Enabling Open Finance in EMDEs: Incentives, Liability, and Performance Measurement

Measurement

Suggested Citation

CCAF, Fii and BIS (2026) ‘Enabling Open Finance in EMDEs: Incentives, Liability, and Performance Measurement’, Cambridge Centre for Alternative Finance (CCAF), University of Cambridge; Financial Innovation for Impact (Fii); Bank for International Settlements (BIS)

Foreword from CCAF & Fii

Open Finance is expanding rapidly around the world, with much of its growth and greatest potential concentrated in Emerging Markets and Developing Economies (EMDEs). By enabling the customer-consented sharing of financial data, Open Finance can extend access, competition, innovation, and reach, offering a pathway to deeper financial inclusion where unmet financial needs remain significant. As these markets continue to shape the next phase of Open Finance development, it is important to understand their unique characteristics, opportunities, and challenges. Many EMDEs face limited resources and stretched regulatory capacity, and their legal and data protection frameworks are often still being developed. For these reasons, they cannot simply replicate the models adopted in Advanced Economies (AEs). For countries that wish to pursue Open Finance, the task instead becomes one of prioritisation under constraints: identifying the few design choices likely to carry the most far-reaching implications and sequencing them sensibly. Nonetheless, the existing evidence base has not kept pace with this challenge. Much of the existing literature documents adoption status and regulatory typologies, describing what countries have introduced rather than what sustains an ecosystem over time. This leaves regulators with limited empirical guidance on the structural conditions that determine whether and how Open Finance can deliver lasting economic and social value.

To help address this gap, the Cambridge Centre for Alternative Finance (CCAF) at the University of Cambridge Judge Business School, together with Financial Innovation for Impact (Fii) and in collaboration with the Bank for International Settlements (BIS), has produced Enabling Open Finance in EMDEs. The report examines the conditions that allow Open Finance ecosystems to take root and endure, drawing on the experience of nine EMDEs as its evidence base: Brazil, Egypt, Ghana, India, Indonesia, Nigeria, the Philippines, Saudi Arabia, and South Africa. Drawing on thirty semi-structured interviews complemented by extensive desk-based research, it moves the analysis from adoption toward the structural drivers of a resilient ecosystem.

The report's central contribution is a framework organised around three interconnected pillars: incentives, liability, and performance measurement. Building on our previous research, the Global and APAC State of Open Banking and Open Finance, this report studies the interdependence of the three pillars and the extent to which a gap in one pillar can be at least partially offset by another. This critical insight allows regulators to sequence priorities and rebalance over time rather than resolve every question at once. This is particularly relevant for authorities operating under institutional and resource constraints, for whom progress is rarely simultaneous.

Given a small and diverse sample, this report provides illustrative tendencies rather than universal conclusions. Key observations include the following:

• Mandates set the floor for participation while incentives raise the ceiling;

• Liability frameworks tend to build on existing legal architecture rather than replace it;

• Performance measurement must go beyond technical and adoption metrics to track and evaluate policy objectives;

• Customers, too often the missing piece, belong at the centre of ecosystem design.

The report is equally clear that Open Finance may not be the right priority for every economy at every stage. Policymakers should weigh against their own policy objectives and market context. We hope this study offers regulators, financial institutions, and industry a practical and empirically grounded basis for that judgement, and for the design choices that follow.

Finally, we extend our gratitude to the Bank for International Settlements for their partnership, to the UK Foreign, Commonwealth and Development Office for their support, and to the many regulators, financial authorities, and fintech firms who gave their time, as well as to our reviewers, whose insight strengthened this work throughout.

Bryan Zhang Co-Founder and Executive Director Cambridge Centre for Alternative Finance

Pavle Avramovic Director of Research and Policy Financial Innovation for Impact

Foreword from BIS

The Bank for International Settlements (BIS) is delighted to contribute to this report. Open finance can foster competition in the financial system and support financial stability by driving efficiency and encouraging innovation. The BIS has pursued work on open finance on two fronts: policy design and support for effective implementation.

On policy design, the BIS issued a report on Key considerations for open finance jointly with CGAP, the International Monetary Fund, the Office of the United Nations Secretary-General’s Special Advocate for Financial Health, and the World Bank. The report identifies considerations for authorities relating to key aspects of open finance frameworks including organisation and governance, regulation and oversight, and operations such as technical infrastructure and architecture, pricing and consumer awareness. This work is part of the enhanced cooperation arrangements on financial inclusion between global standard-setting bodies and international organisations, facilitated by the BIS’s Financial Stability Institute. These arrangements provide a platform to discuss the impact of regulation on access to and use of financial services. On support for effective implementation, the BIS Innovation Hub’s Project Aperta experimented with cross border interoperability among open finance networks. The project sought ways to share financial data across jurisdictions despite divergent technical standards. The project tests a neutral, multilateral interoperability layer that can securely connect domestic open finance networks, translate messages and initiate transactions across networks. It is the first public initiative to prototype real time international portability of data. Central banks could build on this experiment to foster safer and more resilient financial services, more efficient payment systems, and deepen financial inclusion particularly for small and medium enterprises.

This new report complements these works and aims to help jurisdictions that are implementing open finance frameworks. The focus is on examining the structural conditions that can deliver long-term economic and social value: incentives that attract and sustain participation of key players; liability frameworks that build trust; and performance measures that track whether policy objectives are met. We hope policymakers will find the report useful as they continue to strive for a resilient, safe and fair financial system that enables financial service providers to take risks responsibly while meeting evolving consumer needs.

Fernando Restoy Chair, Financial Stability Institute

Tommaso Mancini-Griffoli Head, BIS Innovation Hub

Research team and Acknowledgements

Research Team

CCAF and Fii

Sanya Juneja (Principal Researcher, Fii), Asli Ergun Konuk (CCAF), Tanya Ghuman (Fii), Nipuna Varman (CCAF), Paula da Cunha Duarte (CCAF), Teresa Lam (Fii), Bill Roberts (CCAF), Pavle Avramovic (Fii), and Bryan Zhang (CCAF).

BIS Co-Authors

Benedicte Nolens, Friederike Dorothee Natalie Rühmann, Hakan Eroglu, Jermy Prenio, and Jon Frost.

Reviewers

Douglas Arner (CCAF), Jane Baratt (MX), Max Bentovim (Fii), Oscar Bogagona (Bank of Italy), Alistair Brown, Ross Buckley (UNSW Sydney), Maria Teresa Chimienti (World Bank), Nick Davey (Open Banking Limited), Eric Duflos (CGAP), Fredesvinda Montes Herraiz (World Bank), Henk Van Hulle (Open Banking Limited), Sheirin Iravantachi (World Bank), Aneth Kasebele (Gates Foundation), Fernando Martinez (European Commission, Joint Research Centre), Rahul Matthan (Trilegal), Rafe Mazer (Fair Finance Consulting), Christopher C. Nicholls (University of Western Ontario), Ana Odorovic (Fii), Sarah Ombija (CCAF), Ian Oppermann (Australian Competition and Consumer Commission), Ariadne Plaitakis (Gates Foundation), Albert Puja (UNSW Sydney), Stefan Staschen (Independent), Krishnamurthy Suresh (Fii), Helene Oger-Zaher (Financial Conduct Authority), and Max Nino-Zarazua (Gates Foundation)

Acknowledgments

We would like to further thank the many financial authorities, regulators and fintech entities who made this research possible with their generous commitment of time and willingness to share their experiences.

Nihal Abughattas (Ozone API), Morayo Adisa, Appiah Kusi Adomako (CUTS International, Accra), Ezeh Josephine Adaeze, Louise Beaumont (Invela), Maria Teresa Chimienti (World Bank), Izabela Correa (Banco Central do Brasil), Jonathan Holman (Nebras Open Finance LLC), Josh D'Addario (The Open Data Institute), Bruno Diniz (Spiralem, Open Finance Brazil), Deepti George (Yutadhi), Roelof Goosen, Prof Sri Ram Khanna (Consumer Voice), B.G. Mahesh (Sahamati Foundation), Lesego Mashigo (FinMark Trust), Vamsi Madhav (Finvu), Ejike U.B Madunemeh (Nigeria Inter-Bank Settlement System PLC), Fredesvinda Fatima Montes (World Bank), Leticia Novaes (Nubank), Adedeji Olowe (Open Banking Nigeria), Kwame A. Oppong, Damola Owolade (FinMark Trust), Comfort Phelane, Paula Selihevic (Nubank), and Chaitanya Shah. We would also like to thank the Open Finance Team at Bangko Sentral ng Pilipinas and Bank Indonesia for their valuable contributions.

We are grateful to Mike Green for designing the report and Rebecca House for editing it. We also thank David Allen, Philippa Coney, and Katherine Selby for their press and communications support.

Disclaimer

The data and information contained in this report was accurate at the time of the research. The views and perspectives shared by individuals interviewed for this research do not represent the formal positions of their respective organisations. The analysis, findings, and recommendations presented in this report reflect the views of the authors, and do not necessarily reflect the view of CCAF or Fii or the BIS or its member central banks or the Basel-based standard-setting bodies.

Executive Summary

This report examines the key enablers that may support Open Finance ecosystems in delivering economic and social value in Emerging Markets and Developing Economies (EMDEs). Building on previous CCAF research into the State of Open Banking and Open Finance, both globally and in the Asia Pacific (APAC) region, it moves from the analysis of adoption and regulatory design to the ex-ante and ex-post conditions that may support long-term ecosystem viability. The report covers nine EMDEs: Brazil, Egypt, Ghana, India, Indonesia, Nigeria, the Philippines, Saudi Arabia, and South Africa. These countries represent different stages of Open Finance development, ranging from operational ecosystems with measurable adoption outcomes to countries where foundational design choices remain under active deliberation. The intention is to offer insights for regulators across all stages of implementation, drawing on 33 semi-structured interviews across 11 countries, complemented by a desk-based review of legislation, ecosystem dashboards, and published data.

A cross-cutting observation underpinning the analysis is that Open Finance does not operate in a vacuum. Its design and performance are intrinsically linked to the broader financial services market, the wider regulatory environment and, increasingly, to developments outside financial services, including digital identity, BigTech, Artificial Intelligence (AI) and cross-sector data sharing. This means that EMDE regulators may not be able to simply replicate an approach that has been successful elsewhere without accounting for these dependencies. Against this backdrop, this report's central contribution is a framework organised around three interlinked pillars: incentives, liability, and performance measurement. The framework's premise is that the three pillars reinforce one another, so that gaps in one can be at least partially offset by another. This interdependence can allow regulators to assess tradeoffs, sequence priorities, and identify which pillar most needs strengthening at a given stage. It is particularly relevant for EMDE regulators operating under

institutional and resource constraints, where progress may need to be sequenced and rebalanced over time rather than pursued simultaneously from the outset.

The implications of this broader ecosystem dependence differ across each pillar. For incentives, it suggests that design may need to reflect local market structure, including who holds the most relevant data and whether mandates can realistically reach them. For liability, it suggests that Open Finance frameworks tend to build on top of existing legal architecture and dispute resolution systems, rather than replacing them. For performance measurement, the overlap between Open Finance, technological innovation, and financial innovation can make it harder to isolate the impact of Open Finance-specific interventions, and measurement design may therefore warrant careful consideration in light of these adjacencies. Given the small sample size and the nascent stage of several frameworks in scope, the findings across all three pillars are best interpreted as illustrative tendencies within the sample rather than cross-country conclusions.

Incentives

Mandates alone may not be enough to deliver meaningful participation in Open Finance. Where data holders comply only with the letter of the law, the result can be brittle, low-latency Application Programming Interfaces (APIs) that fail to support real fintech traffic. Mandates may establish a baseline level of participation, but financial and non-financial incentives are often needed to foster deeper and more meaningful engagement.

A commercial model is one tool among many, and choosing not to implement one can be a legitimate policy decision. Regulators that are not yet ready to operationalise a commercial model, or that face market hesitation, need not view this as a barrier to progress. Grants, tax relief, sandbox access, reciprocity provisions, reputational mechanisms, phased implementation, and a well-designed governance framework can sustain participation in its place.

Governance structure and commercial model design appear to be distinct policy decisions. Even within regulation-led environments, approaches to commercial design vary considerably and do not follow directly from the broader governance structure. Differing approaches need not be read as indicators of ecosystem maturity or effectiveness, as illustrated by both Saudi Arabia's technically advanced market without prescribed charges and Brazil's codified but inactive freemium model.

Reciprocity can help rebalance incentives, but it works best when its limitations are understood Data reciprocity is constrained by asymmetries in data depth across participant types and by the need for customers' consent at each stage, meaning it cannot be assumed to function automatically as a balancing mechanism. Government reciprocity, where the state shares datasets such as tax filings, can be a useful complement, but reciprocity overall may not work as a standalone incentive without a well-designed mechanism.

Incentive design should reflect local market structure, rather than default to bank-centric assumptions. In many EMDE contexts, mobile network operators and their mobile money subsidiaries dominate payments activity and control the transactional data underpinning credit decisioning, as is the case in Kenya and Uganda. Understanding the competitive environment and the distribution of dominant data holders can therefore help regulators design appropriate and effective incentives.

Customers are the missing piece and should be recentred in ecosystem design. Customers may not fully understand the underlying infrastructure, but the value exchange of data sharing may need to be established, as illustrated by Brazil's integration of Open Finance into daily Pix journeys. Investing in customers' awareness, streamlined consent and UX standards, and mechanisms that make value immediately tangible can drive sustained adoption.

Liability

Open Finance inherits the existing legal architecture rather than creating liability from scratch. It draws on overlapping financial, data protection, and consumer protection regimes while introducing multi-actor and data-intensive features that these frameworks may not fully address. This can create accountability gaps and consent-related challenges that do not fit neatly within established regulatory regimes.

It can be useful to distinguish genuinely novel Open Finance risks from intensified versions of existing ones in financial services. Multi-party data sharing arrangements that involve third-party providers (TPPs) may be deemed a genuinely novel feature that warrants new rules and supporting infrastructure. Exacerbated risks, such as security breaches and consent complexity, may be addressed by extending existing frameworks.

The pertinent question is often not whether rules exist, but which framework applies and which authority has jurisdiction. Open Finance breaches often span data, payment transactions, and operational categories that do not sit neatly within a single regulator's remit, which may call for stronger crossregulatory coordination across relevant authorities.

The choice of liability model depends on institutional capacity and policy priorities, rather than on governance approach alone. Single-party, multipleparty, fault-based, and hybrid models each offer different trade-offs between clarity, redress, and innovation. Ex-ante mechanisms may be better suited to customers' redress, while ex-post fault-based approaches may better support participation and innovation, provided investigation and enforcement mechanisms are timely and well resourced. Faultbased models, in particular, tend to depend on digital

Performance Measurement

Designing measurement frameworks for Open Finance is analytically demanding and may warrant a similar level of rigour to that applied in more established regulatory domains. The effects of Open Finance are often indirect, distributed across multiple actors, and highly context specific. Isolating its impact from broader market developments may therefore require moving beyond technical and compliancebased metrics.

What constitutes "success" in Open Finance can vary across stakeholders, and measurement design choices should this. Regulators, data holders, data users, and consumer representatives often prioritise different, and sometimes competing, dimensions of success. Consumer outcomes, in particular, appear to be reflected less consistently in the metrics currently being tracked. Metrics can therefore be anchored to the policy objectives the framework was designed to achieve while remaining meaningful to the full range of ecosystem participants.

infrastructure such as audit trails and digital signatures that may not yet exist in all EMDEs.

There can be a meaningful gap between liability as written and liability as practised. Industry perceptions in India and Brazil diverge from the formal models on paper, and in Nigeria, pre-regulatory arrangements have concentrated operational liability on incumbent banks despite a fault-based framework being proposed, pointing to an enforcement and implementation gap that may warrant regulatory attention.

Existing legal architecture may be necessary but not sufficient for effective accountability. Supporting conditions such as accreditation standards, audit infrastructure, dispute resolution capacity, technical guardrails, and cross-regulatory coordination may also be required, alongside consent design choices and dispute resolution mechanisms that can themselves function as substitute incentives for participation.

Design principles can help regulators build credible measurement frameworks, drawing on established regulatory impact assessment practices. Attribution, validity, outcome orientation, proportionality, and granularity provide a structured basis for assessing whether indicators isolate Open Finance effects, measure what they are intended to capture, track meaningful outcomes, impose proportionate reporting burdens, and reveal distributional variation and unintended effects.

Technical metrics are useful but can be incomplete signals of ecosystem performance, particularly when used in isolation. Indicators such as API availability and transaction volume satisfy proportionality by construction but tend to fall short on attribution and outcome orientation. As ecosystems scale, regulators may benefit from triangulating technical metrics with policy outcome-based measures such as active usage, customer benefit, and service quality to build a more complete picture of whether Open Finance is delivering on its founding policy objectives.

Policy outcome metrics can capture whether Open Finance is advancing the public objectives that motivated its introduction. Across competition, innovation, consumer protection and empowerment, and financial inclusion, indicators that go beyond participant counts and aggregate adoption, such as the new-to-credit ratio, consent journey abandonment, and indicators disaggregated by gender, geography, and Micro, Small, and Medium Enterprise (MSME) participation, can offer more meaningful insight into whether the framework is delivering on its objectives.

Cross-Pillar Interaction

Where supervisory capacity to enforce liability is limited, performance measurement can serve as a substitute accountability mechanism. India's publication of participant-level grievance handling data illustrates how transparency requirements can drive behavioural improvement without direct regulatory intervention in each case. Regulators that cannot yet sustain active enforcement of dispute resolution timelines may achieve comparable outcomes by mandating public disclosure of complaints data.

Where liability exposure is structurally concentrated on data holders, incentives can be used to rebalance participation. Regardless of the formal liability model adopted, customers tend to maintain their primary relationship with incumbent banks, which also remain the principal data custodians. This asymmetry can create a disproportionate operational burden on data holders. Where regulators anticipate this dynamic, additional financial or non-financial incentives, whether fee arrangements, reciprocal data access, or reputational mechanisms, can help offset the exposure that data holders would otherwise carry.

Where commercial incentives are not yet in place, a well-designed liability framework can sustain participation. In markets where a commercial model has not been operationalised, clear and predictable liability rules can themselves function as an incentive

Whether to publish metrics can be approached through a proportional, tiered framework rather than a binary choice. Under such an approach, regulators could publish high-level, system-wide indicators, such as adoption numbers, API uptime, complaints resolution timelines, and switching metrics, while keeping commercially sensitive and micro-level data private. The scope of public disclosure could then expand as ecosystems mature.

for data holders and TPPs to engage. Certainty about the allocation of accountability, even under a relatively simple fault-based model, can reduce the perceived risk of participation and may substitute, at least partially, for direct financial returns.

Open Finance ecosystems, and the governance approaches designed to oversee them, are inherently dynamic and continuously evolving. For regulators that wish to pursue Open Finance, the three-pillar framework presented in this report is intended to guide the design, implementation, and iterative refinement of effective governance arrangements. Few regulators will be able to perfect all three pillars from the outset, and this is unlikely to be necessary. What matters more is an appreciation of the interdependence among the pillars: where one pillar cannot be strengthened directly, regulators may be able to draw on complementary adjustments across the others to preserve an efficient and well-functioning ecosystem. As these ecosystems mature, regulatory expectations and supervisory signals will increasingly shape market behaviour, while technological change will continue to redefine what is feasible across all three pillars. The task for regulators, therefore, may be less about perfecting any single pillar than about developing the flexibility and institutional capacity to adapt as the ecosystem matures and the governance tools available to support it continue to evolve.

Introduction

This report builds on the previous CCAF / Fii reports ‘The Global State of Open Banking and Open Finance Report’ and ‘The APAC State of Open Banking and Open Finance Report’, moving from analysis of adoption and regulatory design to the structural conditions needed for enabling Open Finance ecosystems in EMDEs. Covering nine EMDEs – Brazil, Egypt, Ghana, India, Indonesia, Nigeria, the Philippines, Saudi Arabia,

and South Africa – the report examines countries at varying stages of Open Finance1 development, from early-stage exploration to frameworks that have reached critical mass. This range is intentional: the aim is to draw lessons relevant to each stage of development, as well as broader insights that may be applicable to economies at different points along the journey.

Drawing on cross-country evidence, ecosystem data, stakeholder interviews, and targeted use cases, the report introduces a threepillar framework centred on three aspects – incentives, liability, and performance measurement – to support policymakers and regulators in building resilient, high-impact Open Finance ecosystems. These pillars emerged from the interplay of theoretical analysis and empirical inquiry, informed by 33 stakeholder interviews, cross-country comparison, and desk-based research, reflecting dimensions consistently identified as consequential for ecosystem sustainability yet underserved in the existing literature. Where relevant, the report also draws on experience from Advanced Economies

Research Objectives and Rationale

Open Finance is increasingly recognised as a key enabler of transformation in digital financial services, with particularly strong potential in EMDEs. i Industry projections estimate that over one billion users could benefit from Open Finance by 2030, ii with growth heavily concentrated in EMDEs. Digital finance hubs, including India, Brazil, and Mexico, are collectively projected to reach over 680 million Open Finance users by 2030. This trajectory is not merely a function of population size. It also reflects the pace at which EMDEs are building the regulatory and infrastructure

(AEs), primarily the United Kingdom (UK) and Australia, with other markets referenced where data and evidence are available. These are used as reference points for lessons that may inform EMDE contexts, rather than as blueprints. The report is primarily intended for financial sector policymakers, regulators, and supervisory authorities in EMDEs, as well as researchers, development finance institutions, and industry practitioners with an interest in the design and governance of Open Finance ecosystems. A supplementary paper, Regulatory Considerations for Enabling Open Finance in EMDEs: Incentives, Liability, and Performance Measurement , is available for regulators seeking a more practiceoriented distillation of these findings.

foundations for Open Finance. India's Account Aggregator (AA) ecosystem, launched in 2021, iii has expanded rapidly to encompass over 2.2 billion enabled financial accounts across banking, securities, insurance, and pension sectors. iv Brazil issued Open Finance regulation in the same year, and transitioned to a comprehensive Open Finance framework by 2022, expanding data sharing to include insurance, pensions, and investment products, demonstrating a pace of adoption that has outstripped that of most developed economies. v

1. For the purposes of this report, “Open Finance” is used as an umbrella term and may refer to Open Banking in countries where only Open Banking frameworks exist. Where both are in place, it reflects broader Open Finance systems. This terminology does not imply a prescribed sequencing from Open Banking to Open Finance.

This accelerated development can create opportunities that extend beyond efficiency and competition. In many EMDEs, large segments of the population remain unbanked or underbanked, and traditional credit infrastructure is limited. Open Finance frameworks that incorporate alternative data sources, such as mobile money transactions and utility payment histories, can extend access to financial services beyond traditional bank-centric models.vi Evidence from credit markets indicates that integrating such data into credit risk assessment can improve scoring accuracy and access for underserved customers,vii with combined models outperforming traditional approaches by approximately 5 to 20%.viii This convergence of rapid regulatory momentum and significant unmet financial need, therefore, positions EMDEs not merely as late adopters of a developed-market model, but as potentially distinctive sites of Open Finance innovation.

Despite this potential, early experience indicates that structural and institutional constraints, particularly in the design, governance, and long-term sustainability of ecosystems, remain significant hurdles.ix For example, Nigeria issued its Regulatory Framework for Open Banking in 2021 and Operational Guidelines in 2023, yet the regime is not yet operational: governance arrangements, technical standards, and ecosystem coordination remain unresolved.x This gap between regulation and implementation reflects a broader pattern, in which Open Finance reform competes for space against other legislative agendas, stretched institutional capacity, and shifting political priorities.

In EMDEs, these constraints are especially acute given the specific characteristics of their financial systems. Financial sectors in many EMDEs remain highly concentrated, with limited competitive pressure, high mark-ups, and weak incentives for sustained innovation. Combined with households' past experiences of costly banking and financial crises, this concentration may contribute to low levels of trust in the formal financial system.xi At the same time, many EMDEs are navigating uneven digital maturity alongside newly enacted data protection frameworks that are still being implemented and tested, adding further complexity to the regulatory environment. Limited regulatory capacity, inadequate legal powers,

and resource constraints further mean that Open Finance initiatives in EMDEs cannot simply replicate developed-market models. These conditions also raise a more fundamental question: whether Open Finance should be a priority among the range of financial sector reforms available to EMDE policymakers. In contexts where customers have limited financial data to share, or where foundational digital financial services infrastructure has yet to be established, Open Finance may not represent the most effective first-order intervention, and not every EMDE is at a stage where such a framework will generate meaningful returns.

This study, therefore, aims to shift the existing literature’s focus from adoption status and regulatory typologies to the structural drivers of durable ecosystem performance. Central to this is the prior step of objective-setting: before any of these structural drivers can be meaningfully addressed, policymakers need to establish what a given Open Finance ecosystem is actually trying to achieve. Those objectives, in turn, should inform the principles that guide design choices throughout, shaping how participation is structured, how risk is distributed, and ultimately how success is defined and evaluated. The first of these structural drivers, and the first pillar of this study's framework, concerns incentives. In the early stages of Open Finance ecosystem development, one common concern is how to attract and sustain participation across key stakeholder groups, including incumbent banks, financial institutions, fintechs, TPPs, and customers. Policymakers may therefore want to address three questions around incentives:

• how the constructive engagement of data holders can best be obtained, for example, via incentivisation or regulation;

• how data users can be enabled to build viable business models, for example, via the regulation of data access and pricing or levels and the liability risks that TPPs bear; and

• how customers can be motivated to share data and adopt Open Finance use cases, for example, via awareness campaigns or the design of compelling propositions, such that their value outweighs the perceived risks of using them.

While liability considerations must be addressed from the outset, as participation grows and ecosystems become operational during the scaling and growth stage, greater attention is typically directed towards the second pillar of this framework: liability and dispute resolution. As volumes of data flows and transactions increase, critical questions are raised around liability allocation, consumer protection, dispute resolution, and accountability among ecosystem participants. While addressing these questions on incentives and liability does not follow a fixed timeline, countries that make considerable progress on both tend to move towards a more mature and stable phase of Open Finance implementation. The third pillar, performance measurement, plays a role throughout this journey, though its focus evolves over time. From the outset, technical and compliance metrics, such as API call volumes, latency, and success rates, provide regulators with early signals that the ecosystem is functioning as intended. As the ecosystem moves to the maturity stage, the focus shifts towards policy outcomes: whether Open Finance has meaningfully advanced competition, innovation, financial inclusion, ecosystem sustainability,

or broader development goals. While these policyoriented metrics should ideally be defined from the outset, meaningful measurement and analysis usually follow later in the ecosystem's development, once sufficient data points have accumulated to support reliable assessments. This evolution in measurement can foster accountability among regulators, requiring them to demonstrate that Open Finance frameworks are delivering on their intended goal.

Together, these three pillars aim to capture the dynamic evolution of Open Finance ecosystems from launch to maturity and form the organising framework for the remainder of this report. The report specifically seeks to examine: which combinations of incentives support sustained engagement by data holders, data users and customers, how liability allocation and dispute resolution mechanisms influence risk perceptions and data sharing behaviour, and whether existing metrics meaningfully capture ecosystem health, commercial viability, and policy outcomes such as financial inclusion and competition.

1: Three-Pillar Framework for Enabling Open Finance in EMDEs

Policy Objectives

De ne goals from the outset such as nancial inclusion, competition, innovation, and ecosystem sustainability. These objectives inform design principles across all pillars and stages

Incentives

Align stakeholder motivations

Financial Incentives

Non-Financial Incentives Active across all stages →

Source: CCAF, Fii and BIS

Source: CCAF, Fii and BIS

Liability Frameworks

Build trust through clear frameworks

Liability Models

Dispute Resolution & Redress Mechanism

across all stages →

Incentives: Liability: Performance Measurement:

Track progress and shape behaviour

Technical Metrics

Policy Outcome Metrics

all

Framework operational at scale, growing adoption, expanding use cases

Incentives: Liability: Performance Measurement:

Methodology

This report adopts a mixed-methods research approach combining qualitative stakeholder engagement with systematic desk-based analysis to examine the design and performance of Open Finance ecosystems in EMDEs. The selected countries comprise Brazil, Egypt, Ghana, India, Indonesia, Nigeria, the Philippines, Saudi Arabia, and South Africa. These nine countries were selected to reflect diversity across implementation stages, regulatory approaches, and regional contexts. The aim is to generate insights relevant to a broad range of EMDE policymakers, whether they are considering introducing an Open Finance framework, actively managing early implementation, or seeking to deepen and sustain a more mature ecosystem.

As these countries represent different stages of Open Finance development, they have been grouped into three stages: Early Stage (Egypt, Ghana), where regulatory frameworks are nascent and there is limited ecosystem activity; Scaling and Growth Stage (Nigeria, Indonesia, the Philippines, South Africa), where regulation/guidance has been issued

and implementation is underway, with expanding ecosystem participation (driven by regulatory and/ or market efforts); and Maturity Stage (Brazil, India, Saudi Arabia), where frameworks are operational at scale, with growing adoption, an expanding range of use cases, and increasing ecosystem integration. These categorisations are intended as analytical groupings rather than rigid classifications and build on similar ecosystem approaches used in industry and policy literature, although specific definitions may vary.xii The nine EMDEs vary considerably not only in their current stage of Open Finance development but also in market scale – differences that bear directly on how the findings in this report should be interpreted across countries, as captured in Figures 2 and 3. Accordingly, the findings and patterns identified across this sample should be read as indicative rather than representative of the full range of EMDE experience, and policymakers are encouraged to weigh these insights against their own country context.

Source: World Bank Global Findex 2025; Adult population = ages 15+, Banked Population=

Throughout this report, a country is considered to have a "live" Open Finance ecosystem where either a regulated framework is operational, and/ or meaningful market-driven activity is present. This reflects the perspective adopted in previous research that Open Finance is fundamentally centred on the customer-consented flow of financial data; whether that flow is mandated by a regulator or enabled by market innovation should not determine whether it constitutes Open Finance. Accordingly, the absence of a live regulatory framework should not preclude a country from being considered "live" in terms of ecosystem activity. Nigeria is a case in point: while its regulatory framework has not yet entered into force,xiii meaningful market activity predates formal implementation and is captured within this report's analysis. Brazil, India, Indonesia, and Saudi Arabia have enacted Open Banking regulations that are live and operational, with active API infrastructure, albeit with varying degrees of functional scope and market participation. Brazil and India have progressed beyond initial Open Banking phases towards broader Open Finance models extending data sharing across multiple financial sectors. Saudi Arabia has moved rapidly through regulatory implementation under the Saudi Arabian Central Bank (SAMA)'s leadership. Indonesia, though operational, remains payment-scoped, with its standardised open API regime currently covering payment APIs rather than broader data sharing. It continues to refine key design choices around incentives and liability as its ecosystem develops. Ghana, the Philippines, and South Africa are at earlier points along the policy trajectory, with frameworks in draft, consultation, or phased rollout, and fundamental design decisions still actively contested.

This mix of countries and stages enables the report to examine both ex-ante design decisions and ex-post ecosystem outcomes across a diverse set of contexts. Notwithstanding their differences in economic structure, technical capacity, institutional governance,

and policy objectives, the nine countries share a common underlying challenge: how to build and sustain an Open Finance ecosystem that functions effectively for all participants. Across all settings, this requires a common set of core functions to be performed. This includes provider accreditation, customer authentication and authorisation, data access and transmission, effective data protection, and sustained constructive engagement among the three principal stakeholder groups: data holders, data users, and customers. The regulatory and technical solutions adopted to achieve these functions vary considerably according to domestic context, market structure, and policy priorities. It is precisely by comparing how different countries approach these shared functional requirements that the report is able to identify the design trade-offs and governance choices that can shape ecosystem performance across stages of maturity. 2

2. As the sample intentionally includes countries at markedly different stages of Open Finance development, evidence relevant to some research questions is not available across all countries. In particular, outcomes relating to long-term market development, consumer adoption, and ecosystem impacts cannot yet be observed in countries where implementation remains at an early stage. Findings on these issues therefore draw more heavily on evidence from mature ecosystems and should not be interpreted as being equally supported across the full sample.

Figure 3: Open Banking and Open Finance Development Across the Nine Selected EMDEs: Stage, Status, and Regulatory Approach (n=9)

Breakdown by Development Stage

Breakdown by Market Activity

Stage Breakdown

Early Stage: Egypt, Ghana

Growth/Scaling: Nigeria, Indonesia, Philippines, South Africa

Maturity: Brazil, India, Saudi Arabia

Breakdown by Governance Approach

Market Activity

Live: Brazil, Ghana*, India, Indonesia, Philippines, Nigeria*, Saudi Arabia, South Africa*

Not Yet Live: Egypt

Governance Approach and Scope

RegulationLed: Brazil (Open Finance), India (Open Finance), Saudi Arabia (Open Banking), Indonesia (Open Banking), Nigeria (Open Banking)

MarketDriven: Philippines (Open Finance), Ghana* (Open Banking), South Africa* (Open Finance)

Implementation Status

Regulation/Guidance Passed & Live: Brazil, India, Indonesia*, Philippines, Saudi Arabia

Regulation Passed but Not Live: Nigeria

Draft Regulation: Ghana

Regulation Under Consideration: South Africa, Egypt

Source: CCAF, Fii and BIS; Nigeria and South Africa are classified as live based on market-driven API activity. Ghana is classified as market-driven on the basis of current market activity running ahead of the published draft framework; this may shift once regulation is passed. South Africa is similarly classified as market-driven, as no formal framework has yet been enacted despite policy and discussion papers issued by the IFWG and FSCA. Indonesia's framework (SNAP) currently covers payment APIs only. Egypt is not yet classified on governance approach, as current activity has centred on regulator-led payments infrastructure rather than data sharing; a regulation-led approach appears more likely once the regulation covers data sharing.

Primary data was collected through 33 semi-structured interviews conducted across the selected countries. Interviewees represented a broad cross-section of ecosystem participants, including financial regulators and supervisory authorities, data protection and consumer protection bodies, incumbent data holders, fintech entities, and intermediaries, including API providers. All qualitative findings are reported on an anonymised basis, in line with standard research ethics and confidentiality practices. Thematic analysis of interview data was conducted with the assistance of AIbased tools, supporting the identification and coding of recurring patterns across stakeholder groups. All thematic interpretations were reviewed and validated by the research team to ensure analytical rigour and consistency. Qualitative findings from interviews were complemented by extensive desktop research, including a review of Open Finance legislation, regulatory guidance, ecosystem dashboards, public consultations, industry reports, and relevant academic and policy literature. Where available, ecosystemlevel data, such as participation metrics, API usage statistics, and public dashboards, were analysed to support cross-country comparison. The analysis also

Report Structure

The report is organised into three parts. Chapter 1 examines incentives, focusing on economic models, pricing structures, governance arrangements, and access regimes that shape ecosystem participation. Chapter 2 analyses liability frameworks, exploring risk allocation, dispute resolution mechanisms, and their implications for trust and data sharing. Chapter 3 focuses on measurement, proposing a comprehensive

distinguished between regulation-led and marketdriven ecosystem models, enabling an assessment of how different governance approaches can influence participation, trust, and measurable outcomes.

As with any comparative study of this kind, however, several limitations bear on the interpretation of findings. The central challenge lies in producing recommendations generalisable across all stages of Open Finance development from a nine-country sample that varies considerably in economic structure, institutional capacity, and policy objectives. Country classification itself carries a degree of analytical judgement: in several cases, the boundary between stages is not cleanly defined, with some countries exhibiting active market-driven ecosystems in the absence of live regulation, and others with enacted frameworks that have yet to translate into meaningful market activity. Future research drawing on a larger country sample, longitudinal tracking of ecosystem outcomes, and improved availability of published performance data would allow more robust causal claims and more granular cross-country comparison than the current evidence base permits.

performance measurement framework that captures ecosystem health, commercial viability, and policy objectives such as competition and financial inclusion. The report concludes by drawing cross-cutting lessons and policy recommendations for regulators seeking to design resilient Open Finance ecosystems. Supporting material is provided in the Appendix

Chapter 1 Understanding Incentives in Open Finance

This chapter examines how incentives interact to shape participation, competition, and innovation within Open Finance ecosystems. Recognising that customers are not passive participants but active stakeholders whose engagement is essential to ecosystem functionality, this chapter also considers the incentives influencing customer participation alongside those affecting data holders and data users. The analysis considers not only incentives explicitly designed by regulators, but also those that have emerged organically through market activity within the studied ecosystems. The chapter concludes with policy recommendations tailored to EMDE contexts, identifying how regulatory-

led and market-driven strategies can better align stakeholder incentives, strengthen participation, and accelerate meaningful Open Finance outcomes under conditions of capacity constraints and diverse market structures. It is important to note, however, that incentive design does not operate in a vacuum: the effectiveness of any given incentive structure is shaped by the broader market context in which it is deployed, including the maturity of complementary payment infrastructure, the degree of interoperability across financial and non-financial data ecosystems, and the extent to which Open Finance is embedded within wider smart data or sectoral data sharing agendas.

1.1: Incentives

in Open Finance

Incentives, in the context of this report, refer to the economic, fiscal, strategic, practical, and reputational motivations that may lead data holders, data users, and customers to participate meaningfully in data sharing ecosystems. Such incentives include attractive commercial models, revenue-sharing agreements, and enhanced customer convenience and choices. It could also include regulatory mechanisms to prevent anticompetitive behaviour, to reduce transaction costs, and to increase trust and confidence. Establishing the right incentives is a critical early consideration for any regulator designing or overseeing an Open Finance framework. Whether an Open Finance model is regulation-led or market-driven, it risks underperformance if key actors, such as incumbents as data holders, fintechs and TPPs as data users, and customers as the ultimate owners of their data, do not perceive clear and sustainable value in participation

Across academic and industry literature, a recurring theme is the gap between formal enablement and effective engagement, often driven by incentives that frame participation as a compliance obligation rather than a strategic opportunity.xiv Theoretically, this reflects an agency problem at the heart of datasharing regulation: while mandatory data sharing can reduce information asymmetries and lowers entry

barriers, it can simultaneously erode incumbents' rents and weaken their incentives to invest in data infrastructure and customer relationships.xv Without reciprocal rights, compensation mechanisms, or governance safeguards, data holders may bear the implementation and compliance costs while TPPs capture a disproportionate share of the benefits – a free-rider dynamic in which data users draw on infrastructure they did not fund and relationships they did not build.xvi These dynamics are particularly visible in competition-mandate regimes, where incumbents may meet formal legal requirements while undermining functional effectiveness through delayed implementation, limited API functionality, restricted data scope, or friction in the customer journey.xvii Such experiences underscore the importance of carefully designing legal and regulatory obligations so that they reflect not only formal compliance requirements, but also the substantive outcomes regulators seek to achieve in practice.

Regulators have responded to these challenges in markedly different ways, as illustrated in the governance classification and scope shown in Table 1. Of the nine countries examined in this report, five follow or intend to follow a regulation-led approach (Brazil, India, Indonesia, Nigeria, and Saudi Arabia),

while three are currently market-driven (Ghana, the Philippines, and South Africa).3 Egypt, is not yet classified, as its framework remains at an early stage and current activity has centred on regulator-led payments infrastructure rather than data sharing. Several market-driven countries are still developing

their frameworks, exploring how to grant sufficient flexibility to encourage innovation while retaining enough oversight to support adoption. As the sample mixes broader Open Finance regimes with Open Banking-only frameworks, cross-country comparisons should be read accordingly.

Source: CCAF, Fii and BIS; *Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, Egypt remains at an early stage of development and was not included in the table, Indonesia's framework (SNAP) currently covers payment APIs only, and South Africa has not yet taken a formal position in policy or recommendation papers.

However, evidence suggests that neither approach alone may be sufficient. Mandatory requirements can secure baseline participation: in the UK, the nine largest current account providers, representing roughly 80% of the market, were required to open their APIs.xviii Yet mandates alone cannot guarantee meaningful participation, innovation, or ecosystem vitality. Eight years after launch, the UK’s regime had reached around 16.5 million monthly users, or about 18.4% of bank account holders,xix yet the Financial Conduct Authority (FCA) has noted that much of Open Banking's strategic potential remains unrealised, citing fragmented regulation and persistent commercial misalignment.xx Adoption might have progressed faster had positive incentives been deployed alongside the mandate. But the problem regulators faced was precisely that

incumbents had little commercial pressure to open access voluntarily, and customer value depends on a critical mass of data holders participating. Mandatory requirements were therefore used to correct entrenched market dynamics and establish initial conditions for participation, illustrating the broader dilemma between incentives ("carrots") and mandates ("sticks"). Interview evidence from regulators and market participants reinforces these findings and points to the need for incentives beyond mandates to sustain adoption. As one senior central banker from the Europe, the Middle East and Africa (EMEA) region observed, “once regulators require commercial banks to ‘open up’, the central question for incumbents becomes what return they receive in exchange for potentially losing customer relationships built over decades.”

3. Country classifications reflect the regulatory posture at the time of writing and distinguish between frameworks that are operational and those in development. Ghana is currently classified as market-driven on the basis of market activity. However, the Bank of Ghana's December 2024 draft Open Banking Directive envisions a mandatory model for all regulated financial institutions, with ODX as the designated implementing entity, and the country's classification is expected to change upon enactment. South Africa is classified as market-driven with guided implementation: neither the IFWG 2021 policy imperatives paper nor the FSCA's 2024 policy recommendations constitute binding regulation.

1.2:

Commercial Incentives in Open Finance

Industry projections indicate that Open Finance frameworks could collectively reach more than one billion users globally by 2030.xxi Yet, to date, academic and industry literature has largely focused on whether data sharing is mandatory and standardised. As these ecosystems mature, another question has become unavoidable: who pays, for what, and when? Among the EMDEs analysed in this report, four countries (Brazil, India, Nigeria, and the Philippines) show any semblance of a commercial model explicitly articulated in their Open Finance regulation or data protection frameworks. However, these are not yet fully operational or clearly structured: Nigeria’s framework is not live, Brazil’s commercial model is not yet operational, data holders in India are not compensated, and the Philippines has only issued guidelines, leaving implementation largely to bilateral agreements. These commercial questions matter because data sharing is not cost-neutral. Data holders may need to upgrade infrastructure, maintain secure APIs, and meet compliance requirements, while data users invest in product development and customer onboarding.xxii These costs are typically incurred upfront, whereas the benefits materialise only over time as adoption increases and use cases scale. Where no mechanism exists to offset this imbalance, a predictable result is under-investment. As a financial inclusion expert from the Middle East and North Africa (MENA) region observed, “Without a regulated fee structure for premium data, incumbents provide the bare minimum, which results in brittle, low-latency APIs that fail to support high-volume fintech traffic.” This dynamic is especially pronounced in the concentrated market structures common in EMDEs, where a small number of incumbents control the majority of deposits and face limited competitive pressure to cooperate.xxiii

Framing the Commercial Model Decision: Regulation-Led or Market-Driven?

Recent developments have intensified debates around commercialisation. While some interviewed stakeholders argue that data connectivity should function as a form of Digital Public Infrastructure (DPI), others contend that maintaining secure APIs, managing high volumes of requests, and investing in data infrastructure impose significant operational costs that justify commercial pricing models. As these debates evolve, regulators and private players have begun adopting a range of approaches, including free data sharing, tiered pricing structures, and bilateral agreements between ecosystem participants.

Among the nine EMDEs examined in this study, the commercial models governing data-sharing arrangements vary considerably, and any comparison across countries requires care, given the different stages of regulatory development represented in the sample. At a high level, two broad approaches can be distinguished: regulation-led and marketdriven commercial models. This typology should also be understood as illustrative rather than definitive. Expanding the analysis to a broader set of countries could strengthen the framework further and potentially reveal additional commercial models not captured in the current sample.

What is a regulation-led commercial model?

A regulation-led commercial model is one in which the regulator or official representative body has made explicit commentary on the commercial framework governing data sharing.xxiv Such models can span two levels of engagement: light-touch, where the regulator engages with commercial arrangements in principle by permitting charges, addressing compensation, or mandating transparency without specifying pricing levels; and prescriptive, where the regulator directly specifies fee structures, thresholds, or prohibits compensation mechanisms.

What is a market-driven commercial model?

A market-driven commercial model is one in which the regulator is absent or silent on commercial arrangements, leaving pricing and compensation mechanisms to emerge through bilateral negotiation between market participants without regulatory direction, specification, or formal permission. It bears noting that this group is internally heterogeneous: regulatory silence may reflect an early-stage ecosystem in which the commercial model question has not yet arisen, a deliberate policy preference for market selforganisation, or simply limited regulatory bandwidth, and the available evidence does not always allow these drivers to be distinguished.

