.svg)
The Financial Technology Association (FTA) has asked the Consumer Financial Protection Bureau (CFPB) to allow the use of screen-scraping, in addition to secure APIs, when it crafts the country’s open banking rules.
In a comment letter submitted in response to the agency’s consultation, the fintech association argues that ongoing technological and security improvements have enabled the screen-scraping technology to serve as a secure and viable option in addition to APIs.
Screen-scraping is one of the ways that enables the consumer to provide the third-party access portal with their login credentials to allow them to access their financial data. Alternatively, third parties could use an API, the bank’s dedicated interface, where the consumer gives them access without sharing their bank credentials.
Screen-scraping was generally viewed in Europe as an unsafe method and banned under the bloc’s PSD2 regulations.
However, the fintech group, which includes PayPal, Block, Plaid, Stripe and others, have asked the CFPB to revisit these previous concerns given the significant advances in the safeguarding of sensitive consumer information, and the challenges of the immediate and complete adoption of APIs.
For instance, technology now enables firms to encrypt and tokenise login credentials, which reduces the risk of exposing sensitive information. Providers also commonly separate collected login credentials, including personal identification information and passwords, therefore increasing the security of the data.
Additionally, the fintechs said the risk of data theft could be reduced by multi-factor authentication for an initial consumer authentication.
As a result, the fintechs argue that although the use of secured APIs is an “optimal long-term approach” to data sharing, screen-scraping should be allowed to serve as a fallback option, for instance, when a financial institution does not have an API, which is common for smaller institutions.
They recommend the CFPB allow small banks to use screen-scraping as long as they fully implement APIs and allow it as a fallback option when APIs fail to operate or experience other unexpected interruptions.
“We urge the Bureau to focus on encouraging third-party providers to increase API integrations and performance rather than imposing limits on permissioned login approaches,” the firms said.
One approach to staggering API implementation timelines is to segment banks based on total assets, with the smallest entities having the most time to meet stated CFPB targets.
“For these reasons, it is in the clear best interest of the consumer for the Bureau to allow for the use of properly safeguarded permissioned login approaches in order to ensure that some consumers are not left out of being able to permission the sharing and use of their own data,” the fintechs said.
They caution against the use of the “derogatory” term of screen-scraping and instead suggest the use of “permissioned login” as a more accurate description of the method.
They also urged the CFPB to design the open banking framework in a way that covers the broad aspect of products and services.
As a first step, they said account information sharing should be paired with payment initiation services “in order to provide consumers with access to cheaper, more convenient payments solutions, as well as to advance fraud prevention strategies”.
The CFPB opened a consultation on its ongoing rulemaking for financial data sharing in October. As VIXIO pointed out, payment initiation was not included in the proposal at the time but CFPB director Rohit Chopra told Congress they are considering the possibility of including payment initiation in the framework in the future.
