Open Banking: JROC recommendations on next phase aim to keep UK ahead of the pack

'Britain leads the pack in open banking, with 7 million users, but we can’t sit back and put our feet up. Today’s plan will deliver a new generation of products and services, making banking more accessible and convenient for millions of people.'

Andrew Griffith MP, City Minister

Three priorities for achieving vision of expanded Open Banking offering

In the JROC’s view, for Open Banking to successfully move to this new phase the ecosystem needs to become economically sustainable. This means creating an ecosystem that, through industry action and strong regulatory direction, builds commercial arrangements that are fair and proportionate for new products and services with a broad-based and equitably funded Open Banking entity. The existing baseline of regulatory-led free access has been and remains pivotal to democratising access to data as well as to supporting innovation and competition. However, a new phase is needed to allow the ecosystem to scale.

With this in mind, the JROC has identified three priorities to deliver a new phase for Open Banking:

• Ecosystem: to establish a sustainable and competitive footing for the ongoing development of the Open Banking ecosystem so that it can grow beyond the current functionalities and bring further benefits to end users, for example by encouraging and facilitating new commercial agreements to emerge between participants, in which data holders can charge for access to premium APIs;
• Payments: to unlock the potential for Open Banking payments, for example in supporting retail transactions as an alternative to card payments. Here, the expansion of variable recurring payments (VRPs) to non-sweeping use cases will be used as a pilot for future multilateral agreements containing clear pricing and dispute resolution principles (see further ‘Ambitious two-year roadmap covering five key themes’ below); and
• Data sharing: to adopt a model that is scalable for future data sharing propositions, which includes both the secure collection and sharing of data. The JROC is also considering ways to promote use cases and propositions that would create the most value to end users and businesses, particularly those with vulnerable characteristics. It is also looking at possible solutions to enhance visibility on data access and sharing as well as increasing cases where data access and sharing is complemented by payment transactions as part of a broader offering.

The process of achieving the vision will take time and will require joint efforts from regulators, account servicing payment service providers (ASPSPs), third party providers (TPPs), the current Open Banking Implementation Entity (OBIE), the subsequent future entity, consumers, businesses, and other stakeholders.

Ambitious two-year roadmap covering five key themes

The JROC’s vision and the three priorities will be delivered through a roadmap of 29 actions, to be completed in step changes over the next two years. This will lay the foundations for the vision to be fully delivered when the government establishes the long-term regulatory framework for Open Banking.

In addition to the immediate priority of establishing an economically sustainable future entity with effective governance (see ‘Designing and transitioning to the Open Banking future entity’ below) – and to allow Open Banking to continue to develop ahead of the long-term regulatory framework being implemented – the roadmap contains actions relating to five themes that will be progressed in the next two years:

1. Levelling up availability and performance;
2. Mitigating the risks of financial crime;
3. Ensuring effective consumer protection if something goes wrong;
4. Improving information flows to TPPs and end users; and
5. Promoting additional services, using non-sweeping VRPs as a pilot.

The themes build on the Strategic Working Group (SWG) final report (February 2023), the Trustee End of Implementation Roadmap report (January 2023) and stakeholder feedback. The actions include a number of potential consultations, e.g. on mandating data sharing, the use of financial crime prevention tools (including data sharing) and/or additional tools or requirements for high value payments. Some of the actions will be led by ecosystem participants, including the OBIE, while others (such as the above potential consultation) will be led by the FCA and the PSR.

The roadmap sets out a three-phased delivery approach:

• In 2023: The JROC will collectively improve visibility and understanding around the level of financial crime across the Open Banking ecosystem and the availability and performance of APIs across different ASPSPs. It will also improve the functioning of the ecosystem – for instance, by ensuring consistent error messaging – and enable the JROC to better understand consumers’ concerns and possible future developments through consumer research.
• In 2024: The JROC aims to lay the groundwork for the end state by improving data sharing to prevent fraud and financial crime, supporting the development of commercial and liability frameworks and improvements in information flows to TPPs on API calls and payment messages.
• In 2025: The JROC anticipates a sustainable commercial model will have been developed and piloted and new innovative business models will have been tested. Some of these actions may require the long-term regulatory framework and/or other regulatory intervention.

