Data security: The paramount aspect of open banking
By Sumana Iyengar, CEO & Co-founder, Goavega Software India
Open banking, a practice that provides third-party financial service providers an open access to consumer banking, transaction, and other financial data from banks and NBFCs through the use of application programming interfaces (APIs), has been rapidly catching up and is said to be the future of financial technology.
While this has several benefits, the innovation is also a high-risk practice as it involves sharing of and trading vast amounts of data. And while financial technology, over the past few years, seen tremendous growth in India, the Covid pandemic has facilitated a huge surge.
Online transactions worth INR 4.3 lakh crore were reportedly carried out on UPI in January, 2021 vs. INR 2.1 lakh crore in the January, 2020 that has highlighted the urgent need for building a robust open banking system with set data security protocols.
Policy interventions:
As per a recent report, The Reserve Bank of India has announced a new set of guidelines for the digital banking and payments ecosystem, which requires regulated entities (REs), scheduled commercial banks, small finance banks, payments banks and credit card issuing NBFCs to conduct periodic assessment of apps and associated third party services. From conducting source code checks, vulnerability testing, and penetration testing every six months for payment systems, RE’s will also be required to conduct rigorous third party periodic testing, and also be subject to penal provisions in case of no compliance.
Key Data Security processes that needs to be adopted urgently by Banks and other NBFCs:
- API Security and access management: Considering the omnipresence of Application Programming Interface (API’s) and vital role in ensuring app based secure transactions, access control, and overall API security is a non-negotiable factor for open banking. Effective API security looks at Data security and content filtrations, through procedures that like API gateway, encryptions and signatures, and using quotas. For ensuring a successful and effective API and Access Management security, it is vital to focus on the type of API, its key functions and interactions on the web and timely assessments to track and fix any vulnerabilities.
- Stringent KYC and encryption infrastructure: One of main features of open banking is its transparency. Offering customers greater control of their data, allows them a deeper understanding of how it is being used. However, this is also a major security concern as transparency can give rise to data piracy and theft. Encryption technology is important here in making sure that the sensitive information is end-to-end encrypted. Regular KYC on behalf of the banks, helps them to keep track of updated data and ensure it is well encrypted and managed.
- AI enabled authentication protocols: Securing data and encrypting vital KYC information is just the first step to ensuring data security. Effective authentication is a vital step. AI, coupled with other emerging technologies like ML, has been used in data security for a few years now and the same holds true when it comes to API and banking data security. AI enabled processes can help effective and timely KYC, and faster and effective authentication, making the process faster and effective.
- AI and ML empowered cyber security processes: The baking sector has been one of the widely targeted sectors for cyber crimes and open banking can come with its own set of vulnerabilities. Through leveraging AI and ML powered cyber security procedures, with combined intelligence and information sharing across companies, can help make open banking a safe and efficient platform for financial transactions. Better access to more data means better intuitions, which implies that banks can more effectively combat against hostile parties, rather than sitting passively and waiting to be the target of cyber-attacks.