Figure 4 captures the commercial models observed across the nine EMDEs. India, Brazil, Nigeria, and the Philippines have each seen some form of explicit regulatory commentary on commercial arrangements, qualifying them as regulation-led. In Indiaxxv and Nigeria,xxvi it takes the form of transparency requirements: both countries mandate that agreed fees be published on participant websites or stated in SLAs, ensuring pricing is publicly visible even if not set by the regulator. In Nigeria, however, the relevant regulation has not yet fully gone live, even though commercial arrangements are already active in practice.xxvii The Philippines’ central bank permits bilateral commercial arrangements, relying primarily on competition law as the key regulatory constraint, while refraining from setting prices or mandating disclosure.xxviii Brazil adopts a more prescriptive approach through a codified freemium structure in which data sharing is free below defined API call thresholds,xxix while reimbursement above those thresholds is permitted but, in practice, has not yet been activated.xxx Industry consultations indicate that, for banks, establishing and operating a

billing mechanism would be costly and operationally complex and is therefore not currently viewed as a priority.xxxi

Several other countries in the sample continue to rely primarily on market-driven arrangements.4 South Africa, Indonesia, and Saudi Arabia operate without formal provisions governing commercial models. In South Africa, the Financial Sector Conduct Authority (FSCA) proposed recommendationsxxxii that identified commercial arrangements as an important area for future consideration but did not prescribe a specific pricing approach.5 Ghana's draft framework similarly proposes a no-fee model and has yet to be enacted,xxxiii while Egypt's framework remains at an early stage with its commercial model still under consideration. Draft positions in this area can shift materially before implementation: New Zealand initially contemplated charging for data access before adopting a no-fee position in its final framework, a reminder not to treat draft frameworks as settled indicators of policy direction.xxxiv

4. It should also be noted that in some cases, particularly for Egypt, Indonesia and Saudi Arabia, assessments of commercial model status draw on primary interviews with market participants or regulatory representatives, given the limited availability of publicly documented evidence on commercial arrangements in those countries.

5. This reflects the position of the Financial Sector Conduct Authority (FSCA) in its capacity as market conduct regulator and should not be interpreted as an industry-wide position. The Intergovernmental Fintech Working Group (IFWG), which brings together South Africa’s financial sector regulators and policymakers, has thus far published only a high-level paper articulating the policy rationale for Open Finance without addressing commercial model design directly.

Importantly, these approaches should not be read as indicators of ecosystem maturity or effectiveness. A market-driven approach does not imply an underdeveloped commercial environment, nor does a regulation-led one guarantee well-governed pricing. Saudi Arabia, for example, operates one of the most

technically advanced ecosystems in the sample, with an active pricing market despite the absence of formal regulatory commentary. Brazil, by contrast, has the most explicitly codified commercial structure, yet its reimbursement mechanisms above the free threshold remain inactive in practice.

Source: CCAF, Fii and BIS; *Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, Egypt remains at an early stage of development, South Africa has not yet taken a formal position in policy or recommendation papers, and Indonesia's framework (SNAP) currently covers payment APIs only.

Governance Structure and Commercial Model Design: An Imperfect Correspondence

Figure 5 visualises the commercial models along two dimensions: the degree of standardisation in data

sharing and whether participation is mandated by regulation. Three of the four quadrants represent regulation-led approaches, encompassing mandated and/or standardised data-sharing frameworks, while only the non-mandated, non-standardised quadrant reflects a market-driven approach.

5: Interplay between Governance Approaches and Commercial Model Approaches in Open Finance in Selected EMDEs (n=8)

Source: CCAF, Fii and BIS; *Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, Indonesia's framework (SNAP) currently covers payment APIs only, and South Africa has not yet taken a formal position in policy or recommendation papers. Egypt is excluded because it is too early to classify its governance approach.

Mapping the eight EMDEs for which sufficient evidence is available reveals a notable pattern. The key finding is that commercial design does not follow directly from governance structure. Brazil, India, and Nigeria pair regulation-led governance with a regulation-led commercial model, whether light-touch or prescriptive. Saudi Arabia and Indonesia, despite regulationled governance, leave commercial arrangements to bilateral negotiation, showing that regulators implementing mandatory and/or standardised governance frameworks do not consistently extend that prescriptive logic to pricing. The reverse divergence is equally instructive. Ghana and South Africa are market-driven on both dimensions, the more intuitive alignment, but the Philippines is not: despite a market-driven governance approach, its central bank

has taken a regulation-led stance on commercials, permitting bilateral arrangements in its pilot documentation while, per interview evidence, actively managing pricing outcomes through ongoing dialogue with participants rather than direct price-setting. It is the only country in the sample where a market-driven governance model is paired with deliberate regulatory engagement on pricing.

Taken together, this reinforces that commercial model design is a distinct policy decision from governance structure, one that countries appear to be making, or deferring, independently. These classifications should be treated with caution, given the small sample and the number of frameworks still in draft or transitional form, which may change materially before enactment.

Commercial Models in Practice: Data Holder Compensation and Data User Charges

Table 2 examines how commercial arrangements operate in practice across the eight countries for which sufficient evidence is available. The analysis reveals substantial variation not only between regulation-led and market-driven approaches, but also within each category.

On data holder compensation, the evidence is mixed and often uncertain. Brazil's framework permits pricing beyond specified thresholds, but such charges are not currently implemented. In India, data holders are likewise not compensated for data access, though interviewees expect remuneration for technical services, rather than for data sharing itself, to emerge as the ecosystem scales. A smaller number of countries do not impede compensation: in Indonesia, interview

evidence indicates data holders may be compensated under bilateral agreements, while Nigeria provides for compensation through intermediary aggregators. OnePipe,xxxv one such aggregator active in Nigeria's preregulatory market, operates an API gateway through which partner banks publish APIs, charge client fees, and share a portion with OnePipe.xxxvi

Elsewhere, arrangements remain less clearly defined. In Ghana, a regulatory representative indicated that banks may charge nominal fees for data access, though this is not yet reflected in the draft directive.xxxvii In Saudi Arabia, interview evidence suggested an intermediary pricing structure similar to India's, though it is unclear whether bilateral arrangements involve meaningful data access charges. South Africa similarly relies on bilateral agreements between banks and fintechs, with no clear evidence that these currently involve charges for data access.xxxviii

On data user payment, the picture is similarly mixed. In India, data users pay AAs on a per-fetch basis, and intermediary pricing has fallen sharply over time, from roughly INR 10–30 (USD 0.12–0.35) per data pull around 2021 to INR 2–5 (USD 0.02–0.06) by 2023, with some transactions reportedly as low as INR 0.75 (USD 0.009), reflecting competition among a growing number of licensed AAs.xxxix Published policies from providers such as Setu (Agya Technologies) indicate a current range of INR 0.01–25 (USD 0.0001–0.29) per fetch,xl while Perfios discloses INR 5–25 (USD 0.06–0.29) per bank statement.xli

Nigeria also shows relatively visible pricing: Mono, an active aggregator recently acquired by Flutterwave, operates a subscription model with a Basic plan at NGN 50,000 (USD 31) per month, capped at 100 unique account connections.xlii India and Nigeria are the only countries in the sample with granular pricing publicly available, though for different reasons. In India, this visibility stems in part from the transparency requirements governing its commercial model, which are in force. Nigeria's framework also envisages transparency requirements, but these are not yet live; its visible pricing instead reflects voluntary disclosure by aggregators operating in the pre-regulatory market, such as Mono. In Saudi Arabia, fintechs reportedly pay aggregators such as Tarabut and Lean under customised usage-based arrangements,xliii though SAMA's framework does not prescribe pricing.xliv In Brazil, the Philippines, Ghana, and South Africa, whether data users currently pay for access remains unclear or not yet applicable given the stage of ecosystem development.

Comparing the two groups reveals notable differences in formalisation. Market-driven countries generally specify commercial models less, often remaining silent on pricing or leaving it to participants; even where arrangements are acknowledged, as in the Philippines, regulatory involvement stays limited and principlesbased. This may reflect a preference for flexibility during earlier stages, allowing practices to emerge organically while avoiding monetisation structures that could deter early participation. But limited guidance can also create uncertainty and slow convergence towards interoperable, scalable practices, since

commercial terms may require individual negotiation. As an executive from a large Egyptian bank observed, "In the absence of a mandate, every API call is a negotiation, which slows down the scaling of the entire ecosystem." Regulation-led countries in the sample, by contrast, show greater formalisation and observable implementation: commercial arrangements are more often operational, addressed more directly in official frameworks, and more likely to define when charges may apply and which entities may levy them.

These findings should be read cautiously, given the small sample and differing stages of implementation. Rather than demonstrating causal patterns, Table 2 illustrates how varying degrees of regulatory intervention can shape the visibility and formalisation of commercial arrangements. Explicit intervention, whether through transparency requirements, freeaccess thresholds, or formal recognition of bilateral pricing, tends to generate at least some public evidence of how terms operate, whereas its absence leaves arrangements comparatively opaque, disclosed mainly through interview evidence rather than official documentation. Reciprocity requirements, present in some form in Brazil and India, may also shape participation incentives, though given the limited cases and uneven maturity, any conclusions remain tentative.

What Commercial Models Mean for Ecosystem Participants

The variation across commercial arrangements raises broader questions about what different pricing and compensation structures mean for ecosystem participants in practice. Building on the preceding analysis, Table 3 synthesises the main commercial models relevant to Open Finance ecosystems, some observed in the sample and others not yet implemented, alongside their implications for data holders, data users, intermediaries, and regulators. These models apply across different data transfer architectures, one-to-one, one-to-many hub, and many-to-many intermediary, each with distinct implications for cost distribution as discussed in detail in Appendix. The pricing structures may also be set centrally or reached bilaterally between participants.

Table 3: Potential Commercial Models in Open Finance Ecosystems

Pricing Model Data Holders (Supply Side)

Users (Demand Side)

Free Data Sharing

Incentive Gap: Bears marginal costs with no direct return on investment (ROI). Cost burden is highest in oneto-one models, partially socialised in hub-based models, and negotiated in intermediary models. Relies on non-monetary incentives such as compliance obligations or reciprocity.

Tiered Access (eg, S/M/L tiers)

Freemium (Basic + Premium)

Price Differentiation: Cost recovery scales with pre-set usage intensity. In hub-based models, tier structures and revenue distribution are set centrally. In intermediary models, holders may have limited visibility over end-user usage patterns.

Productisation: Incentivises innovation beyond compliance through enriched datasets, higherfidelity data, or value-added services. In hub-based models, the hub may constrain premium differentiation by defining basic access standards.

Low Entry Barriers: Minimises entry barriers and encourages experimentation across all architectures. Indirect costs may arise through intermediary fees even where core data access is free.

Growth Penalty: Predictable costs at lower tiers, but calibration matters, as poorly designed tiers can create disproportionate burdens at growth inflection points regardless of architecture.

Value-Based Choice: Pay only for measurable added value. Premium offerings may be less tailored in hubbased models and harder to unbundle from intermediary service packages in many-to-many models.

Strategic & Regulatory Considerations

Effective for establishing a level playing field preventing the use of Screen Scraping (eg, New Zealand's Year 1 fee ban6). Risk of data holder under-investment or quality degradation where cost recovery is absent. Regulators could monitor for indirect cost recovery through other channels.

FRAND (Fair, Reasonable, and NonDiscriminatory) terms are typically applied across all architectures. Regulators could ensure tier structures are transparent and do not entrench incumbents or disadvantage highgrowth participants.

Basic access standards are typically defined and enforced independently of commercial premium arrangements. Regulators could guard against quality degradation of the basic tier across all architectures.

Usage-Based (Per-Call Fees)

IntermediaryBased Pricing

Marginal Cost Mapping: Ties revenue directly to system load. Revenue is unpredictable in one-to-one models, is smoothed but attribution is complex in hub-based models, and may flow through intermediaries rather than directly to holders.

Low Direct Monetisation: Not applicable in one-to-one models. Reduces build-and-maintain burden where intermediaries operate.

Revenue linked to integration and orchestration services rather than raw data access.

Source: CCAF, Fii and BIS

Measurement Costs: High friction for innovation due to unpredictable cost exposure during testing and scaling phases across all architectures.

Pay for Capability, Not Calls: Fees tied to capabilities, such as onboarding, uptime, and tooling, rather than raw data calls. Competition among intermediaries drives down costs in many-to-many models.

Risk of adverse selection – only highmargin use cases survive, potentially crowding out inclusive finance tools. Regulators may impose fee caps or restrict per-call fees for core data access.

Applicable where intermediaries operate within the ecosystem.

Regulators could monitor for market concentration or hidden fees that recreate centralised control through commercial means.

6. During the transitional period (before the final regulations took effect), some New Zealand banks voluntarily waived API fees for a limited time to support adoption. For example, Westpac NZ made API calls free for accredited third parties for at least 12 months, and other banks offered similar temporary waivers. The New Zealand Government subsequently banned all banks from charging under its CDR regulations.

Commercial Model Evolution Across the Ecosystem Lifecycle

For regulators considering a commercial model, the stage of ecosystem development offers a useful lens for assessing which approach is likely to support rather than undermine participation. The costs, risks, and incentives facing participants evolve as Open Finance moves from early stage to maturity, so pricing decisions appropriate at one stage can be counterproductive at another. The central question is therefore not whether to commercialise, since some ecosystems have sustained participation without doing so, but, if commercialisation is contemplated, what form best fits where the ecosystem currently sits.

At the early stage, the central challenge is not pricing power or competition but the basic friction of market entry.xlv Potential participants face high search, information, measurement, and contracting costs, frictions amplified in EMDEs where thin balance sheets and regulatory ambiguity mean entry costs can extinguish participation before it begins, often compounded by uncertainty about whether the model will work at all. Here, the experience of the nine EMDEs surveyed points to simplicity as paramount. Free data sharing appears least likely to deter participation, not necessarily as a permanent arrangement but as a deliberate strategy to lower switching costs and encourage migration from informal methods such as screen scraping to formal APIs. Where access is charged, data users may face a straightforward cost comparison, and if screen scraping remains cheaper, the regulated channel risks being bypassed before it can establish itself. As one fintech founder in Ghana observed, "When you're starting from zero, any complexity in the fee structure is a deterrent."

At the scaling stage, the challenge shifts from lowering entry barriers to building and maintaining momentum, keeping barriers low enough to support continued development while signalling enough stability to attract investment. Leaving commercial arrangements to the market remains viable, allowing bilateral agreements to emerge as participants negotiate

around actual use cases. Alternatively, regulators may intervene through the Open Finance framework, for example, by requiring agreed pricing to be disclosed, generating at least some public evidence of how terms operate. A further option is to establish the architecture for a commercial model without implementing one, signalling to data holders that infrastructure investment will eventually be recoverable and to data users that the rules of engagement will remain stable, without locking in fees before viable use cases consolidate. Brazil illustrates this: by establishing a formal commercial framework early, despite charges not being levied in practice, the regime provided predictability that supported participation and growth. The value of the model may therefore lie less in immediate monetisation than in the institutional certainty it creates during scaling, though regulators should recognise that prolonged delays between design and implementation can themselves create uncertainty about when, and under what conditions, pricing will take effect.

At the maturity stage, the case for some commercial charging may become more defensible, as the competitive dynamics that made unrestricted pricing risky early on will have been partly addressed by years of data flows. Regulators may then be better positioned to introduce a more structured framework, including regulation-led freemium models that permit charging while protecting a floor of free access for essential data. Australia's Consumer Data Right (CDR) is illustrative: data was initially shared free of charge, with charging introduced only once the framework was operational, applying particularly to value-added data or where free access could undermine incentives to collect and maintain it. Where incumbents risk using control over critical infrastructure to extract monopoly rents, regulators can also intervene through price ceilings or access mandates to ensure smaller and newer participants are not foreclosed by high variable costs. A regulation-led model is not the only path, however: Saudi Arabia shows that remaining largely regulation-led does not preclude leaving aspects of the commercial model to the market.

While commercial models can clearly incentivise data holders, not all countries are ready or willing to implement them. Limited market maturity, fairness concerns, and the complexity of fee structures can make widespread implementation challenging and attempts to impose price controls are often equally problematic, hard to enforce, and prone to unintended consequences. Brazil offers an instructive counterpoint: its ecosystem has reached significant scale under a model in which data sharing remains effectively free, suggesting that strong governance, regulatory leadership, and the inclusion of commercially relevant

data types and payment initiation linkages are also important levers. The commercial model is ultimately one lever among several, and its absence need not preclude a well-functioning ecosystem. Accordingly, regulators and participants are exploring alternative approaches to encourage participation, including financial and non-financial incentives such as targeted subsidies or reputational gains. The following sections examine these complementary incentives, considering their impact not only on data holders and data users but also on an often-overlooked participant: the customer.

Could customers end up paying for data sharing in Open Finance?

A narrative emerging consistently across interviews was that Open Finance may empower customers by giving them greater control over their financial data. A valid question, however, is whether customers could ultimately pay for that empowerment, directly or indirectly. In EMDEs, where cost is often decisive in the uptake of new financial services, this carries particular weight: academic research shows bank maintenance and transaction fees can exceed 5% of monthly income for low-income customers, so even small additional charges can create significant barriers.xlvi Against this, there is a strong regulatory consensus. All regulatory bodies interviewed agreed that customers should not be charged for data sharing, and several countries, including Brazilxlvii and the Philippines,xlviii explicitly prohibit it. Canada's framework, which received royal assent in March 2026, goes further by codifying both the prohibition and a remedy. Section 77 prohibits participating entities from charging consumers for data sharing, while Section 78 requires that any improperly imposed charge be refunded or credited to the customer, together with interest calculated at the Bank of Canada overnight rate.xlix Behavioural evidence reinforces this consensus: even a nominal "convenience fee" at the point of consent can lead users to abandon digital channels altogether.l As a digital payments expert from West Africa observed, "In markets like Ghana and Nigeria, where trust and financial literacy are still developing, any fee at the point of consent can kill adoption before it starts." Regulators, therefore,

treat the prohibition on charging customers not as a subsidy but as a condition for building trust and achieving scale, a stance often reinforced by data protection frameworks that recognise consumer rights of access and portability and constrain charging for their exercise.

While customer access may be free, Open Finance is a two-sided market, linking customers on one side and data users or holders on the other. In such markets, a "seesaw effect" often emerges: suppressing prices on the customer side shifts costs onto intermediaries or data holders, which may re-enter the system indirectly.li Interviews suggest that such indirect cost transfer is already occurring. In India, data-processing fees are capped at 1–2%, yet consumer protection specialists report these costs are frequently "roundtripped" into loan processing or bundled service fees. Similarly, interviews suggest that in Egypt and South Africa, many fintechs have adopted tiered or freemium models, offering basic services free while charging for value-added features such as automated debt management, micro-investment products, or personalised advice. This tension is acute for data users serving low-income customers: services may need to be free to those who cannot pay, while data access costs still need to be recovered. The result may be a disincentive to serve underserved segments, risking market withdrawal or a narrowing of product offerings, and with it a direct risk to financial inclusion.

Beyond monetary costs, consent itself imposes a burden: the time, cognitive effort, and digital capability required to navigate authentication and authorisation processes.lii As existing literature notes, customers may "pay" not with money but with their data and attention, costs that remain largely invisible to the end user.liii Stakeholders from South Africa highlighted that complex, multi-step consent flows act as a "time tax", disproportionately excluding digitally illiterate or low-capacity users. Some countries are responding proactively. Australia's CDR, for example, requires both data holders and accredited recipients to provide online dashboards where consumers can view all active consents, understand what data is shared, and withdraw access at any time, making consent management transparent and keeping users in control.liv This aligns with user-centric UX and data stewardship guidance, such as that of the Open Data

Institute, which promotes clear, understandable, and user-centric control throughout the consent and access process.lv

Looking ahead, while regulators were strongly opposed to charging at the point of consent, fintechs and independent intermediaries acknowledged that future charging mechanisms may emerge, particularly for value-added services such as payment initiation. Their long-term viability will depend less on customers' ability to pay than on whether the value exchange is transparent, immediate, and clearly understood. As a consumer rights advocate from the MENA region noted, "Customers are willing to 'pay' with their data, but only if they see an immediate benefit." Ensuring Open Finance remains affordable, low-friction, and value-transparent for customers will therefore be central to sustaining trust and inclusion as these ecosystems mature.

1.3: Incentives for Data Holders in Open Finance

While commercial models are an important component of Open Finance frameworks, they are not the only mechanism shaping participation. Regulators and ecosystem participants may also draw on a

broader set of incentives, both financial and nonfinancial, that influence how institutions perceive the costs, benefits, and strategic value of engaging.

Table 4: Financial Incentives for Data Holders in Open Finance Ecosystems

Grants and Support for Enabling Infrastructure

Cost Deferral through Phased Implementation

Grants and donor funding can support the foundational digital and payments infrastructure Open Finance requires, indirectly lowering the cost of participation for data holders. Nigeria, for instance, reported donor-supported investment in system-level digital financial infrastructure, including a USD 10.5 million World Bank grant to upgrade the central bank’s technology and payment systems.lvi Though not targeted at bank-level API implementation, such ecosystem-level investment can ease the introduction of Open Finance by improving shared infrastructure, supervisory capacity, and interoperability.

Phased compliance can act as an incentive by deferring costs and spreading the implementation burden over time, particularly for smaller institutions. Brazil's four-phase approach gave smaller banks and credit unions additional time to comply, postponing major expenditure,lvii while Australia's CDR onboarded the four largest banks first before extending obligations to regional and smaller institutions.lviii This sequencing can allow later entrants to benefit from established standards, tooling, and regulatory clarity, easing compliance for those with limited technical and financial capacity.

Centralised Infrastructure and Shared Utilities

Revenue-Sharing Agreements

Centralised infrastructure can substantially reduce individual implementation costs by enabling institutions to connect to shared systems rather than building bespoke solutions. India’s AA framework and UPI provide examples of shared digital infrastructure that can lower technical barriers for participating banks.lix In the UK, the Competition and Markets Authority (CMA) required the nine largest banks to collectively fund the Open Banking Limited (OBL), which developed common standards and infrastructure.lx While this was a legal obligation rather than a direct fiscal incentive, it distributed implementation costs across the largest institutions and reduced duplication by avoiding the need for each bank to develop its own standalone solution, thereby reducing overall system-level costs.

Alongside formal regulatory interventions, certain incentive structures may also emerge organically among participants. For instance, revenue-sharing models can align incentives by allowing data holders to benefit from ecosystem growth. Under such arrangements, banks may receive referral fees or revenue shares when data users use bank-provided data to originate paid services. In the UK, credit-scoring and lending-marketplace applications such as Salary Financelxi and Aboundlxii operate on commission-based referral models, while similar approaches are observed in Australia through platforms such as WeMoney.lxiii As Open Finance ecosystems mature, these models may become increasingly important in ensuring that data holders capture some of the downstream value generated through data sharing, supporting long-term participation.

Source: CCAF, Fii and BIS

In addition to financial incentives, non-financial mechanisms can also play an important role in encouraging participation. These approaches often focus on reducing implementation barriers, fostering

collaboration, or creating strategic benefits that make engagement in Open Finance more attractive for data holders.

Table 5: Non-Financial Incentives for Data Holders in Open Finance Ecosystems

Reciprocity

Data holders have argued that if they are obliged to share their data with TPPs, those entities should share equivalent data in return, framing this as "reciprocity" in principle. In its strict sense, the term implies mutual obligation and roughly symmetric exchange, and on that reading, regulators have generally resisted it: the data is not the data holder's but the customers’, and in an Open Finance ecosystem, it is the customer who chooses with whom it is shared. The strict sense also sits uneasily with the underlying economics, since the data held on either side is rarely equivalent in nature, volume, or structure, and the access each party needs may differ. Reciprocity has proved more useful here as a design mechanism than as a principle: rather than requiring symmetric exchange, regulators have conditioned access or benefit on contribution in order to induce meaningful participation where they have been unable or unwilling to mandate it. Among the nine EMDEs, six reference reciprocity, whether through explicit regulatory provisions or as an articulated design expectation. Across the sample, it takes three observable forms, united less by symmetric exchange than by the conditioning of access or benefit on contribution: direct/ bilateral reciprocity, where the return comes from the counterparty; public-data reciprocity, where the return is consented access to government-held datasets rather than data from the consuming institution; and generalised/multilateral reciprocity, where participants contribute to and draw from shared infrastructure without equivalence between any two parties. This typology is provisional, and research covering more countries may reveal further forms.

Brazil illustrates direct/ bilateral reciprocity most clearly. Joint Resolution No. 1/2020lxiv distinguishes mandatory from voluntary participation: for the largest institutions,7 data sharing is compulsory regardless of what they receive, whereas for voluntary participants, reciprocity is an explicit condition of entry, with access granted only to those who also make their own data available through APIs.lxv One fintech expert described the ecosystem as increasingly dynamic, with institutions shifting between data-holder and data-user roles as they expand, contributing to balance and competition. Published data for January to March 2026 bear this out: the largest data transmitters were also among the largest recipients, and in some cases received more data than they transmitted (Figure 6).lxvi This balance, however, seems to be concentrated among the largest incumbents. Smaller participants often contribute substantial volumes without equivalent return; BMG Bank and Shopee, for instance, ranked among the top 20 transmitters (roughly 250 million successful API calls) yet did not appear among the top 20 recipients.lxvii In practice, differences in data richness, customer relationships, and business models limit how far bilateral reciprocity alone can serve as a sufficient incentive: certain Payment Initiation Service Providers (PISPs), for instance, rely on access without generating comparable flows in return.

Table 5: Non-Financial Incentives for Data Holders in Open Finance Ecosystems (continued)

Reciprocity (continued)

India, which does not mandate bank data sharing, illustrates public-data reciprocity, in effect an inducement to participate absent the legal power to compel it. India's Goods and Services Tax Network (GSTN) is a designated data provider within the AA framework, so a bank contributing consumer account data can, with the customer's consent, also access that customer's GST returns and filing history.lxviii The reciprocal return is not data from the consuming institution but access to valuable government datasets, making the exchange multi-directional rather than purely bilateral. The model is attracting international interest: Thailand's "Your Data" initiative, targeted for operational readiness in 2026, plans consent-based transfers between financial institutions and government agencies including tax data;lxix the UK's CFIT 2024 Open Finance Blueprint identified HM Revenue & Customs datasets such as VAT and corporation tax records among the highest-value for priority consumer and MSME use cases;lxx and New Zealand's Inland Revenue Department has sought information on the role of tax data in Open Finance.lxxi

Singapore's SGFinDex illustrates generalised/multilateral, reciprocity, operating on a similar logic to India's public-data model but through centralised shared infrastructure rather than intermediaries. Seven major institutions, including Citi and HSBC, alongside agencies such as the Inland Revenue Authority of Singapore, contribute to a shared platform through which participating banks and the Ministry of Manpower provide financial-planning applications to users.lxxii Unlike bilateral exchange, value does not depend on direct equivalence between any two participants: a bank may share data with an institution that contributes little in return yet still benefits by accessing datasets from others in the network. Reciprocity here operates at the ecosystem level.

Among the other EMDEs studied, Ghana's draft directive names reciprocity as a guiding principle without yet developing operational provisions;lxxiii as one SSA regulator put it, "Reciprocity seems like one of the quicker low-hanging fruits that may be necessary to encourage participation, especially by the large banks." In the Philippines, stakeholders emphasised that clearly communicating reciprocity could shift the discussion from short-term cost recovery towards longer-term value creation. South Africa's FSCA treats data reciprocity as a matter for API design,lxxiv while the Intergovernmental Fintech Working Group (IFWG) warns that without it, BigTech firms gaining access could combine their existing data advantage with newly acquired financial data in ways that deepen rather than reduce asymmetries.lxxv

Standardised and Supportive Infrastructure

Phased Implementation for Capacity Developments

Many incumbents cite fear of data misuse, unclear liability, and regulatory ambiguity as key barriers to participation.lxxvi Common technical standards and security protocols can reduce operational uncertainty and provide a clear roadmap for participation. In India, for example, Sahamati has complemented standards with technical workshops and capacitybuilding programmes, offering hands-on guidance, templates, and ongoing support.lxxvii Clear guidelines and FAQs, such as those issued by the UK's OBL, can further reassure participants that they are operating within well-defined rules, lowering legal and operational risk.lxxviii

Phased implementation can signal regulatory flexibility, reduce coordination risk, and let institutions adapt gradually to new frameworks. Phasing need not be strictly sequential: tiers may be organised by data holder type, data type, or data sensitivity, and multiple streams may proceed in parallel, the core aim being to avoid a "big bang" deployment on a single date.lxxix Across the nine EMDEs covered, most have adopted or are considering staged approaches, though their nature and maturity vary.8 Brazil,lxxx India,lxxxi Indonesia, the Philippines,lxxxii and Saudi Arabialxxxiii are implementing or have implemented staged rollouts. Egypt, South Africa, and Nigeria are still formulating their roadmaps, though Nigeria's February 2026 fintech policy report identified the issuance of an Open Banking implementation roadmap and industry sensitisation as immediate priorities.

Industry literature highlights that staged rollouts can allow entities to incrementally build internal capabilities, learn from early adopters, and refine governance, technology, and consent processes.lxxxiv While this reduces upfront compliance pressure and spreads implementation costs over time, its most significant incentive effect may be non-monetary: phasing can function as a credible regulatory signal, reassuring participants that rules will evolve predictably, early operational challenges will be tolerated, and institutions will not be penalised for learning-by-doing. By lowering uncertainty around timing, expectations, and enforcement, phased approaches can build institutional confidence, particularly among mid-tier and smaller providers for whom regulatory ambiguity is often the primary barrier.lxxxv

8. Insights on Indonesia's and Egypt's phased implementation approaches are based on interview evidence gathered for this report rather than published regulatory documentation.

Table 5: Non-Financial Incentives for Data Holders in Open Finance Ecosystems (continued)

Figure 7: Adoption of Phased Implementation for Capacity Development and Reciprocity in Open Finance Initiatives (n=9)

Phased Implementation for Capacity Developments (continued)

Reputational and Strategic Advantage

Phased Implementation in Open Finance Initiatives (n=9)

Implemented (5): Brazil, India, Indonesia*, Philippines, Saudi Arabia

Planned (1): Ghana*

Under Consideration (3): Egypt, Nigeria*, South Africa*

Reciprocity in Open Finance Initiatives (n=9)

Implemented (2): Brazil, India, Philippines

Planned (3): Ghana*, Nigeria*, South Africa*

No Mention (4): Egypt*, Indonesia, Saudi Arabia

Source: CCAF, Fii and BIS; 'Implemented' reflects cases where phased implementation or reciprocity is explicitly codified in regulation or a published framework. 'Planned' reflects regulatory intent signalled through consultation papers, pilot documentation, or stakeholder interview evidence. *Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, Egypt remains at an early stage of development, and Indonesia's framework (SNAP) currently covers payment APIs only. In South Africa, no formal regulatory framework currently exists, although regulatory authorities have identified the two as a potential design consideration in consultation papers and stakeholder discussions. Evidence on Indonesia and Egypt is drawn primarily from stakeholder interviews rather than published frameworks.

Frameworks that reward early, visible participation in Open Finance can enhance reputation and strategic advantage for data holders. Those adopting new frameworks promptly can signal digital maturity, customer-centricity, and innovation leadership, gaining visibility that differentiates them from peers. Large banks can leverage this "reputational capital" to consolidate market share in platformised environments, while smaller banks may benefit from niche positioning and increased visibility. Policymakers can strengthen this incentive through public recognition programmes, innovation awards, and proactive communication of compliance leaders.

Source: CCAF, Fii and BIS

Market Structure and the Distribution of Incentives in Open Finance

The incentive to participate in Open Finance does not arise uniformly across institutions, and in EMDE contexts, it appears to depend heavily on which actors hold the data that matters. In markets such as Kenya and Uganda, the dominant data holders are not banks but mobile network operators (MNOs) and their mobile money subsidiaries. Because mobile money platforms dominate payments, they control the transactional data increasingly underpinning credit decisioning and customer acquisition. In such settings, banks may view Open Finance more favourably than competitive logic alone would predict. The interest is not that competitive concerns disappear, but that access to mobile money data, potentially more cheaply than through existing commercial arrangements, offers real gains in credit risk assessment and reach. The incentive to participate, therefore, arises less from regulatory compulsion than from the structure of competition itself. For MNOs, the value proposition is weaker. While Open Finance could, in principle, enable expansion into higher-margin lending and insurance, bank data may add comparatively little, reflecting a narrower, higher-income segment that overlaps only minimally with the customers MNOs already serve. Reciprocity-

based frameworks may therefore prove structurally uneven in these markets. This suggests that data reciprocity alone may be insufficient to sustain EMDEfocused ecosystems and that policymakers may need alternative incentive mechanisms that account for the uneven distribution of data value across institution types.

The Indian experience offers a useful contrast. Data sharing by banks was not mandatory, yet banks had reason to participate. Bank account penetration was low, so participation offered scope to acquire new customers; the credit card business was negligible, so interchange revenue was not materially at risk; and participation could open access to valuable government datasets. The configuration of incentives differed from that in mobile-money-dominated markets, but in both cases, participation reflected the underlying market structure rather than mandate alone. Taken together, these cases make a strong case for an approach to Open Finance that reflects local circumstances, since the distribution of incentives is shaped by who holds data of value and what each institution stands to gain from access.

1.4: Incentives for Data Users in Open Finance

While commercial models can create incentives for data holders, their implications for data users are often more complex. Fee-based access or other monetisation approaches may raise the cost of participation, potentially limit entry or reduce the diversity of participants in the ecosystem. Even where no formal commercial model exists, data users must

still invest significantly to integrate with Open Finance infrastructure, develop services, and meet regulatory and technical requirements. Policymakers may therefore consider additional incentives to encourage data user participation and support a competitive, innovative ecosystem.

Table 6: Financial Incentives for Data Users in Open Finance Ecosystems

Grants and Subsidies

Public grants and subsidies can support data users, particularly fintechs and other intermediaries, in developing and piloting Open Finance solutions. In Hong Kong, the Monetary Authority's Fintech Supervisory Sandbox provides funding of up to HKD 1 million (approximately USD 128,000) under the Public Sector Trial Scheme for eligible pilot projects testing innovative fintech solutions, including API-based technologies, in collaboration with regulated institutions.lxxxvi

Tax Holidays

Regulatory

Sandbox & Pilot Experimentation

Beyond direct grants, governments can also use fiscal incentives such as tax holidays to encourage fintech innovation and financial inclusion. Ghana, for example, offers a comprehensive set of tax incentives for digital businesses. Under the Ghana Investment Promotion Centre framework, businesses in priority sectors, including IT and software development, may receive corporate income tax exemptions of up to 10 years, with additional location-based incentives for operations in lessdeveloped regions.lxxxvii The Income Tax Act further provides R&D deductions for eligible technological innovation, while capital allowances let businesses deduct the cost of IT infrastructure such as servers, networking equipment, and software systems over multiple years.lxxxviii

Regulatory sandboxes and pilots have been widely adopted globally as a tool to reduce entry barriers and compliance costs for fintech innovators by allowing firms to test products and business models in a controlled environment. The Philippines’ Open Finance PERA Pilot, launched by the central bank in 2025, uses consent-based KYC data sharing between banks, e-wallets, and retirement account administrators to streamline customer onboarding and expand access to the country's voluntary retirement savings programme.lxxxix Similar objectives have been pursued through other innovation support mechanisms. For example, the UK has complemented its regulatory sandbox with the Smart Data Accelerator, which supports the development and testing of Smart Data use cases through funding and ecosystem-building activities.xc Empirical evidence suggests that participation in regulatory sandboxes is associated with meaningful economic benefits for fintechs: in the UK, sandbox graduates were about 50% more likely to raise external funding and saw an approximately 15% increase in the amount of capital raised, while broader analysis shows that fintech investment relative to GDP increased by around 75% following sandbox implementation.xci While these figures relate to sandbox participation more broadly and cannot be directly attributed to data-sharing activity, they provide some indication of the commercial benefits that supervised experimentation can generate for fintech firms operating in regulated environments.

Attracting Investment

Participation can also catalyse investment into financial institutions, fintechs, and complementary digital services by demonstrating alignment with modern, interoperable ecosystems. The United Arab Emirates (UAE), for example, has used regulatory innovation, including its Open Finance Regulation under the Financial Infrastructure Transformation (FIT) programme,xcii as part of a broader strategy to develop a world-class digital economy and attract fintech investment: in 2023, fintech funding in the UAE rose 92% year-on-year despite a global downturn, helping the country break into the top 10 globally for fintech investment.xciii More rigorous causal evidence from AEs points in the same direction. Drawing on data from 2010 to 2019, one analysis finds that following the announcement of the Second Payment Services Directive (PSD2), European Economic Area (EEA)-licensed firms attracted greater investment than comparable US firms, with total funding rising by an average of 5.8% a year and the number of funding rounds increasing by 90.8% annually. These effects appear strongest among B2B firms, younger firms of five to ten years, and small firms of fifty employees or fewer.xciv A separate study of 406 Spanish fintech firms over the period 2014 to 2022 indicates that payment-services fintechs experienced a 23% improvement in return on assets following PSD2, a gain driven by revenue growth rather than cost reductions.xcv A Bank of England study points in the same direction. Using the staggered implementation of Open Banking policies across countries in a difference-in-differences design, it finds that the number of venture capital-backed fintech financings rose by a third and the amount of money invested doubled following Open Banking policy adoption.xcvi

Source: CCAF, Fii and BIS

Financial incentives represent one approach to supporting participation from data users. However, non-financial mechanisms can also play an important role by reducing operational barriers, supporting

innovation, and improving the overall accessibility of Open Finance frameworks. Table 7 highlights a range of non-financial incentives that may encourage engagement from data users.

Table 7: Non-Financial Incentives for Data Users in Open Finance Ecosystems

Regulatory Sandboxes

First-Mover Influence

Regulatory sandboxes can also serve an important facilitative role. By providing a supervised environment like SAMA’s Open Banking Lab,xcvii they can signal regulatory willingness to engage constructively, lowering perceived legal and operational risk. This can be particularly valuable in Open Finance ecosystems, where products often span banking, securities, insurance, and pensions. In such cases, interoperability between regulatory sandboxes can further reduce compliance burdens by allowing firms to engage with multiple regulators through a coordinated process rather than navigating separate testing regimes. India's Inter-Operable Regulatory Sandbox (IoRS) framework, introduced by the Reserve Bank of India, is one example of such coordination across financial sector regulators.xcviii

Regulators can structure early participation to reward data users who engage from the outset. Early adopters may gain the ability to shape key aspects of the ecosystem, including technical standards, consent flows, and data formats, influencing how the market develops. In Brazil, for example, early fintech participation allowed regulators to refine operational and technical requirements based on real-world feedback.xcix By signalling that early involvement carries the opportunity to shape ecosystem design, authorities can create a compelling non-monetary incentive, while data users can also benefit by reducing future adaptation costs and aligning emerging rules with their existing business models.

Reputational and Strategic Advantage

Structured Collaboration and Ecosystem Support

Like data holders, data users can also benefit from early, visible participation. By engaging promptly and in a high-quality, compliant manner, they can signal innovation, reliability, and alignment with modern, interoperable financial ecosystems, enhancing market visibility, attracting partnerships, and increasing investor confidence, particularly in EMDE contexts where regulatory credibility is a strong signal to private capital.c Policymakers can reinforce this through public recognition programmes and innovation awards, extending the reputational benefits that accrue to data holders and fostering a culture of early, proactive engagement across the ecosystem. In some countries, early participation has also been linked to broader cross-sector data-sharing agendas, as regulators view reciprocal and interoperable data ecosystems as foundational to wider digital and innovation policy objectives.ci

Regulators can use structured collaboration mechanisms to incentivise data users by signalling that participation will be supported, coordinated, and continuously shaped through dialogue, rather than left to bilateral negotiation or fragmented market dynamics. Innovation hubs, hackathons, industry bodies, and technical working groups can provide visible assurance that authorities are committed to facilitating cooperation between data holders and data users. Several countries have institutionalised such mechanisms. In South Africa, the IFWG offers a formal platform for dialogue between regulators, banks, and fintechs, enabling joint experimentation and iterative feedback as the country advances towards Open Finance.cii In India, Sahamati plays a coordinating role under the AA framework by convening banks, Non-Banking Financial Companies (NBFCs), and fintechs to resolve implementation challenges, align on consent artefacts, and share operational learnings.ciii In Saudi Arabia, the Saudi Financial Academy has hosted Open Banking-focused hackathons, bringing innovators, mentors, and ecosystem participants together to prototype use cases within a regulator-supported setting.civ

Guaranteed and High-Quality Data Access

Regulators can also use guaranteed, rules-based access to high-quality data as a non-monetary incentive for data users. By specifying who can access which datasets, under what conditions, and at what minimum quality standards, authorities can reduce uncertainty and signal that participation will not leave data users exposed to arbitrary restrictions or unusable data. Several countries embed this incentive directly in their frameworks. Under the European Union’s (EU) PSD2, banks must provide licensed TPPs with free access to payment account data through dedicated APIs.cv Brazil enforces minimum API performance and data quality standards, addressing concerns that nominal access could be undermined by poor reliability.cvi Australia's CDR specifies detailed data standards, uptime requirements, and conformance testing, giving accredited data users confidence that the data they receive will be usable for commercial deployment.cvii As one interviewee noted, even when raw data is technically accessible, it is rarely "gold" until cleaned, validated, and transformed into a usable form. Others highlighted that data delivered in a standardised format can still be misleading or incomplete if underlying values are inaccurate or inconsistent, making downstream processing costly and error-prone.

Source: CCAF, Fii and BIS

1.5:

Incentives for Customers in Open Finance

In Open Finance, customers are often asked to share sensitive financial data in exchange for aggregation benefits that may feel vague or long-term, such as budgeting tools or financial insights, rather than immediate and tangible gains. As a result, customers may struggle to perceive the value of Open Finance in their everyday financial lives.cviii Awareness also remains limited in many markets. As one interviewee noted, "Customers are often passive users and might not necessarily know that what they're participating in is Open Finance." A 2024 British survey9 found that only around 46% of respondents were aware of Open

Banking, with a significant share uncomfortable or uncertain about sharing personal financial data.cix

The extent to which conceptual awareness matters, however, is debatable: evidence suggests customers may not need to understand the underlying infrastructure, only to experience that it delivers convenience and tangible value. India's AA ecosystem is illustrative: a separate survey10 found willingness to share data in exchange for better loan offers rose from 33% in 2023 to 71% in 2024, with respondents citing convenience and trust in the lender as primary drivers, rather than awareness of the AA framework itself.cx

Spotlight: Investment Platforms as a Case Study in Open Finance Incentives

Investment platforms occupy a distinctive position within Open Finance ecosystems. Unlike most financial institutions, which are primarily cast as data holders with limited commercial motivation to share, investment platforms are natural data users, and among the most commercially motivated ones. Access to consented transaction data, account balances, income flows, and existing assets allows platforms to assess customer suitability more accurately, reduce onboarding friction, and deliver personalised investment recommendations grounded in a customer's actual financial position rather than a static risk questionnaire.cxi For these platforms, Open Finance is not a compliance obligation, but rather a product input.cxii

This distinction matters for incentive design. The adoption challenge in Open Finance is often framed around persuading data holders to share and customers to consent. Investment platforms illustrate a different dynamic: when data sharing is embedded in a service that customers actively want, including managing savings, building towards a financial goal, and tracking wealth alongside everyday spending,

the consent problem largely resolves itself. Customers share because the value exchange is immediate and tangible, not abstract.cxiii This is the participation model that the incentive frameworks discussed in this chapter are ultimately trying to replicate across the broader ecosystem.

The commercial models these platforms have developed also offer a useful template. Across markets, the most sustainable approaches do not charge customers for data access directly, a structure that, as discussed previously, reliably suppresses adoption. Instead, platforms monetise the services built on that data: subscription tiers for advanced analytics, outcome-linked fees, or premium features such as automated savings sweeps and goal-based planning tools.cxiv The data is free to the customer at the point of consent. The value-added layer is where pricing occurs. This mirrors the freemium logic that regulation in Brazil and guidance in South Africa have begun to formalise and suggests a commercially viable path that requires neither mandatory charging frameworks nor permanent free access.

9. The survey was conducted on a representative sample of 200 respondents from the UK’s adult population who have used or are currently using thirdparty banking applications.

10. The survey was conducted on a representative sample of 1,860 respondents from India’s adult population, including both men and women, with access to smartphones. The data collected was gathered through in-person interviews over a three-month period, from September to November 2024.

Looking ahead, two developments will intensify both the opportunity and the regulatory challenge. Dataenhanced robo-advisors, already moving beyond static questionnaires towards real-time cash-flow analysis and behavioural signals, will increasingly depend on continuous, high-quality Open Finance data feeds to function effectively. More significantly, agentic AI systems are beginning to move beyond passive data aggregation towards delegated financial action,

automatically rebalancing portfolios, adjusting savings rates, or reallocating assets in response to changing financial circumstances.cxv In this model, customers are not simply consenting to data sharing but are delegating financial agency. This evolution makes the design of consent frameworks, liability allocation, and accountability mechanisms not a peripheral regulatory concern but a precondition for the ecosystem to function at all.cxvi

While financial incentives can play an important role in encouraging participation among data holders and data users, their application on the customer side is considerably more limited. Here, "customers" encompass not only individual end users but also businesses and, in some cases, public sector entities that participate in or benefit from data-sharing ecosystems. Few countries deploy explicit ex-ante fiscal incentives such as subsidies or direct rewards specifically to induce customer participation. Current academic research attributes early "deficient performance" in the UK and the EU to a fundamental failure to place the customer at the centre of ecosystem design, which in turn failed to generate compelling use cases for both customers and banks.cxvii

Where customer-facing incentives do exist, they are typically narrow in scope or implemented through market-led mechanisms rather than regulatory mandate. In some markets, merchants using Open Banking payment rails, generally cheaper than card networks, may pass cost savings to customers through discounts or cashback.cxviii Fintechs have also experimented with reward-based adoption strategies: in the UK, the payments provider Banked reported a

130% increase in usage of its Open Banking payment initiation services after partnering with a digital rewards platform to offer gift cards at checkout.cxix

Beyond these cases, customer engagement seems primarily driven by the anticipated benefits of participation, including lower prices, improved access to credit, and greater convenience. While economically significant, these are better understood as outcomes of Open Finance adoption than as deliberate fiscal incentives designed to drive uptake. The distinction matters: unlike other ecosystem actors, customers are rarely directly or systematically incentivised through fiscal policy and are often treated as passive participants whose engagement is expected to follow from downstream benefits. As one senior director at a global payments company in the EMEA region observed, "In countries such as Nigeria, there are currently no explicit mechanisms to incentivise end users to participate in Open Finance, and customer-level incentives have not yet been systematically considered." Given the limited role of direct economic incentives, regulators may instead encourage participation through non-economic measures that build trust, improve transparency, and reduce barriers to use.