Designing and transitioning to the Open Banking future entity

The JROC’s report and roadmap also set out its vision for the Open Banking future entity, including the next steps which need to be taken in designing it. There will be a transition from the Open Banking Implementation Entity (OBIE) to the future entity which will build on the significant progress made to date.

As highlighted by the JROC in its statements in March and December 2022, subject to the CMA’s consent, it expects Open Banking to transition from the current model, in which the OBIE is overseen by the CMA for obligations under the CMA’s Retail Banking Market Investigation Order 2017 (CMA Order), to an interim state, in which a future entity will be overseen by the JROC (in respect of non-Order activity) and by the CMA (in respect of the Order activity) prior to the establishment of a long-term regulatory framework for Open Banking. The interim state began in January 2023 when the CMA deemed the current Order implementation roadmap to be substantially complete and JROC expects the transition to the future entity to start later in 2023. The interim state will end when the long-term regulatory framework is in place.

The further work that the JROC will undertake with Open Banking participants and other stakeholders to develop detailed design proposals for the future entity will be guided by a number of principles which are listed in full in the report. In summary, the future entity will:

• adhere to high standards of corporate governance;
• have a wide membership base, extended to cover all ASPSPs, and underpinned by broad-based, proportionate funding and liability arrangements; and
• ensure the needs of end users (i.e., consumers and businesses) are represented in its decision making.

The JROC will work with Open Banking participants over the next few months to undertake further analysis of the optimal structure, governance and funding of the future entity and the OBIE’s transition to it.

As successful completion of the transition to the future entity will take time, the JROC doesn’t plan to wait until the future entity is in place before unlocking Open Banking’s further potential. It expects the OBIE to undertake some of the non-Order activities outlined in the report (e.g. improving data collection for financial crime and API availability), alongside Order activities, until the new entity is in place. As set out in more detail above, the report’s phased roadmap outlines the actions that the JROC would like to see delivered ahead of the long-term regulatory framework being in place.

Its two immediate priorities are:

• Working with the OBIE to establish alternative arrangements for non-Order activities; and
• Finalising the design of, and beginning the transition to, the future entity, including its appropriate corporate structure.

The JROC will work with the CMA and the Trustee to design and establish alternative arrangements for non-Order activities within the OBIE as soon as possible in Q2 2023. Among other things, the JROC states that this will ensure the effective representation of end user interests. The JROC expects ASPSPs subject to the CMA Order to provide the funding necessary to ensure the OBIE continues its key role, including for certain non-Order activities.

It will also work with Open Banking participants over the next few months to undertake further analysis of the options for the structure, governance and funding of the future entity. The report contains an overview of the options currently under consideration and the further work that’s necessary to enable the JROC, with input from industry and other stakeholders, to finalise its detailed view on the design of the future entity and the OBIE’s transition to it (see Figure 5 at paragraph 3.20). It expects this analysis to be completed by Q3 2023.

Principles for a long-term regulatory framework

In addition, the report outlines the principles that will underpin a long-term regulatory framework, which the Government is intending to legislate for:

• FCA and PSR as regulators: In HMT’s view, the FCA should regulate firms in relation to the provision of Open Banking services, including payment initiation and data sharing requirements. The PSR should regulate the Open Banking services that relate to a payment system and participants in that payment system including, where appropriate, powers over the future entity in respect of its role in a payment system.
• Smart data scheme for Open Banking: The government intends to create a smart data scheme for Open Banking under the relevant powers in the Data Protection and Digital Identity (DPDI) Bill, introduced to Parliament on 8 March 2023 (see this Engage article for more on the Bill). The FCA would be empowered to oversee data sharing (read and write) requirements applying to firms who hold or receive data or offer services within the scope of the smart data scheme.

