# Facilitating open finance through secure services Author: Pal Sinha, Barnali Author URL: https://financedigest.com/author/pal-sinha-barnali Published: 2022-02-01 Category: FINANCE Category URL: https://financedigest.com/category/finance Meta Title: The Importance of Financial-Grade API Security in Open Banking Meta Description: Explore the importance of financial-grade API security for open banking in the evolving landscape of integrated financial services. Learn about the key URL: https://financedigest.com/facilitating-open-finance-through-secure-serviceshtml **![Travis Spencer, CEO, Curity ](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/travis-headshot-1736816272852-compressed.jpg)** **Travis Spencer, CEO, Curity** The open banking revolution is well underway, with financial services heading towards a more integrated future. One only needs to look at the introduction of PDS2 in Europe, UK Open Banking, the new efforts going on in Brazil, and the exponential growth of APIs to see that “platformification” is happening all around us. This is hugely exciting for businesses and consumers alike, paving the [way for the more seamless user experience that people](https://www.financedigest.com/5-common-ways-people-end-up-in-debt-without-realising.html "5 Common Ways People End Up In Debt Without Realising") have come to expect. Naturally, the prospect of moving [financial data](https://www.financedigest.com/the-financial-sector-must-act-to-tackle-internal-data-security.html "THE FINANCIAL SECTOR MUST ACT TO TACKLE INTERNAL DATA SECURITY") around is always something to do with care. The consequences of this information [falling into the wrong hands have the potential](https://www.financedigest.com/oil-dips-as-potential-fed-rate-hike-overshadows-falling-stocks.html "Oil dips as potential Fed rate hike overshadows falling stocks") to be disastrous for consumers, businesses and banks. That’s why financial-grade API [security is paramount when it comes to exchanging data and financial](https://www.financedigest.com/post-brexit-uk-workers-can-have-financial-security.html "Post Brexit – UK workers CAN have financial security") information between institutions and third parties such as fintech vendors and other partners. With security being so important, there are a raft of measures that [financial services](https://www.financedigest.com/as-hackers-declare-cyberwarfare-financial-services-cannot-afford-to-be-complacent.html "As hackers declare cyberwarfare, financial services cannot afford to be complacent") companies should adopt to set themselves up safely for success. **Intricacies of Authenticate** In a highly regulated system, it is important to have strong confidence in the users’ identity. This requires a [Strong Customer Authentication](https://www.financedigest.com/how-strong-customer-authentication-can-prevent-cart-abandonment.html "How Strong Customer Authentication can Prevent Cart Abandonment") (SCA) method, which usually translates to a high Level Of Assurance. This is achieved in part by using multi-factor authentication. Equally essential, users [must prove their identity as part](https://www.financedigest.com/engine-parts-makers-must-cross-valley-of-death-to-reach-ev-era.html "Engine parts makers must cross ‘valley of death’ to reach EV era") of the registration process and authentication process. To achieve this, the regulators require standards-based proven methods that ultimately result in a token (i.e., a ticket or memento) that is cryptographically bound to the bank and codifies the identity of the user, their authentication method, and the [bank’s assurance level that the user represented by that token](https://www.financedigest.com/token-inc-launches-london-office-to-answer-demand-from-european-banks.html "Token, Inc. Launches London Office to Answer Demand from European Banks") really is who they claim to be. **Confirm consent** Authentication is important, but, alone, it [isn’t enough](https://www.financedigest.com/the-challenge-of-keeping-data-secure-why-in-house-security-isnt-enough.html "The challenge of keeping data secure: why in-house security isn’t enough"). Open [Finance regulations are clear that users must](https://www.financedigest.com/why-the-finance-sector-must-prioritise-mobile-security-over-innovation.html "Why the finance sector must prioritise mobile security over innovation") consent to a business accessing certain data or performing an action such as creating a transaction. But it must also be possible for users to manage and even revoke their consent through an [easy-to-use user management service](https://curity.io/product/). [**Protect data**](https://www.financedigest.com/aon-introduces-new-cyber-solution-in-response-to-eu-regulation-on-data-protection.html "Aon introduces new cyber solution in response to EU regulation on data protection") Protecting users’ data can be a challenging task, but it’s a critical one. It takes a long time to build up trust – particularly when [finances are involved – and it can be slashed in seconds if users lose confidence in a business’s](https://www.financedigest.com/1-in-3-uk-businesses-looking-for-finance-are-finding-it-harder-to-get-a-loan.html "1 in 3 UK businesses looking for finance are finding it harder to get a loan") ability to look after their users. As well as costing customers time, money and frustration, this can ruin a business’s reputation. Consequently, the [safety of user data must](https://www.financedigest.com/occupational-health-and-safety-must-be-brought-back-to-the-forefront-of-esg.html "Occupational Health and Safety must be brought back