Table 8: Non-Financial Incentives for Customers in Open Finance Ecosystems

To address these barriers, regulators have begun deploying targeted education initiatives that simplify Open Finance and build trust. The goal is not for customers to understand the term "Open Finance" but to know their rights when sharing data and the benefits they can expect in return. In the Philippines, the central bank has emphasised customer awareness of data safeguards, risk disclosures, and dispute resolution in its Open Finance pilot consultations.cxx The Financial Consumer Agency of Canada (FCAC) has allocated USD 1 million for a campaign explaining how customer-driven banking works and what rights and protections customers hold.cxxi Australia's CDR website provides plain-language FAQs, videos, glossaries, and explanatory materials covering how the system works, how consent is managed, and how customers can exercise control over their data.cxxii The UAE's central bank similarly hosts a public Open Finance page in plain language aimed at end users rather than industry stakeholders.cxxiii

Regulators can encourage customer participation by promoting streamlined consent mechanisms that make data-sharing decisions intuitive, transparent, and low effort. In Australia, customer experience guidelines specify concise language and visual aids, require pre-consent guidance to build trust before customers are asked to share data,cxxiv and mandate a centralised dashboard through which users can view, manage, and withdraw consent.cxxv Brazil, New Zealand, and the UK have introduced comparable Customer Experience Guidelines to prevent incumbents from deliberately introducing friction into consent journeys, while the UAE mitigates this risk through a standardised API-platform journey that guarantees a uniform user experience across participants.

Where such standards are absent or poorly enforced, the consequences for adoption can be significant. As one data governance expert from the European region observed, "When the banks in the UK were initially mandated to provide those services, the interfaces were often clunky and untrustworthy, with numerous warning signs or unnecessary steps that discouraged users from proceeding. The subsequent introduction of mandatory UX standards for banks participating in Open Banking transformed the experience, improving usability and facilitating customer adoption". Research suggests that overly complex or repetitive consent prompts can lead to "consent fatigue," whereas intuitive designs that integrate consent into contextual moments of value creation, such as immediately before a service benefit is delivered, can improve uptake and trust.cxxvi Consent mechanisms are discussed in greater detail in the next chapter on Liability Frameworks.

Table 9 presents the Open Finance Customer Enablement Score, a composite measure capturing the extent to which regulators and industry bodies actively support customer participation across three dimensions: consent and customer experience standards, customer-facing educational materials, and customer awareness initiatives. Each dimension is scored from 0 to 1 depending on whether support comes from official or non-official sources, for a maximum score of 3.11 The score measures the presence of customer enablement mechanisms rather than customer outcomes and therefore does not capture actual levels of awareness, trust, understanding, adoption, or engagement among end users.

11. A dimension is scored 1 when the relevant output has been produced or mandated by a regulator or other officially designated body; 0.5 when an equivalent output exists but has been produced by a non-official body, such as an industry alliance or private-sector organisation; and 0 when no relevant output has been identified.

Table 8: Non-Financial Incentives for Customers in Open Finance Ecosystems (continued)

Streamlined Consent and UX Design (continued)

Source: CCAF, Fii and BIS; AE = Advanced Economy; ✔ = Yes ~ = Partial – = No; *Canada recently transitioned to a regulated Open Banking regime in March 2026 after years under a voluntary framework. Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, South Africa has not yet taken a formal position in policy or recommendation papers, and Indonesia's framework (SNAP) currently covers payment APIs only. Egypt is excluded as it remains at an early stage of development.

A few observations emerge from the scoring. Brazil and India are the only EMDE markets in the sample to achieve the maximum score of 3, supported by CGAP surveys that track customer awareness, trust, and willingness to share data over time.cxxvii At the other end, Ghana, and South Africa score 0 across all three dimensions, consistent with their earlier stage of framework development. The UK scores 2 on the strength of UX standards and customer-facing guidance, including evidence-based design techniques such as notifying customers when they are approaching their last opportunity to review information before deciding, and presenting key terms in FAQ format, but it lacks a regulator-led awareness campaign.cxxviii This gap has been formally recognised, with 2025 FCA research identifying customer trust, understanding, dispute resolution, and data protection as ongoing areas requiring further attention.cxxix

At the aggregate level, regulation-led markets score higher on average than market-driven ones (2.05 versus 0.63), suggesting that formal regulatory frameworks tend to be accompanied by more structured approaches to customer enablement. In market-driven EMDE contexts, regulators could consider introducing customer-facing incentives while still allowing markets to operate freely. AEs similarly outperform EMDEs on average (1.8 versus 1.33), though the gap is modest, and Brazil and India show that EMDE markets can achieve strong customer enablement scores where regulatory commitment is sustained. The analysis covers a small and heterogeneous sample of fifteen markets, and the patterns, while instructive, should not be generalised to Open Finance ecosystems more broadly.

Table 8: Non-Financial Incentives for Customers in Open Finance Ecosystems (continued)

Embedding Data Sharing into High-Frequency Financial Interactions

Another important incentive is the integration of data sharing into financial interactions that customers already perform routinely. Where data sharing is embedded into high-frequency touchpoints rather than presented as a standalone consent exercise, adoption can become organic rather than compliance-driven. Brazil illustrates this most clearly. Within the Pix ecosystem, credit offers can be integrated directly into the payment flow: when users attempt a transaction without sufficient funds, they may be prompted to share data from another institution in exchange for an instant credit line.cxxx Features such as journeys without redirection, Pix by biometrics, and Automatic Pix exemplify this synergy, making financial experiences simpler and more contextual.cxxxi By linking data sharing to an immediate, tangible benefit, Open Finance becomes a functional extension of everyday financial activity rather than an abstract "data project."

This contrasts sharply with markets where data sharing and payments remain siloed. In India, for example, customers use Unified Payments Interface (UPI) applications for payments but must switch to separate applications or consent managers to engage with the AA framework.cxxxii Adoption is further complicated by structural fragmentation: not all AAs have access to all data holders, requiring Technical Service Providers (TSPs) to bridge gaps between participants, an additional layer of complexity absent in models such as Brazil's, where mandatory reciprocity and interoperability apply across all participants. As a result, Open Finance remains disconnected from the everyday payment experience, a factor potentially limiting broader adoption.

Source: CCAF, Fii and BIS

1.6: Incentives in Open Finance: Regulatory Takeaways

Incentives matter regardless of whether the model is regulation-led or market-driven. Whether an Open Finance ecosystem is built through mandate or market initiative, it may underperform if key actors do not perceive clear and sustainable value in participation. Where data holders comply only with the letter of the law, incumbents may provide the bare minimum, often resulting in brittle, low-latency APIs that may fail to support high-volume fintech traffic. Mandates may establish a baseline level of participation, but financial and non-financial incentives are often needed to foster deeper and more meaningful engagement.

Incentives should be calibrated to market structure rather than assumed to revolve around banks. Banks are not always the principal data holders. In many EMDE contexts, mobile network operators and their mobile money subsidiaries dominate payments activity and therefore control the transactional data that increasingly underpins credit decisioning and customer acquisition, as is the case in Kenya and Uganda. In such contexts, incumbent banks may perceive Open Finance more favourably than expected, not because competitive concerns disappear, but because access to mobile money data – often at lower cost than existing arrangements – can offer meaningful gains in credit

risk assessment and customer reach. Regulators may therefore benefit from understanding the competitive environment and the distribution of dominant data holders within their ecosystem before designing incentives.

Explicit regulatory intervention in commercial models tends to generate evidence, while silence can produce opacity. Across the market-driven countries in the sample, commercial models are generally less specified in official frameworks, with several countries either remaining silent on pricing and compensation or leaving these matters largely to market participants. This may reflect a preference for flexibility during the earlier stages of development, but it can also create uncertainty and contribute to slower convergence towards interoperable and scalable practices. As an executive from a leading Egyptian bank observed, “In the absence of a mandate, every API call is a negotiation, which slows down the scaling of the entire ecosystem.” Regulators seeking data on commercial arrangements may benefit from being at least somewhat explicit in their frameworks. Transparency requirements, defined free-access thresholds, or formal recognition of bilateral pricing structures can all generate at least some publicly available evidence on how commercial terms operate in practice.

Differing approaches need not be interpreted as indicators of ecosystem maturity or effectiveness

A market-driven commercial approach (where the regulator does not intervene) does not necessarily imply an underdeveloped commercial environment, nor does a regulation-led commercial approach guarantee well-governed pricing outcomes. Saudi Arabia operates one of the more technically advanced ecosystems in the sample, with an active pricing market despite the absence of formal regulatory commentary on commercial arrangements. Conversely, Brazil's regulation-led freemium model represents the most explicitly codified commercial structure in the sample, even though reimbursement mechanisms above the free threshold remain inactive in practice. Even within regulation-led environments, approaches to commercial design vary considerably and do not appear to follow directly from the broader governance structure. Commercial model design therefore appears to constitute a distinct policy decision from governance structure, one that regulators seem to be making, or deferring, independently.

Commercial model design can benefit from flexibility and careful timing. Introducing pricing too early, particularly while alternative data access methods such as screen scraping remain available, can discourage data users from transitioning to Open Finance frameworks. During the scaling and growth stage, regulators may introduce requirements such as transparency, as in India, where agreed fees are published on the website, or specify that competition law is binding, as in the Philippines, where the central bank also engages in ongoing discussions with market participants to manage pricing outcomes without directly intervening in price-setting. Rather than introducing a full commercial model upfront, regulators could first build the underlying framework to signal future cost recovery and stable data-use rules without fixing prices too early. Brazil’s case suggests that, even without immediate charging, an early formal framework can support predictability and ecosystem growth. Its main benefit lies in institutional certainty during scaling rather than monetisation. However, long delays between design and implementation may also create uncertainty about when pricing will actually begin. In mature stages, the case for allowing some degree of commercial charging may become

more defensible. The competitive dynamics that made unrestricted pricing risky in the early stages may be partly addressed by years of data flows. However, models such as Saudi Arabia's, which do not prescribe charges, can still be defended, including approaches that allow customers to pay for value-added services built on their data.

A commercial model is one tool among many, and choosing not to implement one can be a legitimate policy decision. Regulators that are not yet ready to operationalise a commercial model, or that face market hesitation, need not view this as a barrier to progress. Instead, participation can be supported through grants, tax relief, and sandbox access, reciprocity provisions, reputational mechanisms, phased implementation, and effective government arrangements, which can be deployed individually or in combination. Strong regulatory leadership and the inclusion of commercially relevant data types can also serve as important levers.

Reciprocity can help rebalance participation incentives, but it works best when its limitations are understood. Cross-sample experience suggests reciprocity can be a powerful non-monetary incentive, particularly for data holders that might otherwise perceive Open Finance as a one-sided obligation. The underlying principle is straightforward: give something, get something, but its practical application can be uneven. Data reciprocity, in which a data holder shares data and receives data in return, is constrained by the fact that not all entities hold equally valuable data. PISPs, for example, typically do not hold data of comparable depth or quality to exchange with data holders. Reciprocal flows also require customer consent at each stage, meaning that reciprocity cannot be assumed to operate automatically as a balancing mechanism. A second variant is government reciprocity, where the state shares government-held datasets such as tax filings to encourage meaningful participation rather than mere compliance. This approach is already in use in India and Singapore and is being considered in countries such as New Zealand and Thailand. Overall, reciprocity can be useful but may not work as a standalone incentive. Beyond reciprocity, regulators can also consider incentives such as grants and support, as well as infrastructural measures such as centralised APIs that can help lower technical costs.

Phased implementation, sandbox access, and guaranteed data quality can reduce uncertainty for participants. Other incentives include phased implementation for data holders, regulatory sandboxes and pilot experimentation for data users, and guaranteed access to high-quality data, which regulators can specify more clearly in their frameworks. By defining who can access which datasets, under what conditions, and to what minimum quality standards, regulators can reduce uncertainty and signal that participation need not leave data users exposed to arbitrary restrictions or unusable data. A more pertinent question for EMDE regulators may be: what combination of incentives, in what sequence, and for which actors?

Customers are the missing piece and should be placed at the centre of ecosystem design. Evidence suggests that they do not need to understand the underlying infrastructure or the technical aspects of Open Finance. Rather, they may need to experience clear convenience and tangible value from data sharing

in their financial lives. Brazil's integration of Open Finance into everyday Pix journeys illustrates what is possible when customer activation is treated as a firstorder design priority. Within the Pix ecosystem, users may be prompted to share financial data in exchange for instant credit offers directly within the payment journey, linking data sharing to immediate and tangible customer value. Adoption can follow more naturally when data sharing is embedded in moments of genuine customer need rather than presented as a standalone consent exercise. By contrast, in India, data sharing under the AA framework remains more operationally fragmented and disconnected from everyday payment experiences, which may constrain broader adoption. EMDE regulators may therefore consider investing in customer awareness, streamlined consent and UX standards, FAQs and illustrations on the lead regulator's website, and mechanisms that make the value of participation more tangible, since it is ultimately the customer's decision to share data that allows the ecosystem to function.

Chapter 2 Understanding Liability in Open Finance

The previous chapter showed how the framework's first pillar, incentives, can encourage participation in Open Finance ecosystems. Participation, however, depends not only on the benefits of joining but on clarity about what

happens when things go wrong. Concerns around data misuse, consent failures, dispute resolution, and liability allocation remain central to whether data holders, data users, and customers enter and remain in the ecosystem.

At first glance, these concerns might appear to be addressed by existing financial services regulation. Liability frameworks, consumer protection mechanisms, and dispute resolution processes have long been features of the sector.cxxxiii The central argument of this chapter, however, is that Open Finance changes the picture in ways existing frameworks may not always address neatly. The multi-actor, data-intensive nature of these ecosystems creates accountability gaps, consent complications, and dispute resolution challenges that sit awkwardly within, and sometimes fall between, established regulatory regimes. Building on this, the chapter now turns to the report's second pillar: liability frameworks

This chapter traces liability across four interconnected areas. It begins by establishing the regulatory baseline: how liability and dispute resolution work in conventional financial services, and why that baseline matters as a foundation. It then examines what Open Finance adds, focusing on the structural features that complicate liability attribution, consent management, and customer redress. It examines how countries have translated liability and dispute resolution principles into practice, and where the gap between framework design and operational reality is widest. It then turns to the customer perspective, asking what all of this means for the individuals at the centre of Open Finance ecosystems. Finally, it draws out implications for EMDE regulators currently designing or refining frameworks.

2.1: How Liability and Dispute Resolution Work in Financial Services: The Baseline

Before examining what Open Finance changes, it is important to understand the regulatory foundations on which Open Finance frameworks are built. Liability frameworks, consent requirements, and dispute

The Legal Architecture

What is a liability framework?

A liability framework refers to the set of legal, regulatory, and contractual mechanisms that determine:cxxxiv

• Who bears losses when harm occurs;

• Who is required to compensate affected parties, and through what mechanism (for example, indemnification, reimbursement, or insurance); and

In most countries, the liability landscape for financial services is shaped by at least three overlapping regulatory domains: financial regulation, data protection law, and consumer protection law. Figure 8 illustrates this layering across the nine EMDEs examined in this report. These domains typically operate in parallel and are often administered by separate authorities, such as a financial regulator or central bank, a data protection authority, and, in some cases, a dedicated consumer protection body or ombudsman. Financial regulation establishes conduct standards and accountability obligations for licensed institutions, including banks, payment service providers, and increasingly fintechs. Data protection law governs how personal and financial data may be collected,

resolution mechanisms are not unique to Open Finance. They are longstanding features of financial services regulation that provide the legal architecture within which Open Finance arrangements operate.

• How risks are allocated among different participants in a system.

Liability frameworks interact closely with consent rules (which determine who is authorised to act) and with dispute resolution mechanisms (which determine how liability is enforced when things go wrong).

processed, shared, and retained. Consumer protection frameworks set out the rights of individuals in their dealings with financial institutions, including rights to information, redress, and fair treatment.

In practice, these domains do not always interact seamlessly. A data breach at a bank may engage both financial oversight and data protection obligations, while a mis-sold product may trigger consumer protection alongside financial conduct rules. Where institutional responsibilities are clearly allocated, such overlaps can usually be managed; where they are not, governance gaps may emerge. As the chapter will show, Open Finance often amplifies these coordination challenges rather than resolving them.

Figure 8: Timeline of Financial Regulation, Data Protection, Consumer Protection, and Open Finance Frameworks Across Selected EMDEs (n=9)

Source: CCAF, Fii and BIS; This timeline captures the year in which each regulation or framework was officially published or enacted, rather than the year it became operational or went live in the market. *Ghana's framework is in draft form, Nigeria's regulation has passed but is not yet operational, Egypt remains at an early stage of development, South Africa has not yet taken a formal position in policy or recommendation papers, and Indonesia's framework (SNAP) currently covers payment APIs only.

Consent in Financial Services

Consent is not new to financial services. Customers may need to authorise payments, agree to product terms, or permit the sharing of their data. Regulators have historically relied on consent as an important governance mechanism, requiring it to be informed, explicit, and revocable. Financial institutions may also be required to maintain records of consent, and when disputes arise, they typically involve a customer and an institution that is known, licensed, and directly supervised.

Consent is also one mechanism through which liability allocation can begin to take shape, determining who is authorised to access what data, for what purpose, and for how long. These choices directly affect how clearly responsibility can be attributed when harm occurs, making consent model design not merely a customer experience question but a liability design question. At the same time, consent alone is an insufficient

basis for liability attribution. Consent frameworks are typically designed by the parties seeking to minimise their exposure and may be framed broadly in ways that limit accountability rather than clarify responsibility. cxxxv They must therefore operate alongside laws and regulations that prevent consent from being structured to evade liability.

Two-Layer Dispute Resolution Model

What is Dispute Resolution

In the context of Open Finance, dispute resolution refers to the institutional processes through which customers seek redress for harms arising from data sharing, consent failures, unauthorised access, downstream misuse of data, or payment-related failures involving data holders, data users, or intermediaries.cxxxvi

While liability frameworks define how responsibility is allocated across actors, dispute resolution mechanisms determine whether those allocations can be meaningfully invoked, enforced, and experienced by customers in real-world settings.

Financial services dispute resolution in most countries follows a broadly similar architecture, regardless of whether Open Finance is involved, operating in two layers. The first consists of internal complaint-handling mechanisms maintained by regulated financial institutions: when a customer experiences a problem, such as an unauthorised transaction, a failed transfer, or a data-handling concern, their first port of call is typically the institution with which they have an existing relationship.cxxxvii The second layer provides an independent escalation mechanism, which may take the form of a central bank, financial ombudsman, consumer-protection authority, data-protection authority, or other designated body. This external layer

2.2:

introduces independence, sector-level expertise, and enforcement authority, ensuring that disputes do not remain trapped within bilateral relationships where institutions may have incentives to minimise or delay resolution.cxxxviii

This two-layer structure, together with consent requirements and the broader legal architecture surrounding financial services, is not new. The more analytically significant question is what Open Finance adds: what new complications it introduces, where existing mechanisms prove insufficient, and what additional infrastructure or design choices are needed to make liability frameworks function effectively.

Why Open Finance Changes the Picture

Open Finance does not create liability and dispute resolution from scratch; it inherits the frameworks described in the previous section. What it does is introduce structural features that complicate those frameworks in ways they may not always address neatly. This section identifies what is genuinely different about Open Finance, distinguishing features that are novel from those that represent intensified versions of existing challenges.

Novel Risks vs Exacerbated Risks

A useful starting distinction is between risks that are genuinely new in Open Finance and those that are intensified versions of pre-existing challenges. This matters because not all Open Finance risks demand the same regulatory response: some can be addressed by adapting existing frameworks, others may require new mechanisms.cxxxix

The most genuinely novel feature is the creation of data-sharing arrangements in which a regulated data holder must share customer data with third parties it has not voluntarily chosen to engage. In conventional financial services, data sharing extends well beyond the financial institution itself, to vendors, core processors, and a wide range of unsupervised entities. What makes traditional arrangements work is that the data holder selects its counterparties through voluntary contracting, allowing it to manage risk and extend supervision through that contractual relationship. Open Finance breaks this logic: data must flow regardless of whether the data holder has any prior or voluntary relationship with the third party, creating a supervisory vacuum that the data holder's own risk management cannot fill.cxl

This vacuum generates the chapter's central liability question: who is accountable to the customer when something goes wrong?cxli Long chains of actors are not new to finance; banks have always relied on processors that themselves rely on sub-processors, but in traditional arrangements, the customer-facing accountability is clear. If a data breach at a core processor causes a loss, the bank and processor may dispute who ultimately bears the economic cost, but the customer can, and should, go to the bank. Open Finance may break this. In a multi-party flow involving entities with no contractual relationship to one another, it can be genuinely unclear to the customer whether responsibility rests with the data holder, the TPP, or some shared arrangement, and which door to knock on for redress.cxlii Other Open Finance risks, by contrast, are best understood as intensified versions of existing problems. Security breaches and unauthorised access are not unique to Open Finance, but broader data-sharing ecosystems multiply potential points of vulnerability. The risk of customers poorly understanding consent already exists in conventional banking; Open Finance may increase both the number and technical complexity of consent decisions customers face.

For regulators, this suggests a two-track design approach. The genuinely novel features, particularly the multi-party accountability gap, may require new rules, institutional coordination mechanisms, and supporting

infrastructure. The intensified features can often be addressed by extending existing frameworks through stronger consent requirements, clearer data protection obligations, and improved enforcement capacity. In many EMDEs, however, both tracks require attention simultaneously, often under significant regulatory capacity constraints.

Multi-Actor Accountability Challenge

The multi-actor nature of Open Finance creates challenges for liability frameworks. In particular, two interconnected issues arise:

First, there is uncertainty around what constitutes a breach and which regulatory framework and competent authority governs it. Breaches broadly fall into three categories:12 data-related (unauthorised access, misuse, excessive retention); transactionrelated (unauthorised transactions, authorised payment fraud, execution errors); and operational and technical (system outages, API failures, incorrect data transmission).cxliii These categories often do not sit neatly within the remit of a single regulator. Payment breaches are relatively well defined: under frameworks such as PSD2 in the EU and equivalent rules in Brazil, the data holder remains responsible to the customer for any unauthorised payment regardless of where the failure originated, and may then seek recovery from a downstream party without the customer having to navigate that chain. However, banks have argued that this creates a structural unfairness, with liability defaulting to the data holder rather than following the locus of the breach. Data-sharing breaches present a different challenge: liability is typically governed by broader data protection, consumer protection, and cyber infrastructure legislation, so the pertinent question is not whether rules exist, but which framework applies, who the competent authority is, and how data protection obligations interact with multi-actor Open Finance arrangements. Where these interactions are not clearly defined, governance gaps emerge, particularly in EMDEs where data protection frameworks are newer, and the division of responsibility between financial and data protection regulators may not yet be settled.

This fragmentation often brings coordination challenges between multiple regulators into scope simultaneously. Prior research estimated that 42 of 54 countries (77%) involve more than one authority in overseeing Open Finance implementation, including central banks and financial regulators.cxliv For instance, financial regulators may focus on the conduct of licensed institutions while data protection authorities oversee personal data processing without sectorspecific financial expertise, and problems involving multiple actors can therefore fall across institutional boundaries. These issues are especially visible with fraud and scams: Authorised Push Payment (APP) fraud, for example, may involve a customer being manipulated into consenting to a transaction, raising questions about the validity of consent, the responsibilities of the institution that processed the payment, and the role of TPPs that initiated or facilitated it. Addressing such cases may require coordinated action across regulators, supported by information-sharing arrangements and established channels for joint supervision. The implication for EMDE regulators is not necessarily a single Open Finance regulator but mechanisms for cross-authority coordination from the outset, including informationsharing protocols, approaches to joint supervision of multi-party incidents, and clearer processes for issues spanning regulatory mandates. India's AA experience illustrates that such coordination may extend beyond formal regulatory arrangements to operational and technical alignment across sectoral regulators and ecosystem actors, as discussed in later sections.

Second, while the respective duties of care for data holders and data users are conceptually distinct, enforcing them in practice is considerably more difficult 13 Data holders are responsible for the accuracy and integrity of the data they share; data users are responsible for how they process and apply it. If data is inaccurate, liability for any resulting harm sits with the data holder; if it is accurate, liability rests with the data user. Tracing whether a poor outcome

resulted from inaccurate data at source or flawed downstream processing can be difficult, particularly across interconnected systems with varying levels of technical capability and visibility, and is compounded where enabling legislation leaves significant gaps, such as not clearly specifying data accuracy obligations or recourse mechanisms.cxlv These attribution challenges may be further complicated in cross-border Open Finance arrangements, where questions of jurisdiction, liability allocation, supervision, and redress may arise (see Appendix).

Two approaches are commonly used to manage this, each with limitations. The first is infrastructurebased: audit trails, API logs, and incident reporting requirements can attribute responsibility by creating a verifiable record of data flows and system interactions, but these tools are absent or incomplete in several EMDEs surveyed, meaning fault determination is often unclear and can delay redress rather than being reliably evidence-based. The second is contractual: parties manage traceability gaps through indemnities and liability clauses, though this can shift risk to smaller intermediaries with limited control over underlying data or infrastructure and limited financial capacity to absorb losses, potentially reducing competition and discouraging participation.

Where liability is poorly targeted or unpredictable, it can become a disincentive in its own right. Entities facing uncertainty about when and to what extent they may be held liable may respond by limiting participation,cxlvi raising compliance costs, or adopting defensive behaviour, undermining the participation and innovation Open Finance seeks to promote.cxlvii As one senior Open Finance expert observed, "Insufficiently prescriptive legal frameworks create compliance challenges for both data holders and data users, while customers may face complex dispute resolution processes or even bear financial consequences for failures beyond their control."

13. Duty of care is a legal obligation requiring a person to take reasonable steps to avoid acts or omissions that may foreseeably cause harm to another person or their property.

Consent as a Regulatory Challenge

In conventional financial services, consent is typically bilateral and institution specific. In Open Finance, it becomes multi-layered: a customer may authorise a TPP to access data held at their bank, with that access potentially extending across aggregators, analytics providers, and downstream service providers, each raising questions about authorisation, accountability, and revocability. These challenges are more pronounced where some actors operate outside the traditional financial regulatory perimeter, a gap particularly relevant in EMDEs where licensing regimes for non-bank providers remain underdeveloped.14 How consent is structured, therefore, has direct consequences for both liability and participation. Consent models vary across design dimensions, including timing, purpose specificity, and data granularity,cxlviii shaping both how clearly responsibility can be attributed when harm occurs and the operational and compliance burdens on participants. The Appendix provides a comparative overview of these dimensions and their liability implications.

In practice, formal consent requirements do not always translate into meaningful user understanding or control. Interviewees consistently emphasised the gap between formal and informed consent. An expert from a Nigerian digital bank observed that consent is often "hidden in the fine lines," with technical and legal jargon used defensively, making informed consent difficult for the average customer. A consumer protection organisation in the SSA region noted that "customers are frequently unable to verify whether their data has been deleted after consent is withdrawn, leaving them effectively powerless despite the existence of formal rights." A senior fintech expert from Europe argued that "customer education alone is insufficient," emphasising the importance of "intuitive interfaces and tangible value propositions" such as consent dashboards that clearly demonstrate how data is being used and allow easy revocation.

These concerns have prompted attention to mechanisms supporting meaningful consent.cxlix One set of approaches focuses on customer visibility and

control through consent dashboards and related interface tools that allow users to monitor access, permissions, and revocation. Another focuses on governance, particularly specialised consent managers that standardise consent flows, manage permissions, and maintain auditable records of authorisation and revocation. This function differs from the broader role of technical intermediaries that primarily facilitate data exchange. India illustrates the governanceoriented approach: its Digital Personal Data Protection (DPDP) Act establishes the concept of a "consent manager," defined as a data fiduciary that "enables a data principal to give, withdraw, review and manage consent through an accessible, transparent and interoperable platform," with such entities licensed as non-banking financial companies.cl In Brazil, PrivacyTools provides a secure consent management interface aligned with both domestic and international privacy requirements, offering real-time traceability of consents, revocations, and rejections.cli EMDE regulators could also use accreditation mechanisms and data minimisation requirements to limit unnecessary data access and reduce the scope for misuse.clii Regulators are also increasingly exploring consent-related metrics, such as revocation rates or renewal frequencies, to monitor whether consent frameworks function meaningfully in practice. These provide a measurable link between consent design, accountability, and operational outcomes, and embedding them within supervisory frameworks can help identify emerging risks and misalignments. This reflects the third pillar of this report's analytical framework, performance measurement, which emphasises measurable indicators in assessing whether regulatory design translates into effective market outcomes.

Consent design and liability design are therefore closely interrelated. The way consent is structured can influence how responsibility is attributed when harm occurs, and the extent to which customers can access effective recourse. Regulators that treat consent as a customer experience matter, separate from liability architecture risk, creating systems where formal protections exist on paper, but accountability gaps persist.

14. In several African markets, mobile money is the dominant payment mechanism, yet it is operated by telecommunications companies rather than banks. This creates split oversight arrangements in which central banks supervise the activity while communications regulators oversee the infrastructure. M-PESA in Kenya, operated by Safaricom rather than a separately licensed financial entity, illustrates the challenge: where a payment failure or data breach involves such a provider, questions of regulatory jurisdiction and liability attribution may not have straightforward answers.

2.3: Liability Frameworks in Open Finance

Against the backdrop of the regulatory complexities introduced by Open Finance, this section examines how the nine EMDEs studied have addressed liability allocation, consent, and dispute resolution in practice.

Regulatory Approaches to Liability: Between Clauses and Full Models

In practice, few countries have explicitly defined a liability framework within their Open Finance regulatory documents. Most regulators avoid exhaustively prescribing liability outcomes, relying instead on existing legal architecture. This is not unique to Open Finance but reflects a broader pattern across digital financial services, where rapid innovation and multi-actor structures make fully codified liability frameworks difficult to operationalise.cliii

Regulators may instead impose targeted requirements that act as guardrails restricting certain activities. In the EU, for example, Commission Delegated Regulation (EU) 2018/389 requires banks to use secure standardised communication with licensed TPPs, effectively replacing unregulated screen scraping with controlled API-based access.cliv In other cases, regulators may impose mandatory registration on TPPs. Supported by appropriate infrastructure such as digital signatures and data trails, such requirements can improve auditability by making participant actions traceable and strengthening liability attribution.

In many EMDEs, however, this infrastructure remains uneven or still developing. During the transitional stage, liability is often left to market participants to determine through contractual agreements, including Service Level Agreements (SLAs) between data holders and data users and the channelling of customer-facing liability to specific actors through shared obligations

or non-transferable liability clauses.clv In Nigeria, for instance, actors must execute SLAs detailing the division of roles and responsibilities between data holder and data user, though implementation is not yet operational.clvi Differences in bargaining power in such bilateral agreements can result in liability being allocated in ways misaligned with where risks actually arise and with the capacity of parties to manage them, placing disproportionate burdens on weaker entities and complicating redress.

This creates another design challenge for EMDE regulators: the chosen liability framework may need to be calibrated not only to what is normatively desirable, but to what can be effectively monitored, investigated, and enforced with existing legislation and infrastructure. This requires a clear understanding of what already exists and how supplementary arrangements can be integrated with or developed alongside it. Within these constraints, several design questions remain open, including whether responsibility should attach at the point of harm or at the point of data access and use, and whether liability should be defined ex-ante or determined ex-post.

Conceptual Liability Models

To enable a structured assessment of existing legal architecture, four broad conceptual lenses can be identified: single-party liability,15 multiple-party liability, fault-based liability, and hybrid liability. These should be understood as philosophical frameworks capturing the dominant principles guiding liability allocation, not rigid categories. In practice, countries may combine elements from multiple approaches, transition between models as ecosystems mature, or align closely with one while incorporating features of others.

15.

Figure 9: Major Liability Models Observed in Open Finance Ecosystems

Single-party liability

Multi-party liability

Fault-based liability

Fully responsible for an incident, such as a data breach, fraud, and erroneous data sharing

Source: CCAF, Fii and BIS

Distributes liability between two or more actors in proportion to their contribution

Liability attached only when negligence, breach of duty, or demonstratable misconduct is established

Single-Party Liability

In systems aligned with a single-party approach, responsibility for all types of failure is assigned ex-ante to a specific participant, such as a data holder, data user, or intermediary, with limited or no contractual ability to transfer liability to the customer-facing level.clvii One participant bears exclusive responsibility for either the entire data sharing process or a designated domain within it: if a breach occurs within that scope, they are strictly liable regardless of the actions or omissions of other parties. This broadly aligns with the principle of strict liability in tort law, which assigns responsibility to the party best positioned to prevent harm, and in practice frequently defaults to incumbent banks, since they fall within the established regulatory perimeter and are subject to direct supervisory oversight.clviii The model prioritises clarity and enforceability, enabling timely customer redress without requiring customers to wait for investigations into which party was actually at fault. Behind the scenes, the liable party may seek to recover losses from the party responsible through its own contractual arrangements, though effectiveness depends on the quality of those contracts and the capacity to enforce them, conditions that may not always hold in EMDEs where smaller intermediaries have limited bargaining power and legal resources.

liability

Blends elements of single, multiple, and fault-based liability

Multiple-Party Liability

In multiple-party approaches, responsibility is distributed ex-ante among several actors within the ecosystem, either proportionally to their role or through shared responsibility arrangements.clix This model recognises the multi-party nature of Open Finance ecosystems and draws on joint-and-several liability concepts in lawclx and risk-sharing theory in economics.clxi Unlike single-party models, overlapping or shared obligations may attach liability to more than one actor for the same incident, regardless of whether individual fault is established. Defining responsibilities ex-ante gives participants clarity about their exposure before any harm occurs, reducing uncertainty and supporting more informed decisions about participation and risk management. The model can, however, introduce moral hazard, as participants may rely on others to cover losses, and may discourage participation where actors fear excessive or unpredictable exposure.clxii

Fault-Based Liability

In fault-based frameworks, responsibility generally arises only when negligence, breach of duty, or demonstrable misconduct can be established through the relevant dispute resolution or enforcement mechanisms. This approach determines both when liability is triggered and how it is allocated, with responsibility assigned ex-post on the facts of each case rather than defined ex-ante. In practice, determination may occur at several institutional levels, initially through internal complaint-handling mechanisms and, if escalated, through external bodies such as ombudsmen, regulators, or courts. The approach is consistent with traditional negligence frameworks in law and economic theories linking liability to effort.clxiii It avoids penalising compliant actors and aligns responsibility with actual behaviour, but is investigation-intensive: determining fault requires audit trails, API logs, and other evidence, which can delay redress and increase enforcement costs. In a fully digitalised end-to-end system with tamper-proof audit trails and digital signatures, fault attribution becomes considerably more tractable; without such infrastructure, it may be difficult, time-consuming, and prone to ambiguity.

Hybrid Liability

Hybrid frameworks combine elements of singleparty, multiple-party, and fault-based liability. Actors may hold sole liability for certain obligations, share responsibility for system-level failures, and be assessed on fault for incidents stemming from negligence. This approach reflects the heterogeneous risk landscape of Open Finance, where some risks are actor-specific while others are systemic. Grounded in principal-agent theory,16 hybrid liability seeks to align incentives across multiple actors while maintaining flexibility.clxiv Effective implementation requires clearly defined roles, dispute resolution mechanisms, and transparent rules.

Viewed through the lens of legal strictness, single-party models impose the strongest obligations on individual actors, followed by multiple-party frameworks that pool responsibility across actors. Hybrid models occupy a middle ground by tailoring liability to the nature of the risk, while fault-based regimes are the least stringent, since liability arises only on proof of negligence or misconduct. Table 10 sets out a comparative overview of each model's defining features, advantages, and limitations, providing a foundation for understanding how countries have implemented, or are beginning to implement, liability allocation in practice.

Table 10: Comparative Overview of Liability Models and Incentive Implications in Open Finance

• Clear accountability

Single-Party Liability

Responsibility assigned ex-ante to one specific participant, typically the data holder, with limited ability to transfer liability.

Multiple-Party Liability

Fault-Based Liability

Hybrid Liability

Responsibility distributed ex-ante among several actors, proportionally to role or through shared responsibility arrangements.

Responsibility arises ex-post only when negligence or breach of duty is established through dispute resolution mechanisms.

Combines singleparty, multiple-party, and fault-based elements, assigning different liability rules to different risk types.

• Enables timely consumer redress

• Easy to enforce within regulatory perimeter

• Reflects multi-actor reality

• Pre-defined roles reduce uncertainty

• Reduces individual burden

• Avoids penalising compliant actors

• Aligns responsibility with actual behaviour

• Flexible across incident types

• Most flexible approach

• Aligns incentives across actors

• Reflects heterogeneous risk landscape

• May over-burden data holders

• Misaligns incentives in multi-actor failures

• May discourage API openness

• Risk of moral hazard

• Complex to administer

• May deter participation if exposure feels unpredictable

• Investigationintensive

• Requires robust audit infrastructure

Drives security investment but may reduce willingness to share data broadly

Shared responsibility encourages participation but risks free-riding behaviour Brazil

• Can delay consumer redress Encourages responsible behaviour but increases enforcement costs and redress timelines

• Most complex to define

• Requires clearly defined roles

• Risk of gaps between liability categories

Balances incentives across actors but requires strong governance and dispute resolution infrastructure

Source: CCAF, Fii and BIS; *Egypt is not classified under any model as its framework remains at an early stage of development and the national data protection law is not binding on financial entities. Ghana has been classified based on proposed frameworks not yet in force. Nigeria's framework has been published but is not yet live. Philippines’ classification reflects existing market practices rather than a formally enacted regulatory framework. South Africa has not yet taken a formal position in policy or recommendation papers. Indonesia's framework (SNAP) currently covers payment APIs only.

Governance Approach and Liability: Observed Patterns

To examine how governance structures interact with liability allocation, Figure 10 maps the EMDEs

and selected AEs examined in this report along two dimensions: governance structure (the degree of regulatory intervention in data sharing) and liability allocation (the degree of liability strictness).

Figure 10: Liability Allocation Models in Open Finance Across Regulation-Led and MarketDriven Regimes (n=14)

liability

Source: CCAF, Fii and BIS; AE=Advanced Economy; *Egypt is not classified under any model as its framework remains at an early stage of development and the national data protection law is not binding on financial entities. Ghana is classified based on its draft framework, which is not yet in force. Nigeria's Open Banking regulation has been passed but is not yet live, South Africa remains at earlier stages of regime development, and Canada's Consumer-Driven Banking legislation, which had operated on a voluntary basis for years, received Royal Assent in March 2026. Indonesia's framework (SNAP) currently covers payment APIs only.

The following observations are drawn from a sample of eight EMDEs and six AEs. The sample is analytically purposive, selected to reflect a range of development stages and governance approaches, but it is not statistically representative; the patterns identified should be understood as illustrative tendencies within the sample rather than generalisable conclusions, and a larger comparative study would be required to test whether they hold more broadly.

The first pattern is that regulation-led countries tend to cluster in either fault-based or single-party liability models, often in conjunction with mandated,

standardised data-sharing regimes. Within the sample, 50% of regulation-led countries fall in the singleparty row, consistent with the expectation that stronger regulatory intervention in data governance is associated with more centralised and clearly delineated liability. India and Indonesia embed non-transferable, domain-specific obligations within their frameworks. The UK's APP fraud reimbursement framework, clxv and Canada's statutory non-transfer provisions also illustrate how such approaches can be operationalised. clxvi

A related but distinct clustering emerges among fault-based regimes, where allocation relies on attributing responsibility ex-post through evidence of conduct. Effectiveness is closely linked to institutional capacity, particularly the availability of audit trails, digital signatures, and enforcement mechanisms that enable reliable fault attribution, conditions more likely to hold in countries with advanced digital systems and mature regulatory institutions. Australia's position reflects a mature CDR framework with strong audit trail requirements and enforcement capacity, where fault attribution is tractable in ways that may not yet apply in most EMDEs. clxvii The UAE benefits from a centralised API infrastructure that supports monitoring of API calls and system accountability, clxviii alongside extensive investment in smart government infrastructure (the UAE ranked 9th of 69 countries in a 2025 digital competitiveness index), conditions that together strengthen traceability and support faultbased implementation. clxix Nigeria also appears in the fault-based row, but its placement warrants a different interpretation: the framework is not yet operational, and the proposed fault-based model has attracted criticism in stakeholder interviews for its operational complexity, an issue discussed in the following section.

The third pattern concerns market-driven countries in the sample, which cluster towards the lower right of the figure, where data sharing is voluntary rather than mandated and liability regimes are less stringent. This aligns with market-driven approaches' tendency to prioritise flexibility and minimise regulatory burdens by allowing liability to be determined expost. Liability within such regimes is therefore less uniformly defined and depends more on underlying legal frameworks and bilateral agreements. Faultbased approaches, however, are already operationally demanding, requiring high digital maturity and institutional capacity to trace, attribute, and resolve harms, so the combination of fault-based liability with market-driven governance may further complicate coordination and delay redress. More digitally advanced countries such as Hong Kong may be wellpositioned to support these models, but interviewees raised concerns about the Philippine context, where weaker digital infrastructure, low broadband penetration, persistent digital divides, and outdated

frameworks may constrain the effective operation of market-driven regimes that rely on ex-post mechanisms alone. clxx

Taken together, Figure 10 suggests that the relationship between governance models and liability design is not uniform. The intuitive expectation that higher regulatory intervention coincides with stricter liability, and vice versa, appears to hold more consistently in market-driven regimes, where liability is more frequently left to ex-post enforcement, bilateral agreements, and underlying legal frameworks. The relationship is less clear-cut among regulation-led countries: Canada, Saudi Arabia, and the UK combine mandated, standardised data sharing with strict single-party liability, while similarly interventionist Australia and the UAE adopt faultbased approaches instead. Liability design within regulation-led systems may therefore reflect broader policy choices beyond the degree of regulatory intervention alone, including preferences around customer certainty and rapid redress, the operational feasibility of ex-post fault attribution, and the balance regulators strike between accountability and ecosystem flexibility.

Spotlight: What is consent validity, and how is it structured across EMDEs?

Building on the previous section's discussion of consent frameworks, consent validity emerges as a commonly specified design parameter. It refers to the duration for which a granted consent remains active, determining how long a data user may access a customer's data without seeking fresh authorisation. Across the EMDEs examined, consent validity falls into two broad categories by degree of regulatory involvement. Market-driven models leave the duration

to market arrangements, contractual terms, or ecosystem rules, while regulation-led models structure consent validity directly, through time-bound fixedterm models (for example, 180 days), time-bound capped models (for example, a 12-month maximum), or use-case-based models (for example, 12 months for personal financial management). Figure 11 maps these models across selected EMDEs and AEs.

Figure 11: Consent Validity Models in Open Finance across Advanced Economies and Emerging Economies (n=14)

Advanced Economies

Emerging and Developing Economies

Source: CCAF, Fii and BIS; AE=Advanced Economy; *Egypt is not classified under any model as its framework remains at an early stage of development and the national data protection law is not binding on financial entities. Ghana is classified based on its draft framework, which is not yet in force. Nigeria's Open Banking regulation has been passed but is not yet live, South Africa remains at earlier stages of regime development, and Canada's Consumer-Driven Banking legislation, which had operated on a voluntary basis for years, received Royal Assent in March 2026. Indonesia's framework (SNAP) currently covers payment APIs only.

As Figure 11 shows, economies including Australia,clxxi Singapore,clxxii Canada,clxxiii and the UK clxxiv adopt explicitly time-bound consent models, either through fixed validity periods or regulatory caps. These provide greater ex-ante clarity on how long consent remains valid, reducing uncertainty around data access, responsibility, and liability over time. Hong Kong and New Zealand similarly constrain consent validity, but through use-case-based limitations rather than predefined time periods. In New Zealand, the Customer and Product Data Act (2025) does not prescribe a fixed duration but provides an enabling power for such limits to be introduced through regulations if required.clxxv

Most EMDEs in the sample, by contrast, rely on market-driven validity, leaving duration to contractual arrangements or ecosystem rules. While this flexibility can support innovation and accommodate diverse use

Operational Realities: The Gap Between Design and Practice

Interviews across the nine EMDEs reveal a consistent gap between how liability frameworks are conceptualised and how they operate in practice. Respondents frequently described their approaches using the language of multiple-party, fault-based, or singleparty liability, but closer examination suggests that formal legal design often masks more layered and asymmetrical allocations of responsibility. Since Ghana, Nigeria, and South Africa are at early or pre-regulation stages, these observations reflect a combination of operational experience, where available, and stakeholder expectations about how frameworks are likely to function as systems scale.

