions, open banking has witnessed the biggest advancements in Europe and the UK.

In Malaysia, however, industry observers tell Digital Edge that it could be several years before the necessary frameworks are in place to facilitate open banking.

“At this juncture, the policies, regulations and use cases that we have are still very limited. Proper infrastructure including well-defined data security, privacy and quality standards is needed,” says Clarence Chan, ​partner, digital trust and cybersecurity, at PwC Malaysia.

“We are not left behind, but we are in the very early stages,” says Bavani Meganathan, APAC solution consultant at Strands, a financial management services provider that is active in both personal and business financial management.

She expects, however, that, given regulatory support for digital banks, open banking will soon be embraced by the financial sector in Malaysia.

According to Meganathan, open banking is a subset of the open data movement, which strives to put control over personal information back in the hands of consumers. “Open data is not limited to financial data alone,” she says, citing the example of user data being capitalised on by social media giants to generate more targeted ads. Closer to home, Meganathan points to the check-ins required using the MySejahtera app during the Covid-19 outbreak as an example of the collection of personal data.

From the perspective of digital banks, she expects that they are much more likely to benefit from an open data environment in which they can access non-bank financial information. Given that these banks are mandated to cater for the unbanked or underbanked segments of society, which typically lack a credit history or financial profile, information obtained from utility bill payments, rental records, mobile bills and other payment records are used to build financial profiles of individual customers, Meganathan says.

By being able to access their customers’ payment history, she explains, digital banks can study what they can afford and what kind of paymasters they are, giving the banks an opportunity to approve more targeted loans and make informed decisions on extending credit lines.

“Digital banks and fintechs can educate, inform and encourage responsible financial behaviour by giving their customers clear insights, alerts and even offer actions based on their spending patterns, financial health forecasts, liquidity risk and more,” Meganathan says.

For example, Revolut, a digital bank with operations across Europe, North America and even Singapore, targets young international travellers and offers financial management options beyond traditional banking products, including affordable foreign exchange transfers, splitting bills across borders, subscription management and even travel booking services.

Similar to personal financial management needs, small and medium enterprises (SMEs) are also expected to be targeted by digital banks in Malaysia. Applications based on open API integration with third-party apps can also come in handy here, offering SMEs tools and solutions beyond traditional financial institutions, Meganathan says.

“It’s like giving them a ‘beyond banking’ experience, where digital banks allow them to manage their finances and also offer accounting, invoicing and cash management tools.”

PwC’s Chan notes that, in countries where more robust open banking frameworks are in place, digital banks and incumbent banks can tap into consumer data, run analytics and machine learning solutions, and innovate in a way that offers customers very dedicated and tailored products and services.

But the cynicism that Malaysians had towards their location data being collected via the MySejahtera app highlights how wary consumers can be when it comes to sharing personal information, says Meganathan. “Imagine how customers might feel about sharing their banking and transactional data,” she says. “From a consumer’s perspective, open banking requires a paradigm shift in understanding the benefits of having seamless access to data between applications that they’ve consented to.”

In the UK and Europe, the revised Payment Services Directive (PSD2) and the implementation of the General Data Protection Regulation (GDPR) in 2018 have been key catalysts for the growth of open banking there, giving consumers confidence that their personal data is protected, says Chan.

Closer to home, the Monetary Authority of Singapore launched the Singapore Financial Data Exchange (SGFinDex) in December 2020. It consolidates personal financial information of Singaporeans across relevant government agencies and seven participating banks. From the exchange, individuals can use their national digital identity, Singpass, to access personal information ranging from savings and current account data to details on their credit card and loan balances.

“The whole idea of open banking is that, as a customer, I should have full control over the customer data that I have provided to the financial institutions and choose how I want it to be used, including how it benefits me as a consumer,” Chan says.

While the GDPR bears similarities to Malaysia’s Personal Data Protection Act (PDPA), the latter protects personal information only in respect of commercial transactions, according to an article by Selvamalar Algaratnam, a partner at legal firm Skrine.

Unlike the GDPR, which requires data to be shared with the customer in a commonly used and machine-readable format, “Section 30 of the PDPA only provides for the right to request from the data user a copy of the personal data in an intelligible form,” Algaratnam wrote. “The PDPA also does not provide a right for data subjects to have their personal data transmitted directly from one data user to another.”

Another law that governs financial data in Malaysia is the Financial Services Act 2013, which restricts financial institutions from sharing customer data with any third party without permission from the customers, Chan notes.

The current framework for data protection in Malaysia means that fintechs such as Finory, a credit card management app, requires its customers to individually upload their own credit card statements and other financial documents to the platform every month, says co-founder Kee Hui Jiang.

“If there were open banking, using an API, we could connect directly with the bank and get live data,” Kee says, instead of the current method of extracting information from documents sent in by customers.

For both traditional and digital banks, the most useful API in Finory’s perspective is one that would enable more seamless information gathering on account information. “We want our users to be able to see all their transactions [across multiple banks],” Kee says, adding that it would also be useful for Finory to be connected with digital banks. “It’s not too useful to link to just one bank.”

In 2019, Bank Negara Malaysia issued a policy framework that encouraged financial institutions to offer APIs on a voluntary basis. Those that have begun implementing open APIs, however, have offered only static information via these APIs, Kee says, citing examples such as product features and the application processes.

Kee admits there is little incentive for banks to share their data openly with third parties unless directed to do so by regulators, a view that both PwC’s Chan and Strands’ Meganathan share.

Chan noted that a key part of open banking is that “the data is aggregated from multiple institutions, which therefore calls for a need to implement a robust data management framework to ensure the quality and consistency of the data shared and exchanged”. He explains that a complete and consistent profile of an individual’s banking behaviours and habits can only be built using multiple sources of information.

Instead of worrying about losing their competitive edge, Meganathan says, banks should have a different perspective towards open banking and consider instead what they stand to gain from accessing more complete financial information about their customers.

“As much as [the banks] share out in terms of data, they are also able to consume. With that, they would be able to create better value for their customers via new business models, new strategies and more competitive services and offerings,” she says.

At the end of the day, says Chan, the biggest challenge for digital banks is how they can remain profitable while being subject to regulatory scrutiny as they grow into “real banks”.

“While innovation is at the core of their business, they are bound to have some external restrictions, such as how to deal with personal data or customer data,” he says.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's AppStore and Androids' Google Play.