to the forefront of ESG") be prioritised. A combination of different techniques, frameworks and processes can be introduced to mitigate the risk of fraud, leaking or manipulating [data and violating privacy](https://www.financedigest.com/tesla-to-warn-of-data-privacy-risk-from-car-security-cameras-in-germany.html "Tesla to warn of data privacy risk from car security cameras in Germany"). This is an opportunity to ensure standards are implemented across the board. Standards and directives such as PSD2 are designed to protect user data, as well as [securing bank services](https://www.financedigest.com/what-can-we-learn-from-financial-services-security.html "What can we Learn from Financial Services Security?"). Businesses [need to ensure they are investing in the right technology to adhere to these standards](https://www.financedigest.com/why-preparation-for-new-swift-cyber-security-standards-needs-to-start-now.html "‘Why preparation for new SWIFT cyber security standards needs to start now’"). By choosing solutions that automatically implement these specifications, businesses can [reap the benefits](https://www.financedigest.com/can-finance-reap-the-benefits-of-the-cloud-without-compromise.html "Can finance reap the benefits of the cloud without compromise?") of a secure customer database and improved customer relationships which they are exposing via APIs. In order to do this, [businesses must also invest](https://www.financedigest.com/analysis-uk-crisis-forces-off-kilter-businesses-to-halt-investment.html "Analysis-UK crisis forces ‘off kilter’ businesses to halt investment") in their teams. It’s not enough to simply put protocols in place. Design and execution requires a specific set of skills which, unfortunately, are high in [demand and low](https://www.financedigest.com/samsungs-quarterly-profit-plunges-to-8-year-low-on-demand-slump.html "Samsung’s quarterly profit plunges to 8-year low on demand slump") in supply. [Recent research](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/973802/Ipsos_MORI_Cyber_Skills_in_the_UK_2021_v1.pdf) commissioned by the Department for Culture, Media and Sport found that half of UK businesses (approx. 680,000) have a basic skills gap, lacking staff with the technical, incident response and governance skills needed to manage their [cyber security](https://www.financedigest.com/how-to-handle-cyber-security-during-mergers-and-acquisitions.html "How to Handle Cyber Security during Mergers and Acquisitions"). Meanwhile, a third (approx. 449,000) are missing more advanced skills, such as penetration testing, forensic analysis and security architecture. Despite being essential – even more so as services are increasingly digitalised, [cyber security](https://www.financedigest.com/the-future-of-cyber-security.html "THE FUTURE OF CYBER SECURITY") skills are often poorly understood and undervalued by both management boards and within IT teams. This can lead to a lack of investment in training, mishiring, and poor retention of staff in security roles. This only exacerbates the challenge of building a [team that possesses the requisite skills](https://www.financedigest.com/what-skills-and-areas-of-knowledge-should-finance-teams-develop-during-2023.html "What Skills and Areas of Knowledge Should Finance Teams Develop During 2023? "). Hiring can be hard when there’s a shortage of skills, so businesses need to be creative. This means  considering new recruitment avenues and, importantly, breaking free from the traditional model of what [cyber security](https://www.financedigest.com/5-ways-to-protect-your-company-from-cyber-security-threats.html "5 Ways to Protect Your Company From Cyber Security Threats") professionals look like. Curiosity is key, so, for more junior roles especially, attitude should be a key qualification. [Businesses should trust that many skills can be acquired on the job if the candidate has the essential](https://www.financedigest.com/5-essential-leadership-skills-for-family-owned-businesses.html "5 essential leadership skills for family-owned businesses") fundamental knowledge and drive. To aid in this, employers should [provide training](https://www.financedigest.com/mazars-to-acquire-financial-modelling-consultancy-and-training-provider-corality-financial-group.html "Mazars to acquire financial modelling consultancy and training provider, Corality Financial Group") and mentorship. We’re on the cusp of an exciting future for financial [services which will shake up the way that banks do business and consumers](https://www.financedigest.com/do-consumers-want-robo-advisory-services.html "DO CONSUMERS WANT ROBO-ADVISORY SERVICES?") manage their financial transactions. New [opportunities mean new processes and challenges](https://www.financedigest.com/how-finance-leaders-can-turn-the-inflation-challenge-into-opportunity.html "How finance leaders can turn the inflation challenge into opportunity"), however. This is particularly important when it comes to security. Previous measures simply won’t be enough. Not only will delivering on this future require financial-grade security and authentication protocols, it will also rely upon having the know-how to do so. Clearly, the skills gap in security [needs to be filled in order to make this happen](https://www.financedigest.com/what-needs-to-happen-to-improve-the-landscape-for-smes-trying-to-access-finance-options-in-the-uk.html "What needs to happen to improve the landscape for SMEs trying to access finance options in the UK"). So, ensure you’re investing in your team first, product second. --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---