Perceived vs Formal Models

In India and Brazil, industry participants commonly characterised liability as apportioned to each actor's functional role in a breach, such as entities determining the purposes and means of processing, service providers processing data on their behalf, or intermediaries facilitating exchange, suggesting a fault-based approach

cases, it introduces variability and greater uncertainty around ongoing responsibility when harm occurs. Only a small number of EMDEs, such as India, impose explicit temporal or use-case-based constraints. This contrast suggests that AEs tend to use time-bound consent as a governance tool to manage risk, allocate liability more predictably, and reinforce participation incentives. For EMDEs, the prevalence of market-driven models reflects both regulatory capacity constraints and a deliberate reliance on market coordination, but it may also heighten the importance of complementary safeguards, including data quality standards, liability rules, and effective dispute resolution. Given the small, heterogeneous EMDE sample and varying stages of ecosystem development, these patterns should be read as indicative rather than definitive, and further research would help strengthen comparative insights.

in practice. The underlying regulatory instruments, however, diverge in how responsibility is allocated on paper. In India, obligations are non-transferable and strictly domain-specific: FIPs, FIUs, and AAs each bear distinct statutory duties grounded in central bank directions and data protection law, which cannot be shifted contractually.clxxvi Each participant is strictly liable for breaches within their designated area and is not accountable for failures originating in another's domain, producing actor-specific accountability closer in effect to a single-party model. Brazil takes a different approach: rather than assigning exclusive responsibility by role, its Open Finance regulations distribute obligations across multiple participants simultaneously, with data reliability, confidentiality, security, and contractual compliance governed in ways that make all relevant actors jointly accountable for the same obligations.clxxvii This produces an allocation that more closely resembles a multipleparty model, where responsibility for the same incident may attach to several parties rather than being preassigned to one. In both cases, practitioner perceptions diverge from formal design, reflecting an enforcement gap with practical implications for how disputes are pursued and how entities manage their exposure.

Market Practice Gaps

While the divergence in India and Brazil reflects differences between perceived and formal liability within developed frameworks, a further misalignment emerges at the level of market practice. Nigeria is instructive, with an important caveat: the Regulatory Framework (2021) and Operational Guidelines (2023) prescribe a model similar to fault-based liability, but the system has not yet gone live in a regulated environment, and the observations below draw on existing private data-sharing arrangements rather than the regulated system. Within these pre-regulatory arrangements, the proposed fault-based elements were repeatedly criticised in interviews for operational complexity, including evidentiary burden, slow dispute resolution, and limited customer recourse when

multiple actors are involved. One interviewee noted that "In Nigeria, incumbent banks often play a central role in liability and accountability arrangements, reflecting their position as API providers and entities directly regulated by the central bank." Operational liability, therefore, tends to concentrate on data holders, producing outcomes resembling aspects of a single-party model. The proposed shift towards fault-based liability may partly reflect an attempt to distribute liability more evenly across participants, particularly as the framework seeks to bring data users within the central bank's supervisory perimeter through the Open Banking Registry.clxxviii Whether the formal framework will ultimately succeed in shifting existing market practices away from this concentration on incumbent banks remains an open question.

Liability Burden on Data Holders in Open Finance

Interview evidence consistently highlights that data holders, most often banks and regulated financial institutions, bear a disproportionate share of the regulatory and liability burden in Open Finance ecosystems. As the primary custodians of customer data and the entities most directly supervised by financial regulators, data holders are typically the first point of accountability when something goes wrong.clxxix This reflects a broader pattern in financial services, where prudentially regulated institutions often serve as the primary locus of supervisory oversight.clxxx

As one interviewee from a digital banking platform put it, this is "both intuitive and unavoidable: customers complain to the bank because it is their bank, even when the root cause lies elsewhere in the data-sharing chain."

Some interviewees emphasised that this outcome persists regardless of the formal liability framework in place. Whether regimes are structured as fault-based, multiple-party, or hybrid, responsibility still tends to fall de facto on the data holder. The pattern may be reinforced by institutional and capacity constraints, particularly in EMDEs. Financial sector authorities are generally more experienced in supervising banks

than newer actors such as TPPs and aggregators, so even where formal frameworks envisage a broader distribution of responsibility, oversight in practice may remain anchored on data holders within established regulatory perimeters.clxxxi Extending effective supervision across the full ecosystem would require significantly greater technical expertise, staffing capacity, and supervisory tools than many resource-constrained EMDE regulators can realistically deploy.clxxxii

The full picture is more nuanced, however, and caution is warranted before accepting this framing uncritically. Some interviewees pointed to market diagnostics in countries such as South Africa, suggesting a different dynamic in bilateral arrangements. Where contracts between banks and fintech data users have been examined closely, liability has often been found to shift downstream to the data user, particularly smaller fintech partners with weaker bargaining power. In these cases, responsibility is not concentrated on the data holder but disproportionately allocated to the counterparty with less negotiating power, with potential implications for their risk exposure and capital requirements.

This concentration, whether it ultimately falls on data holders or data users, has important implications for incentives and participation.clxxxiii Interview evidence suggests the key issue is not only where liability formally sits but where it is perceived to sit. Even the expectation that liability may fall on one party can be enough to shape its behaviour and act as a disincentive to participate. Faced with open-ended or uncertain exposure, data holders may rely on indemnification clauses, insurance requirements, or contractual safeguards to mitigate downstream risk, and may respond defensively by tightening access conditions, narrowing the scope of data shared, or delaying participation altogether.clxxxiv Conversely, data users perceived to face limited accountability may have weaker incentives to invest in data security and consent management. Such outcomes can undermine the core objectives of Open Finance by limiting interoperability, reducing competition, and slowing ecosystem growth.clxxxv

Against this backdrop, regulatory attention becomes critical. For EMDE regulators, a grounded understanding of how liability actually operates in

practice is important. This may require triangulating evidence across multiple participants, including smaller data users and intermediaries, and reviewing the actual terms of bilateral contracts to assess whether liability is being allocated in a way that is disproportionate or misaligned with policy intent. On this basis, regulators may consider designing corrective mechanisms such as recovery rights, indemnification standards, or downstream accreditation requirements to address imbalances.

A further design question is whether an ex-ante or ex-post approach is more appropriate, as illustrated in Figure 12. Interview findings suggest no universally superior model; the choice depends on institutional capacity, enforcement resources, and policy priorities. Where customer redress is the primary objective, exante mechanisms may be more effective in preventing harm.clxxxvi Where the focus is on encouraging participation and innovation, ex-post fault-based approaches may be more suitable, though only where investigation and enforcement mechanisms are sufficiently resourced, procedurally efficient, and capable of timely resolution; otherwise, they risk delays and weak accountability in practice.

Source: CCAF, Fii and BIS; In ex-ante frameworks, investigation into actual fault and cost recovery occurs after

frameworks,

Bridging the Gap: Infrastructure & Regulatory Complements

Interviews suggest that both regulators and industry participants increasingly recognise that neither fully codified liability rules nor reliance solely on existing legal architecture may be sufficient to ensure effective operation. Additional governance and technical infrastructure may be required to complement formal frameworks in practice. Interviews also underscored the growing role of intermediaries and central infrastructure in shaping the risk environment within which liability operates. In early-stage countries such as Ghana, centralised connectivity layers and API clearing mechanisms are being proposed to prevent errors and breaches ex-ante, shifting regulatory emphasis towards risk prevention rather than post-incident allocation. Intermediaries such as the Invela Network require TPPs and AAs to undergo risk-based accreditation, assigning ratings that allow data holders to engage only with partners matching their risk appetite and backed by insurance-based warranties.clxxxvii These mechanisms do not determine or allocate liability, since a participant cannot escape liability simply by being accredited, but they can shape the conditions under which liability is more or less likely to arise. Accreditation and risk-based entry standards can therefore complement formal frameworks by reducing the likelihood of incidents while leaving existing liability rules intact.

India similarly illustrates how operational and governance infrastructure may evolve alongside formal liability frameworks. Given the cross-regulatory nature of the AA ecosystem, several areas required

technical, operational, and legal alignment across the four financial sector regulators. In this context, Sahamati worked extensively with all relevant regulators and stakeholders, including Reserve Bank Information Technology Pvt Ltd (ReBIT),17 to support the development of the AA ecosystem through various participatory governance forums.clxxxviii In parallel, Sahamati collaborated with industry participants to develop participatory governance tools such as the Fair Use Template Library,18 an industry-driven collection of templates designed for various recognised use cases within the AA ecosystem.clxxxix

Taken together, the implementation gap observed across these markets is not incidental. It reflects the degree to which liability in Open Finance depends on conditions that sit outside the existing legal architecture, including enforcement capacity, technical infrastructure, the distribution of regulatory oversight across participants, and practical asymmetries between regulated and less-regulated actors. For regulators, this indicates that existing legal architecture may be a necessary but insufficient condition for effective accountability. Supporting conditions may also be required, including accreditation standards, audit infrastructure, dispute resolution capacity, technical guardrails, cross-regulatory governance arrangements, and mechanisms to ensure all participants have a working understanding of the rules that apply to them. These observations are drawn from a small sample of nine EMDEs, and further research across a broader set of countries may reveal additional dimensions of the implementation gap beyond those identified here.

17. A wholly owned subsidiary of the Reserve Bank of India.

18. The formation of the Fair Use Library involved a collaborative effort by active FIUs within the AA Ecosystem, through the individual User Councils, which was further reviewed and approved by the Fair Use Committee and Governing Council of Sahamati. These templates, designed as “Best Practice Consents Templates,” were meticulously crafted through collaborative efforts and rigorous deliberations led by leading industry practitioners. Key considerations during the design process included safeguarding end-customer interests, ensuring alignment with the principles of the Digital Personal Data Protection (DPDP) Act, adhering to central bank’s master guidelines for AA, and addressing the specific requirements of various use cases.

2.4: Dispute Resolution in Open Finance

Having examined liability frameworks, this section turns to dispute resolution: the mechanisms through which such frameworks are operationalised and enforced in Open Finance ecosystems.

Two-Layer Model in Practice

As discussed earlier, dispute resolution is typically organised around a two-layer structure: an internal complaints process at the institutional level, followed by escalation to an external authority where issues remain unresolved. Open Finance largely builds on this pre-existing architecture, with most countries extending existing financial services frameworks rather than establishing dedicated Open Finance complaint channels. Interviews from the SSA region highlight a deliberate preference for regulatory continuity, with authorities seeking to avoid fragmentation or duplication. A senior regulator emphasised that "introducing a separate Open Banking reporting mechanism could confuse customers," arguing instead for maintaining existing bank-level complaint interfaces while centralising oversight and analytics within the regulator.

While this two-layer resolution model remains broadly consistent across countries, the two layers vary in structure. In Saudi Arabia, unresolved complaints are escalated to the central bank, whereas in India, the UAE, and the UK, specialised financial ombudsmen or supervisory bodies play a more formalised adjudicatory role, reflecting broader institutional design choices around centralisation and the independence of external review. As with liability frameworks, regulators tend to build additional requirements and procedural overlays on top of existing systems, producing incremental adaptation to accommodate Open Finance-specific risks. Ghana, for example, has proposed a three-layer model in which unresolved complaints are first escalated to OpenDX19 and, if still unresolved, to the central bank.cxc

A similar pattern is observable at the internal layer. Nigeria is instructive, with the Open Banking framework proposing a notably more prescriptive standard than the baseline applicable to traditional banking. Under the Central Bank of Nigeria's general consumer protection framework, banks are required to resolve complaints within two weeks, and where internal resolution fails, customers may escalate to the central bank within 14 days.cxci The Open Banking Framework retains this general architecture, internal resolution first followed by regulatory escalation, with both physical and digital lodgement channels, but significantly tightens the operational requirements.cxcii The most notable shift is the resolution timeline: 48 hours rather than two weeks,cxciii reinforced by a 24hour acknowledgement requirement and a mandate for participating institutions to operate a 24/7 customer service desk, formalising not only the speed of resolution but the responsiveness of institutions across the complaint lifecycle.cxciv These requirements reflect a deliberate choice to reduce barriers to complaint initiation and prevent disputes from being deferred or suppressed through limited access windows. As of the time of writing, the framework has been issued but is not yet fully operationalised, so these should be read as design specifications rather than observed outcomes.

This level of procedural granularity is not consistently reflected across the sample. Australia’s CDR cxcv and India's AA framework cxcvi reference a one-month timeline, consistent with their broader grievance redress standard, while the UK's Open Banking framework applies a 15-day timeline mirroring its general financial services standard.cxcvii Even where timelines are set, the rules tend to focus on ensuring visibility of grievance redress channels and escalation pathways rather than prescribing acknowledgement windows or service-desk obligations. Ghana's draft Open Banking directive requires participating institutions to include dispute resolution clauses in their contracts with data subjects in line with the Bank

of Ghana's Consumer Recourse Mechanism Guidelines, but does not itself set out detailed operational timelines within the Open Banking framework.cxcviii

The Philippines similarly relies on existing grievance redress structures rather than introducing additional procedural requirements at the framework level.cxcix Brazil requires uninterrupted 24/7 access to customer complaint channels, though this is derived from its broader consumer-protection regime governing Serviço de Atendimento ao Consumidor (SAC) rather than from Open Finance-specific rules.cc

This variation in procedural specificity across EMDEs is not merely a design difference; it shapes the incentives of both customers and financial institutions.

Interview evidence indicates that the credibility and accessibility of these mechanisms can play a decisive role in shaping customer willingness to engage with data-sharing arrangements and institutional perceptions of participation as manageable from a risk and compliance perspective. Poorly articulated or ambiguously enforced mechanisms can exacerbate liability aversion among incumbents, especially where escalation carries reputational or financial consequences. From the customer perspective, as

discussed under Incentives, Open Finance ecosystems often offer limited direct incentives to share data, and effective, predictable redress can function as a substitute incentive, offering reassurance that harms will be addressed. Dispute resolution systems can also provide valuable signals about ecosystem performance: internal resolution timelines can function as meaningful indicators of ecosystem health, particularly in countries with explicit consumerprotection mandates, an indicator discussed in greater detail in the subsequent section.

For regulators, this means there are options to layer additional requirements within the Open Finance framework itself, such as tighter timelines, acknowledgement windows, or service-desk obligations, and doing so can serve as an incentive in its own right for both customers and participating institutions. What matters is not only that customers can direct claims to data holders or data users but also how those claims are processed and resolved across the ecosystem. Other data-sharing infrastructures involving multiple governance participants, such as credit reporting, could offer useful guidance in designing such Open Finance-specific arrangements.

Dispute Resolution Timelines

Building on the previous section, Figure 13 presents a second-order comparison of internal dispute resolution responsiveness by showing the maximum regulatory time limits applicable to Open Finance participants.

These limits represent the longest period within which a participating entity, whether a data holder, data user, or intermediary, is required to resolve a customer complaint through its internal dispute resolution mechanism, before escalation to external redress channels becomes available.

Figure 13: Regulatory Time Limits (in days) for Internal Customer Dispute Resolution in Open Finance (n=14)

Source: CCAF, Fii and BIS; *Nigeria's Open Banking regulation has passed but is not yet live; Egypt and South Africa are in the earlier stages of regime development; Ghana's framework remains in draft; Indonesia's framework (SNAP) currently covers payment APIs only; and Canada's ConsumerDriven Banking legislation received Royal Assent in March 2026. The figure therefore reflects regulatory ambition rather than operational outcomes.

Before drawing any conclusions from Figure 13, several methodological caveats are necessary. First, the sample is small: 14 countries (8 EMDEs, 6 AEs), several of which are not yet live, limit the ability to draw robust conclusions about global patterns. Second, the timelines reflect a combination of Open Financespecific rules and broader consumer protection

frameworks, since several countries do not prescribe resolution timelines within their Open Finance regimes. Only four of the fifteen countries (India, Australia, Nigeria, and the UK) explicitly specify timelines in their frameworks. A useful prior check is whether Open Finance timelines are shorter or longer than those applicable in other parts of financial regulation in

the same countries: Nigeria's general standard is two weeks against 48 hours under Open Banking, India's AA framework retains the broader one-month grievance standard,cci the UK applies the same 15-day20 timeline in Open Banking as elsewhere,ccii and Australia applies 30 days in both.cciii

Where Open Finance is silent, the figure reflects the general financial sector standard, so some variation may reflect broader consumer protection traditions rather than deliberate Open Finance design.cciv In Brazil, for example, although Open Finance-specific rules apply, the general SAC framework mandates responses within seven days.ccv Third, prescribed timelines and actual resolution performance can diverge considerably. The data in Figure 13 should therefore be read as reflecting regulatory ambition rather than operational outcome.

With these caveats in mind, the figure suggests wide dispersion across the sample, ranging from 2 days in Nigeria to 60 days in New Zealand. Nigeria's framework has not yet gone live in a regulated environment, and its proposed short timeline has attracted criticism in interviews for the operational demands it places on participants. The average prescribed resolution time across regulation-led regimes is 23.89 days, slightly shorter than the 30-day average across market-driven regimes, though both sit within a similar band, and within-group dispersion is larger than between-group difference. This suggests that the regulation-led versus market-driven distinction is, on its own, weakly associated with the choice of prescribed resolution timeline.

A clearer pattern appears to emerge when the sample is examined by development status. Several EMDEs (Nigeria,ccvi Saudi Arabia, Brazil, Indonesia) alongside

the UK ccvii prescribe relatively short timelines of 15 days or fewer, while a cluster of AEs (New Zealand, Canada, Australiaccviii) prescribe the longest at 30 days or more. India sits in the middle at 30 days, with South Africa as a notable EMDE outlier at 42 days. One reading consistent with the sample is that several EMDE frameworks are setting comparatively ambitious headline timelines, while several AE regimes are codifying longer windows that may simply reflect established consumer protection practice in adjacent financial services. Whether shorter EMDE timelines reflect genuine ambition, alignment with fastresolution norms (as in Brazil's SAC framework ccix), or expectations that will be difficult to meet in practice cannot be determined from this data alone, particularly given the Indian gap between the prescribed 30-day standardccx and the observed 193-day resolution at the 90th percentile.ccxi

Brazil's 7-day standard under a multiple-party liability model is worth noting. Multiple-party frameworks distribute responsibility for the same domain across several actors, which in principle could complicate resolution by requiring coordination between parties before a response can be given. Brazil's relatively short timeline suggests this complexity can be managed, though it may also reflect the maturity of Brazil's Open Finance governance infrastructure, which may make inter-participant coordination more tractable than in contexts lacking such infrastructure. Read alongside the wider sample, the feasibility of any prescribed timeline likely depends less on the headline number than on whether the underlying governance, dispute routing, and coordination mechanisms are in place to support it. The gap between India's prescribed and observed performance illustrates the importance of these supporting arrangements.

20.

A second dimension concerns the incentives shaping institutional behaviour within the prescribed window. Shorter timelines may create incentives for institutions to treat internal dispute resolution as a superficial screening step, with substantive resolution effectively deferred to external mechanisms. Several interviewees pointed to mechanisms that could strengthen these incentives, including penalties for complaints that escalate to the regulator and are subsequently upheld, which they argued would encourage firms to resolve disputes substantively at the internal stage and reduce supervisory overload. Interviewees in Egypt and the UAE emphasised that clarity around liability allocation and redress mechanisms is a prerequisite for mass adoption, with uncertainty acting as a barrier to entry for both banks and fintechs. Defined timelines

and credible enforcement can therefore strengthen institutional confidence in data-sharing ecosystems. Taken together, these findings suggest that prescribed dispute resolution timelines are shaped by a combination of factors, including the chosen liability model, the broader governance approach, existing financial consumer protection practices, and the wider stage of economic development. Within the sample, the variation observed does not track cleanly with any single one of these factors. What appears to matter more, from a regulatory perspective, is whether prescribed timelines are accompanied by meaningful oversight, enforcement, and incentives to resolve complaints substantively rather than pass them through to the next layer.

Another persistent challenge identified across interviews is the burden placed on customers to prove harm or fault within complex, multi-actor Open Finance ecosystems. In theory, fault-based or multiple-party liability models may appear fair and flexible. In practice, requiring customers to identify which entity caused a failure, gather evidence, and navigate fragmented redress pathways can be prohibitively demanding.ccxii Many customers lack the technical knowledge to understand API failures, consent-propagation issues, or downstream data misuse, and may not even know which institutions were involved. Interviewees from Ghana, Nigeria, and South Africa repeatedly cautioned that "low complaint volumes should not be interpreted as evidence of ecosystem health." In Nigeria, a data-user interviewee estimated that "fewer than 1% of issues are formally reported”, suggesting significant underdetection of customer harm. In Ghana, consumer protection experts noted that many users bypass formal mechanisms altogether, turning to social media in the belief that public pressure is more effective than regulatory channels. Such complaints, though informal, may still be visible to regulators and service providers, as social media and messaging platforms increasingly function as supplementary channels for monitoring customer grievances, even if not

systematically captured within formal frameworks.ccxiii The Bank of Ghana's 2024 Annual Report noted that it has developed an AI chatbot that handles customer complaints and performs sentiment analysis and real-time monitoring of social media to assess public perception.ccxiv

Some countries and private initiatives are actively seeking to reduce this burden. While the practice is observed across the wider financial sector, the underlying principle of shifting the burden away from the customer in multi-actor journeys is directly relevant to liability design in Open Finance. The UK is often cited as a global reference point in reallocating liability away from customers. Rules effective from October 2024 require Payment Service Providers to reimburse victims of APP fraud, with losses split evenly between sending and receiving banks, and a mandated five-business-day reimbursement target places emphasis on the speed of redress as well as the refund itself.ccxv Additionally, private initiatives such as the Invela Network are developing accreditation, dynamic risk monitoring, and a warranty that will provide insurance-backed financial protection for TPPs. These approaches can promote ex-ante risk mitigation and assured compensation, complementing existing liability allocation frameworks.ccxvi

Figure 14 shows what visibility looks like in an ecosystem with mature reporting infrastructure. Drawing on data from the UK between April 2024 and September 2025, it shows the number of successful Open Banking payments alongside the corresponding number of fraud cases. The trajectory is not linear: fraud cases fell as initial controls, and the October 2024 APP reimbursement rules bedded in,ccxvii stabilised through to spring 2025, and rose again in the second

half of 2025 in a movement OBL associates with a broader market-wide uptick in APP fraud rather than a weakness specific to Open Banking.ccxviii Open Banking volumes continued to grow throughout, reaching 30.9 million successful monthly payments by September 2025,ccxix and in H1 2025 Open Banking fraud accounted for 0.013% of transactions by volume, materially below the wider payments industry average of 0.045% over the same period.ccxx

14: Number of Successful Payments and Fraud Cases in Open Finance, United Kingdom (April 2024–September 2025)

Source: Open Banking Limited (OBL);, MiData Historic Data (2025); OBL Financial Crime within Open Banking Journeys Report (December 2025). *Monthly fraud cases are interpolated from trend data published by OBL (2025); fraud rates for March-June 2024 and September 2025 are directly reported.

The more important point for EMDE regulators is not the specific shape of the trajectory but the fact that it can be observed at all. The UK can detect, disaggregate, and respond to these dynamics because it has the infrastructure to do so, including mandatory audit trails, API logging, incident reporting obligations, and centralised data collection across participating institutions.ccxxi The implication for EMDEs scaling

their own ecosystems is direct: fraud will grow as participation grows, but it will only be visible where the detection and reporting infrastructure exists to surface it. Low complaint volumes in early-stage ecosystems should therefore not be read as evidence of low fraud incidence, but as potential evidence of low detection capacity.

Regulatory frameworks also increasingly recognise that operational transparency is essential for effective dispute resolution. Audit trails, consent logs, and incident-reporting requirements enable regulators and ombudsman bodies to reconstruct data flows, identify points of failure, and distinguish between errors attributable to data holders, intermediaries, or data users. For instance, Thailand’s draft Open Finance framework requires service providers to maintain detailed logs of data-sharing activities, noting that these records are essential for legal proceedings and offender identification.ccxxii Similarly, Brazil, Ghana, India, Nigeria, and the UAE mandate record-keeping and incident reporting as participation requirements. Interviewees emphasised that these obligations are not merely technical safeguards, but foundational elements of the customer-protection architecture.

Dispute resolution frameworks can also evolve alongside ecosystem maturity. For instance, India’s AA framework initially relied on existing grievance

mechanisms but gradually introduced more structured processes, including ticketing systems, defined SLAs, and the involvement of a self-regulatory organisation.ccxxiii Interviews indicate that this layered approach has helped manage growing ecosystem complexity while maintaining clarity for both participants and customers. Intermediaries further highlighted how ticketing systems can enable issues such as failed consent flows or data mismatches to be identified and resolved within days, often before customers experience harm.

Overall, these findings underscore a core insight for regulators: effective consumer protection in Open Finance can be strengthened by dispute resolution mechanisms that minimise reliance on individual customers to detect, evidence, and pursue technical failures. Where the burden of proof is high, trust may be weakened, complaints may go unreported, and regulators may lose important feedback loops needed to identify and address emerging or systemic risks.

2.5: Liability in Open Finance: Regulatory Takeaways

Open Finance inherits the existing legal architecture rather than creating liability from scratch. It draws on overlapping financial, data protection, and consumer protection regimes, while introducing multi-actor and data-intensive features that these frameworks may not always address neatly. These features can create accountability gaps, consent-related challenges, and dispute resolution issues that do not fit neatly within established regimes. Clear and predictable liability frameworks can therefore act as a meaningful incentive in their own right, reinforcing trust and complementing other incentives across the ecosystem.

It may be useful to distinguish between risks that are genuinely novel to Open Finance and those that represent intensified versions of existing risks in financial services. Multi-party data-sharing arrangements involving TPPs are among the most novel features of Open Finance and may require new rules and supporting infrastructure, given their potential to fragment responsibility across institutions with different regulatory statuses. By contrast, heightened risks such as security breaches and consent complexity may be addressed through the adaptation and extension of existing frameworks, including stronger consent requirements, clearer data protection obligations, and improved enforcement capacity.

The key question is often not whether rules exist, but which framework applies and which authority has jurisdiction. Open Finance breaches can span data, transaction, and operational domains that do not fit neatly within a single regulator's remit. Where the interactions between financial, data protection, and consumer protection frameworks are not clearly defined, governance gaps can emerge, particularly in EMDEs where data protection frameworks are newer and the division of responsibility may not yet be settled. This points to the potential value of establishing cross-authority coordination mechanisms from the outset, rather than relying on a single dedicated regulator.

Tracing fault across interconnected systems can be difficult, and the tools commonly used each have limitations. Two approaches are common. The first is infrastructure-based, where audit trails, API logs, and incident reporting can attribute responsibility, though these tools are absent or incomplete in several of the EMDEs surveyed. The second is contractual, where indemnities and liability clauses allocate risk between data holders and data users. In practice, this can shift risk to smaller participants due to low bargaining power, which may discourage participation.

Regulators may find it useful to understand the four broad liability models when designing their approach. Single-party liability assigns responsibility ex-ante to a specific participant, often defaulting to incumbent banks, prioritising clarity and timely redress. Multiple-party liability distributes responsibility ex-ante across several actors, providing clarity on exposure but potentially introducing moral hazard. Faultbased liability assigns responsibility ex-post based on negligence, avoiding the penalisation of compliant actors but depending heavily on audit trails, digital signatures, and other evidentiary infrastructure. Hybrid liability combines elements of the above, reflecting the heterogeneous risk landscape of Open Finance.

Fault-based models tend to depend on digital infrastructure that may not yet be available in all EMDEs. Fault-based regimes rely on the ability to attribute responsibility ex-post through evidence of conduct, which is more likely to be operationally tractable in countries with advanced digital systems and mature regulatory institutions. Where digital infrastructure is weaker, broadband penetration is limited, or digital divides are persistent, the effective operation of such mechanisms can be constrained. The relationship between governance approach and liability design is also not uniform, suggesting that liability choices may reflect broader policy preferences regarding customer certainty, operational feasibility, and the balance between accountability and innovation.

There can be a meaningful gap between liability as written and liability in practice. In India and Brazil, industry participants commonly described liability as being apportioned by functional role, suggesting a fault-based approach in practice. However, the underlying regulatory instruments diverge. India's non-transferable, domain-specific obligations produce a framework closer to a single-party model, while Brazil distributes obligations across multiple participants simultaneously, resembling a multiple-party model. Nigeria offers a further illustration at the level of market practice, where pre-regulatory arrangements have tended to concentrate operational liability on incumbent banks, producing outcomes resembling a single-party model.

The choice between ex-ante and ex-post approaches can depend on institutional capacity and policy priorities. There is no universally superior model, as the choice may depend on enforcement resources and priorities within a given country. Where customer redress is the primary objective, ex-ante mechanisms may be more effective in preventing harm. Where the focus is on encouraging participation and innovation, ex-post fault-based approaches may be more suitable, though they tend to be effective only where investigation and enforcement mechanisms are sufficiently resourced and capable of timely resolution.

Existing legal architecture may be necessary but not sufficient for effective accountability. The implementation gap observed across the sampled markets reflects the extent to which liability depends on conditions outside the existing legal architecture, including enforcement capacity, technical infrastructure, and the distribution of regulatory oversight. Supporting conditions may therefore also be required, including accreditation standards, audit infrastructure, dispute resolution capacity, technical guardrails, cross-regulatory governance arrangements, and mechanisms to ensure that all ecosystem participants have a working understanding of the rules that apply to them.

Consent can be understood as a regulatory tool in its own right. In Open Finance, consent becomes multilayered, as a customer's authorisation to a TPP may extend across aggregators, analytics providers, and downstream service providers, each raising questions about authorisation, accountability, and revocability. Design dimensions include timing, purpose specificity, data granularity, and the validity period of consent, which itself involves a trade-off between minimising friction and protecting customer interests. Mechanisms that can support meaningful consent include dashboards that improve customer visibility and control, and governance-oriented approaches such as the consent manager model introduced under India’s DPDP Act. Accreditation mechanisms and data minimisation requirements may also be used to limit unnecessary data access. The practical effectiveness of consent in complex Open Finance ecosystems remains an area worth further research and policy attention.

Dispute resolution mechanisms tend to be built on top of existing systems rather than designed from scratch. Regulators have generally added requirements to existing dispute resolution systems. Ghana, for example, has proposed a three-layer model escalating from OpenDX to the central bank, while Nigeria's central bank has proposed retaining the existing architecture but tightening the timeline to 48 hours, compared to the current two-week limit applied in traditional banking contexts. This variation in procedural specificity can shape both customer willingness to engage with data sharing and institutional perceptions of risk. Effective and predictable redress can function as a substitute incentive, offering reassurance that harms will be addressed when failures occur.

Three practical design questions can help regulators structure their approach. First, whether Open Financespecific liability clauses are needed. The evidence suggests that they generally are, though their scope can be targeted to address Open Finance-specific accountability gaps rather than replace existing law. Second, whether supplementary infrastructure is required. This may depend on what already exists, as audit trails and incident reporting can often be extended from existing financial regulation, while in their absence, such tools may need to be built as a prerequisite. Third, whether formal cross-authority coordination is needed. The answer is generally likely to be yes, with even a memorandum of understanding and defined escalation pathways being preferable to operating in silos.

Understanding Performance Measurement in Open Finance

The previous chapters explored how regulators and market participants can incentivise participation across data holders, data users, and customers, and how they can establish trust through clear liability allocation and effective dispute resolution. Building on those insights, a performance measurement

framework can provide the means to assess whether Open Finance is working in practice: whether incentives are generating the intended participation, whether liability arrangements are translating into consumer protection, and whether the ecosystem as a whole is delivering on its policy objectives.

This is not the first time regulators have faced the challenge of measuring the performance of a financial or infrastructure reform. Regulatory Impact Assessment (RIA), and performance measurement more broadly, is a well-developed yet continually evolving discipline,ccxxiv with convergent practice across mature regimes built on explicit intervention logic,ccxxv ex-ante targets paired with ex-post evaluation,ccxxvi and a blend of quantitative and qualitative evidence.ccxxvii Comparable evolution is observable across adjacent domains, including financial inclusion, payments oversight, and digital financial services, where measurement has typically moved from technical functionality and compliance towards broader assessments of whether systems are delivering their intended policy outcomes.ccxxviii However, the shift to policy outcomes is difficult, as it requires isolating the effect of a regulatory intervention from broader market developments. Open Finance compounds this challenge: as a data-sharing infrastructure supporting diverse use cases across multiple financial markets, its effects are often indirect, distributed across actors, and highly context-specific. Measurement also depends on data generated by multiple parties including banks, financial institutions, TPPs, and intermediaries, many of whom may be reluctant to disclose commercially sensitive metrics.21

Against this backdrop, this chapter examines how regulators can measure progress in Open Finance. It begins by considering what "success" means in practice, drawing on stakeholder perspectives that often diverge across regulators, data holders, data users, intermediaries, and customer representatives.

It then sets out five design principles that can help regulators construct credible measurement frameworks. The chapter turns next to technical metrics, examining their usefulness as early signals of ecosystem health and their limitations when used in isolation, and proposes indicators across the datasharing lifecycle from consent initiation through to revocation. It then considers policy outcome metrics, proposing indicators that move beyond aggregate counts towards more meaningful measures of outcomes and distributional impact. The chapter closes by drawing out conclusions and regulatory takeaways.

Aligning Measurement Terminology

Measurement vocabulary varies by audience, and different disciplines often use different terms for closely related ideas. Economists and evaluators tend to speak of impacts and policy outcomes; performance and strategy specialists often use Key Performance Indicators (KPIs); technical and operational analysts may use metrics, indicators, and technical or compliance metrics. These are not always distinct concepts so much as the same

3.1:

measurement viewed through different professional lenses. This chapter uses technical metrics for measures of whether the infrastructure is functioning and policy outcome metrics for measures of whether the ecosystem is delivering on its objectives, while recognising that readers may encounter the other terms used interchangeably elsewhere.

Measuring Success in Open Finance: Interview Insights

Before examining the specific metrics being adopted across countries, it is worth considering what "success" in Open Finance actually means in practice. Across the nine EMDEs examined in this report, regulators have adopted Open Finance frameworks for distinct reasons: to increase competition, extend financial inclusion, drive innovation and efficiency gains, or enhance consumer protection and empowerment. Interviews revealed that stakeholders frequently prioritise different outcomes depending on their institutional role.22

• From a regulatory perspective, success operates at two levels: at the ecosystem level, through indicators capturing overall health, participation, and progress towards stated policy objectives; and at the individual firm level, through compliance and enforcement that require accurate, timely, and independently audited data. As one senior European regulator put it, "success must always be assessed relative to the original goals of the initiative." Regulators in South Africa and the MENA region similarly emphasised outcome-based definitions, describing success variously as positive movement on financial inclusion, MSME access, and competition-driven price reductions, or as a staged process beginning with infrastructure readiness and progressively expanding towards more sophisticated outcomes.

• Financial institutions and data holders more often frame success in commercial and operational terms: revenue from API infrastructure, expansion of customer relationships through third-party partnerships, improved retention, and digital reputation. Commercial and regulatory success do not always converge. If competition is the regulator's primary objective, the entry and growth of new participants may reduce incumbents' market share, an outcome they may perceive as commercial loss but which the regulator may read as a more contestable market. Alternatively, competitive pressure from TPPs may push incumbents to innovate and offer more competitive products, aligning firm-level and regulatory success.

• TPPs and intermediaries typically frame success around ecosystem health and innovation: trust, interoperability, adoption, systemic stability, and the visible emergence of new products. Intermediaries in Brazil described a phased evolution from adoption to revenue-generating use cases and ultimately to macroeconomic impact, including changes in credit market conditions and interest rates.

22. Findings draw from 33 interviewees from 11 countries (9 EMDEs and 2 AEs), including 12 regulators, 6 consumer protection experts, 6 intermediaries, 5 financial institutions, 2 international experts, and 1 industry body. Given the relatively small qualitative sample, findings should be interpreted as exploratory rather than statistically representative.

• From a consumer protection and advocacy perspective, success is most often defined by awareness, trust, and effective redress. Interviewees from Ghana, Nigeria, and South Africa emphasised speed, affordability, access to appropriate credit, data security, and complaint resolution rates as central indicators of whether Open Finance is genuinely working for customers. Several stressed that "inclusion alone is insufficient; success depends on beneficial and responsible usage of financial services enabled by shared data."

This diversity reflects the multi-dimensional nature of what Open Finance is intended to achieve. Within the interview sample, three patterns illustrate how priorities diverge: policy outcomes were discussed primarily by regulators, with few other stakeholders citing system-level goals as their primary measure of success; ecosystem outcomes showed the highest overlap, with commercial viability cited across data holders, TPPs, and intermediaries; and customer outcomes appeared less consistently, as reflected in the metrics countries currently track, revealing a critical gap.

Despite this diversity, and consistent with practice in adjacent domains, these diverging priorities can be mapped onto two broad categories of metrics: those that assess whether the framework is working as designed, which tend to be technical or complianceoriented, and those that assess whether it is delivering its intended policy effects. The practical implication is that metrics should be anchored to the policy problem the framework was designed to solve while remaining legible to the full range of ecosystem participants. Accordingly, regulators should track both technical and compliance indicators to demonstrate that the system is functioning as designed, alongside outcome-oriented metrics to assess whether Open Finance is achieving the objectives that motivated its introduction.

The effectiveness of any performance measurement framework depends not only on what is measured but on how measurement systems are designed. Before examining how countries currently measure success in practice, it is therefore useful to set out the principles that well-designed metrics should satisfy, against which existing approaches can be assessed.

3.2: Design Principles for Performance Measurement Frameworks in Open Finance

The following principles draw on established approaches to regulatory impact assessment and ex-post evaluation, including the OECD Best Practice Principles for Regulatory Impact Assessment,ccxxix the UK HM Treasury Magenta Book,ccxxx and the European Commission’s Better Regulation Toolbox (including S.M.A.R.T. objectivesccxxxi and R.A.C.E.R. criteriaccxxxii).

They also reflect emerging guidance from the World Bank,ccxxxiii OECD Recommendations on Public Policy Evaluation,ccxxxiv and Responsible Digital Finance principles.ccxxxv Together, these provide a structured basis for designing performance measurement frameworks for Open Finance that are both analytically rigorous and operationally feasible.

Does the metric genuinely measure the phenomenon it purports to capture?

Source: CCAF, Fii and BIS

Is the metric measuring meaningful outcomes aligned with regulatory objectives, rather than activity or compliance?

1. Attribution

A central challenge in designing metrics is attribution: determining whether observed market outcomes can plausibly be linked to the Open Finance intervention rather than to broader economic, technological, or regulatory developments. Established evaluation guidance consistently emphasises that performance indicators are most meaningful when interpreted against an understanding of what would likely have occurred without the intervention.ccxxxvi

Is the measurement burden proportionate to the policy value of the indicator? 5

or longitudinal datasets that may not be available to all regulators. Where attribution has been demonstrated in Open Banking specifically, it has relied on differencein-differences designs exploiting policy cutoffs (such as the Bank of England's analysis of the MSME turnover threshold under PSD2)ccxxxvii or comparator countries (such as the EEA-versus-US fintech comparison),ccxxxviii both discussed in Chapter 1. Performance measurement frameworks can nonetheless be designed to strengthen attribution incrementally, by establishing pre- and post-intervention baselines, comparing Open Finance-enabled products with nonenabled segments, or tracking indicators tied more directly to the intervention's theory of change. The objective is not perfect causal isolation but indicators Can the metric reasonably isolate the e ects of the Open Finance intervention?

Does the measurement framework capture the system in full, including distributional variation and unintended e ects?

In practice, fully isolating the causal impact of Open Finance is rarely feasible through routine metric monitoring alone. Credible attribution typically requires econometric methods, comparator markets,

that improve the regulator's ability to distinguish Open Finance-related effects from wider market dynamics, particularly where the framework is expected to deliver long-term outcomes such as competition, inclusion, or customer welfare, all of which are influenced by multiple external factors.

Drawing on data from 2010 to 2019, one analysis finds that following the announcement of the Second Payment Services Directive (PSD2), European Economic Area (EEA)-licensed firms attracted greater investment than comparable US firms, with total funding rising by an average of 5.8% a year and the number of funding rounds increasing by 90.8% annually. These effects appear strongest among B2B firms, younger firms of five to ten years, and small firms of fifty employees or fewer.ccxxxix

2. Validity

Metrics are only as reliable as the data underlying them, and only as meaningful as the phenomena they genuinely capture. A metric may be technically accurate while lacking validity if it fails to measure what it claims to measure. Banks may, for example, report API connection success rates based only on requests that get past their edge servers, systematically excluding calls blocked at firewall or authentication layers and thereby overstating system performance. In Open Finance ecosystems, where data is generated

across multiple actors, reliability and comparability require standardised definitions, consistent reporting methodologies, and measurement obligations embedded within participation requirements rather than left to voluntary self-reporting. Indicators used for supervision, compliance, or enforcement should rely on independently auditable data sources or thirdparty measurement, since self-reported metrics from regulated entities may involve inherent conflicts of interest.ccxl

Metrics should also be robust against manipulation. Indicators frequently become targets once tied to compliance or evaluation,ccxli creating incentives for strategic optimisation rather than genuine performance improvement, a manifestation of Goodhart's Law.23 This risk is particularly acute for burden-reduction or operational-efficiency metrics, where costs or frictions may simply be shifted between actors rather than substantively reduced. Supervisory findings on Consumer Duty24 implementation in large insurance firms illustrate these dynamics: firms relied on process-completion metrics, set tolerances so high as to be effectively unbreachable, and rated indicators as satisfactory even where underlying customer outcomes had deteriorated.ccxlii Independent auditability and standardised reporting frameworks are therefore important safeguards against metric gaming and superficial compliance.

23. According to Goodhart’s Law, a measure becomes a target, it ceases to be a good measure," emphasising how metrics can lose their effectiveness when manipulated to meet specific objective

24. The UK’s Consumer Duty is a regulatory framework introduced by the Financial Conduct Authority requiring firms to deliver “good outcomes” for retail customers, including through fair value, customers understanding, suitable products and services, and effective customer support.

3. Outcome Orientation

Effective performance measurement frameworks should prioritise indicators tied to outcomes that matter, whether at the technical level (does the system deliver reliably enough to support customer journeys?) or the policy level (is Open Finance changing market outcomes?). This is not a distinction between technical metrics and policy outcome metrics; both types can be outcome-oriented or merely activity-counting. Some technical metrics, such as end-to-end consent journey success rates, remain genuinely outcomeoriented because failures in them translate can directly into customers abandoning a service. Others, such as raw API call counts, capture activity without revealing whether anything useful happened. Outcome-oriented indicators, therefore, focus on what changed as a result of the framework, rather than what activity occurred within it.

The same logic applies to policy outcome metrics. Counting the number of TPPs licensed is an activity; tracking switching behaviour among customers using Open Finance-enabled services is an outcome. Brazil's Banco Central do Brasil (BCB) operationalises this distinction by framing Open Finance against four explicit policy goals (competition, innovation, efficiency, and inclusion), providing a clear link between intervention and intended outcome, while maintaining a separate technical dashboard tracking API calls and uptime: the two dashboards serve different purposes, but both are anchored to meaningful operational and policy outcomes.ccxliii The UK’s CMA Open Banking Lessons Learned Review identified the absence of an explicit link between intervention and intended outcome in early Open Banking monitoring as a notable gap, and industry analysis of Australia's CDR has similarly pointed to a gapccxliv between compliance readiness and sustained customer usage.ccxlv The lesson is not that technical metrics should be downplayed in favour of policy outcome metrics, but that every indicator, technical or policy, should be selected on the basis that it provides meaningful insight into whether the framework is achieving its intended objectives.

4. Proportionality

Measurement frameworks impose costs on regulators and participants. These frameworks are most effective when the depth, frequency, and granularity of reporting remain proportionate to the policy value of the information collected. Excessively burdensome reporting may discourage participation by smaller TPPs or intermediaries,ccxlvi while highly complex indicators may prove difficult to operationalise or monitor consistently within existing analytical capacity. Established evaluation guidance treats proportionality as a core quality criterion, with the European Commission's Better Regulation Toolbox specifically requiring that indicators be "easy to monitor," that data collection avoid disproportionate burden, and that regulators re-use existing datasets, automate reporting, and rely on common standards wherever possible.ccxlvii Existing Open Finance regimes reflect these trade-offs in practice. Centralised data infrastructures, such as those used in Brazil and India, involve higher upfront investment but reduce long-term reporting and coordination costs.ccxlviii In EMDE contexts with limited monitoring capacity, recommended approaches include re-using existing prudential and conduct reporting, drawing on datasets already collected by credit bureaus or telecommunications providers, and embedding Open Finance questions within existing financial inclusion or consumer surveys rather than commissioning bespoke exercises.ccxlix

Proportionality also operates temporally. The depth, frequency, and granularity of indicators should scale with policy stakes and be periodically reviewed,ccl with performance measurement treated as an adaptive learning process in which indicators are refined as evidence accumulates and needs change.ccli In the early stages of Open Finance, this typically implies a focus on a limited set of technical and implementation-oriented indicators, with more granular outcome measures introduced as data availability improves and the ecosystem matures.

