Open Banking

A banking revolution is underway in the form of a new financial transparency. A focus on 3rd-party access and straightforward payment options are forcing compliance and regulation mandates on a global scale. The critical technology for this shift is the open API. What does this mean for service providers worldwide?

Learn how Okta’s product suite will secure customer identity, protect your APIs, and enforce state-of-the-art authentication.

New regulations such as Open Banking Standards (UK), Open Banking Farrell Report (Australia) and PSD2 (Europe) are rapidly disrupting the financial services landscape. They are igniting innovation by changing the way consumers engage with their financial service providers, and pay for goods and services. Due to these regulations, organisations such as banks, retirement service providers, and mortgage lenders, (to name only a few) are now required to enter the API economy. This entrance requires unprecedented API exposure of core platforms from these entities. This new transparency allows downstream, 3rd-party applications to access their account information, payment transactions and approval, and general financial services data.

These regulations also place identity and authentication at the center of this new financial services experience. Authorization and consent management will be critical differentiators for banking organizations allowing API access. Fraud prevention is paramount, and strong authentication must play a part in every transaction. But these changes will also usher-in new opportunities in customer acquisition and account source. Organizations that embrace these changes can potentially tap into previously unmet customer needs, and an opening in their customer service models.

What can Okta Identity Access Management (IAM) and security solutions do for you?

Okta provides a comprehensive platform to meet all open banking requirements to secure banking APIs, enable seamless transactions, and build a banking ecosystem with any 3rd-party application.

Use Okta’s API Access Management to secure read access to your Financial APIs

As banks expose data and processes using APIs, a Financial grade (FAPI) Security standard (a variant of OAuth 2.0) is required.

Okta's API Access Management (API-AM) solution provides a complete OAuth 2.0 standard compliant API Authorization server with an identity-driven API access policy engine. The solution provides access control for API resources after obtaining customer consent for sharing personal information with third parties. API-AM issues access tokens to consumer apps that would be used to authorize access to banking APIs, make policy access decisions based on the customer, the app, requested resource along with the ability to revoke specific or all access tokens granted to a customer. Additionally, the product enables the ability to revoke specific or all access tokens granted to a customer which can also be used to quickly cut off access to a customer's data in the event of a breach. With API Access Manager in place, customers can deliver on the potential of open banking knowing that their banking APIs are secure at all times.

Use Okta’s MFA capability to enable secure transactions without expensive card processor networks

The Open Banking Standard requires organizations to implement Strong Customer Authentication (SCA) to secure banking transactions above €30. Okta offers a comprehensive solution to secure transactions above and below €30.

For transactions above €30, Okta Multifactor authentication offers a secure way to meet the requirements of SCA. Okta Multifactor authentication solution gives you the options of a range of factors based on something the user knows (passwords, security questions) or something the user has (SMS, Voice, Email, Okta Verify, Google Authenticator, YubiKey, U2F etc) or something the user is (Windows Hello, TouchID, FaceID etc.). Organizations can choose the factor that is most appropriate to their needs and the associated risk.

For transactions below €30, Okta Adaptive Multifactor authentication offers a non disruptive method to reduce the risk of fraud. Leveraging a range of contextual factors such as user's device, location, ip and threats organizations can evaluate risk before accepting, forcing the user for step-up authentication or blocking the transaction.

Managing factors using Okta is easy. With a range of self-service options to enroll and reset factors, organizations can enable their end-users to securely manage their factors experience without incurring additional support costs. Okta's admin dashboards also enable security op teams to control and tweak policy without extensive developer cycles.

Use Okta’s identity and security products to offer new services with better user experiences

Open Banking requires user consent. Financial service providers need this for the access of 3rd party providers. This consent must be seamless when granting and revoking within the banking platform, but also for all downstream 3rd-party providers.

Okta's customer authentication products and directories also enable you to store user records securely, with a single record of truth for any changes to that consent.