Phase 3 and 4 API functions will be implemented progressively by 28 participating banks starting from December 2021, the HKMA says.
The HKMA (Hong Kong Monetary Authority) has announced its implementation plan for the next two phases of the Open API Framework.
The Open API Framework was first issued in July 2018, setting out a four-phase approach for banks to implement APIs to allow third-party service providers to use bank-generated data to provide financial services.
To date, the first two phases were implemented in January and October 2019, respectively, making bank product information available via APIs and allowing customers to apply for financial products via third parties. The final two phases will make account information available via APIs and enable transaction capabilities.
The HKMA said it had commissioned Accenture as an external consultant to analyse and recommend the ways forward for the implementation of phases 3 and 4 of the Open API Framework, taking into consideration international practices and local market situation.
Based on the recommendations in the newly published study report, the HKMA says it has decided to adopt a progressive approach to implementing phase 3 and 4 API functions that enable viable use cases involving lower implementation cost and risk.
The initial batch of API functions, covering deposit account information and online merchant payments, are expected to be implemented progressively by the 28 participating banks starting from December 2021.
App-to-app payments via FPS (Faster Payment System) will be launched by December 2021, while API functionality for deposit account information will be launched by March 2022 for corporate and SME customers and by June 2022 for retail customers.
To promote secure and efficient implementation, the HKAB (Hong Kong Association of Banks) will develop a set of standards covering key areas of customer experience and authentication, technical and data standards, information security, and operation standards.
“Since Phases III and IV will open customer data to third parties and involve transaction processing, fraud and cybersecurity risks should be mitigated to protect customers,” the study report says, also outlining risks related to data privacy, system resilience, liability and money laundering that could arise.
The HKAB will also refine the current Common Baseline document to include the scope of Open API Phase 3 and 4 implementation. Both the standards set and the refined Common Baseline document are expected to be published by the end of 2021.