2022-11-20-BIS-数据共享的API标准专题报告_48页_1mb

API Standards for Data-Sharing in Open Finance

Introduction

This report summarizes key aspects of API standards for facilitating secure data-sharing in open finance environments. APIs enable interoperability between data providers and consumers, fostering transparency, competition, and financial inclusion. Central banks play a pivotal role in driving these initiatives, addressing challenges like standardization and security.

Key Definitions and Concepts

• Data-Sharing: Defined as the provision of data by providers to third-party consumers with explicit consent. It encompasses practices, technologies, and legal frameworks for exchanging digital information.
• API Content: Includes communication protocols, data exchange formats (e.g., XML/JSON), access policies, and security measures.
• Data Serialization: Translates data formats for exchange without altering the source data.
• Consent Architecture: Mechanisms, such as OAuth 2.0 and OpenID Connect, ensure user authorization and control over data access.
• Account Aggregators (AAs): Intermediate platforms that manage data flows between providers and consumers without storing data, promoting interoperability and trust.

Data-Sharing Models

Three primary models are discussed:

• Centralized Model: An aggregator collects and consolidates data, offering fast responses but requiring strict data management and security.
• Decentralized Model: Data remains with providers; participants share individually, ensuring up-to-date information but posing challenges in standardization.
• Trust Ecosystem Model: Hybrid approach with decentralized data-sharing and centralized identity management, relying on trusted third parties for certification and security.

Data-Sharing Implementation Process

The process follows a phased lifecycle:

• Exploration/study
• Model design
• Proof of concept (PoC)
• Prototype development
• Pilot testing
• Production deployment
  Coordination among stakeholders is crucial, involving technical work and regulatory alignment.

Technological Considerations for API Design

• API Design Patterns: Use patterns like decoupled services and service gateways to enhance scalability and security.
• Protocols and Styles: REST, SOAP, and gRPC are common, with REST being predominant for web-based services.
• Access Levels: Public, private, and partner APIs cater to different user needs based on regulation and use cases.
• Security Mechanisms: Standards like JSON Web Token (JWT), OAuth 2.0, OpenID Connect, and Financial-grade API (FAPI) ensure robust authentication, authorization, encryption, and audit logging.

Case Studies and Global Examples

• Brazil: Implements a broad-based open finance framework with decentralized architecture, focusing on customer data sharing for services like loans and insurance.
• Mexico: Adopts a decentralized model with REST APIs, emphasizing data security through TLS and interoperability standards.
• Australia, India, Korea, UK: Demonstrate various models, including centralized platforms and trust frameworks, highlighting the need for harmonized technical standards and robust governance.

Challenges and Opportunities

• Challenges: Lack of coordination, data standardization issues, security risks, and regulatory divergences impede progress.
• Opportunities: Open finance can drive innovation, efficiency, and inclusive financial services by empowering data ownership and cross-sector sharing.
• Recommendations: Central banks should promote collaborative efforts, define open standards, and enforce FAPI profiles for enhanced security.

Conclusions

Data-sharing via APIs is essential for modernizing financial systems, promoting competition, and enhancing consumer control. Successful implementation requires strong governance, standardized protocols, and robust security measures. Ongoing international collaboration can mitigate challenges and accelerate adoption in open finance ecosystems.