5. Granularity

Financial institutions hold granular complaints, payments, and transaction-level data; intermediaries and TPPs capture behavioural and journey-based usage patterns; customer advocacy groups provide complementary insights through independent surveys; and regulators aggregate system-level indicators for supervisory and policy purposes. For regulators to capture system performance fully, measurement frameworks should therefore draw on data from across these stakeholders rather than rely on any single source. This may also require standardisation of reporting obligations to reduce reliance on voluntary or fragmented disclosure and ensure that critical parts of the ecosystem are not omitted. Recent reviews of Open Finance measurement practice highlight the importance of combining heterogeneous sources, including centralised dashboards, participant-reported data, third-party administrative datasets (credit bureau, payments, telecom, and tax records), official statistics, and structured surveys.cclii

A further extension of this principle is sensitivity to distributional effects and unintended consequences: whether benefits and costs accrue to intended

populations and whether risks are displaced onto less visible market segments. In practice, this requires disaggregation across dimensions such as gender, income, geography (including urban-rural divides),ccliii and MSME participation, alongside monitoring outcomes such as adoption, consent revocation, complaints, and access to credit. Empirical evidence from Germany, where researchers working with a fintech lender found that borrowers with higher credit risk were more likely to opt into sharing bank transaction data, illustrates why disaggregation matters: those who did so experienced an 11.7 % increase in loan approval probability and a 2.2 % reduction in interest rates compared with similar applicants, with benefits concentrated among lower credit score borrowers and lower observed default rates.ccliv This finding demonstrates that Open Finance outcomes can vary significantly across population segments and that system-wide averages may obscure important distributional effects. The design challenge is therefore to ensure measurement frameworks capture such variation across actors, population groups, data types, and outcomes, while remaining sufficiently disciplined to prevent unnecessary expansion of reporting requirements.

3.3: Measuring Success of Open Finance in terms of Technical Outcomes

What are Technical Metrics in Open Finance?

Technical Metrics measure the operational performance of Open Finance infrastructure: whether APIs are available, responsive, and functioning as designed. They capture system-level behaviour: uptime, response times, error rates, consent success rates, and data fetch reliability. Technical metrics are

largely provider-facing: they enable regulators to assess whether the shared infrastructure underpinning data sharing is working reliably enough to support participation. They are typically measurable in near real time, directly attributable to specific participants, and comparable across providers.

Across Open Finance implementations, the starting point for measurement is almost universally technical: indicators that confirm infrastructure is live, stable, and operating within acceptable parameters. Before an ecosystem can deliver outcomes for customers or markets, it needs to function reliably as infrastructure, and technical metrics can provide its earliest available signal. Regulators and infrastructure operators interviewed for this report consistently highlighted the importance of technical metrics in maintaining trust, identifying system failures, and enabling effective supervisory oversight. As a senior specialist from a financial regulator in Southern Africa observed, early technical metrics are particularly critical during pilot phases, as they can provide assurance that the system is “stable enough to exist.”

This emphasis on infrastructure readiness reflects a broader set of international standards and regulatory precedents that have shaped technical metrics across countries. For instance, international standards such as ISO 20022 for financial messaging,cclv and Financialgrade API specifications for secure data exchange define baseline expectations for interoperability and security that influence how countries set their own performance thresholds.cclvi Several regulators have subsequently embedded these expectations into their formal regulatory reporting and monitoring requirements. For instance, the European Banking Authority Guidelines under PSD2 require ASPSPs to monitor and report minimum metrics for dedicated

interfaces, including daily average response times and error rates.cclvii

How these standards are translated into practice, however, varies considerably by country and institutional context. In Australia, technical metrics are embedded deeply within the regulatory architecture. Data holders are required to implement a compulsory “Get Metrics” API, providing the competition authority, the ACCC, with granular, real-time data on availability, error rates, and response times.cclviii India’s AA ecosystem, by contrast, places less emphasis on latency and uptime and more on scale, adoption, and consent flows. Public dashboards maintained by ecosystem bodies highlight metrics such as the number of accounts enabled, monthly consent volumes, data fetches, and growth rates, offering visibility into ecosystem usage rather than underlying infrastructure performance.cclix This difference may, in part, reflect the structural design of the AA system, which relies on a distributed network of AAs connected through bilateral integrations with data holders and data users. In such a topology, enforcing uniform technical service standards can be inherently more complex, as connectivity is not fully standardised across all participants and performance can vary across individual pairwise integrations. Understanding both what these indicators measure and what they systematically omit is the central task of this section. It begins with the metrics most commonly reported across the nine EMDEs and then assesses them against the five design principles.

Common Technical Metrics

Drawing on perspectives across the ecosystem, Figure 16 summarises the technical metrics most frequently referenced across the 33 stakeholder interviews conducted for this report. API availability and uptime emerged as the most referenced indicator, cited by 45% of interviewees, followed by transaction volume and value at 41%. By contrast, metrics related to

interoperability, data quality, and onboarding were cited far less frequently, despite being described by multiple interviewees as persistent operational challenges. This concentration around infrastructure availability and volume reflects the priorities of early and scaling/growth-phase ecosystems, where proving that the system works takes precedence over demonstrating that it is working effectively.

Source: CCAF, Fii and BIS; Findings draw from 33 interviewees from 11 countries (9 EMDEs and 2 AEs), including 12 regulators, 6 consumer protection experts, 6 intermediaries, 5 financial institutions, 2 international experts, and 1 industry body. Given the relatively small qualitative sample, findings should be interpreted as exploratory rather than statistically representative.

The Value and Limits of Common Technical Metrics

Technical metrics serve several consistent functions across countries. They are considered particularly valuable for enforcing minimum standards, benchmarking firms against regulatory thresholds, and identifying systemic operational risks before they translate into customer harm. The interview analysis in the previous section indicated that API uptime was the most frequently referenced metrics, underscoring its centrality in stakeholder assessments of system performance. Building on this, Figure 17 illustrates average API response times across the selected EMDEs and AEs.25

However, it is important to note that in some EMDEs, reported response times are derived from regulatory service-level standards rather than continuously observed system performance. As such, crosscountry comparisons should be interpreted as indicative of relative positioning rather than precise equivalence in realised system performance. For instance, Brazil’s Open Finance framework specifies response time requirements ranging from 1,500 ms

to 4,000 ms depending on endpoint category and usage frequency.cclx While the frameork also publishes operational monitoring data, including API availability metrics over rolling 90-day periods for participant and authentication services, these indicators primarily reflect uptime performance rather than end-toend latency experienced across all API calls.cclxi By contrast, some ecosystems publish observed system performance through public dashboards. For instance, the OBL in the UK and the ACCC, under Australia’s CDR framework, regularly publish operational metrics. Notably, the OBL Dashboard also discloses response times by individual data holders, enabling transparency and allowing regulators and ecosystem participants to hold entities accountable for performance.cclxii In India, the Sahamati Dashboard similarly reports ecosystem performance metrics for the AA Framework. Over the 30-day period ending in February 2026, the average response time stood at approximately 186 ms, reflecting comparatively fast data-exchange performance within the ecosystem.cclxiii This aligns with the broader Indian Digital Public Infrastructure (DPI) stack, which is designed to sustain low response times while operating at massive scale.cclxiv

Source: Sahamati Dashboard; ACCC, CDR Performance Dashboard; Banco Central do Brasil (BCB), Open Finance Standards; Open Banking Limited, the UK Open Banking Dashboard December 2025

25. Response time figures are not directly comparable across countries. Measurement definitions, API endpoint types, and reporting methodologies vary: Sahamati and the UK Open Banking Dashboard report exact observed figures (February 2026 and December 2025 respectively), the Australian CDR Dashboard reports an average range across data holders (0.205–0.562 seconds, December 2025), and the Brazilian average (1,500–4,000 milliseconds) figure reflect regulatory guideline threshold rather than observed performance data. Cross-country comparisons should therefore be treated as indicative of relative positioning rather than precise equivalence.

Such comparisons serve an important supervisory purpose. They allow regulators to benchmark infrastructure reliability across participants, identify outliers, and assess whether baseline service obligations are being met consistently. Where performance thresholds are publicly reported, they can also create market incentives for improvement and enable TPPs to hold data holders accountable. Yet the supervisory value of response time metrics is bounded by what they can observe. As interviewees consistently noted, “fast response times do not reveal whether data is accurate, whether customer journeys are completed, or whether users derive any value from data sharing.” Similarly, strong performance at one stage of the datasharing lifecycle can coexist with high drop-off rates or poor outcomes at another. A regulator monitoring API latency may be looking at a system that is technically responsive but functionally failing users at the point of product delivery or consent revocation. Technical benchmarking, while necessary, therefore captures only one dimension of success.

Response times are not the only technical metric where this gap between operational signal and outcome insight becomes apparent. Successful API call volumes, another widely reported indicator, can similarly be misleading when interpreted in isolation. Comparing Brazil and the UK illustrates this point: despite Brazil recording more than twice the volume of successful API calls than the UK (4,460 million in Brazilcclxv vs. 1,990 million in the UK cclxvi), both markets exhibit virtually identical levels of active adoption among the adult population (18.6% in Brazilcclxvii vs 18.4% in the UK cclxviii).

Much of the difference in API volumes is explained by population size, with Brazil having approximately twice the adult population of the UK. Moreover, API call counts are sensitive to the architectural design of standards, as the same data exchange may require different numbers of API calls across frameworks. For regulators, these factors suggest that API call volumes should not be treated as a standalone proxy for ecosystem maturity or user value. This view was echoed by practitioners across the sample. A data user from Nigeria described API call counts as a “low-level operational metric”, emphasising that technology is

ultimately a means to an end and should be assessed alongside outcome-based indicators such as active usage rates, customer benefit measures, and service quality assessments. Similarly, consumer protection specialists and regulators in India and the UK highlighted a growing emphasis on measuring realised customer value through impact reporting, customer surveys, and ecosystem benefit assessments. As one interviewee summarised the emerging regulatory stance: “show me the value”. Importantly, this does not imply that volume metrics are uninformative, but rather that they are incomplete without complementary measures of outcomes and value creation, especially as the ecosystem scales.

Upgrading the Common Technical Metrics

The previous observation that volume metrics can mislead is not an argument against technical metrics, but rather an argument for understanding precisely what they measure and what they do not. A structured way to do this is to assess some of the commonly used technical indicators against the five principles for measurement framework design set out in this report. The point of this assessment is not to condemn technical metrics for failing to do something they were never designed to do. Rather, it is to identify, systematically, which principles are addressed by existing technical measurement, and which are structurally absent, so that the case for complementary indicators can be grounded in RIA principles rather than assertion.

Consider five commonly reported indicators from Figure 16: API latency, API call volumes, transaction volumes, consent volumes, and participant onboarding counts. None fully satisfy the Attribution or Outcome Orientation principles. This is not a weakness of the indicators themselves, which are designed primarily for operational and supervisory purposes. However, it highlights an important limitation: technical metrics that are frequently used as proxies for Open Finance success provide only indirect evidence of whether intended economic or customer outcomes are being achieved. By contrast, all five metrics satisfy the Proportionality principle. They impose relatively low reporting burden and the fact that they are generated automatically through the technical infrastructure. This ease of collection may help explain their prevalence relative to more outcome-oriented indicators, which typically require greater methodological effort to develop and maintain. A further limitation is the lack of granularity. Although the underlying data could often support disaggregation by factors such as customer segment, MSME size, or geography, published metrics are typically reported only in aggregate form. This echoes findings from adjacent regulatory domains. In its review of Consumer Duty implementation, the UK's FCA criticised reliance on process-based measures rather than customer outcomes and emphasised that a wider range of metrics is needed to understand whether regulatory objectives are being achieved.cclxix

This does not imply that technical metrics should be replaced or viewed as deficient. Their primary function is operational and supervisory: to monitor the reliability, availability, standardisation, and ongoing functioning of the Open Finance infrastructure itself. In that role, they remain essential not only during earlystage implementation but throughout the lifecycle of the ecosystem, including in more mature markets where new use cases, participants, and interoperability challenges continue to emerge. The limitation is

instead that technical metrics, by design, are not intended to fully capture whether broader policy objectives are being achieved. A technically functional system does not necessarily imply improved customer welfare, MSME access, competition, or financial inclusion. As ecosystems mature, technical indicators, therefore, should be complemented, rather than replaced, by outcome-oriented technical measures to extract richer insights from the same underlying data.

Table 11 shows how the previously discussed technical indicators can be upgraded. Several countries have already begun moving in this direction. In the UK, impact assessments produced by the OBL, in collaboration with academic institutions such as the University of Bristol, supplement technical metrics with analysis of journey completion, abandonment rates, and customer outcomes.cclxx Brazil has progressively expanded from API performance monitoring to examining usage patterns, engagement, and system resilience.cclxxi

Table 11: Upgrading Technical Metrics using the Design Principles

Traditional Technical Metric

API Latency (Response Time)

Participant Onboarding Count

Measures average speed against thresholds but does not reveal whether delays disproportionately affect smaller TPPs or high-impact customer journeys.

Journey-weighted Latency, disaggregated by use case and participant type. Disaggregation by participant type can show whether higher latency is due to technical challenges or barriers to participation.

Requires disaggregated API logs by use case and participant type. May require upgrades to existing API infrastructure and standardised reporting templates agreed across the ecosystem.

Counts entities that have completed technical onboarding but does not distinguish actively operating participants from dormant registrations.

System Availability (Uptime %)

Consent Volumes

Aggregate uptime masks short but critical outages during peak periods and does not reveal uneven impact across participants.

Active Participation by Use Case: share of registered participants generating live services within a defined period.

Requires participant registries that distinguish active from dormant status, and a standardised definition of what constitutes a live service agreed by the regulator.

Use-case Critical Availability: uptime during peak or high-impact periods, disaggregated by participant type and reported publicly.

Raw consent counts do not reveal whether consents are informed, whether users understand what they have authorised, or whether consent revocation is accessible.

Effective Consent Rate: ratio of consents granted to data-sharing journeys completed, combined with revocation ease score (eg, steps required to revoke).

Requires time-stamped uptime logs disaggregated by participant, with peak period definitions agreed across the ecosystem.

Requires linking system logs to track journey completion rates and revocation steps. Revocation ease score can be derived from technical audit of the consent flow like number of steps, screens, and time required to revoke.

Outcome Orientation: ties latency to actual journey completion.

Granularity: surfaces uneven incidence across participants and use cases.

Attribution (partial): isolates participant-type effects from background noise.

Outcome Orientation: measures live participation, not registration.

Validity: regulator-defined live-service threshold reduces gaming.

Granularity: disaggregates by use case and segment.

Outcome Orientation: prioritises moments that matter to customers.

Granularity: distinguishes participant-level exposure to outages.

Validity: peak-period definitions reduce reporting discretion.

Outcome Orientation: captures meaningful consent, not volume.

Validity: revocation ease score is independently auditable.

Granularity: disaggregates by journey type and outcome.

Source: CCAF, Fii and BIS; The upgraded metrics strengthen outcome orientation by prioritising measurable effects over procedural activity; however, this comes at the cost of proportionality, as the additional disaggregation, tracking, and audit requirements increase data collection and reporting burdens relative to the original indicators.

A useful organising device for both current and upgraded technical metrics is the data-sharing lifecycle itself. Although institutional arrangements may vary, Open Finance implementations follow a broadly common sequence: consent initiation, consent verification, API data request, data delivery, and consent revocation or expiry. As Figure 18 illustrates, each stage generates its own set of measurable indicators, and the menu is extensive. Metrics at the consent and authorisation stages can provide insight

into user trust and the clarity of consent frameworks, dimensions absent from most current measurement. Midstream indicators covering API response times and error rates can assess operational reliability. Downstream indicators, including journey completion rates and consent revocation patterns, can reveal whether technical performance translates into usable outcomes.

Figure 18: Technical Data-Sharing Lifecycle and Examples of Associated Metrics

Consent Opt-In Rate

to

Consent Veri cation & Authentication

Data Request via API Data Sharing & Delivery

Data Receipt & Use

Consent Revocation or Expiry

Source: CCAF, Fii and BIS

Consent Drop-O Rate Consent Flow Error Rate Authentication Success Rate Average Authentication Time

Failure Rate Consent Token Issuance Rate

on participants. The practical test is signal quality: which indicators, with the least analytical overhead, tell you most clearly whether the ecosystem is moving in the right direction. It is also worth noting that as Open Finance frameworks mature and expand in some countries towards broader smart data or cross-sector data-sharing regimes, the lifecycle and its associated Consent Initiation

API Request Success Rate

Invalid / Expired Token Rate API Response Time (Latency) API Availability

Data Delivery Success Rate

Schema Compliance Rate

End-to-End Completion Rate

Downstream Processing Error Rate

Consent Revocation Success Rate

Data Completeness Rate

Data Delivery Latency

Service Decision Time User Journey Completion Rate

Post-Revocation Access Incidents Time to Revoke Consent Audit Log Completeness

The breadth of available indicators across the lifecycle, however, creates its own risk: measurement overload. Not every metric at every stage needs to be tracked by every regulator. Consistent with the proportionality principle, regulators may consider prioritising the indicators that are most directly connected to their stated policy objectives and that can be collected without imposing disproportionate reporting burdens

metrics will also extend accordingly, encompassing new data types, new participant categories, and new consent relationships. Regulators intending to expand data access across sectors can accordingly build measurement frameworks that are designed to evolve with the ecosystem from the outset.

In conclusion, while existing technical indicators are essential for supervisory oversight and operational assurance, they are structurally limited in their ability to answer the questions that matter most as Open Finance ecosystems mature: whether competition is increasing, whether underserved populations are benefiting, and whether customers are being

empowered. At the firm level, these measures support compliance monitoring, operational resilience, and participant conduct supervision. In aggregate, they provide a useful picture of ecosystem activity and performance. The upgraded indicators can strengthen their usefulness by incorporating greater outcome orientation and granularity, but they remain primarily measures of system functioning rather than policy effectiveness. Addressing this requires a distinct category of measurement: policy-level indicators explicitly designed to assess progress against the objectives that Open Finance was established to achieve.

3.4: Measuring Success of Open Finance in

terms of Policy Outcomes

What are Policy Outcome Metrics in Open Finance?

Policy Outcome Metrics measure whether Open Finance is advancing the specific public objectives that motivated its introduction: competition, innovation, financial inclusion, and consumer protection and empowerment.26 They assess impact on market structure, user welfare, and distributional equity

rather than system performance. They are typically longer-horizon, harder to attribute directly to Open Finance infrastructure, and may require data from sources beyond the API layer, including credit bureaus, household surveys, complaint registries, and market conduct data.

Governments and regulators often adopt Open Finance frameworks not as ends in themselves but to advance objectives such as competition, sustainable development, innovation, financial inclusion, and consumer protection and empowerment, goals that often overlap.cclxxii These objectives are inherently context-specific, shaped by national market structures, development priorities, institutional capacity, and each country's stage of digital and financial sector transformation. Technical metrics, however, carefully designed, cannot fully capture whether these objectives are being realised. A system that is fast,

reliable, and widely used may still be failing if it primarily benefits already-served customers, leaves incumbent pricing unchanged, or generates products that deepen debt rather than build resilience.

Policy outcome metrics might therefore be expected to be well developed and central to Open Finance monitoring frameworks, particularly since the data infrastructure, reporting structures, and disaggregation mechanisms needed for later measurement should be established early, well before outcomes can themselves be observed. In practice, however, policy

26. While these may be the most commonly stated objectives, other public interest objectives, such as stability and data and cyber security, remain relevant and should also be monitored.

outcome metrics across the nine EMDEs examined remain unevenly developed. Most countries articulate high-level policy goals clearly; fewer have translated those goals into systematic, measurable indicators. Where policy outcome metrics exist, they tend to rely on proxy measures from adjacent regulatory domains or on qualitative assessment rather than systematic quantitative tracking. Regulators in the Philippines, for example, noted that policy outcome metrics are not yet a primary focus given the early stage of implementation, while regulators in Brazil and India described a deliberate, phased transition from adoption-focused indicators towards more outcome and impact-oriented measures over time. The implication is not that countries should already possess mature outcome datasets, but that they should begin establishing the conceptual and institutional foundations for future measurement early in the implementation process, so that the necessary data and reporting structures are in place when such effects begin to materialise.

Common Policy Outcome Metrics

Unlike technical metrics, which are already systematically tracked across the EMDEs examined in this report, policy outcome metrics remain relatively nascent. The indicators identified through interviews, including both those currently monitored by regulators and those stakeholders indicated should be incorporated into future monitoring frameworks, provide a useful starting point for assessing how policy outcomes can be measured in Open Finance ecosystems. Figure 19 illustrates the frequency with which different policy outcome metrics were cited across interviews, grouped by the four policy objectives. It is important to note that this distribution reflects practitioner perspectives gathered through the interview process and should not be read as a comprehensive mapping of all metrics in use across the nine EMDEs. With that caveat in mind, it reveals where measurement attention is currently concentrated and, by implication, where it is not.

to market/ onboarding time (13%)

reduction/ e ciency gains (20%)

> product conversion (loans, accounts, services) (23%)

products/ use cases

(30%)

Voluntary participation (signal of value) (13%) Market share shifts / concentration (20%)

Consent control and revocation experience (13%)

levels/ surveys (20%)

dence indices (20%)

security/fraud incidents (23%)

to accounts / users onboarded (30%) Share of payments/transactions via Open Finance rails (10%) Sandbox outputs/cohort tracking (10%)

of participants /entrants (27%)

received/ resolved (27%) Gender/geography disaggregation (13%) Movement from informal to formal services (13%) New-to-credit / underserved segments (20%)

expansion / MSME lending (27%)

Source: CCAF, Fii and BIS; Findings draw from 33 interviewees from 11 countries (9 EMDEs and 2 AEs), including 12 regulators, 6 consumer protection experts, 6 intermediaries, 5 financial institutions, 2 international experts, and 1 industry body. Given the relatively small qualitative sample, findings should be interpreted as exploratory rather than statistically representative.

Innovation metrics focus primarily on observable market outputs, particularly new products and use cases enabled through Open Finance (30%). Stakeholders also pointed to measures such as APIenabled lending, account opening, and cost reductions as evidence of innovation. Competition metrics are less developed and rely largely on structural proxies, with participant numbers and new entrants (27%) the most commonly cited indicators. A senior regulator in the SSA region described success in terms of whether market concentration, particularly in mobile money, begins to "even out a bit" over time, while interviewees in the UK and Nigeria pointed to market entry and partnership formation as early indicators, cautioning that switching metrics alone may be misleading since customers often retain accounts but shift usage patterns rather than formally switching. Consumer protection and empowerment metrics are split between reactive measures, such as complaints and fraud incidents, and perceptual measures, including trust and awareness. Financial inclusion metrics are the most outcome-oriented, with access to accounts or users onboarded (30%), and credit expansion or MSME lending (27%) cited most frequently. However, interviewees noted persistent attribution challenges, as many inclusion outcomes are influenced by broader policy and market developments.

Evaluating the four most commonly cited indicators in Figure 19 against the measurement design principles introduced earlier reveals a consistent pattern of partial rather than full alignment across all four: new products or use cases enabled, number of participants or entrants, complaints received or resolved, and accounts or users onboarded. All four metrics partially satisfy the Attribution principle. They are more closely connected to policy-relevant behaviours and market developments than upstream technical activity measures, but none can isolate the causal effect of Open Finance without a comparator group, policy discontinuity, or jurisdictional control embedded within the measurement design. As a result, changes in these indicators cannot be confidently attributed to

Open Finance alone. Performance against the Outcome Orientation principle is stronger. Complaints received and resolved is the only metric that fully satisfies the principle, as it directly reflects customer experience and consumer outcomes. The remaining indicators operate at the level of intermediate outcomes. They capture meaningful changes in customer adoption, market participation, or innovation activity, but stop short of measuring the ultimate policy objectives that Open Finance seeks to achieve.

Validity is more uneven across the indicators. Registerbased measures, such as participant or entrant counts, perform relatively well because they rely on regulator-controlled data and stable definitions. By contrast, measures such as users onboarded, new use cases, and Open Finance-related complaints are vulnerable to definitional drift across jurisdictions and over time. Differences in classification practices can undermine comparability and create opportunities for inconsistent reporting or strategic interpretation. All four indicators perform reasonably well against the Proportionality principle. The underlying data are generally generated as a by-product of existing supervisory, licensing, or operational processes, meaning that collection costs are relatively low and the marginal burden of standardised reporting is modest. This helps explain their widespread adoption within Open Finance monitoring frameworks. Granularity, however, remains consistently underdeveloped. In principle, each indicator could be disaggregated by characteristics such as gender, income, geography, vulnerability status, or MSME segment. Such disaggregation could allow policymakers to assess whether benefits are being distributed equitably and to identify unintended consequences, including fraud, exclusion, or disproportionate customer detriment. In practice, however, most reporting frameworks continue to publish these indicators only in aggregate form, limiting their usefulness for understanding distributional effects and policy effectiveness across different population groups.

The following four subsections examine each policy objective in turn and consider how more outcomeoriented indicators could strengthen the evaluation of Open Finance. It should also be noted that as these policy objectives overlap, an indicator used for one may also serve another, so a measure of innovation may also speak to inclusion or consumer protection. The discussion draws on both existing measurement practices and potential approaches that could improve future monitoring frameworks. This analysis is necessarily more exploratory than the preceding assessment. As noted earlier, many of the outcome measures associated with policy effectiveness become relevant only once an Open Finance ecosystem reaches a sufficient level of maturity. Consequently, relatively few countries in the sample were able to provide robust evidence on these longer-term outcomes. To address this limitation, the discussion also draws on insights from AEs, adjacent evaluation approaches and related policy domains, where appropriate, to illustrate how outcome measurement could evolve as Open Finance frameworks mature.

Policy Outcome Metrics for Innovation

Regulators may wish to be wary of a common measurement pitfall: many innovation metrics conflate experimentation with success. Counts of sandbox participants, pilot projects, or proofs-of-concept reward countries for hosting activity without testing whether it translates into scalable products or durable economic value. This risks rewarding "innovation theatre," where firms cycle through continuous experimentation without reaching market scale and regulatory resources are absorbed by testing processes that generate limited measurable impact.cclxxiii Two of the indicators below are intended to address this directly; the remaining two are useful refinements of measures already in common use.

Share of New Products Serving Previously Underserved or Unfeasible

Use Cases: This captures whether Open Finance is enabling genuinely new market activity rather than accelerating existing innovation. It measures the share of new financial products launched over a given period that depend on Open Finance infrastructure to function, expressed as a percentage of all new launches. Products qualify

where their core functionality would not be technically feasible, or commercially viable, without API-based data access, payment initiation, or consent flows. The aim is to distinguish additive innovation from the repackaging of existing services. Operationalising it may require a regulator-defined taxonomy of qualifying use cases, ideally captured at the point of product authorisation to keep the reporting burden manageable. The closest existing analogues are the OBL Impact Reports,cclxxiv which classify live-to-market Open Banking propositions by outcome area (Figure 20(a)), and the EY analysis commissioned by OBL, which quantifies the economic value of Open Banking across six named use cases(payments, spending, saving, accounting, credit and debt management, and nonbanking applications).cclxxv Both come close to what this indicator would measure, but neither applies a strict dependency test to confirm that the counted propositions would be infeasible without Open Finance infrastructure.

Sandbox-to-Scale Conversion Rates: The proportion of firms that transition from regulatory testing to full licensure reflects the regulator's ability to clear pathways to market without compromising stability. Since 2018, SAMA's sandbox has processed 50 fintech firms,cclxxvi with 15 graduating to full authorisation by late 2024, implying a conversion rate of roughly 30%.cclxxvii The UK’s FCA operates a validator model requiring firms to be test-ready before admission,cclxxviii producing a 92% authorisation rate that reflects strict pre-selection rather than superior firm quality.cclxxix These differences reflect different regulatory approaches to risk and are best interpreted in context rather than ranked. The indicator becomes most useful when narrowed to the subset of sandbox participants related to Open Finance, such as the SAMA’s Open Banking Lab or the UK’s Smart Data Accelerator. Even where this leaves only a small number of firms, the resulting conversion rate is a cleaner signal of whether the Open Finance pathway is functioning, and whether the time from entry to live authorisation is compressing across successive cohorts. A declining rate among Open Finance firms even as the overall sandbox rate holds steady may indicate that complexity specific to data sharing, such as liability allocation, consent architecture, or API standardisation, is acting as a bottleneck that aggregate figures would obscure.

Two further indicators are worth tracking as complements, though both are closer to measures already in use. Time-to-Market Compression reflects both regulatory design and technical readiness: the shift to RESTful APIs has shortened product development cycles in leading markets from a typical two to five years to two to six months,cclxxx with the UK often cited for aggregator-hosted integration within weeks.cclxxxi Measuring the median time from approval to live launch, disaggregated by firm type and ecosystem stage, can show where friction is greatest. Public Sector Adoption Intensity captures the number and share of public services using Open Finance infrastructure, which can create guaranteed demand and validate infrastructure under realworld conditions.cclxxxii The clearest example is the UK's integration of Open Banking into HMRC tax collection,cclxxxiii which has processed more than GBP 33 billion (approximately USD 45.5 billion) since launch.cclxxxiv For most EMDEs this may be a maturitystage benchmark rather than an immediate priority, and regulators could begin with lighter forms of engagement, such as government agency participation as data users, before progressing to full payment or data-sharing integration. The Philippines offers an emerging example: the central bank has indicated plans to develop an Open Finance API for PERA, the country's voluntary pension scheme, enabling banks to connect account holders to pension services through their existing bank accounts.cclxxxv

Policy Outcome Metrics for Competition

As noted earlier, competition as a policy objective in Open Finance operates through two mechanisms, and tracking only one can mislead. The first is market structure: whether a more diverse set of participants are entering, competing for customers, and sustaining viable business models. The second concerns competitive outcomes: whether competitive pressure leads existing large providers to cut prices, improve products, or serve customers they previously neglected. An ecosystem with many active TPPs but no

change in incumbent pricing may indicate successful entry without effective competitive discipline. Conversely, when incumbents’ rates are falling but entrants cannot scale may signal competitive pressure working indirectly even where structural barriers persist. One indicator for each mechanism deserves particular attention; others are useful complements.

Activity-Based Diversity of Participants (Market Structure): As Figure 20(a) shows, live-to-market TPP propositions in the UK grew from 16 in 2018 to a peak of 155 in 2022, before settling at 145 by 2025.cclxxxvi This plateau may not suggest stagnation, but rather a market maturation phase. Single-feature aggregators and personal finance tools that could not monetise data presentation alone have exited, while B2B infrastructure providers, specialised lenders, and vertical solutions in areas such as tenant referencing and carbon accounting have entered.cclxxxvii A simple headcount cannot capture this qualitative shift, nor the layer beneath it: the 145 authorised TPPs support around 406 unregulated agents operating under a principal's umbrella, a substantial share of actual participants that authorisation-based counts overlook entirely.cclxxxviii As the UK extends Open Banking principles to energy, telecommunications, and transport under a Smart Data regime,cclxxxix the definition of a competitor will widen further, and capturing this will require activity-based diversity metrics rather than simple headcounts. External evidence points to effects further down the chain.

A 2024 Bank of England working paper studies the UK's 2017 MSME data-sharing rule, which applied only to firms with turnover below GBP 25 million (approximately USD 33 million).ccxc By comparing firms just below the threshold with otherwise similar firms just above it, the study was able to partially isolate the effect of Open Banking. Eligible firms were around 25% more likely to establish a new lending relationship, primarily with non-bank lenders. However, these gains accrued mainly to firms that were already borrowing, highlighting that increased competition and improved financial inclusion are related but distinct outcomes.

Figure 20: Two Dimensions of Open Finance Competition: Market Structure (UK) and Competitive Behaviour (Brazil)

Number of Fintechs Lending Rate Reduction

Source: (a) Open Banking Limited, Impact Reports 2019–2025; (b) International Monetary Fund (IMF) Working Paper (2026); Haas Ornelas and Reggi Pecora, BCB Working Paper (2022). Note: Brazil rate reduction figures are cumulative vs. 2018 baseline; fintech player counts are approximate.

Lending Rate Reduction (Incumbent Behaviour): The harder dimension to measure is whether competitive pressure leads incumbents to reduce price, shown in Figure 20(b). In Brazil, the entry and expansion of fintech lenders between 2018 and 2024 corresponds to an estimated cumulative reduction of 2.7 % in incumbent bank lending rates,ccxci and analysis of BCB credit registry data shows that in oligopolistic municipalities large incumbents cut rates and extended credit to more businesses following the arrival of peer-to-peer lenders.ccxcii These effects reflect

fintech expansion broadly rather than Open Finance alone, and other factors may contribute, but they illustrate a channel Open Finance can strengthen by lowering data-access barriers and enabling data-driven lenders to enter and scale. Central bank credit registries, which Brazil, India, and Nigeria already maintain, hold the loan-level data needed to detect such responses: regulators could periodically compare lending rates and credit volumes across markets or borrower segments with differing levels of Open Finance participation as one indicator of competitive effect.

Two further indicators are worth tracking as complements. The Share of Payment Transactions Originated by Non-Banks can be used to distinguish between passive data access and the ability of nonbanks to compete directly with incumbent providers. Brazil's Payment Transaction Initiator licence,ccxciii which mandates standardised, low-friction journeys across major banks, has supported 49 payment-initiation use cases and lets non-bank actors such as messaging platforms, marketplaces, and delivery apps initiate payments directly.ccxciv The share of Pix transactions they originate can signal whether Open Finance enables new providers to challenge incumbent revenue rather than merely aggregating data. Multi-Homing, the extent to which customers use several providers rather than remaining tied to oneccxcv can indicate lower switching costs and weaker lock-in,ccxcvi but is contextdependent. Where provider silos are strong, users may multi-home out of necessity, and better interoperability could reduce rather than raise it. As interoperability improves, users can increasingly meet their needs through one provider, so multi-homing may fall even as competitive pressure rises. It should therefore be read alongside interoperability and against prereform conditions, rather than as a universally positive signal. Systematic multi-homing data is not yet widely available, but both indicators can sharpen competition assessment as coverage improves.

Policy Outcome Metrics for Financial Inclusion

While many countries position Open Finance as a tool for financial inclusion, progress is often measured using aggregate adoption metrics that obscure who is actually benefiting. Such metrics cannot distinguish between inclusion (extending access to previously excluded groups) and intensification (existing users engage more deeply with financial services). Meaningful inclusion measurement, therefore, should include indicators that track participation and outcomes for women, rural users, MSMEs,

informal workers, and credit-thin customers. More broadly, regulators could consider disaggregation by characteristics such as gender, geography, income tier, and customer segment as a default, ensuring that ecosystem activity can be assessed not only by scale but also by its distributional impact.

New-to-Credit Ratio: Figure 21(a) shows AA-enabled lending in India growing more than eightfold between FY23 and H1 FY25, reaching INR 462 billion (approximately USD 4.8 billion) in a single half-year,ccxcvii led by personal loans (60% of H1 FY25 volume) and consumer durable loans (from zero in H2 FY24 to INR 105 billion, approximately USD 1.1 billion). Aggregate volume of this kind, however, cannot tell inclusion from intensification, and the product mix in Figure 21(b) is the more revealing lens. It shows a two-tier structure: the highest-share categories carry the smallest tickets (consumer durable loans average INR 0.27 lakh, approximately USD 280, and personal loans INR 2.0 lakh, approximately USD 2,100), consistent with reaching thin-file and lower-income borrowers, while the categories most associated with asset accumulation and durable economic mobility remain marginal (home loans and loans against property average INR 31.8 lakh, approximately USD 33,000, but only 3% of volume, and unsecured MSME lending 10% at INR 12.8 lakh, approximately USD 13,000).ccxcviii The appropriate metric is therefore not total disbursement but the new-to-credit ratio, the share of Open Financeenabled credit reaching borrowers with no prior formal credit history, read alongside volume and product mix. A rising ratio can signal genuine access expansion, while a flattening ratio amid growing volumes can signal that existing borrowers are simply taking on more debt.ccxcix Sahamati data suggest a significant share of FY25 disbursements reached new-to-credit or thin-file customers,ccc a World Bank study similarly assesses whether the AA framework reaches borrowers who would otherwise face informational barriers,ccci and interview insights indicate India plans to begin collecting gender- and geography-disaggregated data from 2026.

Figure 21: Growth in Lending Disbursements via India’s AA Ecosystem

Source: Sahamati, Primary Survey of Top Lending FIUs (2025). Data in USD Million. Average ticket size in USD (1 K =

10,000). Financial year (FY) = April–March; First half of FY (H1) = April–September; Second half of FY (H2) = October–March

MSME Digital Penetration: Inclusion frameworks should test impact where barriers have been highest, and MSMEs are a natural test case: in economies such as Nigeriacccii and the Philippinesccciii they drive employment and growth yet face persistent credit and data asymmetries and high switching costs. In the UK, MSME Open Banking adoption has reached about 18 %, roughly one in five businesses, ahead of retail uptake at about 13%,ccciv and in markets such as South Africa, where the MSME funding gap is estimated at ZAR 350 billion (approximately USD 22 billion), the share of MSME credit and services delivered through digital data rails can offer a tractable measure of progress.cccv

However, the evidence counsels care in interpretation. As noted earlier, the 2024 Bank of England analysis found that the UK's 2017 MSME data-sharing rule benefited firms that already borrowed, with no measurable effect for those without prior lending relationships.cccvi Data sharing can thus deepen access and lower costs for already-served MSMEs while leaving the wholly excluded untouched, which is precisely the distinction aggregate adoption figures miss. Tracking MSME Onboarding Rates and Alternative-Credit Origination, disaggregated by whether borrowers were previously served, can turn this into an inclusion signal rather than a volume count.

Two further dimensions are worth tracking as complements. Rural inclusion begins with infrastructure, since an API that performs in cities but fails on rural connections is exclusionary by design.cccvii API response times and availability could be monitored separately for metropolitan, peri-urban, and rural areas rather than reported as national averages.cccviii Further, a perfectly reliable API in a rural region does not translate into inclusion if no participating financial institution is offering products suited to the rural economy, or if rural users have insufficient digital or financial data to share. Take agriculture as an example, a more complete rural inclusion picture would combine three indicators: API performance disaggregated by geography (infrastructure availability); the participation of financial institutions serving the agricultural sector as either data holders or data users (supply-side relevance); and the share of Open Finance-enabled disbursements directed towards agri-credit, input financing, weatherindexed insurance, or other rural-specific products (demand-side use). Gender Inclusion and Monitoring is cross-cutting and requires explicit measurement, since women are disproportionately excluded and risk further disadvantage if credit models replicate historical bias.cccix Gender-disaggregated data on participation rates, approval outcomes, and usage patterns can help ensure Open Finance narrows rather than widens existing gaps. Specifically, regulators can monitor approval rate differentials for women with comparable cash-flow profiles to men; active consent shares held by women; and the share of Open Finance-enabled credit reaching women-led MSMEs.

Policy Outcome Metrics for Consumer Protection and Empowerment

Consumer protection metrics assess whether the framework prevents and remedies harm: complaint handling, fraud incidence, data security, and timely redress. Consumer empowerment metrics go further, capturing whether customers have meaningful choice, agency, and the ability to act on it: informed consent, frictionless revocation, the ability to switch or withdraw. One indicator for each deserves particular attention; the others are useful complements.

Redress and Grievance Composition: The practical first step is a grievance framework that tracks not just how many complaints arise but where in the user journey they occur, since without that granularity a regulator cannot tell an onboarding problem from a data-delivery or redress problem, or target intervention. India's AA ecosystem is an instructive model. As Figure 22(a) shows, Sahamati's dashboard sorts complaints across workflow steps, and of 116,593 cases to date about 88.5% cluster at the data-fetch layer, pointing supervisors straight at the technical reliability of data holders.cccx This kind of dashboard does not need to be public: regulators can keep granular FIP-level data confidential while using it internally to benchmark provider performance, detect deterioration, and prioritise engagement. The value lies in having the visibility, not necessarily in disclosing it. This monitoring can be complemented with additional indicators. Normalising complaint volumes per 100,000 users can help distinguish rising awareness of rights from genuine system failures; an accelerating complaint rate relative to adoption may signal structural problems.cccxi Escalation rates from internal to external dispute resolution can indicate whether institutions are resolving issues effectively or whether customers are increasingly forced to seek external remedies.cccxii Tracking the full distribution of resolution times rather than headline averages is equally important. FIPs in India are formally required to resolve complaints within 30 days, but Sahamati's data report a P50 of 13 days and a P90 of 193 days, pointing to a long tail of delayed cases that a headline average would flatten into a single uninformative figure.cccxiii

Consent Abandonment: Friction in the consent journey is the clearest window onto whether choice is real or nominal, and it is measurable. In Australia's CDR framework, as Figure 22(b) shows, abandonment falls at different stages by sector. In banking, it is spread across the funnel: about half of drop-offs (51%) occur before identification, but a substantial share come later, at pre-authentication (23%), account selection (11%), and token exchange (7%). In energy, the profile is far more front-loaded, with 91% of abandonment occurring before identification and little thereafter.cccxiv This points to different challenges. In energy, the concentration of

drop-off before identification suggests consumers are choosing not to begin, potentially reflecting limited awareness, trust, or perceived relevance rather than friction within the journey. In banking, consumers more often progress before abandoning, suggesting friction is distributed through the flow, including at the technical token-exchange stage, rather than concentrated at first contact. Abandonment must be read in context: for low-stakes journeys such as balance

checks, high abandonment may simply reflect choice and is not necessarily a poor outcome, whereas in high-stakes journeys such as mortgage applications or dispute resolution it may signal an unclear value proposition, weak trust, or poorly understood consent interfaces. It is therefore more useful as a supervisory signal when benchmarked by journey type rather than aggregated across heterogeneous use cases.

Figure 22: Consumer Protection Indicators: Grievance Composition (India) and Consent Abandonment (Australia)

(a) India: AA Grievance Composition by Consent Work ow Step (Cumulative Reported Cases Through January 2026)

(b) Australia: CDR Journey Abandonment by Stage and Sector (%, January-March 2026)

Source: (a) Sahamati Grievance Dashboard; all tickets to date total 116,593 cases; (b) Australian Competition and Consumer Commission, CDR Performance Dashboard; exact figures as reported.

Three further indicators are worth tracking as complements, two on the empowerment side and one bridging both. The Click-to-Consent Ratio, the number of screens or actions needed to authorise sharing, signals friction, but it is a tension to calibrate rather than a target to minimise: fewer clicks lift conversion, yet over-simplified flows such as single

"accept all" buttons can undermine informed consent,cccxv which is why Australian standards prohibit pre-selected options,cccxvi and why Nubank's reported consent conversion of around 65% against a market average near 35% reflects design and brand as much as efficiency.cccxvii Revocation friction, measured as the number of steps required to locate

and activate a revocation option, indicates design choices that discourage withdrawal.cccxviii This is particularly important to measure in advance, since users typically have no way of assessing revocation difficulty before consenting. Once they have consented, high revocation friction can effectively trap them in a data-sharing arrangement they would otherwise exit. Regulators can specify maximum acceptable revocation friction thresholds within customer experience guidelines and audit compliance. Revocation latency, the time between user action

and actual termination of data access, captures the operational dimension of the same right. Once a user withdraws consent, data access is expected to cease promptly; if data continues to flow for hours or days, institutions may be exposed to liability windows in which data is processed without a valid legal basis, undermining customer trust.cccxix These indicators are most useful when tracked per institution rather than as ecosystem averages, since the empowerment risk is concentrated at the level of individual provider design.

Should

success metrics be published in Open Finance?

A recurring theme across interviews was whether Open Finance success metrics should be made public. Views were divided. Around half of the interviewees supported public reporting, arguing that transparency can strengthen trust, accountability, and market development. They pointed to mature ecosystems such as Brazil and the UK, where public dashboards provide visibility into performance metrics such as API availability, latency, and success rates. Australia's experience reinforces this case: after the ACCC introduced a public dashboard identifying data holders that were not reporting performance data, reporting rates and system performance improved significantly without formal enforcement. Proponents argued that public benchmarking can create incentives for regulators and market participants to improve performance, much like the former Ease of Doing Business Index.

The other half of respondents emphasised caution, particularly for early-stage ecosystems and EMDEs. They highlighted the potential for misinterpretation, where temporary dips in technical performance, such as API latency or consent failure rates, could be read as systemic failures, undermining confidence rather than building it. Concerns were also raised about commercial confidentiality, where granular disclosure

of operational or business-model data could reveal sensitive strategies or pricing approaches, creating competitive distortions. Some stakeholders also noted that overemphasis on public metrics might encourage gaming of metrics, with providers optimising for what is measured rather than what matters for customer outcomes and inclusion.

