Open banking needs better risk controls to keep money safe

Article content

With last week’s rumour about the political demise of Finance Minister Chrystia Freeland proven greatly exaggerated, advocates of open banking in Canada can breathe a sigh of relief that this project won’t be derailed by changes to cabinet.

Recall that Freeland’s April budget announced a legislative framework for introducing open banking this fall, a long-awaited initiative that could eventually change how Canadians bank. Open banking garners broad support in political circles, including Opposition leader Pierre Poilievre, who said it “will give Canadians back control of their banking … and create savings … 365 days of the year.”

Article content

For those unfamiliar with open banking, the Finance Department touts it as allowing “consumers and small businesses to securely transfer their financial data through an application interface to approved service providers of their choice.” In short, it offers Canadians and small businesses the right to safely share financial data — typically limited to the internal use of one’s bank — using fintech apps accessible on smartphones and computers.

What will this look like in practice?

With the help of fintech apps, consumers and small businesses can shop around for loans, mortgages, bank accounts and investments. Ultimately, the goal of open banking is to go beyond data sharing to “buying” various financial services and products. We already see this in other G7 jurisdictions such as the United States, where fintech has taken off.

Open banking enthusiasts have lamented the slow pace of change in Canada, yet this offers time to assess the associated risks and how to manage them.

Consider the case of now-bankrupt Synapse Financial Technologies Inc. in the U.S. It pioneered “banking as a service” by managing money mobility, also known as payments. Synapse served as the operational heart of some fintech startups that were leveraging new technology to connect consumers with financial services, such as cheaper loans and high-interest-rate deposits offered by old-school, regulated banks.

Article content

Article content

The fintech startups do not manage client money — they are essentially brokers. Synapse’s job was to oversee the flow of funds to and from fintech clients and the regulated U.S. banks partnering with the fintechs, some of whom boasted that client deposits were covered by the Federal Deposit Insurance Corp., an institution similar to the Canada Deposit Insurance Corp.

This was technically true when the funds reached the regulated bank. But managing those funds in transit was up to Synapse.

Synapse went bust this spring and so the fintech chain it was embedded in broke, exposing the precarious position of impacted fintech clients. Roughly US$300 million in deposits could not be accessed by clients and another US$95 million of customer deposits were missing.

The basics of banking, such as tracking customer monies, fell apart, and nobody is taking responsibility. The founder of one of the impacted startups, Yotta Technology, told the New York Times that “it is not our fault” Synapse and the banks “are unable to account for and reconcile tens of millions of dollars.” As for U.S. banking regulators, they can do little to help. They only become involved after the funds arrive at regulated banks.

Article content

The judge overseeing Synapse’s bankruptcy figures that “tens of millions of depositor funds” will never be recovered.

And the Canadian lesson?

Freeland’s open banking framework protects consumers sharing financial information, thereby covering scenarios such as identity theft, and credit card or bank account information breaches. This framework entails a statutory liability, making directors and officers personally liable, that assigns responsibility to the party that permitted the data breach. With potential losses in the millions, good luck collecting from directors and officers at fintech flops such as Synapse.

More critically, what about customer money transferred into fintech companies destined for a Canadian chartered bank or credit union? Canada’s Retail Payment Activities Act (RPAA), overseen by the Bank of Canada, sets out registration requirements and standards, but, as the Canadian Bankers Association noted in December 2023, it “is silent on market conduct.”

In everyday language, who is ensuring fintech payment firms have robust operational infrastructure alongside clear policies and procedures and proactive oversight to ensure compliance?

Article content

If that sounds like a bank inspection, it is. That is the level of regulation needed when giving fintech firms responsibility for safeguarding customer money as they pass it through to a government-regulated financial institution with deposit insurance, which is, as noted above, the ultimate open banking objective.

Freeland’s framework assigns oversight to the Financial Consumer Agency of Canada. Its vision is to be a “leader and innovator in financial consumer protection.” Fair enough, but as the term itself makes clear, open banking is about banking, and, as the Synapse case reveals, the challenge isn’t only about protecting customer data; it’s about safeguarding people’s savings and the integrity of the financial system.

It is hard to see how Freeland’s framework or the RPAA would prevent a Synapse-like scenario in Canada. This should give her reason for pause.

Canadians long ago deemed it unacceptable to lose their savings when “banking” in Canada. The same will prove true when open banking with fintech apps comes to full fruition.

John Turley-Ewart is a regulatory compliance consultant and Canadian banking historian.

Bookmark our website and support our journalism: Don’t miss the business news you need to know — add financialpost.com to your bookmarks and sign up for our newsletters here.

Article content