Understanding Open Banking API in the Indonesian Banking Sector in the Development of Financial Services
Understanding Open Banking API in the Indonesian Banking Sector in the Development of Financial Services
The proliferation of digital platforms and applications in the financial sector has led the current generation to rarely visit local bank branches to fulfill their financial needs. Banking institutions are now innovating to enhance customer journey convenience with increasingly modern multi-channel approaches.
One of the newest innovations in financial services is open banking, where financial service providers rely on Application Programming Interface (API) technology. This system enables integration between banking services and consumers with third-party application services.
Simply put, open banking is a system that provides users' banking data access to third-party financial services through the use of Application Programming Interface (API) technology. Of course, this access needs to provide security assurances for its users.
Open Banking API can facilitate bank account verification. Users are required to fill out forms provided, including their bank account numbers and valid debit/credit card numbers. The open banking API then undergoes a verification process to check whether the listed bank account number matches the one in the bank's database. It then creates a Personal Identification Number (PIN) for use in the open banking API service.
Bank Account API
Bank Indonesia initiated the open banking API program by issuing the Open API Standard Cumulative Paper and Bank Interlink with FinTech in March 2020. This document aims to gather input from financial service industry players and the public. This means that financial service providers, in this case, banking institutions, can launch open banking API services. Customers can then register their accounts and create integrated accounts.
1. Bank Account API Access
Users or customers of banks that have implemented open banking API, which have Bank account API access, and have registered their accounts in the API service, can access it for various purposes, such as checking balance information, transaction history, credit or debit transfers, and other financial service conveniences.
2. Bank Account Verification API
Every user who registers their account to an open bank API account will be asked to verify their data. Banks typically perform bank account verification API using two methods simultaneously, for safety measures. Firstly, verification at ATMs to ensure the account number is still active. Secondly, through the user's phone number, by sending a verification code.
3. Bank Account Validation API
Although banking API services can be accessed directly, banks still validate customer account accounts within 1 x 24 hours. After a successful validation process, users will receive a notification message, and customers (users) can then perform financial API activities.
4. Virtual Bank Account API
In addition to real accounts registered with banks in Indonesia, in certain cases, such as stock transactions with the stockbit application, users, in this case, customers, can have virtual accounts at Sinarmas Bank. The main function of this virtual bank account API is only as a temporary place to hold user funds.
Open Bank API Specification
Regulations for open banking API have been regulated and supervised by Bank Indonesia (BI) and the Financial Services Authority (OJK). These regulations aim to increase financial inclusion while prioritizing the security of customer and consumer data.
As outlined in the Bank Indonesia Consultative Paper, there are technical specifications for open banking API. The following are the open bank API specifications according to Bank Indonesia.
- Open banking APIs are created to include; product/service API information, product/service registration API, account information API, and payment transaction API.
- The open banking API standard emphasizes payment transaction APIs.
- The open banking API standard will consider and adopt best practices from countries such as the UK, Hong Kong, Australia, Japan, Singapore, and India.
- Technical standards are based on the latest protocols, architectures, and data formats.
- Security standards include authentication, authorization, data integrity and confidentiality, as well as a Business Contingency Plan (BCP) that guarantees and ensures the continuity of data and service availability.
- Recommended security standards include ISO 27001 and PCI DSS, secure programming methodologies, and fraud detection systems.
In Indonesia, the development of open banking API has been implemented by several banks listed on Bank Indonesia's open banking API list, such as:
- BCA, through Finhaks for accelerating financial technology (fintech) innovation.
- BRI, through BRIAPI for developing virtual account and direct debit services for transactions and accessing product information.
- Mandiri, with MandiriAPI targeting fintech and e-commerce players.
Additionally, there are several other banks such as Permata, BNI, CIMB Niaga, and others listed on the open banking API list, actively collaborating with fintech startups to build API services and products.
Open Banking API Companies
One of the most active companies in developing open banking API is Bank Jago in collaboration with GoPay under the auspices of GoJek. The acquisition of GoPay by Bank Jago is a strong indication and highly publicized as an open banking API company created by the nation's children and pioneers in digital finance, combining banking and digital transaction facilities.
Besides Bank Jago and Gopay, in Indonesia, there are at least 3 open banking API providers, namely Bank Jago, Bank DBS, and Transferwise. All three also serve as open banking API aggregators facilitating digital banking transactions both domestically and internationally.