Interviewee perceptions also vary across governance models. In market-driven systems, support for public disclosure is generally moderate, with interviewees in Ghana, and the Philippines expressing mixed views. South Africa stands out within this group, with interviewees expressing comparatively stronger support for public disclosure as an enabler of trust and accountability. By contrast, regulator-led systems show generally strong support. Interviewees in Brazil, India, and Nigeria frequently linked public disclosure to regulatory oversight, market discipline, and consumer protection. In Brazil, this is reflected in strong public engagement with the Open Finance Dashboard, which recorded 5.9 million views between January and June 2022.cccxx Indonesia is the exception, with interviewees indicating either active concerns around disclosure or a lack of current policy focus on performance transparency.

Figure 23: Interviewee Perceptions of Public Disclosure of Performance Metrics in Open Finance (n=7)

Source: CCAF, Fii and BIS; Data was not available for Egypt and Saudi Arabia.

The middle ground that emerges is a tiered approach balancing openness with proportionality. Certain metrics, particularly those reflecting ecosystem health and customer outcomes, may be appropriate for public disclosure, including high-level adoption numbers such as active users or consents granted, API uptime and availability, complaints resolution timelines, and switching indicators. Sensitive metrics such as revenue per user, conversion rates, granular consent logs, or business-model specifics can remain private to protect commercial interests and customer privacy. This approach aligns with OECD cccxxi and World Bank cccxxii guidance on proportional disclosure that safeguards both ecosystem stability and confidentiality.

Interviewees also stressed that transparency should evolve with ecosystem maturity. Early-stage ecosystems may require greater discretion when adoption and performance metrics are still developing, whereas more mature ecosystems can support broader disclosure. India's AA framework reflects this approach by

combining technical and adoption-focused reporting while preparing to expand measurement to genderand geography-disaggregated data. Public reporting can also extend beyond dashboards to qualitative evidence of customer outcomes. Brazilian examples are illustrative. Banks in Brazil report a range of customerlevel gains: Banco do Brasil reached BRL 700 million (approximately USD 135 million) in increased credit limits for individual customers, based on information shared via Open Finance with the bank in 2023;cccxxiii Nubank's overdraft alerts saved customers BRL 6.4 million (approximately USD 1.2 million) in interest over the first ten months of Open Finance use, reflecting access to cheaper credit than overdraft facilities;cccxxiv and the time taken to open accounts fell from 32 hours to around two hours, drawing on customer information held by other institutions.cccxxv Such evidence can complement ecosystem-level dashboards by demonstrating realworld value creation.

Importantly, meaningful public reporting does not require complete ecosystem coverage. The UK's OBL Impact Report (now in its seventh edition, May 2025) draws primarily from the nine largest current account providers representing approximately 85% of total payment volume. Sahamati similarly publishes an AA impact report covering India's lending ecosystem, using data from 12 FIUs that together account for 67% of lending consents fulfilled, then extrapolating to the ecosystem level.cccxxvi These examples suggest that representative samples or coverage-weighted

estimates can provide credible public insights where a comprehensive reporting infrastructure is not yet available. Taken together, stakeholder perspectives suggest that performance disclosure should not be viewed as a binary choice. A proportional framework that publishes systemic, high-level indicators while protecting commercially sensitive and customerlevel data offers a pragmatic path to strengthening accountability, trust, and ecosystem learning, particularly in emerging Open Finance markets.

In conclusion, Open Finance is complex, and no single measure will capture it. Establishing attribution, examining value, and tracking outcomes will require a combination of technical and policy metrics, applied with appropriate proportionality and granularity. The right combination will differ by country, shaped

by market context and policy goals. Regulators are therefore encouraged to consult and engage with industry to test and validate the proposed technical and policy outcome metrics against the five design principles, and to strike a workable balance between comprehensiveness and burden.

3.5: Performance Measurement in Open Finance: Regulatory Takeaways

Designing measurement frameworks for Open Finance is analytically demanding and warrants a similar level of rigour to that applied in more established regulatory domains. As a data-sharing infrastructure capable of supporting diverse use cases across multiple financial markets, the effects of Open Finance are often indirect, distributed across multiple actors, and highly context-specific. Measurement also depends on data generated by multiple parties within the ecosystem, including banks, financial institutions, TPPs, and intermediaries, many of whom may be reluctant to disclose commercially sensitive metrics publicly. Isolating its impact from broader market developments, therefore, requires moving beyond technical and compliance-based metrics.

What constitutes “success” in Open Finance can vary across stakeholders, and performance measurement design choices should reflect this Interviews conducted for this report revealed that regulatory bodies, data holders, incumbents, data users, intermediaries, and customer representatives frequently prioritise different, and sometimes competing, dimensions of success. Policy outcomes such as data protection and financial inclusion were discussed primarily by regulators, while ecosystem outcomes such as commercial viability showed the highest degree of overlap across data holders, TPPs, and intermediaries. Customer outcomes appeared to be less consistently reflected in the metrics currently tracked. This diversity is not a measurement problem to

be resolved by a single shared metric, but a reflection of the multidimensional nature of Open Finance. Metrics should therefore be anchored to the policy objectives the framework was designed to achieve while remaining meaningful to the full range of ecosystem participants.

Five design principles can help regulators build credible performance measurement frameworks, drawing on established regulatory impact assessment practices. Attribution asks whether the metric can reasonably isolate the effects of the Open Finance intervention from broader market dynamics, which often calls for pre- and post-intervention baselines or comparator groups. Validity asks whether the indicator genuinely measures what it purports to capture and is robust against manipulation, which may benefit from standardised definitions and independently auditable data. Outcome orientation asks whether the metric captures meaningful outcomes for customers, firms, and markets rather than merely operational activity or compliance. Proportionality asks whether the measurement burden is proportionate to the policy value of the indicator, recognising that excessive reporting can deter smaller participants. Granularity asks whether the framework captures distributional variation and unintended effects across segments such as gender, income, geography, and MSME participation.

Technical metrics are useful but may provide an incomplete picture of ecosystem performance, particularly when used in isolation. Technical indicators are often the earliest available signal that infrastructure is live and stable, and interviews conducted for this report identified API availability and uptime, and transaction volume, as the most frequently cited. However, headline volume metrics can be misleading without contextual normalisation, and API call counts have been described by some interviewees as low-level operational metrics. Assessed against the five design principles, technical metrics tend to satisfy proportionality by construction, since they are generated as a by-product of the infrastructure, but most fall short on attribution and outcome orientation. As ecosystems scale, regulators may benefit from

triangulating technical indicators with outcome-based measures such as active usage rates, customer benefit, and service quality to extract richer insight from the same underlying data.

Mapping technical metrics across the data-sharing lifecycle can help regulators choose the indicators that best fit their policy objectives. Data sharing follows a broadly common sequence, from consent initiation and verification through API data request and delivery to consent revocation or expiry, and each stage generates its own measurable indicators. Metrics at the consent and authorisation stages can offer insight into user trust and the clarity of consent frameworks, midstream indicators can assess operational reliability, and downstream indicators can reveal whether technical performance translates into usable outcomes. Not every metric at every stage needs to be tracked by every regulator. Consistent with the proportionality principle, regulators may prioritise indicators most directly connected to their stated policy objectives, and frameworks can be designed to evolve as ecosystems expand towards broader smart data or cross-sector data-sharing regimes.

Policy outcome metrics can help assess whether Open Finance is advancing the public objectives that motivated its introduction. Policy outcome metrics are typically outcome-oriented, assessing impact on market structure, user welfare, and distributional equity rather than system performance, and they often require data from sources beyond the API layer, including credit bureaus, household surveys, complaint registries, and market conduct data. A system that is fast, reliable, and widely used may still be falling short if it primarily benefits already-served customers, leaves incumbent pricing unchanged, or generates products that deepen debt rather than build financial resilience. Across competition, innovation, consumer protection, and financial inclusion, the most commonly tracked indicators often capture intermediate outcomes such as participant counts, new use cases, complaints, and accounts onboarded, but seldom isolate the effects of Open Finance or reach the ultimate policy objectives without an explicit comparator design embedded from the outset.

In principle, policy outcome metrics should play a central role in Open Finance monitoring frameworks from the outset, even though many intended outcomes may only become observable once ecosystems reach sufficient scale and maturity. The key implication is not that countries must already possess mature outcome datasets, but that they may benefit from establishing early the conceptual, institutional, and data foundations necessary to support future impact assessment. Although it can be challenging to isolate the specific contribution of Open Finance from other market and regulatory developments, a range of methods of analysis (such as qualitative and quantitative descriptive, differencein-differences designs, and regression analysis) can help isolate its contribution to measure competition, inclusion, innovation, and customer outcomes. During early implementation stages, technical metrics may also serve as proxy indicators for broader policy objectives. For example, the number of successful data-sharing consents may provide an indication of user engagement, while the number of active TPPs may offer an early signal of market participation and competitive activity. However, these proxies should not be treated as substitutes for dedicated policy outcome metrics designed to assess whether Open Finance is delivering its intended outcomes.

Competition metrics may benefit from capturing both market structure and incumbent behaviour, since each can move independently of the other. Headcounts of participants or new entrants can mask qualitative shifts in market composition, and an Active Diversity Ratio that measures the share of API volume generated by non-bank actors can offer a more meaningful signal. Incumbent pricing responses are also relevant, as evidence from Brazil suggests that even a relatively small non-bank market share can trigger a price response from incumbents. Central bank credit registries already maintained in countries such as Brazil, India, and Nigeria contain the loan-level information needed to detect such responses. Indicators such as the share of transactions originated by non-banks and multi-homing behaviour can further help distinguish passive data access from active market disruption.

Financial inclusion measurement can benefit from indicators that distinguish genuine access expansion from deeper engagement with already-served customers. Aggregate adoption metrics cannot reliably

distinguish between inclusion and intensification. A new-to-credit ratio, capturing the share of Open Finance-enabled credit reaching borrowers with no prior formal credit history, can offer a more meaningful signal than total disbursement volume alone, and tracking the product mix over time can reveal whether secured and productive-sector lending is scaling. MSME digital penetration, rural API availability, and response times disaggregated by geography, and sex-disaggregated data on participation, approval, and usage patterns can together help ensure that Open Finance narrows rather than widens existing gaps.

Consumer protection and empowerment measurement can extend beyond infrastructure health to capture whether consent is meaningful, revocable, and supported by credible redress. A structured grievance-monitoring framework that tracks where in the consent journey complaints arise, as illustrated by India's AA grievance dashboard, can help regulators target supervisory attention. Such dashboards need not be public to be useful, as their value lies in visibility rather than disclosure. Consent journey indicators such as abandonment rates by stage, as used in Australia's CDR framework, can highlight where consumers systematically disengage, while the click-to-consent ratio can flag friction or, conversely, over-simplified flows that may undermine informed consent. Revocation friction and revocation latency can further help assess whether user autonomy is genuinely supported once consent is withdrawn.

Whether to publish metrics can be approached through a proportional, tiered framework rather than a binary choice. Interview perspectives are notably divided, with some stakeholders arguing that public reporting fosters trust, accountability, and market development, and others emphasising risks of misinterpretation, commercial sensitivity, and metric gaming, particularly in early-stage ecosystems. Under such an approach, regulators could publish high-level, system-wide indicators – such as adoption numbers, API uptime, complaints resolution timelines, and switching metrics – while keeping commercially sensitive and micro-level data private. The scope for public disclosure could then expand as ecosystems mature.

Way Forward

This report set out to examine how incentives, liability, and performance measurement interact to enable Open Finance ecosystems. For countries pursuing Open Finance, these three pillars provide a structured approach for regulators to navigate key design choices that influence ecosystem outcomes: how to encourage meaningful participation from data holders, data users, and customers; how to build on existing legal architecture to address the accountability gaps specific to Open

Finance; and how to measure whether the resulting frameworks deliver on their policy objectives. While this analysis is grounded in evidence from nine EMDEs, complemented by selected reference to implementation experience elsewhere, the report aims to identify comparative patterns and illustrative tendencies rather than generalisable conclusions, offering practical design considerations that should be adapted to each country's institutional and market context.

Open Finance has the potential to enhance competition, stimulate innovation, strengthen consumer protection, and improve financial inclusion. However, the decision to adopt Open Finance is not straightforward. Policymakers and regulators in EMDEs should carefully assess whether its implementation aligns with their policy objectives and specific context, including the maturity of the financial sector, the robustness of digital infrastructure, and the presence of other pressing reform priorities. As such, a key area for further empirical research is the comparative effectiveness of Open Finance relative to alternative financial sector reforms in countries at earlier stages of digital and financial sector development. The evidence base needed to support such comparisons, including counterfactual analysis of countries that have prioritised other reform pathways, remains limited.

It is also important to acknowledge that the broader landscape in which Open Finance operates is evolving. The rapid development of AI, and particularly agentic AI systems capable of initiating transactions and managing financial relationships on behalf of customers, adds further complexity to questions of consent, accountability, liability and value exchange. BigTech firms hold a significant amount of personal, transactional, behavioural, and identity data, and their participation in any data-sharing ecosystem could

shift the discussion on incentive structures, liability frameworks, compliance and reporting expectations. Moreover, the extension of Open Finance principles into broader cross-sector smart data regimes will inevitably widen the universe of data holders, data users, and consent relationships, raising new questions around incentives to participate, allocation of liability, and clarity of governance approaches and regulatory regimes.

With these evolving developments in mind, the three-pillar framework provides regulators with a distinct lens to assess how incentive structures shape liability design, how liability arrangements in turn influence incentives, and how key metrics respond to targeted interventions. The policy considerations and trade-offs highlighted in this report, supplemented with observations from the nine EMDEs studied here, suggest that thoughtful, iterative design across incentives, liability, and performance measurement can form a credible foundation for enabling Open Finance ecosystems and adapting to changing market conditions. This section synthesises the report's chapter-level findings, identifies areas where the evidence base remains limited, and considers how the three-pillar framework can adapt to the broader shifts reshaping the Open Finance landscape.

Incentives

Regarding incentives, this report finds that mandates alone are unlikely to deliver meaningful Open Finance participation, and that a commercial model, while useful, is one tool among many rather than a prerequisite for progress. Governance structure and commercial model design appear to be largely independent policy decisions, with differing approaches across the sample not necessarily reflecting ecosystem maturity or effectiveness. Reciprocity can help rebalance incentives but works best when its limitations are understood, and incentive design more broadly may need to reflect local market structure rather than default to bank-centric assumptions, particularly in EMDEs where mobile network operators dominate transactional data. Underpinning all of this, customers remain the missing piece, and ecosystems function only when data sharing delivers tangible value in their everyday financial lives.

Looking ahead, the evidence gathered across the nine EMDEs in this study suggests that the more productive question for regulators is no longer whether to pursue a regulation-led or market-driven path, but rather which combination of incentives, in what sequence, and for which actors is most likely to support a functioning Open Finance ecosystem. Sequencing, in particular, remains an underexplored dimension of incentive design, and whether there are net positive benefits to introducing certain incentives before others is a question that would benefit from further empirical attention as more countries move into implementation.

Additionally, the typology of regulation-led and market-driven commercial models offered in this report is illustrative rather than definitive. Expanding the analysis to a broader set of countries could strengthen the framework and potentially identify additional models not captured in the current sample. Within this small sample, the most significant finding is that commercial model design appears to be largely

independent of governance approach. As the evidence base grows, future research could test whether this independence holds at scale, and whether particular combinations of governance and commercial design are associated with stronger ecosystem outcomes.

A further area where the evidence base remains thin concerns the views and experiences of customers themselves, and how Open Finance is shaping their financial lives. Even where evidence is currently limited, financial sector authorities could benefit from closely monitoring the market and adapting regulation accordingly as new evidence emerges, drawing on the range of tools already available, such as the CGAP toolkit. Change analysis may also become a valuable lens. If countries that have so far avoided charges for data access begin to introduce them, the questions of when the shift occurred and what conditions prompted it could form an interesting future research topic. While regulators interviewed for this study were strongly opposed to charging customers, fintechs and independent intermediaries acknowledged that future charging mechanisms may emerge, particularly for value-added services such as payment initiation, with long-term viability depending less on customers' ability to pay than on whether the value exchange is transparent, immediate, and clearly understood.

Other financial incentives may also emerge within the market without explicit regulatory intervention. Revenue-sharing models, for instance, can align incentives by allowing data holders to benefit from ecosystem growth without charging directly for data access, with banks receiving referral fees or revenue shares when fintechs use bank-provided data to originate paid services. Similar approaches are already observed in the UK and Australia through platforms such as Salary Finance, Abound, and WeMoney. How such models emerge in EMDEs, and whether they evolve organically or require some form of regulatory facilitation, would itself be a valuable area for further research.

Liability

Regarding liability, this report finds that Open Finance does not create accountability frameworks from scratch but instead builds on existing financial, data protection, and consumer protection regimes, while introducing genuinely novel multi-party features that can create accountability gaps not always addressed neatly by those regimes. Across the sample, no single liability model emerges as universally superior, with single-party, multiple-party, fault-based, and hybrid approaches each offering different trade-offs that may depend on institutional capacity, digital infrastructure, and policy priorities. A meaningful gap can exist between liability as written and liability in practice, with operational realities tending to concentrate responsibility on incumbent banks regardless of formal model design. Consent emerges as a regulatory tool in its own right, and dispute resolution mechanisms, while typically built on existing systems, can themselves function as substitute incentives where direct incentives for customer participation are limited. Existing legal architecture may therefore be necessary but not sufficient, with supporting conditions such as accreditation standards, audit infrastructure, crossregulatory coordination, and enforcement capacity playing a decisive role in whether liability frameworks deliver their intended outcomes.

Looking ahead, the evidence base for this chapter, while rich in interview insights and comparative regulatory analysis, is constrained by the nine-EMDE sample and the nascent state of several frameworks within it. The patterns identified should therefore be understood as illustrative tendencies within the sample rather than generalisable cross-country conclusions, and a larger comparative study would be required to determine whether they hold more broadly. Several questions, in particular, warrant further investigation as Open Finance ecosystems develop, and these questions are likely to become more pressing as countries move beyond Open Finance towards broader cross-sector data portability, where the scope and

volume of shared data increase substantially and the consequences of poorly designed liability and consent frameworks are correspondingly greater.

A first area for further research concerns whether the observed tendency for liability to concentrate on data holders, regardless of formal model design, holds across a larger and more diverse sample, and which institutional or market features drive or mitigate it. Closely related is the empirical relationship between prescribed dispute resolution timelines and actual resolution quality, including whether shorter timelines lead to genuine resolution or merely to superficial clearance at the internal stage. These questions speak directly to the implementation gap identified in this chapter and could meaningfully shape how future frameworks are designed and supervised.

A second area concerns the institutional architecture that underpins effective liability frameworks. How cross-authority collaboration between financial regulators and data protection authorities is operationalised in practice in advanced Open Finance markets, and what lessons this offers for EMDE institutional design, remains underexplored. The role of enforcement and supervision in determining whether liability frameworks deliver their intended outcomes is similarly under-researched relative to the attention given to framework design, and a stronger evidence base on this dimension could help regulators prioritise capacity building alongside rule-making.

A third area concerns the customer-facing effects of different consent models, specifically whether time-bound or purpose-specific consent translates into meaningfully better customer understanding and protection, or whether the benefits are primarily technical. This question becomes particularly important as ecosystems evolve and consent fatigue, dashboard usability, and the practical experience of revocation become increasingly relevant to whether consent functions as a genuine protection rather than a procedural formality.

Performance Measurement

With regard to performance measurement, this report finds that measuring Open Finance is analytically demanding, and that what constitutes success can vary meaningfully across stakeholders, with customer outcomes appearing less consistently reflected in the indicators currently tracked. Five design principles – attribution, validity, outcome orientation, proportionality, and granularity – can help regulators build credible measurement frameworks anchored to the policy problem the framework was designed to solve. Technical metrics offer the earliest signal that infrastructure is functioning, but tend to be incomplete on their own, and mapping indicators across the datasharing lifecycle can help regulators select those most directly connected to their objectives. Policy outcome metrics covering competition, innovation, consumer protection and empowerment, and financial inclusion can offer more meaningful insight where they move beyond aggregate counts towards indicators such as the Active Diversity Ratio, the new-to-credit ratio, consent journey abandonment, and disaggregation by gender, geography, and MSME participation. Whether to publish metrics may be best approached through a proportional and tiered framework that expands as ecosystems mature, rather than a binary choice between full transparency and confidentiality.

Looking ahead, the findings in this chapter rest on a relatively small interview base across the nine EMDEs studied, and the patterns identified, including the most commonly cited technical and policy outcome metrics and the divergent stakeholder views on what constitutes success in Open Finance, should be understood as illustrative tendencies rather than generalisable conclusions. A larger and more structured survey across a broader set of countries and stakeholder categories could meaningfully strengthen the evidence base, surface patterns not visible at this scale, and help test whether the design principles and proposed indicators travel well across different regulatory and market contexts.

Regulator-level performance is one area where further research could prove particularly valuable. While much of the existing measurement conversation focuses on the performance of data holders, data users, and intermediaries, comparatively little is known about how to assess regulators’ own contribution to ecosystem outcomes. Possible indicators could include the time taken to issue, revise, or finalise key rules, the stability of regulatory positions over time, and the responsiveness of supervisory processes to emerging market developments. The back-and-forth observed in the United States, the multiple iterations of Australia's CDR, New Zealand's shift from initially permitting charges in draft form to removing them from the final framework, and Brazil's codification of a commercial model that has not been operationalised in practice all point to the value of treating regulatory consistency, sequencing, and credibility as measurable dimensions of Open Finance performance in their own right.

Beyond regulator-level performance, several other dimensions of performance measurement design may warrant further investigation. The empirical relationship between specific metric design choices and observed ecosystem outcomes remains underexplored. In particular, it remains unclear whether certain indicators systematically correlate with stronger competition, innovation, or inclusion outcomes, and whether the design principles proposed here behave differently across early, growth, and mature stages of ecosystem development. The unintended consequences of measurement, including the extent to which published metrics influence the behaviour of regulated entities through metric optimisation rather than substantive performance improvement, would also benefit from more systematic study, particularly as Open Finance ecosystems mature and the stakes attached to published indicators increase.

Appendices

Governance Frameworks in Open Finance

Regulation-Led

1. Mandated and Standardised Data Sharing: refers to countries whose authorities mandate data holders to share customers’ data, upon the customer's consent, with data users, and stipulate the technical standards to be used for data sharing. This approach is seen in countries such as Australia, Brazil, and the UK, where regulators enforce both data sharing obligations and detailed technical standards.

2. Mandated Data Sharing: refers to countries whose authorities mandate data holders to share customers’ data, upon the customer's consent, with data users, but do not stipulate the technical standards to be used for data sharing. Countries adopting this model include the EU and Oman, where data sharing is compulsory, but implementation standards are left more flexible.

Market-Driven

4. Guided Implementation: lies between regulationled and market-driven approaches. It refers to countries where authorities may issue API standards and/or best practices without enforcing strict adherence. They may also facilitate discussions, knowledge-sharing events and create incentives – such as access to government databases –to encourage data sharing among financial institutions. While compliance is not mandatory – at least not yet in some countries – regulators may observe market developments and behaviours from a distance, influencing participation through incentives. the Philippines illustrates this approach,

3. Standardised Data Sharing: refers to countries in which data holders are not required to share customers data with users without their consent. However, if data holders choose to participate in data sharing, they are required to follow specified technical standards. Regulators can either issue a single standard that all participating data holders must use, ensuring consistency, or provide a list of recommended or recognised standards, allowing for greater flexibility in implementation but potentially increasing complexity for data users who need to accommodate different systems. This framework is applied in markets such as Colombia, India, Indonesia, and Nigeria.

as regulators encourage engagement through guidance and various incentives, but refrain from requiring mandatory compliance.

5. Voluntary: refers to countries where governments have not actively supported the development of Open Banking products and services, instead allowing the market to decide. Examples include Ghana, South Africa, and the United States, where Open Banking is advancing mainly through industry-led initiatives rather than regulatory requirements.

Data Sharing Architecture in Open Finance

Once a country decides whether its Open Banking approach will be primarily regulation-led or marketdriven, the next question is much more practical: what does the actual data sharing setup look like in real life? Countries solve this in different ways depending on their digital foundations, technical capacity, and the mix of large and small providers in the market. This section breaks down these three models and illustrates how EMDEs are putting them into practice.

One-to-One Model (Direct Connections): The data user connects directly to each data holder. After the data owner gives consent in the data user’s app, the data user calls the data holder’s API and receives the authorised data. This works best when most banks and mobile money providers already have strong APIs and digital ID systems. Imagine a customer who has three different financial accounts – one with a bank, one with a mobile money provider, and another with a second bank. When the customer wants to use a budgeting app or digital lender, the app first requests consent for all three accounts inside the data user’s interface. Once consent is granted, the data user must separately connect to each financial institution using that institution’s API. Each data holder then authenticates the customer, typically using an OTP, biometrics, or a digital ID login, and, once verified, sends the authorised account data directly back to the data user. Because the data moves point-to-point between each data holder and the data user, this model offers strong security and clear accountability. However, it can be difficult for smaller institutions that lack the capacity to build and maintain standardised APIs. Brazil’s system is designed around direct API connections. After the data owner approves sharing, the data user (a fintech, budgeting app, or lender) connects straight to the data holder through standardised APIs set by the central bank. Data holders authenticate the customer using an OTP or biometrics and return the permitted data. No intermediaries are needed because large banks follow uniform API rules.

One-to-Many Hub Model (Central Switch or Repository): In the one-to-many hub model, all participants connect just once to a national hub, usually owned or supervised by the government, central bank, or a national payments switch, instead of building multiple direct connections. When the data owner gives consent, the data user sends a request to the hub, and the hub retrieves the necessary information from the relevant data holders on the customer’s behalf. This greatly reduces the technical burden on small banks, Microfinance Institutions (MFIs), and mobile money providers, because they only need to maintain a single connection to the hub rather than creating separate APIs for every data user. The model also gives regulators better visibility across the system since all data flows pass through a single point. However, it introduces a potential single point of failure and requires strong trust, governance, and security around the hub. The Ghana Interbank Payment and Settlement Systems Limited (GhIPSS) is an example of an institution already positioned to play this role: the data user sends a consented request to GhIPSS, and GhIPSS fetches the data from the appropriate data holders, making participation easier for small providers while still ensuring controlled and accountable data sharing.

Many-to-Many Intermediary Model (AggregatorBased): By contrast, the many-to-many intermediary model has multiple intermediaries, not just one. Data users can choose any intermediary they want, and intermediaries compete to provide better reliability or onboarding. These intermediaries handle the technical connections, security protocols, and API requests across the ecosystem. When the data owner consents, the data user sends that consent to whichever intermediary they are using, and that intermediary fetches the data from the data holder and delivers it. The data user might choose different intermediaries for different data holders, and data holders may integrate with multiple intermediaries. This model is

especially valuable in markets with uneven technical readiness, because it allows smaller banks, Microfinance Institutions (MFIs), Non-Banking Financial Companies (NBFCs), and insurers., and insurers to participate without needing advanced APIs. The downside is the added operational layer, which can create dependency and complicate questions around liability. India’s AA system works exactly in this way: AAs act as data-blind

entities – they never see, access, or store the customer’s financial data. Instead, they simply route the consent, retrieve the encrypted data from the data holder, and deliver it to the data user. As of now, there are around 16 licensed AAs operating in India.cccxxvii This design allows the ecosystem to scale quickly while using India’s digital ID systems for secure customer authentication.cccxxviii

Key Dimensions of Consent Design in Open Finance

1. Timing of Consent

How it is designed: Consent may be obtained at the time of transaction, per use case, at product enrolment, or embedded as a one-time agreement within general terms and conditions.

In practice: A data user in the Philippines noted that consent is often embedded as a perpetual agreement within terms and conditions at account creation, authorising ongoing data access tied to the account purpose. However, this approach differs from activityspecific consent models, where new or distinct

Regulatory Guidance: Regulators may consider specifying whether consent must be event-specific or whether standing authorisations are permitted, and if so, under what conditions. Blanket consent embedded

data uses involve fresh authorisation, with potential implications for the granularity of consent over time.

Liability implication: Blanket or embedded consent can reduce clarity over who is lawfully authorised to access data at the point of a breach, complicating attribution of responsibility.

Participation implication: Embedded consent can raise initial uptake by reducing friction, but it can weaken ongoing accountability clarity for both customers and regulators.

in terms and conditions may not be equivalent to informed, purpose-specific consent. Minimum standards for consent capture and audit logging at the point of access can be defined.

2. Degree of Purpose Specificity

How it is designed: Ranges from narrowly defined, usecase-specific consent to broad authorisation covering multiple or undefined purposes.

In practice: Senior fintech leaders in India noted that consent artefacts require explicit approval of the use case and purpose, with any deviation treated as misuse.

Liability implication: Narrow, purpose-specific consent can improve traceability and attribution precision when misuse occurs. Broad consent can make it harder to

Regulatory Guidance: Regulators may consider requiring consent artefacts to specify the use case and data purpose explicitly. Frameworks that permit open-ended authorisations can include clear rules on

establish whether a given use is authorised. However, these benefits depend on system design, poorly structured technical frameworks may permit access to excess data, undermining the value of purpose limitation.

Participation implication: Narrow purpose definitions can increase compliance costs but build customer trust. Overly broad consent may reduce trust and expose participants to regulatory challenge.

what constitutes misuse, so that deviations can be identified and enforced. This is particularly important in EMDE markets where customer literacy and awareness of data rights may be limited.

3. Granularity of Data Access

How it is designed: Consent may apply to specific data fields, datasets, or the frequency of access, for example, capped API call limits for recurring data pulls.

In practice: Interviewees from India described ecosystem-level “fair use rules” that cap how often data can be fetched under a recurring consent, codifying granularity at the infrastructure level. Granularity may also be shaped by specifying the types of consent that can be collected, thereby limiting access to what is necessary for the defined use case.

Regulatory Guidance: Regulators could consider establishing minimum granularity requirements, particularly on data field scope and API call frequency, while avoiding over-specification that excludes

Liability implication: High granularity aligns liability more closely with actual control: it is clearer which actor accessed what data and when, supporting more precise fault attribution.

Participation implication: High granularity can increase technical and operational burden. It can deter smaller participants without the infrastructure to implement fine-grained access controls.

smaller participants. Codifying granularity at the ecosystem or infrastructure level, as India has done through fair use rules, can lower individual compliance costs while maintaining accountability standards.

4. Duration and Validity

How it is designed: Consent may be single-use, time-bound (for example, 90–180 days), or effectively perpetual unless actively revoked.

In practice: A consumer protection organisation in Ghana noted that once consent is given, there is often no clear expiry. Other interviewees suggested moderate durations – around two years – to balance protection with transaction costs.

Regulatory Guidance: Regulators could set a maximum consent validity period, even where they allow flexibility in shorter durations. The absence of any expiry, as observed in several EMDEs, is a governance

Liability implication: Time-bound consent limits legacy liability exposure by ensuring that outdated or forgotten access is automatically terminated. Perpetual consent can create open-ended liability risk.

Participation implication: Shorter durations can increase customer safety but raise transaction costs through frequent renewal. Longer durations can reduce friction but increase the risk of stale or misused access.

gap that concentrates unquantifiable liability risk. A reasonable default of 12–24 months, with use-case-based exceptions, can provide predictability without excessive friction.

5. Revocability and Enforcement

How it is designed: Formal revocation rights exist across most frameworks, but the speed and reliability of enforcement varies significantly in practice.

In practice: A payments specialist in SSA reported disputes where customers claimed to have withdrawn consent, but data access continued due to delays in real-time propagation across systems.

Liability implication: Weak or slow revocation can create liability ambiguity: if access continues after withdrawal, it is unclear whether subsequent data use was lawful and who bears responsibility for harm.

Participation implication: Where revocation is difficult or unreliable, customer trust can decline. Effective revocation is a prerequisite for customers to feel genuinely in control of their data.

Regulatory Guidance: Establishing a right to revoke is insufficient without technical requirements for how revocation propagates across systems. Regulators may consider specifying maximum propagation timelines,

the period within which all participants in the data chain must reflect a revocation, and make data access that continues after revocation a strict liability event, removing the need for customers to prove harm.

6. Aggregation and Intermediaries

How it is designed: Consent may be managed by data holders, intermediaries, or dedicated consent managers, with each arrangement carrying different implications for role clarity and risk concentration.

In practice: In India, consent managers introduced under the Digital Personal Data Protection Act is designed as an umbrella construct that extend the logic of sector-specific models, such as the existing AA framework. The AAs are expected to be recognised under this broader framework to facilitate crosssectoral data sharing.

Regulatory Guidance: Where multiple entities can perform consent management functions, regulators could consider designating a clear lead and define non-overlapping responsibilities. In markets where intermediaries are emerging, regulators could consider

Liability implication: Clear role assignment can improve auditability and makes it easier to identify which entity is responsible for a consent failure. Overlapping mandates can reduce clarity and may allow responsibility to fall between actors.

Participation implication: Centralised consent management can reduce coordination costs but concentrates risk. Fragmented management across multiple intermediaries can raise complexity and may deter participation.

establishing accreditation or certification requirements for consent managers, both to ensure technical capability and to create a clear accountability chain in the event of failures.

Regulators face a recurring trade-off in calibrating consumer protection and operational efficiency. Verifiable, purpose-specific, and time-limited consent provides greater clarity over who is authorised to access data, for what purpose, and for how long, thereby facilitating clearer liability assignment when misuse or breaches occur.cccxxix At the same time, tightly defined consent parameters can introduce friction for users and increase compliance burdens

for participating institutions. These trade-offs are particularly acute in EMDEs, where regulatory capacity and market maturity may be uneven. Among the various consent design parameters, consent validity periods represent one of the most clearly defined regulatory levers shaping this balance between consumer protection and operational efficiency.

Regional Harmonisation and Cross-Border Interoperability in Open Finance

What regional harmonisation means in Open Finance? Open Finance frameworks have largely been designed and implemented at the national level. However, as data portability and digital financial services mature, questions are increasingly being raised about how nationally distinct Open Finance regimes might interact across borders. In this context, regional harmonisation can be understood as the coordination or alignment of Open Finance arrangements across multiple countries to enable cross-border data sharing and interoperability.cccxxx This does not necessarily imply the replacement of domestic frameworks or standards. Rather, regional harmonisation refers to the potential for interoperability between national Open Finance systems, where countries retain their own regulatory approaches while enabling controlled and lawful crossborder data sharing.

Building on a long history of cross-border data initiatives: The desire to enable safe and harmonised data sharing is not new. The OECD Guidelines on the Protection of Privacy and Transborder Flow of Data (1980), the UN Guidelines for Data Protection (1990), the Council of Europe Convention on Automatic Processing of Personal Data (1981), and more recently the EU's GDPR (2016)cccxxxi all built towards the same underlying premise of safe and efficient cross-border data sharing. In Open Finance specifically, the EU offers a partial illustration: under PSD2, Open Finance operates across member states through a common legal framework and shared objectives, while allowing national authorities discretion in implementation and supervision.cccxxxii Although this model reflects the EU's specific legal and institutional context, it demonstrates how interoperability can be pursued without eliminating national regulatory autonomy.cccxxxiii

Beyond Europe, regional efforts are increasingly moving from principle-setting to operational coordination. In ASEAN, divergent rules on data localisation, consent, and processing create practical barriers for firms operating across multiple countries,cccxxxiv for example when data must be stored domestically in one country but analysed using tools located in another. In response, ASEAN is advancing the Digital Economy Framework Agreement (DEFA), which seeks to establish a legally binding regional framework for cross-border data flows and signals a shift from soft coordination towards more formalised interoperability. The East African Community has similarly set out an EAC CrossBorder Payment System Masterplan to harmonise the regulatory framework for payment systems.cccxxxv In Africa more broadly, the Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade,cccxxxvi adopted by the African Union in 2024 with its annexes adopted in 2025,cccxxxvii situates Open Finance within a continental strategy for digital trade and data flows.

Benefits of interoperability: From a technical perspective, regional harmonisation could involve interoperable APIs, mutual recognition of consent artefacts, or compatible identity and authentication mechanisms, allowing data to move across systems even where underlying standards differ.cccxxxviii From a functional perspective, cross-border interoperability may facilitate financial services for individuals and businesses operating across multiple countries, support regional trade and remittances, and enable products tailored to mobile or cross-border populations.cccxxxix It may also reduce duplication in technical integration and compliance efforts for firms operating in multiple markets, potentially supporting more scalable business models.

The real constraint is legal, not technical: At the same time, regional interoperability introduces additional layers of complexity. Differences in legal frameworks governing consent, data use, and liability raise questions around accountability, risk allocation, and enforcement when data is shared across borders. Evidence from stakeholder interviews suggests that technical infrastructure is generally not the primary barrier to cross-border Open Finance. Instead, legal and institutional differences governing data flows appear to be more significant constraints. While technical standards can often be developed and aligned, achieving legal interoperability, particularly in relation to consent validity, data protection obligations, and liability allocation, remains complex. Effective crossborder data sharing typically requires coherence across multiple interdependent layers, including legal foundations, technical infrastructure, governance processes, and commercial arrangements.

These legal frictions can also shape market incentives. Interviews point to an "incumbency hurdle", whereby many established financial institutions already perceive Open Finance obligations as a challenge to their existing market positions, with even domestic mandates proving difficult to enforce. Extending obligations across borders is likely to be viewed as more challenging still, and in the absence of clear regional guidance on consent and liability, incumbents may respond defensively, reducing participation incentives for smaller firms and fintechs.

A data governance expert further noted that regional coordinating bodies, such as the ASEAN Secretariat, face constraints in acting as stewards for harmonised consent or liability principles, reflecting both resistance from national incumbents and the absence of a strong coordinating mandate.

Emerging responses: A number of initiatives are seeking to address these challenges. Emerging discussions around fintech passporting arrangements in Africa, which would allow licensed entities in one

jurisdiction to operate across others with limited additional compliance, could ease entry barriers and support regional scale,cccxl though such arrangements require coordination on consumer protection and liability standards. At the international level, the OECD cccxli and the Financial Stability Board have examined cross-border data flows, data portability, and regulatory coordination, highlighting opportunities for greater alignment while preserving flexibility for domestic policy objectives.cccxlii In parallel, BIS-led initiatives such as Project Aperta focus on enabling interoperability between national consent, identity, and data sharing frameworks by developing a common technical layer that allows systems to "translate" across countries. Rather than imposing uniform standards, the project accommodates differences in domestic legal regimes by allowing countries to retain their own consent models, data protection rules, and liability arrangements, demonstrating how technical solutions can perform much of the operational heavy lifting even where legal frameworks remain nationally defined.

Outlook: The trajectory of cross-border Open Finance integration will be shaped less by the availability of technical solutions than by the extent to which countries can establish compatible legal and governance foundations for data sharing.

Initiatives such as DEFA, the EAC Cross-Border Payment System Masterplan, and the AfCFTA Digital Trade Protocol illustrate that legal and institutional alignment is already being pursued.cccxliii While full legal harmonisation is unlikely in the near term, these incremental efforts, through shared principles on consent, clearer approaches to liability allocation, and interoperable governance mechanisms, are beginning to lay the foundations for cross-border interoperability. In regions such as Africa, where digital financial activity is increasingly cross-border by nature, the effectiveness of these efforts may determine whether data sharing ecosystems scale regionally or remain fragmented along national lines.

Open Finance as an Enabler of MSME Credit Access and Efficiency

MSMEs are a major engine of economic activity worldwide, especially in EMDEs. They generally make up over 90% of all firms, contribute roughly 50% of global employment, and generate about 50% of GDP in many countries.cccxliv Their economic footprint makes them critical for inclusive growth, job creation, and poverty reduction. Despite their importance, MSMEs face persistent barriers to accessing formal finance. Recent estimates indicate that the MSME finance gap in EMDEs is approximately USD 5.7 trillion – a figure roughly equivalent to 19% of GDP and about 1.3 times the current level of MSME lending.cccxlv This gap is particularly wide for formal, small, and women-owned enterprises, constraining investment, productivity, and resilience.cccxlvi

These structural frictions have motivated policy interest in Open Finance initiatives, which can enable secure, consent-based access to more granular financial data and support digital underwriting models tailored to MSMEs. By allowing lenders to aggregate transaction, banking, and accounting data, Open Finance frameworks can enrich MSME credit risk assessment, particularly in contexts where traditional credit histories are thin or fragmented.cccxlvii Access to such data has been shown to be highly predictive of repayment capacity and enables a shift towards cash-flow-based credit assessment, reducing reliance on balancesheet proxies and collateral.cccxlviii The inclusion of alternative data, such as transaction histories, invoice flows, and platform revenues, has been associated with improvements in credit scoring accuracy and expanded loan availability for small firms and first-time borrowers, while also lowering onboarding costs and operational friction for lenders.cccxlix Taken together, these efficiency gains translate into tangible incentives for lender participation in Open Finance ecosystems, supporting scalable MSME lending models and entry into new business segments.

One measurable operational outcome associated with Open Finance adoption is a reduction in MSME loan turnaround time, which has emerged as a practical metric for assessing improvements in credit market efficiency.cccl API-based data sharing can enable near-real-time verification of income, balances, and transaction histories, reducing the need for paper documentation and repeated in-person verification.cccli Automated underwriting tools that assess live cash flows and apply standardised scoring models can shift credit decisioning from multi-week timelines to hours or days, depending on market maturity and lender business models.ccclii

Country experiences illustrate these dynamics. In India, the AA framework allows lenders to access MSME cash-flow data with customer consent, and documented cases indicate that loan approval timelines for many digital MSME products have fallen from weeks to under 48 hours.cccliii Many lenders also report a significant increase in lending to new-tocredit customer segments.cccliv Building on this, India’s Unified Lending Interface (ULI) standardises APIs for complete loan lifecycle and integrates diverse financial and non-financial data sources, allowing credit access to SMEs.ccclv In the UK, Open Finance-enabled account and income verification has reduced MSME verification processes from several days to near-instant,ccclvi with funding frequently completed within 24 hours of approval.ccclvii CFIT’s Open Finance coalition provides more evidence of Open Finance allowing greater MSME credit access. It was observed that Open Finance may provide access to finance to over 25% of MSME loan applicants who had already been referred for manual underwriting and would potentially have failed to receive any offer under conventional processes.ccclviii

Table 12: Indicative MSME Loan Turnaround Times using Open Finance Data (n=3)

India < 1 hour–48 hours

UK ≤ 24 hours

Singapore 24–120 hours

Source: CCAF, Fii and BIS

Instant approval for select bank digital products (eg, State Bank of India’s SME Digital Business Loan);ccclix 24–48 hours typical for fintech and other digital MSME loansccclx

Same-day approval and rapid disbursement enabled by Open Banking verificationccclxi

Digital lenders faster than traditional banksccclxii

Beyond speed, Open Finance may also influence pricing and market structure by facilitating entry by digital lenders and increasing competitive pressure. In Brazil, while credit remains relatively expensive, emerging evidence shows that fintech and P2P lenders using digital data have forced banks to improve pricing. One study finds that in municipalities with fintech entry, incumbent bank loan rates fell by ~2.5 %, and in areas with high-speed internet by up to 11 points.ccclxiii Industry analysts also forecasts that as Brazilians share richer profiles via APIs, lenders will further reduce interest rates and approve more MSME loans.ccclxiv This suggests that richer data and faster decisioning can translate into efficiency gains for MSMEs through improved access, pricing, and terms, although outcomes vary across countries and depend on broader market and regulatory conditions.

However, these gains are not automatic. While access to richer data improves credit assessment, lenders’ willingness to rely on Open Finance data also depends on how legal, operational, and financial risks are distributed across the data-sharing value chain. In the absence of clearly defined liability rules, lenders face uncertainty over who bears responsibility when shared data is inaccurate, incomplete, delayed, or misused.ccclxv This uncertainty can have a direct impact on lending incentives, particularly for MSMEs, which are already perceived as high-risk borrowers due to limited collateral and volatile cash flows. When lenders cannot clearly assess or mitigate their exposure to data-related risks, they may revert to conservative lending practices, limiting the potential inclusion and competition benefits of Open Finance for MSMEs.

Interview Questionnaire

Table 13: Interview Questionnaire for Regulators, Data Holder, Data Users and Consumer Protection Organisations

Regulators

Context and Policy Objectives

Incentives

Liability

Performance Measurement

• What motivated your country to pursue Open Finance? Which specific policy objectives are you prioritising (inclusion, competition, innovation, consumer protection)?

• Are your Open Finance/Banking rules mandatory or voluntary?

• Is there a phase-wise or sectoral rollout strategy?

• What incentives (monetary or otherwise) are in place to encourage data holders and users to participate?

• Are there subsidies, cost offsets, or fee frameworks to support data holders implementing APIs?

• Do you foresee a business case for monetisation of API access for data holders?

• How is liability currently assigned in your Open Finance ecosystem (for example, for data misuse, fraud, technical errors)?

• Is there a legal fallback for disputes between data holders and data users?

• Do you plan to introduce centralised or sectoral dispute resolution mechanisms?

• What indicators do you use to track progress of your Open Finance framework?

• Which metrics are most useful to your agency for assessing policy impact?

• Are you considering outcome-based metrics (for example, credit access for MSMEs) in addition to infrastructure metrics?

• What were the biggest initial challenges in implementing Open Finance?

Case Study Inputs

• What regulatory changes did you need to make for data sharing to work smoothly?