In addition, the government intends that the regulations made under the DPDI Bill’s smart data powers will specify the role of the future entity, the obligations that data holders and receivers will have in relation to the future entity (including, for example, obligations to fund and support future entity-led developments), and provide for effective regulatory oversight and intervention where appropriate.

In line with the government’s wider approach under the Future Regulatory Framework Review, (planned) reform of the Payment Services Regulations 2017 using powers in the Financial Services and Markets Bill may also allow for existing data sharing and payment initiation rules to be amended by the FCA. This will ensure consistency with the future direction of Open Banking under the smart data scheme. The government intends that these requirements will need a broader set of Open Banking data holders to at least meet the compliance standard that currently applies to the ASPSPs subject to the CMA Order (thereby ‘levelling up’ the ecosystem).

Effective coordination will be required between the FCA and PSR in the development and implementation of the long-term regulatory framework.

The government will set out in more detail its plans for a smart data scheme, including the role that it expects firms and the future entity to play, as the DPDI Bill progresses through Parliament.

Interdependencies with broader developments

The report points out that the future of Open Banking is closely linked and correlated to, and will impact and be impacted by, broader initiatives in the regulatory space, in particular:

• the possible future expansion of Open Banking into Open Finance;
• the development of the New Payments Architecture (NPA); and
• other innovations in financial services such as the government, Bank of England, FCA, and PSR’s work on stablecoins and digital assets, where regulatory proposals have been introduced, and development of technologies such as blockchain, as well as the possible development of a future central bank digital currency may have an impact on Open Banking as new payment methods or systems may be introduced as a result.

The JROC will continue to consider how all of the above may impact and interact with Open Banking.

What will success look like for the JROC’s Open Banking vision?

For the JROC, long-term success will be assessed from various angles:

• greater innovation, lower prices or costs and improved quality of services through competitive pressure being exerted across the sector;
• the growth of the ecosystem (including the number of products and services offered);
• increased use of and reliance on Open Banking by consumers and businesses, the significant increase of total number of active users, and the overall growing investment in Open Banking;
• a low number of incidents and issues, the way in which those are resolved, and the scale of any resulting consumer loss;
• the development, functioning and take-up of a commercial framework.

In the shorter term, over the next two years the JROC will also measure success through stakeholders’ ongoing commitment and the delivery of the actions in the report, including the development, testing and piloting of a commercial model for Open Banking and the establishment of the future Open Banking entity.

Next steps

The report includes a full timetable of next steps.​ The JROC acknowledges that the roadmap is ‘necessarily ambitious’, but sees it as achievable if stakeholders collaborate effectively. In its view, the actions set out in the roadmap will further strengthen the ecosystem, with the aim of ensuring it is resilient, economically sustainable, efficient, and scalable to promote new and innovative products and services, provide a greater choice of payment methods and support further data sharing propositions.

The JROC will hold a webinar to summarise its proposals in May 2023 and will work with participants and users of the Open Banking ecosystem, by organising workshops and sprints where appropriate or by supporting stakeholders’ initiatives, to develop the design of the future entity, put it on an economically sustainable footing and establish an effective governance framework.

In Q4 2023, it will use the above input to set out a detailed plan for the future entity and the OBIE’s transition to it. In parallel, it will provide further guidance and set out the principles for engagement on the actions under the five themes identified in the roadmap. It will work closely with the OBIE and other stakeholders to progress the actions assigned to them and will publish terms of reference, where applicable, for the actions it is asking the ecosystem to develop proposals for.

The JROC intends to monitor progress against all actions in the roadmap regularly and will provide a first progress report in Q4 2023.

Those wishing to get in touch with the JROC should contact jroc@fca.org.uk.

If you would like to discuss any aspect of the JROC’s recommendations and roadmap, please get in touch with one of the listed lawyers or your usual Hogan Lovells contact.

Authored by James Black and Virginia Montgomery.