• Are there any specific success stories or lessons learned that you would be willing to highlight?

Data Holders (banks, insurers, pension funds, etc)

• What are your current obligations or expectations around Open Finance?

• What are the major costs (technical, legal, operational) involved in complying?

Participation and Incentives

Liability and Risk

Performance Measurement

Case Study Inputs

• Are you currently monetising your APIs? If yes, so models (for example, tiered pricing, freemium) are used?

• What, if any, non-monetary benefits have you observed (for example, reputational gains, improved customer insights)?

• What liability concerns do you have when sharing customer data with third parties?

• Have you encountered any real or potential legal disputes under Open Finance?

• What kind of legal protections would make you more comfortable participating?

• How do you define “success” for your Open Finance initiatives?

• Are there internal metrics you track for API usage, performance, or returns?

• Have you observed any measurable impact on product uptake, customer satisfaction, or efficiency?

• Can you describe a successful use case where sharing data created tangible benefits?

• What changes did you have to make to your legacy systems to enable Open Finance?

• What challenges are unique to EMDE markets (for example, low digital literacy, informal sector)?

Table 13: Interview Questionnaire for Regulators, Data Holder, Data Users and Consumer Protection Organisations (continued)

Data Users (fintechs, MSMEs, investment platforms, aggregators)

• Are you actively using Open Finance data from banks or other institutions? What APIs do you use?

Access and Incentives

Liability and Legal Concerns

Performance Measurement

Case Study Inputs

• How easy or difficult is it to access this data?

• What value does it bring to your business? Have you quantified the return (for example, better credit models)?

• Are you paying to access APIs? Are pricing models transparent and affordable?

• Are you confident in the legal clarity around your use of customer data?

• Have you faced challenges with data access (for example, consent management, data quality, denial of access)?

• What kind of liability protection or dispute-resolution support would you need?

• What metrics do you track to assess whether Open Finance is helping your business?

• For MSMEs: Has access to more granular or real-time data helped with credit approval or business growth?

• For investment platforms: Has data access led to better product personalisation, engagement, or Assets Under Management growth?

• Please describe one concrete example where Open Finance has helped you innovate or expand.

• What do you see as the biggest roadblock to broader ecosystem adoption?

• What regulatory or industry change would make the biggest difference for your success?

Consumer Protection Organisations

• What are the primary consumer protection concerns regarding Open Banking/Finance?

• Do current consumer protection laws adequately cover Open Banking/Finance in your experience? Where are the critical gaps?

Framework and Gaps

Liability Assignment

• To what extent are customers adequately informed about their data rights (for example, access, consent, withdrawal, deletion, and data portability)?

• Have you seen examples where consumer protection mechanisms have worked well in resolving disputes involving multiple parties, including fintechs?

• Based on your experience, what liability models tend to support trust and inclusion in Open Banking or data sharing ecosystems?

• From a consumer protection perspective, what are the key risks India should pay attention to as Open Finance expands?

• Should liability differ between data sharing (banks) and data usage (fintechs)?

• Are existing dispute resolution mechanisms adequate to handle Open Banking/Finance complaints?

• What incentives currently exist for customers to participate in Open Banking/Open Finance (for example, better product recommendations, awareness campaigns)?

Incentives for Customers

Are customers aware that data sharing could provide them with tangible benefits (for example, improved access to credit, tailored financial products)?

• Do current incentive mechanisms risk coercing or misleading customers into data sharing?

• How can policy ensure that participation remains genuinely voluntary and informed?

• From a consumer protection and empowerment perspective, what metrics should be used to measure the success of Open Banking/Open Finance?

CustomersOriented Metrics

Are there existing metrics in your country that capture how customers are benefiting from Open Banking/Open Finance (for example, improved access, reduced costs, better product fit)?

• What additional metrics could help regulators and providers understand whether Open Banking/Open Finance is delivering real value to customers?

Source: CCAF, Fii and BIS

Glossary

Account Aggregator (AA)

Account

Information Service Provider (AISP)

Account Servicing Payment Service Provider (ASPSP)

Agentic AI

Application Programming Interface (API)

Artificial Intelligence (AI)

Burden of Proof

Consumer Data Right (CDR)

Consumer Protection

Cybersecurity

Data Holder

Data User

Digital Public Infrastructure (DPI)

An intermediary that enables consumers and businesses to access, consolidate, and share financial data across institutions, typically with user consent. While AAs globally enable the consolidation and sharing of financial data, their roles differ significantly across countries. In India, AAs function as regulated consent managers that facilitate data transfer without accessing or storing data. In contrast, in the United States, AAs typically access, process, and store user data, and often provide customer-facing services alongside their infrastructure role.

An entity that provides account information services as an online service, enabling access to and consolidation of data from one or more financial accounts held by a customer across one or more data holders.

It refers to any financial institution that offers a payment account with online access, including banks and building societies (mutuals).

It is an artificial intelligence system that can accomplish a specific goal with limited supervision. It consists of AI agents, which are machine learning models that mimic human decision-making to solve problems in real time. In a multiagent system, each agent performs a specific subtask required to reach the goal and their efforts are coordinated through AI orchestration.ccclxvi

It refers to code that enables software programs to interact by exchanging data or functionality, for actions such as making a payment transaction. This includes payment APIs, data APIs, “ecosystem expansion” APIs, and “consent and identity” APIs.

A machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. Different AI systems vary in their levels of autonomy and adaptiveness after deployment.ccclxvii

The legal obligation placed on a party in a dispute to establish the facts necessary to support its claim or defence.

The regulatory framework in Australia set out under the Competition and Consumer Act 2010 enabling consumers to securely share their data with accredited data users.

A framework of laws, regulations and institutional arrangements that safeguard customers by ensuring they are treated fairly and responsibly in the financial marketplace.

Human and machine actions that seek to preserve the security of software and computer systems, data confidentiality, data integrity, and availability of digital information and/or information systems, including measures to ensure information authenticity, accountability, non-repudiation and reliability.

An entity that collects, maintains, and controls financial data of a customer in the course of providing services. In Open Finance systems, data holders are typically banks or regulated financial institutions responsible for the accuracy, security, and lawful disclosure of customer data.

An entity that receives customer data, with the customer’s consent, for a specific purpose.

It refers to the basic capabilities that are the building blocks for developing digital services at a societal scale. DPI is the intermediate layer between physical infrastructure (for example, broadband and data centres) and sectoral applications (for example, social protection and e-commerce). The most common types of DPI are platforms and systems for digital identification (ID), digital payments, and data sharing.ccclxviii

Dispute Resolution

Emerging Markets and Developing Economies (EMDEs)

Fintech

Know Your Customers (KYC)

Liability

Micro, Small, and Medium Enterprises (MSMEs)

Mobile Money

Payment Initiation Service Provider (PISP)

Regulatory Impact Assessment (RIA)

Regulatory Sandbox

Service Level Agreement (SLA)

Third-Party Providers (TPPs)

Technical-Service Providers (TSPs)

Unified Payments Interface (UPI)

The processes and mechanisms through which complaints or disagreements between parties are addressed and resolved. This can include internal complaint management systems, mediation, arbitration, ombudsman schemes, and court proceedings.

A macroeconomic classification based on World Bank income categories encompassing low-income, lower-middleincome, and upper-middle-income economies.

An abbreviated form of “financial technology”, used to refer to a digital financial services company, and collectively to advances in technology that have the potential to transform financial services, stimulating the development of new business models, applications, processes, and products.

It refers to practices and processes adopted by private and public sector organisations to identify their customers or contractual third parties and ensure that client records are maintained, typically according to industry best practice and, in many cases, as required by law.

Legal responsibility imposed on an entity to bear the consequences of a wrongful act, failure, or risk, including an obligation to compensate for loss, damage, or harm caused.

It refer to enterprises categorised by their scale of operations, typically measured through investment in assets, annual turnover, or workforce size.

Mobile money is a financial service using mobile money accounts, typically offered by a mobile network operator (MNO) or another entity in partnership with an MNO. Unlike mobile banking, which is the use of an application on a mobile device to execute banking services, a bank account is not needed to use mobile money services. The only device required is a basic mobile phone.ccclxix

An entity which provides an online service to initiate a payment order at the request of the customer with respect to a payment account held at another payment service provider.

A systematic approach that critically measures the expected positive and negative effects of proposed and existing regulations through a rigorous, well-defined, and evidence-based analysis.

A formal regulatory programme that allows market participants to test new financial services or models with real customers, subject to certain safeguards and oversight.

A formal contract that defines the terms and conditions including responsibilities between a data holder and a data user.

Entities that offer additional financial services by accessing customers’ bank accounts with their consent, typically through APIs. TPPs facilitate services such as account information aggregation and payment initiation, enabling users to manage multiple accounts or initiate transactions directly.

Entities that provide technical support to third parties for the provision of Open Finance Services, including information technology services, communication network provision, the processing and storage of data, the obtaining and processing of account and product information, and trust and privacy protection services.

• Real-time payment system developed by the National Payments Corporation of India, enabling bank-to-bank transfers via smartphones.

Data Set

The below table presents the full set of data points compiled for the comparative analysis in this report. The dataset spans the selected nine EMDEs, and is organised across four thematic groupings: (i) country context, regulatory development, and governance approach; (ii) commercial models, reciprocity, and customer-facing measures relevant to the incentives chapter; (iii) liability, consent, and dispute resolution provisions relevant to the liability chapter; and (iv) operational and supervisory

indicators relevant to the performance measurement chapter. Data points were assembled from regulatory documents, supervisory communications, interview evidence, and publicly available implementation data. Country-level entries reflect framework status as of the report's cut-off date and should be interpreted alongside the qualifications discussed in the relevant chapters, particularly where frameworks have been passed but are not yet operational.

Endnotes

i. Sahamati (2024). Global Open Finance Adoption Report 2024-2030. Available at: https://sahamati.org.in/wp-content/ uploads/2026/01/Sahamati-Global-Open-Finance-AdoptionReport-GOFAR-1.pdf

ii. Ibid.

iii. Press Information Bureau (2025). Celebrating four years of launch of the Account Aggregator Ecosystem - India’s Digital Public Infrastructure (DPI). Available at: https://www.pib.gov.in/ PressReleasePage.aspx?PRID=2162953&reg=3&lang=2

iv. Ibid.

v. CCAF (2024). The Global State of Open Banking and Open Finance, Cambridge: Cambridge Centre for Alternative Finance, Cambridge Judge Business School, University of Cambridge. Available at: https://www.jbs.cam.ac.the UK/faculty-research/ centres/alternative-finance/publications/the-global-state-ofopen-banking-and-open-finance-report/

vi. CGAP (2023). Global Landscape: Data Trails of Digitally Included Poor (DIP) People. Available at: https://www.cgap.org/research/ reading-deck/global-landscape-data-trails-of-digitally-includedpoor-dip-people

vii. Carroll, P. and Rehmani, S. (2017). Alternative Data and The Unbanked. Available at: https://www.oliverwyman.com/ our-expertise/insights/2017/may/alternative-data-and-theunbanked.html

viii. FICO Blog (2024). How to Use Alternative Data in Credit Risk Analytics. Available at: https://www.fico.com/blogs/how-usealternative-data-credit-risk-analytics

ix. CCAF (2024). The Global State of Open Banking and Open Finance, Cambridge: Cambridge Centre for Alternative Finance, Cambridge Judge Business School, University of Cambridge. Available at: https://www.jbs.cam.ac.the UK/faculty-research/ centres/alternative-finance/publications/the-global-state-ofopen-banking-and-open-finance-report/

x. Open Banking Nigeria (n.d.). Open Banking in Nigeria. Available at: https://openbanking.ng/open-banking-in-nigeria/

xi. Feyen E. (2021). Digital money: Implications for emerging market and developing economies. Available at: https://www. bis.org/publ/work973.pdf

xii. CGAP (2021). Open Finance: Overview and Potential Impact in Low- and Middle-Income Countries, Consultative Group to Assist the Poor. Available at: https://www.cgap.org/sites/ default/files/publications/TechGuide_OpenFinance_Final.pdf

xiii. Central Bank of Nigeria (2021). Issuance of the Regulatory Framework for Open Banking in Nigeria. Available at: https:// www.cbn.gov.ng/out/2021/psmd/circular%20on%20the%20 regulatory%20framework%20on%20open%20banking%20 in%20nigeria.pdf

xiv. Briones de Araluze, G. K. (2022). A Multidisciplinary Approach to the Open Banking Definition and the Understanding of Adoption drivers By End-Customers. Available at: https://www. researchgate.net/publication/376181831_A_Multidisciplinary_ Approach_To_The_Open_Banking_Definition_And_The_ Understanding_Of_Adoption_Drivers_By_End-Customers

xv. Babina, T. et. al. (2022). Customer Data Access and Fintech Entry: Early Evidence from Open Banking. Available at: https://www. fdic.gov/analysis/cfr/bank-research-conference/annual-21st/ papers/gornall-paper.pdf

xvi. OECD (2019), Enhancing Access to and Sharing of Data. Available at: https://doi.org/10.1787/276aaca8-en

xvii. OECD (2023). Open finance policy considerations, OECD Business and Finance Policy Papers. Available at: https://doi. org/10.1787/19ef3608-en

xviii. CCAF (2024). The Global State of Open Banking and Open Finance, Cambridge: Cambridge Centre for Alternative Finance, Cambridge Judge Business School, University of Cambridge. Available at: https://www.jbs.cam.ac.the UK/faculty-research/ centres/alternative-finance/publications/the-global-state-ofopen-banking-and-open-finance-report/

xix. Open Banking Limited (2025). Impact Report 7: Open banking delivers real-world impact as adoption accelerates year-on-year. Available at: https://www.openbanking.org.the UK/wp-content/ uploads/Impact-report-7-may-2025.pdf

xx. Murray, A. and Buckenham, J. (2025). Open Banking and Open Finance in the the UK. Available at: https://www.fca.org.uk/ publication/research-notes/open-banking-open-finance-uk.pdf

xxi. Sahamati and Open Finance Connect (2024). Global Open Finance Adoption Report 2024-2030. Available at: https:// sahamati.org.in/gofar/

xxii. OECD (2023). Open finance policy considerations, OECD Business and Finance Policy Papers. Available at: https://doi. org/10.1787/19ef3608-en

xxiii. Carrière-Swallow, Y. and Haksar, V. (2022). Open Banking and the Economics of Data. Available at: https://academic.oup.com/ book/41431/chapter-abstract/352765207?redirectedFrom=fullt ext&login=false

xxiv. The existence of a regulatory framework allowing charges does not necessarily mean that pricing mechanisms are fully operational in practice, nor that fees are currently significant. In several cases, charging provisions function primarily as enabling mechanisms, allowing cost recovery if needed as ecosystems mature, rather than resulting in widespread or high data access fees at present.

xxv. Reserve Bank of India (2025). Reserve Bank of India (NonBanking Financial Companies - Account Aggregator) Directions, 2025. Available at: https://www.rbi.org.in/Scripts/ NotificationUser.aspx?Id=12936&Mode=0

xxvi. Central Bank of Nigeria (2023). Operational Guidelines for Open Banking in Nigeria. Available at: https://www.cbn.gov.ng/ Out/2023/CCD/Operational%20Guidelines%20for%20Open%20 Banking%20in%20Nigeria.pdf

xxvii. OnePipe (n.d.). For Banks - OnePipe. Available at : https:// onepipe.com/banks/

xxviii. Bangko Sentral Ng Pilipinas (2023). Open Finance Pilot FAQ. Available at: https://www.bsp.gov.ph/Pages/InclusiveFinance/ Open%20Finance/Annex%20H.pdf

xxix. Banco Central do Brasil (2020). Frequently asked questions Open Banking. Available at: https://www.bcb.gov.br/content/ about/faq/Open%20Banking.pdf

xxx. Totolo, E. et al. (2024). Data Exchange Market Deep Dives. Available at: https://www.centerforfinancialinclusion.org/ wp-content/uploads/2024/09/Data-Exchange-Markets-DeepDives.pdf

xxxi. Mazer, R. and Dias, D. (2025). Open Finance Implementation: Global Lessons From the First Wave of Innovation. Available at: https://www.findevgateway.org/sites/default/files/publications/ submissions/115193/Open%20Finance%20Implementation%20 Key%20Lessons%20-%20Mazer-Dias%20-%20March%202025.pdf

xxxii. Financial Sector Conduct Authority (2020). Regulating Open Finance Consultation and Research Paper. Available at: https://www2.fsca.co.za/Regulatory%20Frameworks/ FinTechDocuments/Regulating%20Open%20Finance%20 Consultation%20and%20Research%20Paper.pdf ; Financial Sector Conduct Authority (2023). Draft Position Paper on Open Finance. Available at: https://www2.fsca.co.za/Regulatory%20 Frameworks/FinTechDocuments/Draft%20Position%20 Paper%20on%20Open%20Finance.pdf

xxxiii. Bank of Ghana (2024). Draft Open Banking Directive for Regulated Financial Institutions. Available at: https://www.bog. gov.gh/news/press-release-draft-open-banking-directive-forregulated-financial-institutions/

xxxiv. Ministry of Business, Innovation, and Employment (n.d.). Open Banking Regulations. Available at: https://www.mbie.govt.nz/ business-and-employment/business/customers-data-right/ customers-data-right-policy-design/open-banking

xxxv. OnePipe (n.d.). For Banks - OnePipe. Available at: https:// onepipe.com/banks/

xxxvi. Techpoint (2020). OnePipe is building a super aggregator for every financial service API in Nigeria. Available at: https:// techpoint.africa/feature/onepipe-raises-950k-pre-seed/

xxxvii. Bank of Ghana (2024). Draft Open Banking Directive for Regulated Financial Institutions. Available at: https://www.bog. gov.gh/wp-content/uploads/2024/12/Draft-Open-BankingDirective-for-Regulated-Financial-Institutions-201224.pdf

xxxviii. Cenfri (2024). Open Finance in South Africa: Promising moves, but challenges ahead. Available at: https://cenfri.org/ blog/open-finance-in-south-africa-promising-moves-butchallenges-ahead/

xxxix. Singh, A. (2023). How price wars hurt account aggregators. Available at: https://www.livemint.com/industry/banking/howprice-wars-hurt-account-aggregators-11702464234857.html

xl. Setu AA (2024). Agya - Pricing Policy. Available at: https://setuaa.com/pricing-policy

xli. Anumati (n.d.). Pricing. Available at: https://www.anumati.co.in/ pricing/

xlii. Mono (n.d.). Pricing. Available at: https://mono.co/pricing

xliii. Dashdevs (2025). Top 7 Open Banking Providers: A Comparative Overview. Available at: https://dashdevs.com/blog/openbanking-providers/

xliv. Saudi Central Bank (n.d.). Open Banking Policy. Available at: https://www.sama.gov.sa/en-US/Documents/Open_Banking_ Policy-EN.pdf

xlv. Williamson, O. E. (1981). The Economics of Organization: The Transaction Cost Approach. American Journal of Sociology, American Journal of Sociology, Vol. 87, No. 3. Available at: https://www.jstor.org/stable/2778934

xlvi.

Beyene, B. et. al. (2024). Understanding Barriers to Financial Access: Insights from Bank Pricing Data. Available at: https:// www.imf.org/en/publications/wp/issues/2024/07/12/ understanding-barriers-to-financial-access-insights-from-bankpricing-data-551370

xlvii. Banco Central do Brasil (2020). Frequently asked questions Open Banking. Available at: https://www.bcb.gov.br/content/ about/faq/Open%20Banking.pdf

xlviii. Bangko Sentral ng Pilipinas (2023). Open Finance Pilot FAQ. Available at: https://www.bsp.gov.ph/Pages/InclusiveFinance/ Open%20Finance/Annex%20H.pdf

xlix. Parliament of Canada (2025). Bill C-15: An Act to implement certain provisions of the budget tabled in Parliament on November 4, 2025 (First Reading). Available at: https://www. parl.ca/documentviewer/en/45-1/bill/C-15/first-reading

l. Vlaicu, R. (2025). Digital Payments Adoption by Customers and Firms:Implications for Financial Inclusion. Available at: https://publications.iadb.org/en/digital-payments-adoptioncustomers-and-firms-implications-financial-inclusion

li. Jhanji, K. (2020). API Monetisation: Making a Success of Open Banking. Available at: https://media-publications.bcg.com/apimonetisation-making-a-success-of-open-banking.pdf

lii. Hvozdyk, I. (2025). How to Reduce Fintech User Friction [And Still Keep Security]. Available at: https://www.eleken.co/blogposts/reduce-fintech-user-friction

liii. Baley, I. and Veldkamp, L. (2024). The partial data barter trades of the digital economy. Available at: https://www.brookings. edu/articles/the-partial-data-barter-trades-of-the-digitaleconomy/

liv. Australian Government, Office of the Australian Information Commissioner (n.d.). Customers consent, authorisation and dashboards. Available at: https://www.oaic.gov.au/customersdata-right/customers-data-right-guidance-for-business/ privacy-obligations/customers-consent,-authorisation-anddashboards

lv. Open Data Institute (2022). Measuring the impact of data institutions. Available at: https://theodi.org/insights/reports/ measuring-the-impact-of-data-institutions-report/

lvi. Olatokunbo, T. (2025). CBN: FG Secures $10.5m Loan from World Bank to Improve Apex Bank’s Infrastructure. Available at: https:// thesourceng.com/cbn-fg-secures-10-5m-loan-from-world-bankto-improve-apex-banks-infrastructure/

lvii. Banco Central do Brasil (n.d.). Open Finance. Available at: https://www.bcb.gov.br/en/financialstability/open_finance

lviii. Australian Government (2020). Inquiry into Future Directions for the Customers Data Right - Final Report. Available at: https:// treasury.gov.au/sites/default/files/2021-02/cdrinquiry-final.pdf

lix. Setu (2023). The similarities and differences between UPI and Account Aggregator. Available at: https://blog.setu.co/articles/ the-similarities-and-differences-between-upi-and-accountaggregator

lx. Competition and Markets Authority (2022). CMA publishes findings of ‘Lessons Learned’ review into Open Banking. Available at: https://www.gov.the UK/government/news/ cma-publishes-findings-of-lessons-learned-review-into-openbanking

lxi. Salary Finance (n.d.). Who are Salary Finance?. Available at: https://www.salaryfinance.com/the UK/

lxii. Abound (n.d.). Loans made for you. Available at: https://www. getabound.com/

lxiii. WeMoney (n.d.). Pay down debt. Faster. Available at: https:// www.wemoney.com.au/

lxiv. Banco Central do Brasil and Conselho Monetário Nacional (2020). Resolução Conjunta nº 1, de 4 de maio de 2020. Available at: https://normativos.bcb.gov.br/Lists/Normativos/ Attachments/51028/Res_Conj_0001_v4_P.pdf

lxv. The Paypers (2021). Open Banking in Brazil: all questions answered by the Central Bank Brazil (Part 1). Available at: https://thepaypers.com/fintech/interviews/open-bankingin-brazil-all-questions-answered-by-the-central-bank-brazilpart-1

lxvi. Open Finance Brasil (n.d.). Registration and Transaction Data. Available at: https://dashboard.openfinancebrasil.org.br/ transactional-data/ranking/receivers

lxvii. Open Finance Brasil (n.d.). Registration and Transaction Data. Available at: https://dashboard.openfinancebrasil.org.br/ transactional-data/ranking/receivers

lxviii. Goods and Services Tax Network (n.d.). Account Aggregator. Available at: https://www.gstn.org.in/account-aggregator

lxix. Central Banking (2024). Bank of Thailand launches data-sharing initiative. Available at: https://www.centralbanking.com/ central-banks/financial-market-infrastructure/7962444/bank-ofthailand-launches-data-sharing-initiative

lxx. Centre for Finance, Innovation and Technology (2024). Embracing the UK’s Open Finance Opportunity. Available at: https://cfit.org.uk/wp-content/uploads/2024/02/CFIT-OpenFinance-Blueprint.pdf

lxxi. Global Government Finance (2025). NZ Inland Revenue explores use of open banking technology. Available at: https://www. globalgovernmentfinance.com/new-zealand-inland-revenueopen-banking-rfi/

lxxii. Singapore Financial Data Exchange (n.d.). Frequently Asked Questions on Singapore Financial Data Exchange (SGFinDex). Available at: https://www.mas.gov.sg/-/media/MAS/Fintech/ SGFinDex/Media/SGFinDex---Frequently-Asked-Questions-V5. pdf?la=en&hash=C40A136310F913A49ABF203B07BB59C38F FA5425

lxxiii. Bank of Ghana (2024). Draft Open Banking Directive for Regulated Financial Institutions. Available at: https://www.bog. gov.gh/wp-content/uploads/2024/12/Draft-Open-BankingDirective-for-Regulated-Financial-Institutions-201224.pdf

lxxiv. Financial Sector Conduct Authority (2024). Open Finance - FSCA Policy Recommendation. Available at: https://www2.fsca.co.za/ Regulatory%20Frameworks/FinTechDocuments/2024%20 Open%20Finance_FSCA%20Position%20Paper.pdf

lxxv. Intergovernmental Fintech Working Group (2021). Articulating the policy rationale and policy imperatives for Open Finance in South Africa. Available at: https://www.ifwg.co.za/IFWG%20 Documents/IFWG_Articulating-the-policy-rationale-andpolicy-imperatives-for-Open-Finance-in-South-Africa_ November-2021.pdf

lxxvi. CCAF & ADBI (2025). The APAC State of Open Banking and Open Finance, Cambridge Centre for Alternative Finance, University of Cambridge and the Asian Development Bank Institute. Available at: https://www.jbs.cam.ac.the UK/faculty-research/ centres/alternative-finance/publications/the-apac-state-ofopen-banking-and-open-finance/

lxxvii. Sahamati (2024). Workshop on Account Aggregator (AA) Ecosystem at the Capital. Available at: https://sahamati.org.in/ delhi-roadshow-on-account-aggregator-ecosystem/ lxxviii. The Open Banking Implementation Entity (2019). Open Banking Publishes Operational Guidelines and Checklist. Available at: https://www.openbanking.org.the UK/news/obie-publishesoperational-guidelines-and-checklist/ lxxix. AFI & DFSWG (2025). Policy Development and Implementation Guide for Inclusive Open Finance. Available at: https://www. afi-global.org/publication/2025-policy-development-andimplementation-guide-for-inclusive-open-finance/ lxxx. Banco Central do Brasil (n.d.). Open Finance. Available at: https://www.bcb.gov.br/en/financialstability/open_finance

lxxxi. Sahamati (n.d.). Account Aggregator Timeline. Available at: https://sahamati.org.in/account-aggregator-timeline/ lxxxii. Bangko Sentral Ng Pilipinas (2021). Open Finance Framework. Available at: https://www.bsp.gov.ph/Regulations/ Issuances/2021/1122.pdf

lxxxiii. Saudi Central Bank (n.d.). Open Banking Policy. Available at: https://www.sama.gov.sa/en-US/Documents/Open_Banking_ Policy-EN.pdf

lxxxiv. World Bank. (2022). Technical Note on Open Banking: Comparative Study on Regulatory Approaches. Available at: https://documents1.worldbank. org/curated/en/099345005252239519/pdf/ P16477008e2c670fe0835a0e8692b499c2a.pdf

lxxxv. AFI & DFSWG (2025). Policy Development and Implementation Guide for Inclusive Open Finance. Available at: https://www. afi-global.org/publication/2025-policy-development-andimplementation-guide-for-inclusive-open-finance/

lxxxvi. Hong Kong Monetary Authority (n.d.). Fintech Supervisory Sandbox (FSS). Available at: https://www.hkma.gov.hk/eng/ key-functions/international-financial-centre/fintech/fintechsupervisory-sandbox-fss/

lxxxvii. ICLG (2025). Digital Business Laws and Regulations Ghana 2025-2026. Available at: https://iclg.com/practice-areas/digitalbusiness-laws-and-regulations/ghana

lxxxviii. Asare, I. (2025). Tax incentives under the Income Tax Act, 2015 (Act 896): mapping the tools to drive growth. Available at: https://thebftonline.com/2025/08/19/tax-incentives-underthe-income-tax-act-2015-act-896-mapping-the-tools-to-drivegrowth/ lxxxix. Philippine Information Agency (2026). Pinoys now have more options for opening PERA account. Available at: https://pia.gov. ph/press-release/pinoys-now-have-more-options-for-openingpera-account/

xc. Financial Conduct Authority (FCA). (2025). Smart Data Accelerator. Available at: https://www.fca.org.uk/firms/ innovation/smart-data-accelerator

xci. Cornelli, G. et. al. (2023). Regulatory sandboxes and fintech funding: evidence from the UK. Available at: https://www.bis. org/publ/work901.pdf

xcii. Emirates NBD & PWC (2025). From code to capital: The UAE's fintech revolution. Available at: https://www.emiratesnbd. com/-/media/enbd/files/pdf/dubai_fintech_summit_2025_ report.pdf

xciii. Browne, R. (2024). UAE defies fintech slowdown with a 92% jump in funding — against a global plunge of 48%. Available at: https://www.cnbc.com/2024/01/10/global-fintech-investmentplunges-51percent-in-2023-but-uae-defies-slowdown.html

xciv. European Commission, Joint Research Centre (2025). Has PSD2 Favoured Investments in the European PayTech Companies? Available at: https://publications.jrc.ec.europa.eu/repository/ bitstream/JRC141896/JRC141896_01.pdf

xcv. Alonso-Robisco, A., et al. (2025). The effects of open banking on fintech providers: evidence using microdata from Spain. Available at: https://www.bde.es/f/webbe/SES/Secciones/ Publicaciones/PublicacionesSeriadas/DocumentosTrabajo/25/ Files/dt2514e.pdf

xcvi. Babina, T. et al. (2024). Customer Data Access and Fintech Entry: Early Evidence from Open Banking. Available at: https://www. bankofengland.co.uk/-/media/boe/files/working-paper/2024/ customer-data-access-and-fintech-entry-early-evidence-fromopen-banking.pdf

xcvii. The Saudi Central Bank (2023). Saudi Central Bank Launches Open Banking Lab. Available at: https://www.sama.gov.sa/enUS/News/pages/news-807.aspx

xcviii. Reserve Bank of India (2025). Inter-operable Regulatory Sandbox (IoRS). Available at: https://www.rbi.org.in/ commonman/English/scripts/FAQs.aspx?Id=3822

xcix. Banco Central do Brasil (n.d.). Open Finance. Available at: https://www.bcb.gov.br/en/financialstability/open_finance

c. Gupta, R. and Symss, J. (2025). Corporate Governance and Risk Disclosure: An Integrative Review from an Institutional Perspective. Available at: https://jmsr-online.com/article/ corporate-governance-and-risk-disclosure-an-integrativereview-from-an-institutional-perspective-461/

ci. OECD (2023), Open finance policy considerations, OECD Business and Finance Policy Papers. Available at: https://doi. org/10.1787/19ef3608-en.

cii. Intergovernmental Fintech Working Group (n.d.). Innovation Accelerator. Available at: https://www.ifwg.co.za/Pages/ Innovation-Accelerator.aspx

ciii. Sahamati (2024). Open Finance Roundtable – World Bank Spring Meetings 2024. Available at: https://sahamati.org.in/openfinance-roundtable-world-bank-spring-meetings-2024/

civ. GAD, N. (2024). Saudi innovators join Open Banking Hackathon. Available at: https://sharikatmubasher.com/media-hub/ news/21398766/30-saudi-innovators-join-open-bankinghackathon

cv. EBA (n.d.). Response to discussion on RTS on strong customer authentication and secure communication under PSD2. Available at: https://www.eba.europa.eu/eba-response/345

cvi. Banco Central do Brasil (n.d.). Open Finance. Available at: https://www.bcb.gov.br/en/financialstability/open_finance

cvii. Australian Government (2025). Customers Data Right Assessment: Data Quality obligations for a data holder. Available at: https://www.oaic.gov.au/customers-data-right/customersdata-right-assessments/customers-data-right-assessment-dataquality-obligations-for-a-data-holder

cviii. Johnson, T. (2023). How to drive customers adoption of open banking. Available at: https://www.finextra.com/thelong-read/663/how-to-drive-customers-adoption-of-openbanking

cix. The Fintech Times (2021). Firms Must Provide Greater Open Banking Awareness as Only 46% of Customers Have Heard About It. Available at: https://thefintechtimes.com/firms-mustprovide-greater-open-banking-awareness-as-only-46-ofcustomers-have-heard-about-it/

cx. CGAP (n.d.). Open Finance Gains Traction in India, Finds CGAP and Sahamati. Available at: https://www.cgap.org/news/openfinance-gains-traction-in-india-finds-cgap-and-sahamati cxi. Lam, P. T. I. and Law, A. O. K. (2016). Crowdfunding for renewable and sustainable energy projects: An exploratory case study approach. Renewable and Sustainable Energy Reviews, 60, pp. 11–20; see also GoCardless (2023). How investment platforms use open banking. Available at: https://gocardless.com/guides/ posts/investment-platforms-open-banking/ cxii. GoCardless (2023). How investment platforms use open banking. Available at: https://gocardless.com/guides/posts/ investment-platforms-open-banking/ cxiii. Braun, A. et al. (2024). When do customers share personal data? Evidence from the insurance industry. Journal of the Academy of Marketing Science. Available at: https://link.springer.com/ article/10.1007/s40821-024-00263-w ; CGAP (2025). Combining Open Finance and Data Protection for Low-Income Customers. Available at: https://www.cgap.org/research/publication/ combining-open-finance-and-data-protection-for-low-incomecustomers

cxiv. CGAP (2025). Harnessing Open Finance for Competition and Financial Inclusion. Available at: https://www.cgap.org/ sites/default/files/2025-09/3-HARNESSING-OPEN-FINANCEFOR-COMPETITION-AND-FINANCIAL-INCLUSION-Sai-KrishnaKumaraswamy-Arisha-Salman.pdf

cxv. World Bank (2019). Robo-Advisors: Investing through Machines. Available at: https://documents1.worldbank.org/curated/ en/275041551196836758/pdf/Robo-Advisors-Investingthrough-Machines.pdf

cxvi. Hogan Lovells (2025). Agentic AI in Financial Services: Regulatory and Legal Considerations. Available at: https:// www.hoganlovells.com/en/publications/agentic-ai-in-financialservices-regulatory-and-legal-considerations

cxvii. Briones de Araluze, G. (2022). A Multidisciplinary Approach to the Open Banking Definition and the Understanding of Adoption Drivers by End-Customers. Available at: https://www. researchgate.net/publication/376181831_A_Multidisciplinary_ Approach_To_The_Open_Banking_Definition_And_The_ Understanding_Of_Adoption_Drivers_By_End-Customers

cxviii. Hwa Hwang, B. (2025). Pay-by-Bank and the Merchant Payments Use Case: Benefits, risks and potential impacts on customers payment behaviors in the U.S. Available at: https://www. federalreserve.gov/econres/notes/feds-notes/pay-by-bank-andthe-merchant-payments-use-case-benefits-20250707.html

cxix. IMA (n.d.). Banking on Rewards: How Open Banking is Benefiting from Digital Gift Cards. Available at: https://www. incentivemarketing.org/IMA/IMA/News/Industry-News/2023/ Banking-on-Rewards.aspx

cxx. Ghiyazuddin, A. (2025). Customers protection must be at the heart of open finance frameworks. Available at: https://www. afi-global.org/opinion/customers-protection-must-be-at-theheart-of-open-finance-frameworks/

cxxi. Financial Customers Agency of Canada (2024). FCAC welcomes new mandate to oversee Canada’s Customers-Driven Banking Framework. Available at: https://www.canada.ca/en/financialcustomers-agency/news/2024/06/fcac-welcomes-newmandate-to-oversee-canadas-customers-driven-bankingframework.html

cxxii. Government of Australia (n.d.). What is CDR?. Available at: https://www.cdr.gov.au/what-is-cdr

cxxiii. Commercial Bank of Dubai (n.d.). Take Charge of Your Financial World with Cbd Via Altareq. Available at: https://www.cbd.ae/ personal/more/information-and-tools/altareq-open-finance

cxxiv. Australian Government (n.d.). Pre-consent. Available at: https:// cx.dsb.gov.au/consent/pre-consent

cxxv. Australian Government, Office of the Australian Information Commissioner (n.d.). Customers consent, authorisation and dashboards. Available at: https://www.oaic.gov.au/customersdata-right/customers-data-right-guidance-for-business/ privacy-obligations/customers-consent%2C-authorisation-anddashboards

cxxvi. James, K. (2025). Consent Fatigue in Open Banking Designing Seamless User Consent. Available at: https://asima.co.the UK/ blog/consent-fatigue-in-open-banking-designing-seamlessuser-consent/

cxxvii. CGAP (2023). Success in Open Finance Requires Trust - Lessons from Brazil. Available at: https://www.cgap.org/blog/success-inopen-finance-requires-trust-lessons-brazil

cxxviii. Open Banking Limited (n.d.). The Open Banking Standard. Available at: https://standards.openbanking.org.the UK

cxxix. Financial Conduct Authority (2025). Research Note: Open Banking and Open Finance in the UK. Available at: https://www. fca.org.uk/publication/research-notes/open-banking-openfinance-uk.pdf

cxxx. Pix is Brazil’s instant payment system developed by the Central Bank of Brazil.

cxxxi. The Paypers (2025). Brazil’s Open Finance: five years of evolution and ecosystem building. Available at: https://thepaypers. com/fintech/expert-views/brazils-open-finance-five-years-ofevolution-and-ecosystem-building

cxxxii. Sahamati (n.d.). What is Account Aggregator?

Available at: https://sahamati.org.in/what-is-accountaggregator/#:~:text=Account%20Aggregators%20(AA)%20 use%20technology,be%20shared%20without%20your%20 consent

cxxxiii. Institute of International Finance (2018). Liability and Customers Protection in Open Banking. Available at: https://www.iif.com/ portals/0/Files/private/32370132_liability_and_customers_ protection_in_open_banking_091818.pdf

cxxxiv. Polinsky, A. M. and Shavell, S. (2000). The Theory of Public Enforcement of Law. Journal of Economic Literature vol. 38, no. 1. Available at: https://www.aeaweb.org/articles?id=10.1257/ jel.38.1.45

cxxxv. Nouwens, M. et al. (2020). Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence. Available at: https://arxiv.org/abs/2001.02479

cxxxvi. World Bank (2017). Good Practices for Financial Customers Protection. Available at: https://openknowledge.worldbank. org/server/api/core/bitstreams/eca2f77f-64c0-5102-ab82eea089d285c1/content

cxxxvii. Institute of International Finance (2018). Liability and Customers Protection in Open Banking. Available at: https://www.iif.com/ portals/0/Files/private/32370132_liability_and_customers_ protection_in_open_banking_091818.pdf

cxxxviii. World Bank (n.d.). Complaints handling and dispute resolution. Available at: https://digitalfinance.worldbank.org/topics/ financial-customers-protection/complaints-handling-anddispute-resolution

cxxxix. CGAP, BIS, IMF, UNSGSA, World Bank (2025). Key Considerations for Open Finance. Available at: https://www.cgap.org/sites/ default/files/publications/KP_Open%20Finance%20Report.pdf

cxl. CGAP (2023). Combining Open Finance and Data Protection for Low-Income Consumers. Available at: https://www.cgap. org/research/publication/combining-open-finance-and-dataprotection-for-low-income-consumer

cxli. CGAP (2026). Liability in Open Finance: How Do We Make It Work for Consumers? Available at: https://www.cgap.org/ blog/liability-in-open-finance-how-do-we-make-it-work-forconsumers

cxlii. CGAP (2026). Open Finance Oversight and Supervision: Emerging Practices and Early Lessons. Available at: https://www. cgap.org/research/publication/open-finance-oversight-andsupervision-emerging-practices-and-early-lessons

cxliii. OECD (2024), Customers Finance Risk Monitor, OECD Publishing. Available at: https://doi.org/10.1787/047b2ea6-en

cxliv. CCAF (2024), The Global State of Open Banking and Open Finance, Cambridge: Cambridge Centre for Alternative Finance, Cambridge Judge Business School, University of Cambridge. Available at: https://www.jbs.cam.ac.the UK/wp-content/ uploads/2024/11/2024-ccaf-the-global-state-of-open-bankingand-open-finance.pdf

cxlv. Mazer, R. and Dias, D. (2025). Open Finance Implementation: Global lessons from the first wave of innovation. Available at: https://www.findevgateway.org/sites/default/files/publications/ submissions/115193/Open%20Finance%20Implementation%20 Key%20Lessons%20-%20Mazer-Dias%20-%20March%202025.pdf

cxlvi. CGAP (2024). Key Considerations for Open Finance. Available at: https://documents1.worldbank. org/curated/en/099121824111037522/pdf/ P1809671abadcb04a1a2f112c8b33f037ad.pdf

cxlvii. Khan, A. and Gray, J. (2025). Open finance: Learning from early adopters. Available at: https://cenfri.org/articles/open-financelessons-learnt-from-early-adopters/

cxlviii. World Bank (2021). The Role of Customers Consent in Open Banking. Available at: https://documents1. worldbank.org/curated/en/099425002082230437/pdf/ P1705050aeb8e704f088260f228802b73b8.pdf

cxlix. Duflos, E. (2024). Ensuring Responsible Open Finance for Customers and their Data. Available at: https://www.cgap.org/ blog/ensuring-responsible-open-finance-for-customers-andtheir-data

cl. Ministry of Electronics and Information Technology (2023). The Digital Personal Data Protection Act, 2023. Available at: https:// www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8f ef35e82c42aa5.pdf

cli. Privacytools (n.d.). Consent Management. Available at: https:// www.privacytools.com.br/en/consent-management/

clii. World Bank. (2021). The Role of Customers Consent in Open Banking: Financial Inclusion Support Framework. Technical Note. Available at: https://openknowledge.worldbank.org/entities/ publication/5fa1c972-ea32-5504-a60f-42237b7385ac

cliii. Cenfri (2025). Who is responsible? Allocating liability in digital financial services. Available at: https://cenfri.org/articles/who-isresponsible-allocating-liability-in-digital-financial-services/

cliv. European Commission (2019). Frequently Asked Questions: Making electronic payments and online banking safer and easier for customers. Available at: https://ec.europa.eu/ commission/presscorner/detail/en/qanda_19_5555

clv. Mazer, R. & Farrell, S. (2025). Liability Frameworks in Open Finance: Enabling Trust and Participation. Available at: https:// www.pymnts.com/cpi-posts/liability-frameworks-in-openfinance-enabling-trust-and-participation/

clvi. Central Bank of Nigeria (2023). Operational Guidelines for Open Banking in Nigeria. Available at: https://www.cbn.gov.ng/ Out/2023/CCD/Operational%20Guidelines%20for%20Open%20 Banking%20in%20Nigeria.pdf

clvii. Mazer, R. and Dias, D. (2025). Open Finance Implementation: Global lessons from the first wave of innovation. Available at: https://www.findevgateway.org/sites/default/files/ publications/2026/Open%20Finance%20Implementation%20 White%20Paper%20-%20Mazer-Dias%20-%20March%202025.pdf

clviii. Posner, A. R. (1970). The Costs of Accidents - A Legal and Economic Analysis. Available at: https://chicagounbound. uchicago.edu/cgi/viewcontent.cgi?article=3665&context=uclrev

clix. Mazer, R. & Farrell, S. (2025). Liability Frameworks in Open Finance: Enabling Trust and Participation. Available at: https:// www.pymnts.com/cpi-posts/liability-frameworks-in-openfinance-enabling-trust-and-participation/

clx. Joint and several liability is a legal concept that arises when two or more parties are independently and collectively held liable for the entire harm caused; Cornell Law School (n.d.). Joint and Several. Available at: https://www.law.cornell.edu/wex/ joint_and_several

clxi. Risk sharing is a mechanism wherein parties pool the risks arising from uncertain events to reduce the impact of the risk on any single party; Clemente, G.P. et. al. (2025). Risk sharing rule and safety loading in a peer to peer cooperative insurance model. Decisions Econ Finan 48, 1439–1452. Available at: https://doi.org/10.1007/s10203-024-00438-0

clxii. Holmstrom, B. (1982). Moral Hazard in Teams. The Bell Journal of Economics, 13(2), 324–340. Available at: https://doi. org/10.2307/3003457

clxiii. Posner, R. A. (1972). A Theory of Negligence, 1 Journal of Legal Studies 29. Available at: https://chicagounbound.uchicago.edu/ journal_articles/9933/

clxiv. Jensen, M. C. and Meckling, W. H. (1976). Theory of the firm: Managerial behavior, agency costs and ownership structure. Journal of Financial Economics Volume 3, Issue 4. Available at: https://www.sciencedirect.com/science/article/ pii/0304405X7690026X#aep-bibliography-id6

clxv. The UK Payment Systems Regulator (PSR) (2023). PS23/3 Fighting Authorised Push Payment Fraud: A New Reimbursement Requirement. Available at: https://www.psr. org.the UK/publications/policy-statements/ps233-fightingauthorised-push-payment-fraud-a-new-reimbursementrequirement/

clxvi. Parliament of Canada (2025). Budget 2025 Implementation Act, No. 1. Available at: https://www.parl.ca/documentviewer/en/451/bill/C-15/first-reading

clxvii. Central Bank of UAE (2025). Open Finance Regulation. Available at: https://rulebook.centralbank.ae/en/rulebook/open-financeregulation-0

clxviii. Ibid.

clxix. IMD (2025). World Digital Competitiveness Ranking 2025. Available at: https://www.imd.org/entity-profile/uae-digital/ clxx. World Bank (2025). Unlocking the the Philippines’ Digital Transformation by Increasing Internet Connectivity. Available at: https://www.worldbank.org/en/results/2025/07/02/unlockingthe-philippines-digital-transformation-by-increasing-internetconnectivity

clxxi. Office of the Australian Information Commissioner (2020). Chapter C: Consent — The basis for collecting and using CDR data. Available at: https://www.oaic.gov.au/__data/assets/pdf_ file/0012/10245/chapter-c-consent-the-basis-for-collectingand-using-cdr-data-v2.0.pdf

clxxii. Open Finance Tracker (n.d.). Singapore Financial Data Exchange – SGFinDex. Available at: https://ozoneapi.com/the-openfinance-tracker/library/singapore-financial-data-exchangesgfindex/

clxxiii. Government of Canada (2025). Budget 2025: Canada's Consumer-Driven Banking Framework. Available at: https:// www.canada.ca/en/department-finance/programs/financialsector-policy/open-banking-implementation/budget-2025canadas-framework-for-consumer-driven-banking.html

clxxiv. Plaid (2023). Now you can enjoy 180 days of secure connectivity in Europe. Available at: https://plaid.com/blog/ eu-reauth-update /

clxxv. New Zealand Legislation (2025). Customer and Product Data Act. Available at: https://www.legislation.govt.nz/act/ public/2025/14/en/latest/#LMS789073

clxxvi. Parliament of India (2023). The Digital Personal Data Protection Act, 2023. Available at: https://www.indiacode.nic.in/ bitstream/123456789/22037/1/a2023-22.pdf#search=data%20 protection ; Reserve Bank of India (2025). Reserve Bank of India (Non-Banking Financial Companies – Account Aggregator) Directions, 2025. Available at: https://rbidocs.rbi.org.in/rdocs/ notification/PDFs/368MDA3A72C813679452CB0A291E6B300 DB59.PDF

clxxvii. Banco Central do Brasil (2020). Regulation on Open Banking. Joint Resolution No. 1 of May 4th, 2020. Available at: https:// www.bcb.gov.br/content/config/Documents/Open_Banking_ Regulation_Joint%20Resolution_No_1_Updated.pdf

clxxviii. Central Bank of Nigeria (2022). Operational Guidelines for Open Banking in Nigeria. Available at: https://www.cbn. gov.ng/Out/2022/CCD/OPERATIONAL%20GUIDELINES%20 FOR%20OPEN%20BANKING%20IN%20NIGERIA_APPROVED%20 EXPOSURE%20DRAFT.pdf

clxxix. Medine, D. and Plaitakis, A. (2023). Combining Open Finance and Data Protection for Low-Income Customers. Available at: https://www.cgap.org/sites/ default/files/publications/20230216_Medine_TN_ OpenFinanceDataProtection.pdf ; CGAP (2024). Key Considerations for Open Finance. Available at: https:// documents1.worldbank.org/curated/en/099121824111037522/ pdf/P1809671abadcb04a1a2f112c8b33f037ad.pdf

clxxx. Boms, S. and Taussig, S. (2022). Customer Protection and the Liability Conundrum in an Open Finance Ecosystem. Oxford University Press. Available at: https://academic.oup.com/ book/41431/chapter-abstract/352763245?redirectedFrom=fulltext clxxxi. CGAP (2026). Open Finance Oversight and Supervision: Emerging Practices and Early Lessons. Available at: https://www. cgap.org/research/publication/open-finance-oversight-andsupervision-emerging-practices-and-early-lessons clxxxii. Ibid.

clxxxiii. OECD (2023). Open Finance Policy Considerations. Available at: http://oecd.org/content/dam/oecd/en/ publications/reports/2023/11/open-finance-policyconsiderations_932ba548/19ef3608-en.pdf

clxxxiv. Borowicz, M. K. (2025). Competition, standards, and EU data spaces. Available at: https://pmc.ncbi.nlm.nih. gov/articles/PMC12391248/ ; Association for Financial Markets in Europe (2022). Open Finance and Data Sharing. Available at: https://www.afme.eu/media/zthe UKd3kci/ openfinanceanddatasharing1.pdf

clxxxv. OECD (2023). Open Finance Policy Considerations. Available at: http://oecd.org/content/dam/oecd/en/ publications/reports/2023/11/open-finance-policyconsiderations_932ba548/19ef3608-en.pdf

clxxxvi. CGAP (2026). Liability in Open Finance: How Do We Make It Work for Consumers? Available at: https://www.cgap.org/ blog/liability-in-open-finance-how-do-we-make-it-work-forconsumers

clxxxvii. Invela. Build Your Open Finance Services with Confidence. Available at: https://www.invela.com/ clxxxviii. Sahamati (2025). Reconciling the Account Aggregator and Consent Manager Frameworks. Available at: https://sahamati. org.in/reconciling-the-account-aggregator-and-consentmanager-frameworks/ clxxxix. Sahamati (n.d.). AA Fair Use Template Library. Available at: https://sahamati.org.in/aa-fair-use-template-library/

cxc. Bank of Ghana (2024). Draft Open Banking Directive for Regulated Financial Institutions. Available at: https://www.bog. gov.gh/wp-content/uploads/2024/12/Draft-Open-BankingDirective-for-Regulated-Financial-Institutions-201224.pdf

cxci. Central Bank of Nigeria (n.d.). Customers Protection Department Frequently Asked Questions. Available at: https://www.cbn.gov. ng/OUT/2018/CPD/CUSTOMERS%20PROTECTION%20FAQs.PDF

cxcii. Central Bank of Nigeria (2023). Operational Guidelines for Open Banking in Nigeria. Available at: https://www.cbn.gov.ng/ Out/2023/CCD/Operational%20Guidelines%20for%20Open%20 Banking%20in%20Nigeria.pdf

cxciii. Ibid.

cxciv. Central Bank of Nigeria (2021). Circular to all Deposit Money Banks (DMBs) and Payment Service Providers (PSPs). Available at: https://www.cbn.gov.ng/out/2021/psmd/circular%20 on%20the%20regulatory%20framework%20on%20open%20 banking%20in%20nigeria.pdf

cxcv. Office of Australian Information Commissioner (n.d). How to make a Consumer Data Right complaint. Available at: https://www.oaic.gov.au/consumer-data-right/consumerdata-right-complaints/how-to-make-a-consumer-data-rightcomplaint#section-give-them-at-least-30-days-to-respond

cxcvi. Reserve Bank of India (2016). Master Direction - Non-Banking Financial Company - Account Aggregator (Reserve Bank) Directions, 2016. Available at: https://www.rbi.org.in/Scripts/ BS_ViewMasDirections.aspx?id=10598

cxcvii. UK Legislations (2017). The Payment Services Regulations 2017. Available at: https://www.legislation.gov.uk/uksi/2017/752

cxcviii. Bank of Ghana (2024). Draft Open Banking Directive for Regulated Financial Institutions. Available at: https://www.bog. gov.gh/wp-content/uploads/2024/12/Draft-Open-BankingDirective-for-Regulated-Financial-Institutions-201224.pdf

cxcix. Bangko Sentral ng Pilipinas (2021). Circular No. 1122: Open Finance Framework. Available at: https://www.bsp.gov.ph/ Regulations/Issuances/2021/1122.pdf

cc. Brasil (2022). Decreto nº 11.034, de 5 de abril de 2022 - Regulamenta a Lei nº 8.078, de 11 de setembro de 1990Código de Defesa do Consumidor, para estabelecer diretrizes e normas sobre o Serviço de Atendimento ao Consumidor. Available at: https://www.planalto.gov.br/ccivil_03/_ato20192022/2022/decreto/d11034.htm

cci. Reserve Bank of India (RBI). (n.d.). Frequently Asked Questions (FAQs). Available at: https://www.rbi.org.in/commonperson/ english/scripts/FAQs.aspx?Id=3407

ccii. Financial Ombudsman Service. (n.d.). Before We Get Involved. Available at: https://www.financial-ombudsman.org.uk/ businesses/resolving-complaint/before-get-involved cciii. Australian Financial Complaints Authority (AFCA). (n.d.). The Process We Follow. Available at: https://www.afca.org.au/whatto-expect/the-process-we-follow

cciv. Mounir, H. (2024). Egypt: CBE lays down guidelines for banks on handling customer complaints. Available at: https://www. zawya.com/en/business/banking-and-insurance/egypt-cbelays-down-guidelines-for-banks-on-handling-customercomplaints-e7srd6ue

ccv. Brasil (2022). Decreto nº 11.034, de 5 de abril de 2022 - Regulamenta a Lei nº 8.078, de 11 de setembro de 1990Código de Defesa do Consumidor, para estabelecer diretrizes e normas sobre o Serviço de Atendimento ao Consumidor. Available at: https://www.planalto.gov.br/ccivil_03/_ato20192022/2022/decreto/d11034.htm

ccvi. Central Bank of Nigeria (2021). Regulatory Framework for Open Banking in Nigeria. Available at: https://www.cbn.gov. ng/out/2021/psmd/circular%20on%20the%20regulatory%20 framework%20on%20open%20banking%20in%20nigeria.pdf

ccvii. Open Banking Limited (n.d.). VRPs for sweeping. Available at: https://standards.openbanking.org.the UK/good-practice/vrpfor-sweeping-guidelines/v3-1-10/

ccviii. Australian Government, Customers Data Right (n.d.). Your rights. Available at: https://www.cdr.gov.au/your-rights

ccix. Brasil (2022). Decreto nº 11.034, de 5 de abril de 2022: Regulamenta a Lei nº 8.078, de 11 de setembro de 1990 –Código de Defesa do Consumidor, para estabelecer diretrizes e normas sobre o Serviço de Atendimento ao Consumidor. Available at: https://www.planalto.gov.br/ccivil_03/_ato20192022/2022/decreto/d11034.htm

ccx. Reserve Bank of India (2025). Reserve Bank of India (NonBanking Financial Companies - Account Aggregator) Directions, 2025. Available at: https://rbidocs.rbi.org.in/rdocs/notification/ PDFs/368MDA3A72C813679452CB0A291E6B300DB59.PDF

ccxi. Sahamati (n.d.). FIPs Grievance Resolution Speed – Closure. Available at: https://sahamati.org.in/grievance-dashboards/ closure/

ccxii. Rott, P. (2025). Digital Fairness and the Burden of Proof. J Consum Policy 48. Available at: https://doi.org/10.1007/s10603025-09583-4

ccxiii. Bank of Ghana (2021). Report on Complaints Management Function. Available at: https://www.bog.gov.gh/wp-content/ uploads/2022/06/Report-on-Complaints-ManagementFunction-2021.pdf

ccxiv. Bank of Ghana (2024). Annual Report and Financial Statements. Available at: https://www.bog.gov.gh/wp-content/ uploads/2025/07/2024-Annual-Report-and-FinancialStatements-1.pdf

ccxv. Allen, E. & Spencer, A. (2024). UK introduces mandatory reimbursement rules to combat APP fraud. Available at: https://www.taylorwessing.com/en/insights-andevents/insights/2024/10/dqr-uk-introduces-mandatoryreimbursement-rules-to-combat-app-fraud https://www. taylorwessing.com/en/insights-and-events/insights/2024/10/ dqr-uk-introduces-mandatory-reimbursement-rules-to-combatapp-fraud

ccxvi. Invela (n.d.). Open Finance, Covered. Available at: https://www. invela.com/

ccxvii. Payment Systems Regulator (n.d.). Deadlines for firms. Available at: https://www.psr.org.uk/our-work/app-scams/deadlines-forfirms/

ccxviii. Open Banking Limited (2025). Financial Crime within Open Banking Journeys. Available at: https://www.openbanking.org. uk/wp-content/uploads/OBL-Financial-Crime-report-update2025-December.pdf

ccxix. Open Banking Limited (n.d.). Average API availability –unweighted. Available at: https://www.openbanking.org.uk/ api-performance/

ccxx. Open Banking Limited (2025). Financial Crime within Open Banking Journeys. Available at: http://obl-financial-crimereport-update-2025-december.pdf/ https://www.openbanking. org.uk/wp-content/uploads/OBL-Financial-Crime-reportupdate-2025-December.pdf

ccxxi. Open Banking Limited (2020). TPP Guidelines. Available at: https://standards.openbanking.org.uk/operational-guidelines/ tpp-operational-guidelines/v3-1-5/ https://standards. openbanking.org.uk/operational-guidelines/tpp-operationalguidelines/counter-fraud-counter-fraud-measures/v3-1-4/

ccxxii. Bank of Thailand (n.d.). Consultation Paper - Draft Regulation on Oversight of Mechanisms Enabling Customers to Exercise Their Right to Share Their Data Held by Financial Service Providers. Available at: https://www.bot.or.th/content/dam/ bot/documents/en/laws-and-rules/hearing/public-hearing20250218-yourdata-eng.pdf

ccxxiii. Sahamati (2025). Self-Regulatory Organization for the Account Aggregator Ecosystem. Available at: https://sahamati.org.in/ self-regulatory-organization-for-the-account-aggregatorecosystem/

ccxxiv. OECD (2020). Regulatory Impact Assessment. Available at: https://www.oecd.org/en/publications/regulatory-impactassessment_7a9638cb-en.html

ccxxv. HM Treasury (2026). Magenta Book – Central Government guidance on evaluation. Available at: https://assets.publishing. service.gov.uk/media/6a049bedda82768016cb3f08/ CCS0126982978-001_PN10541411_Magenta_Book_Update_ V2_Accessible__1_.pdf

ccxxvi. OECD (2016). Reference guide on ex-post evaluation of competition agencies’ enforcement decisions. Available at: https://www.oecd.org/content/dam/oecd/en/publications/ reports/2016/04/reference-guide-on-ex-post-evaluationof-competition-agencies-enforcement-decisions_ d0990849/262476ff-en.pdf

ccxxvii. Mazer, R. (2026). Impact measurement in open finance: Initial review of global experiences and thematic priorities for measurement. Available at: https://rafemazer.com/Mazer_ Impact_Measurement_in_Open_Finance_2026.pdf

ccxxviii. World Bank (n.d.). Impact Measurement Framework. Available at: https://digitalfinance.worldbank.org/subtopics/impactmeasurement-framework

ccxxix. OECD (2020). Reviewing the Stock of Regulation. Available at: https://www.oecd.org/content/dam/oecd/en/publications/ reports/2020/12/reviewing-the-stock-of-regulation_ c6a98487/1a8f33bc-en.pdf

ccxxx. HM Treasury (2026). Magenta Book – Central Government guidance on evaluation. Available at: https://assets.publishing. service.gov.uk/media/6a049bedda82768016cb3f08/ CCS0126982978-001_PN10541411_Magenta_Book_Update_ V2_Accessible__1_.pdf

ccxxxi. European Commission (2025). Better Regulation Toolbox. Available at: https://commission.europa.eu/document/ download/9c8d2189-8abd-4f29-84e9-abc843cc68e0_ en?filename=BR%20toolbox%20-%20December%202025.pdf

ccxxxii. European Commission (n.d.). Monitoring Arrangements and Indicators. Available at: https://commission.europa. eu/document/download/e30026c0-b761-4676-b455ef6543fe5950_en?filename=better-regulation-toolbox-41_ en.pdf

ccxxxiii. World Bank. (2018). Global Indicators of Regulatory Governance: Worldwide Practices of Regulatory Impact Assessments. Available at: https://documents1.worldbank.org/curated/ en/905611520284525814/Global-Indicators-of-RegulatoryGovernance-Worldwide-Practices-of-Regulatory-ImpactAssessments.pdf

ccxxxiv. OECD (2025). Implementation Toolkit for the OECD Recommendation on Public Policy Evaluation. Available at: https://www.oecd.org/content/dam/oecd/en/ publications/reports/2025/02/implementation-toolkit-forthe-oecd-recommendation-on-public-policy-evaluation_ f24516be/77faa4fe-en.pdf

ccxxxv. CGAP (2024). Responsible Digital Finance Ecosystem (RDFE): A Conceptual Framework. Available at: https://www.cgap.org/ research/publication/responsible-digital-finance-ecosystemrdfe-conceptual-framework

ccxxxvi. HM Treasury (2026). Magenta Book – Central Government guidance on evaluation. Available at: https://assets.publishing. service.gov.uk/media/6a049bedda82768016cb3f08/ CCS0126982978-001_PN10541411_Magenta_Book_Update_ V2_Accessible__1_.pdf

ccxxxvii. Bank of England (2024). Customer Data Access and Fintech Entry: Early Evidence from Open Banking, Staff Working Paper. Available at: https://www.bankofengland.co.the UK/-/media/ boe/files/working-paper/2024/customer-data-access-andfintech-entry-early-evidence-from-open-banking.pdf

ccxxxviii. European Commission, Joint Research Centre (2025). The Future of European Competitiveness: Artificial Intelligence and Advanced Digital Technologies. Available at: https:// publications.jrc.ec.europa.eu/repository/bitstream/JRC141896/ JRC141896_01.pdf

ccxxxix. European Commission, Joint Research Centre (2025). Has PSD2 Favoured Investments in the European PayTech Companies? Available at: https://publications.jrc.ec.europa.eu/repository/ bitstream/JRC141896/JRC141896_01.pdf

ccxl. Abdul Latif Jameel Poverty Action Lab (n.d.). Improving ThirdParty Audits and Regulatory Compliance in India. Available at: https://www.povertyactionlab.org/evaluation/improving-thirdparty-audits-and-regulatory-compliance-india

ccxli. European Commission (2018). Development of a system of common indicators for European Regional Development Fund and Cohesion Fund interventions after 2020. Available at: https://ec.europa.eu/regional_policy/sources/studies/indic_ post2020/indic_post2020_p1_en.pdf

ccxlii. Financial Conduct Authority (2025). Insurance multi-firm review of outcomes monitoring under the Consumer Duty. Available at: https://www.fca.org.uk/publications/multi-firm-reviews/ insurance-multi-firm-review-outcomes-monitoring-underconsumer-duty

ccxliii. BCB (2020). Regulation on Open Banking - Joint Resolution No. 1/2020. Available at: https://normativos.bcb.gov.br/Lists/ Normativos/Attachments/51028/Res_Conj_0001_v4_P.pdf

ccxliv. Baker, K. (2022). Open Banking Lessons Learned Review. Available at: https://assets.publishing.service.gov.uk/ media/62908644d3bf7f036ebf5880/CMA_OB_Lessons_ Learned_Review.pdf

ccxlv. Australian Banking Association. (2024, July 3). Release of strategic review into roll-out of the Consumer Data Right. Available at: https://www.ausbanking.org.au/release-ofstrategic-review-into-roll-out-of-the-customers-data-right/

ccxlvi. OECD (1992). The Impact of Laws and Regulations on Micro and Small Enterprises in Niger and Swaziland. Available at: https://www.oecd.org/en/publications/the-impact-of-lawsand-regulations-on-micro-and-small-enterprises-in-niger-andswaziland_685353573323.html

ccxlvii. European Commission (2023). ‘Better Regulation’ Toolbox – July 2023 Edition. Available at: https://commission. europa.eu/document/download/9c8d2189-8abd-4f2984e9-abc843cc68e0_en?filename=BR%20toolbox%20-%20 December%202025.pdf

ccxlviii. Mazer, R. (2026). Impact measurement in open finance: Initial review of global experiences and thematic priorities for measurement. Available at: https://rafemazer.com/impactmeasurement

ccxlix. Ibid.

ccl. OECD (2020). Best Practice Principles for Reviewing the Stock of Regulation. Available at: https://www.oecd.org/en/publications/ reviewing-the-stock-of-regulation_1a8f33bc-en.html

ccli. National Audit Office (2021). Principles of Effective Regulation: Good-Practice Guide for Regulators. Available at: https:// www.nao.org.uk/wp-content/uploads/2021/05/Principles-ofeffective-regulation-SOff-interactive-accessible.pdf

cclii. Mazer, R. (2026). Impact measurement in open finance: Initial review of global experiences and thematic priorities for measurement. Available at: https://rafemazer.com/Mazer_ Impact_Measurement_in_Open_Finance_2026.pdf

ccliii. OECD (2020). Regulatory Impact Assessment. Available at: https://www.oecd.org/content/dam/oecd/en/ publications/reports/2020/02/regulatory-impactassessment_0bf78a03/7a9638cb-en.pdf

ccliv. Nam, J. R (2022). Open Banking and Customer Data Sharing: Implications for FinTech Borrowers. Available at: https://www. ecb.europa.eu/press/conferences/ecbforum/shared/pdf/2023/ EFCB_2023_Rachel_Nam_Paper.pdf

cclv. Swift (n.d.). ISO 20022: Standards. Available at: https://www. swift.com/standards/iso-20022/iso-20022-standards

cclvi. Murphy, S. and Khan, M. (2025). FAPI 2.0: The Future of API Security for High-Stakes Customer Interactions. Available at: https://auth0.com/blog/fapi-2-0-the-future-of-api-security-forhigh-stakes-customer-interactions/

cclvii. EBA (2018). Guidelines on the conditions to benefit from an exemption from the contingency mechanism under Article 33(6) of Regulation (EU) 2018/389 (RTS on SCA & CSC). Available at: https://www.eba.europa.eu/legacy/regulation-and-policy/ regulatory-activities/payment-services-and-electronic-money/ guidelines

cclviii. Customers Data Right (2024). CDR Register Metrics Collection. Available at: https://cdr-support.zendesk.com/hc/en-us/ articles/900005182383-CDR-Register-Metrics-Collection cclix. Sahamati (n.d.): Ecosystem Dashboard. Available at: https:// sahamati.org.in/aa-dashboard/ cclx. Open Finance Brazil (2024). Desempenho e Disponibilidade das APIs. Available at: https://openfinancebrasil.atlassian.net/wiki/ spaces/DraftOF/pages/420446229/Desempenho%2Be%2BDisp onibilidade%2Bdas%2BAPIs

cclxi. Open Finance Brazil (n.d.). IT Services. Available at: https:// dashboard.openfinancebrasil.org.br/monitoring/it-services

cclxii. Open Banking Limited (n.d.). Average API availability –unweighted. Available at: https://www.openbanking.org.uk/ api-performance/

cclxiii. Sahamati (n.d.). Dashboard 2: FIP Wise Customer Experience Summary. Available at: https://sahamati.org.in/dashboard-2-fipapi-wise-health/

cclxiv. World Bank (2025). Digital Public Infrastructure and Development: A World Bank Group Approach. Available at: https://documents1.worldbank.org/curated/ en/099031025172027713/pdf/P505739-84c5073b-9d40-4b83a211-98b2263e87dd.pdf

cclxv. Citizen Dashboard (n.d.). API Calls. Available at: https:// dashboard.openfinancebrasil.org.br/open-data/api-requests/ evolution

cclxvi. Open Banking Limited (n.d.). Average API availability –unweighted. Available at: https://www.openbanking.org.uk/ api-performance/

cclxvii. BIIA (2025). Open Finance Enables Brazilian Customers by Reshaping How they Leverage Financial Data – BCB Insights. Available at: https://www.biia.com/open-finance-enablesbrazilian-customers-by-reshaping-how-they-leverage-financialdata-bcb-insights/

cclxviii. Open Banking Limited (2025). OBL Impact Report 7: open banking delivers real-world impact as adoption accelerates year-on-year. Available at: https://www.openbanking.org.uk/ wp-content/uploads/Impact-report-7-may-2025.pdf

cclxix. Financial Conduct of Authority (2025). Insurance multifirm review of outcomes monitoring under the Customers Duty. Available at: https://www.fca.org.the UK/publications/ multi-firm-reviews/insurance-multi-firm-review-outcomesmonitoring-under-customers-duty

cclxx. Open Banking Limited (2021). The Open Banking Impact Report (June 2021). Available at: https://www.openbanking.org.the UK/ insights/the-open-banking-impact-report/

cclxxi. Open Finance Brazil (2022). Biannual Report. Available at: https://ob-wp-media-files.s3.amazonaws.com/wp-content/ uploads/2023/06/15095957/20221003_Biannual_Report_OFB.pdf

cclxxii. Cambridge Centre for Alternative Finance (2024). The Global State of Open Banking and Open Finance Report. Available at: https://www.jbs.cam.ac.the UK/faculty-research/centres/ alternative-finance/publications/the-global-state-of-openbanking-and-open-finance-report/

cclxxiii. Granados, C., Ayala, Y., Ramos-Mejia, M. (2024). Is it substantive or just symbolic? Understanding innovation theater in organisations: The case of technology-based innovation. Available at: https://www.sciencedirect.com/science/article/ abs/pii/S0166497223001918

cclxxiv. Open Banking Limited (n.d.). Impact Reports. Available at: https://www.openbanking.org.the UK/news/category/impactreport/

cclxxv. Open Banking Limited (2026). Unlocking the everyday: The value, growth and opportunity of open banking in the UK. Available at: https://www.openbanking.org.uk/wp-content/ uploads/Unlocking-the-everyday-value-growth-opportunityopen-banking-UK.pdf

cclxxvi. GCC Business Watch (2024). Saudi Central Bank Approves Three New FinTech Startups for Regulatory Sandbox Testing. Available at: https://gccbusinesswatch.com/news/saudicentral-bank-approves-three-new-fintech-startups-forregulatory-sandbox-testing/

cclxxvii. The Saudi Central Bank (2022). Saudi Central Bank Grants Permit To 4 New Fintech Firms To Operate Under Its Regulatory Sandbox. Available at: https://www.sama.gov.sa/en-US/News/ pages/news-784.aspx

cclxxviii. Scaleupinstitute (2020). FCA Regulatory Sandbox: World-leading programme breaking down regulatory barriers. Available at: https://www.scaleupinstitute.org.the UK/programmes/ fca-regulatory-sandbox-world-leading-programme-breakingdown-regulatory-barriers/#:~:text=90%25,as%20HSBC%20 and%20First%20Direct

cclxxix. Rusu, J. (2022). Performance of FCA regulatory sandbox. Available at: https://fintechcanada.io/performance-of-fcaregulatory-sandbox/ cclxxx. Galileo (2025). Banking APIs Cut Your Fintech Development Time from Years to Just Months. Available at: https://www.galileo-ft. com/blog/banking-apis-cut-fintech-development-time/ cclxxxi. Yapily (2025). How long does it take to integrate open banking? Available at: https://www.yapily.com/blog/how-long-does-ittake-to-integrate-open-banking

cclxxxii. Edey, M. (2012). Inertia and Coordination Problems in Payment Networks. Available at: https://www.rba.gov.au/speeches/2012/ sp-ag-300312.html

cclxxxiii. Capgemini (2022). HMRC becomes the first tax authority in the world to launch open banking payments https://www. capgemini.com/news/client-stories/hmrc-becomes-thefirst-tax-authority-in-the-world-to-launch-open-bankingpayments/

cclxxxiv. HM Treasury (2025). National Payments Vision. Available at: https://www.gov.the UK/government/publications/nationalpayments-vision/national-payments-vision#fnref:8 cclxxxv. Bangko Sentral ng Pilipinas (BSP). (n.d.). Media Release. Available at: https://www.bsp.gov.ph/SitePages/MediaAndResearch/ MediaDisp.aspx?ItemId=7841&MType=MediaReleases

cclxxxvi. Open Banking Limited (2025). OBL Impact Report 7: open banking delivers real-world impact as adoption accelerates year-on-year. Available at: https://www.openbanking.org.the UK/insights/obl-impact-report-7-open-banking-delivers-realworld-impact-as-adoption-accelerates-year-on-year/ cclxxxvii. Open Banking Limited (n.d.). Availability of Propositions. Available at: https://openbanking.foleon.com/live-publications/ the-obl-impactreport-7/availability-of-propositions cclxxxviii. Open Banking Limited (2025). Open Banking Impact Report 7. Available at: https://www.openbanking.org.uk/wp-content/ uploads/Impact-report-7-may-2025.pdf

cclxxxix. The UK Parliament (2024). Regulatory Powers for Smart Data. Available at: https://bills.parliament.the UK/publications/56550/ documents/5223

ccxc. Babina, T., et al. (2024). Customer data access and fintech entry: early evidence from open banking. Available at: https://www. bankofengland.co.uk/-/media/boe/files/working-paper/2024/ customer-data-access-and-fintech-entry-early-evidence-fromopen-banking.pdf

ccxci. Xu, R. (2026). Fintech Competition and Banks’ Shrinking Margins in Brazil. Available at: https://www.elibrary.imf.org/view/ journals/001/2026/007/article-A001-en.xml

ccxcii. Haas Ornelas, J. R. & Reggi Pecora, A. (2022). Does Fintech Lending Lower Financing Costs? Evidence From an Emerging Market. Available at: https://www.bcb.gov.br/pec/wps/ingl/ wps571.pdf

ccxciii. Banco Central do Brasil (2025). Financial Stability Report Volume 24, N. 1. Available at: https://www.bcb.gov.br/content/ publications/financialstabilityreport/202504/fsrFullRep.pdf

ccxciv. Duque, V. (2022). Beyond Pix: Open Banking “Payment Initiation” Accelerates Ach in Brazil. Available at: https://americasmi. com/insights/beyond-pix-open-banking-payment-initiationaccelerates-ach-in-brazil/

ccxcv. DSpace@MIT (n.d.). Understanding multi-homing and switching by platform drivers. Available at: https://dspace.mit.edu/ handle/1721.1/156444?show=full

ccxcvi. OECD (2009). Series Roundtables on Competition Policy N° 97. Available at: https://www.oecd.org/content/ dam/oecd/en/publications/reports/2009/12/two-sidedmarkets_39bffd74/1ab6f5f3-en.pdf

ccxcvii. Sahamati (2025). Account Aggregator Ecosystem: Transforming India’s Financial Services. Available at: https://sahamati.org.in/ wp-content/uploads/2025/11/Account-Aggregator-Adoptionupdate-for-website-Mar-25.pdf

ccxcviii. Ibid.

ccxcix. NBER (2025). Underwriting Based on Cash Flow Helps Younger Entrepreneurs Access Credit. Available at: https://www.nber. org/be/20252/underwriting-based-cash-flow-helps-youngerentrepreneurs-access-credit?page=1&perPage=50

ccc. Sahamati (2025). Sahamati Marks 4th Account Aggregator Foundation Day. Available at: https://sahamati.org.in/sahamatimarks-4th-account-aggregator-foundation-day-indias-dataempowerment-revolution-scales-new-heights/

ccci. Alok, S. (2024). Does Open Banking Expand Credit Access?. Available at: https://thedocs.worldbank.org/en/doc/224ef95415 948656163953f97acbeffe-0050062024/original/Open-BankingLatest-PPT.pdf

cccii. EconomyFoot Print (2024). Creating Impact: The Role of Msme Support and Financing in Alleviating Poverty and Food Insecurity in Nigeria. Available at: https://economyfootprint. com/2024/10/07/creating-impact-the-role-of-msme-supportand-financing-in-alleviating-poverty-and-food-insecurity-innigeria/

ccciii. Bulletin, M. (2025). Philippine MSMEs keep growing despite challenges, says ADB. Available at: https://mb.com. ph/2025/11/13/philippine-msmes-keep-growing-despitechallenges-says-adb

ccciv. Open Banking Limited (2024). Latest Impact Report shows strong growth and the power of payments. Available at: https:// www.openbanking.org.the UK/insights/latest-impact-reportshows-strong-growth-and-the-power-of-payments/

cccv. Burger, S. (2025). Report highlights data gap preventing small businesses from accessing finance. Available at: https:// www.engineeringnews.co.za/article/report-highlightsdata-gap-preventing-small-businesses-from-accessingfinance-2025-05-29

cccvi. Bank of England (2024). Customer Data Access and Fintech Entry: Early Evidence from Open Banking, Staff Working Paper. Available at: https://www.bankofengland.co.the UK/-/media/ boe/files/working-paper/2024/customer-data-access-andfintech-entry-early-evidence-from-open-banking.pdf

cccvii. BrowserStack (2025). Network Delay Request: Meaning, Causes, and Best Practices. Available at: https://www.browserstack.com/ guide/understanding-network-delay-request

cccviii. OECD (2025). Digital connectivity expands across the OECD, but rural areas are falling further behind. Available at: https:// www.oecd.org/en/data/insights/statistical-releases/2025/07/ digital-connectivity-expands-across-the-oecd-but-rural-areasare-falling-further-behind.html

cccix. Khera, P. et al. (2022). The Digital Gender Gap. Available at: https://www.imf.org/en/publications/fandd/issues/2022/12/ the-digital-gender-gap-khera-ogawa-sahay-vasishth

cccx. Sahamati (n.d.). FIPs Grievance Composition (Workflow). Available at: https://sahamati.org.in/grievance-dashboards/ composition/

cccxi. Umbrex (2026). Complaint Rate. Available at: https://umbrex. com/resources/company-analysis/customer-service-support/ complaint-rate/

cccxii. Commonwealth Ombudsman (n.d.). Better Practice Complaint Handling Guide. Available at: https://www.ombudsman.gov. au/__data/assets/pdf_file/0025/288241/Better-PracticeComplaint-Handling-Guide-2021.pdf

cccxiii. Sahamati (n.d.). Grievance Dashboard – Closure. Available at: https://sahamati.org.in/grievance-dashboards/closure/

cccxiv. Customers Data Right (n.d.). Performance. Available at: https:// www.cdr.gov.au/performance

cccxv. Nouwens, M. et. al. (2020). Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence. Available at: https://arxiv.org/abs/2001.02479

cccxvi. Australian Government, Office of the Australian Information Commissioner (n.d.). Customers consent, authorisation and dashboards. Available at: https://www.oaic.gov.au/customersdata-right/customers-data-right-guidance-for-business/ privacy-obligations/customers-consent,-authorisation-anddashboards

cccxvii. Nubank (2023). Open Finance: With overdraft alerts, Nubank customers have saved R$ 4 million in interest. Available at: https://international.nubank.com.br/customers/open-financewith-overdraft-alerts-nubank-customers-have-saved-r-4-millionin-interest/

cccxviii. Open Banking Limited (n.d.). Revocation. Available at: https:// standards.openbanking.org.the UK/customer-experienceguidelines/introduction/revocation/latest/

cccxix. European Union (2020). Guidelines on consent under Regulation 2016/679. Available at: https://gdpr-text.com/ guidelines/consent/

cccxx. Open Finance Brazil (2022). Biannual Report. Available at: https://ob-wp-media-files.s3.amazonaws.com/wp-content/ uploads/2023/06/15095957/20221003_Biannual_Report_OFB.pdf

cccxxi. OECD (2025). Government at a Glance 2025. Available at: https://www.oecd.org/en/publications/government-at-aglance-2025_0efd0bcd-en.html

cccxxii. CFRR (2025). Guidance: Good Practices in Public Sector Financial Reporting and Fiscal Transparency. Available at: https://cfrr. worldbank.org/publications/guidance-good-practices-publicsector-financial-reporting-and-fiscal-transparency

cccxxiii. Banco do Brasil. (2023). BB incrementa mais de R$ 700 mi em limite de crédito para clientes com Open Finance. Available at: https://www.bb.com.br/pbb/pagina-inicial/imprensa/n/67320/ bb-incrementa-mais-de-r-700-mi-em-limite-d#/

cccxxiv. Nubank. (2024). Soluções de Open Finance do Nubank Geram Economia e Benefícios para os Clientes. Available at: https:// international.nubank.com.br/pt-br/companhia/solucoes-deopen-finance-do-nubank-geram-economia-e-beneficios-paraos-clientes/

cccxxv. Gomes, L.T. et al. (2023). Implementation and Challenges of Open Finance in Brazil (NEASF 18th Meeting Report). Available at: https://direitorio.fgv.br/sites/default/files/arquivos/direito_ rio_livro_neasf_18_eng_ap5.pdf

cccxxvi. Sahamati (2025). The Credit Reimagined: Account Aggregator (AA) Impact Report H2 FY25. Available at: https://sahamati. org.in/the-credit-reimagined-account-aggregator-aa-impactreport-h2-fy25/ cccxxvii. Sahamati (n.d.). Certified Entities in the Account Aggregator Ecosystem. Available at: https://sahamati.org.in/certifiedentities/ cccxxviii. Thanawala, H. (2025). Four years of Account Aggregator framework: How India’s financial dashboard is shaping up. Available at: https://www.moneycontrol.com/news/business/ personal-finance/four-years-of-account-aggregator-frameworkhow-india-s-financial-dashboard-is-shaping-up-13550090. html?pitchClick=personal-finance

cccxxix.

cccxxx.

OECD (2023), Open finance policy considerations, OECD Business and Finance Policy Papers, OECD Publishing. Available at: https://doi.org/10.1787/19ef3608-en

OECD (2023). Data Portability in Open Banking. Available at: https://www.oecd.org/content/dam/oecd/en/ publications/reports/2023/02/data-portability-in-openanking_84cca550/6c872949-en.pdf

cccxxxi. Minh Duc, D. T. and Linh, V.P. (2025). Harmonization of Data Regulation: International Approaches and Recommendations for the ASEAN Digital Economy Framework. Available at: https:// www.teseopress.com/repenserlesfrontiereseconomiques/ chapter/harmonization-of-data-regulation-internationalapproaches/

cccxxxii. ECB (2018). The revised Payment Services Directive (PSD2) and the transition to stronger payments security. Available at: https://www.ecb.europa.eu/press/intro/mip-online/2018/ html/1803_revisedpsd.en.html

cccxxxiii. Asia House (2024). Mind the Gap: How Southeast Asia’s fragmented personal data rules impact digital finance. Available at: https://www.asiahouse.org/files/documents/PoomthawatWachirapornpruet-Mind-the-Gap-How-Southeast-Asiasfragmented-personal-data-rules-impact-digital-finance.pdf

cccxxxiv. Singapore Fintech Association (2025). Data Without Borders: Harmonising ASEAN’s Digital Regulations for Growth. Available at: https://singaporefintech.org/wp-content/uploads/2025/11/ Data-Without-Borders.pdf

cccxxxv. Cenfri (2025). A leap in seamless cross-border payments in East Africa. Available at: https://cenfri.org/articles/a-leap-inseamless-cross-border-payments-in-east-africa/

cccxxxvi. African Union (2024). Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade. Available at: https://au.int/sites/default/files/treaties/44963treaty-EN_-_Protocol_to_AfCFTA_Agreement_on_Digital_ Trade.pdf

cccxxxvii. African Union (2025). Compiled Annexes to the African Continental Free Trade Area Protocol on Digital Trade. Available at: https://au.int/sites/default/files/treaties/44963-axENG_Circulation_Digital_Trade_Compiled_Certified_Legal_ Instruments_38thAssembly_Feb_2025_27_May2025.pdf

cccxxxviii. BIS (n.d.). Building block 15: Harmonising API protocols for data exchange. Available at: https://www.bis.org/cpmi/cross_border/ bb15.htm

cccxxxix. OpenID (2023). Open Banking and Open Data: Ready to Cross Borders?. Available at: https://openid.net/wordpress-content/ uploads/2023/01/OIDF-Whitepaper_Open-Banking-and-OpenData-Ready-to-Cross-Borders_Final.pdf

cccxl. Techcabal Insights (2026). Regulatory Passporting and the Future of Cross-Border Fintech in Africa. Available at: https:// insights.techcabal.com/regulatory-passporting-and-the-futureof-cross-border-fintech-in-africa/

cccxli. OECD (2023). Data Portability in Open Banking. Available at: https://www.oecd.org/content/dam/oecd/en/ publications/reports/2023/02/data-portability-in-openanking_84cca550/6c872949-en.pdf

cccxlii. Financial Stability Board (2024). Recommendations to Promote Alignment and Interoperability Across Data Frameworks Related to Cross-border Payments. Available at: https://www.fsb.org/ uploads/P121224-1.pdf

cccxliii. U.S. Commercial Service. (2024). AfCFTA Digital Trade Protocol. Available at: https://www.trade.gov/market-intelligence/afcftadigital-trade-protocol

cccxliv. IFC (n.d.). MSME Finance. Available at: https://www.ifc.org/en/ what-we-do/sector-expertise/financial-institutions/msmefinance

cccxlv. Ibid.

cccxlvi. World Bank (n.d.). Small and Medium Enterprises (SMEs) Finance. Available at: https://www.worldbank.org/en/topic/ smefinance

cccxlvii. Bhattacharjee, R. (2025). How Is Alternative Data Helping Expand the Scope for MSME Lending. Available at: https:// bureau.id/resources/blog/how-is-alternative-data-helpingexpand-the-scope-for-msme-lending

cccxlviii. World Bank (2024). The Use of Alternative Data in Credit Risk Assessment: Opportunities, Risks, and Challenges. Available at: https://documents1.worldbank.org/curated/ en/099031325132018527/pdf/P179614-3e01b947-cbae-41e485dd-2905b6187932.pdf

cccxlix. Owens, J. V. & Wilhelm, L. (2017). Alternative data transforming SME finance. World Bank Group. Available at: http://documents. worldbank.org/curated/en/701331497329509915

cccl. CGAP (2024). Key Considerations for Open Finance. Available at: https://documents1.worldbank. org/curated/en/099121824111037522/pdf/ P1809671abadcb04a1a2f112c8b33f037ad.pdf

cccli. Stripe (2025). What is open banking and how does it work? Available at: https://stripe.com/in/resources/more/openbanking-explained

ccclii. Bhasin, H. (2026). Automated Underwriting: The Future of Fast, Intelligent Loan Decisions with Pulse Einstein aiDEAL. Available at: https://mypulse.io/blog/automated-underwriting-thefuture-of-fast-intelligent-loan-decisions-with-pulse-einsteinaideal

cccliii. Sahamati (2025). Sahamati Marks 4th Account Aggregator Foundation Day, India’s Data Empowerment Revolution Scales New Heights. Available at:https://sahamati.org.in/sahamatimarks-4th-account-aggregator-foundation-day-indias-dataempowerment-revolution-scales-new-heights/ cccliv. Ibid.

ccclv. RBI Innovation Hub (n.d.). Unified Lending Interface. Available at: https://rbihub.in/projects/unified-lending-interface

ccclvi. Owusu, S. (2024). From Weeks to Minutes: How Automation Transforms SME Loan Approvals. Available at: https://mypulse. io/blog/from-weeks-to-minutes-how-automation-transformssme-loan-approvals

ccclvii. CRIF (2023). CRIF & iwoca unite to bring open banking-powered instant lending to UK SMEs. Available at: https://www.crif.co.uk/ news-events/news/crif-iwoca-unite-to-bring-open-bankingpowered-instant-lending-to-uk-smes/

ccclviii. CFIT (2024). Embracing the UK’s Open Finance Opportunity. Available at: https://cfit.org.uk/wp-content/uploads/2024/02/ CFIT-Open-Finance-Blueprint.pdf

ccclix. Banking Frontiers (2024). Now, SMEs can avail digital loans from SBI in just 45 minutes. Available at: https://bankingfrontiers. com/now-smes-can-avail-digital-loans-from-sbi-in-just-45minutes/

ccclx. Sahamati (2025). Sahamati Marks 4th Account Aggregator Foundation Day, India’s Data Empowerment Revolution Scales New Heights. Available at:https://sahamati.org.in/sahamatimarks-4th-account-aggregator-foundation-day-indias-dataempowerment-revolution-scales-new-heights/

ccclxi. CRIF (2023). CRIF & iwoca unite to bring open banking-powered instant lending to UK SMEs. Available at: https://www.crif.co.uk/ news-events/news/crif-iwoca-unite-to-bring-open-bankingpowered-instant-lending-to-uk-smes/

ccclxii. Thinksme (n.d.). How Long Does SME Loan Approval Take in Singapore?. Available at: https://thinksme.sg/how-fast-are-smeloans-approved-in-singapore/

ccclxiii. Haas Ornelas, J. R. & Reggi Pecora, A. (2022). Does Fintech Lending Lower Financing Costs? Evidence From an Emerging Market. Available at: https://www.bcb.gov.br/pec/wps/ingl/ wps571.pdf

ccclxiv. Pinto, A. (n.d.). Open Finance will make loans cheaper and easier to get. Available at: https://www.pismo.io/blog/open-financewill-make-loans-cheaper-and-easier-to-get/

ccclxv. European Commission (2023). Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/ HTML/?uri=CELEX%3A52023SC0224

ccclxvi. IBM (n.d.). What is Agentic AI? Available at: https://www.ibm. com/think/topics/agentic-ai

ccclxvii. OECD (2024). Explanatory memorandum on the updated OECD definition of an AI system. Available at: https://www.oecd. org/content/dam/oecd/en/publications/reports/2024/03/ explanatory-memorandum-on-the-updated-oecd-definition-ofan-ai-system_3c815e51/623da898-en.pdf

ccclxviii. World Bank (2022). Government migration to cloud ecosystems: multiple options, significant benefits, manageable risks. Available at: https://openknowledge.worldbank.org/server/api/ core/bitstreams/582c0d73-d367-423c-831d-0640814a7349/ content

ccclxix. International Monetary Fund (2021). AI and the Future of Work. Available at: https://www.elibrary.imf.org/view/ journals/001/2021/177/article-A001-en.xml

With the support of With the support of In collaboration with