Threat or opportunity?

Transcription

1 PSD2 és az API gazdaság a bankszektorban PSD2 Threat or opportunity? Szabó János Industry Solution Architect janos.szabo@hu.ibm.com Rainer Pirker Bluemix Sales Leader CEE rainer.pirker@at.ibm.com

2 Agenda 08:30 09:00 Registration 09:00 09:15 Introduction (Peter Rehus Country Leader, IBM Hungary) 09:15 10:00 PSD2 Overview and impact 10:00 10:30 PSD2 Use cases and examples 10:30 10:50 Coffee break 10:50 11:15 Instant payment and real-time fraud detection 11:15 12:00 API Economy new way to work for business 12:00 13:00 Lunch

3 PSD2 Overview and impact Szabó János Industry Solution Architect

4 Background, Objectives & Principles for PSD2 Contribute to a more integrated and efficient European payments market Principles Make payments safer and more secure SECURITY INNOVATION TRANSPARENCY COMPETITION Improve the level playing field for payment service providers (including new entrants) Protect consumers Encourage lower prices for payments 2014

5 What is Payments System Directive 2 (PSD2)? 1 Extension of scope Beyond EU and in the definition of Payment Institution Third-party payment initiation Allow users to initiate online payments directly from their bank accounts via third-party providers. 3 Third-party account access Aggregation of payment account information for users whom can get all of their transaction history and balances from one portal. 4 Prohibition of payment surcharges Standardization of surcharges on card-based transactions across EU. 5 Security and authentication New security requirements for electronic payments and account access. 2

6 Timeline of PSD2 Changed in 27/02/2017 European Commission creates proposal Parliament adopts proposal >18 month transition period European Banking Authority specifies implementation guidelines [RTS] RTS not in force despite compliance with PSD2 Member governments pass laws (compliance over 2 years) Misalignment between RTS & compliance Security & Technical Standards RTS = Regulatory Technical Standards

7 PSD2 abbreviations (there are too many TLAs) APIS Banks Account Service Provider (ASP/ASPSP) Services Providers Payment Initiation Service (PIS) Payment Initiation Service Provider (PISP) $ Third Party Provider (TPP) Customer Account Information Service (AIS) Account Information Service Provider (AISP) Access To Account (XS2A) Security

8 Scope of PSD2: Account Information Services (AIS) Account Information Service Provider (AISP) Account owner Banks will be mandated to provide aspects of account information to 3rd party providers (TPPs) via APIs Account information service providers (AISPs) will not have full access to the account of the customer They will receive the information explicitly consented by the customer and only to the extent they are necessary for the service provided to the customer ASP A ASP B ASP C A dynamically generated code only valid for that specific transaction will have to be used in the authentication process Today PSD2 Push based account info Real-time account info (request on demand)

9 Scope of PSD2: Payment Initiation Services (PIS) 1. Purchase Merchant 2. Payment Instruction Buyer 2. Payment request 3. Payment instruction 2. Payment request 5. Payment Initiation Service Provider (PISP) Credit transfer Today PSD2 PISP = Payment Initiation Service Provider ASP = Account Service Provider PSP = Payment Service Provider 7. Payment initiation service providers (PISPs) will not have full access to the account of the payer Merchant processor (PSP) 4. Payment instruction (API) Buyer s Bank Banks will be mandated to allow payments to initiated from customer accounts by 3rd party providers (TPPs) via APIs e.g. card providers; device providers; app providers 6. TPPs will only be able to receive information from the payer's bank on the availability of funds (a yes/no answer) on the account before initiating the payment (with the Merchant s Bank explicit consent of the payer) A dynamically generated code only valid for that specific transaction will have to be used in the authentication process

10 Process flow - TPP permission request Account Service Provider (ASP) Customer Request to activate account for TPP service Confirmation that request has been issued to ASP 3 Customer Channel TPP NewPermission.rq 1 XS2A admin Process TPP permission request 2 Confirm receipt TPP permission request NewPermission.rs Request permission approval (by account owner) Authentication + Permisison approval Response permission approval Confirm TPP permisison ( , SMS,...) XS2A API channel Response permission approval UpdateStatusPermission.rq UpdateStatusPermission.rs 1 Support XS2A APIs + Security TPP API calls 2 Processing, registration and management of TPP permission request 3 Account owner approval (or reject) of permission via existing customer channel of ASP

11 Process flow - TPP permission request (token based) ASP Customer Customer Channel TPP 1 API channel XS2A Consent Request to activate account for TPP service SubscribeService.rq Redirect Requestfor approval by account owner Dialogue to request approval account owner 3 GenerateToken.rq SubscribeService.rs (+ token) 4 2 Generate token GenerateToken.rs Store token Response activation account for TPP service 1 Support XS2A APIs + Security TPP API calls 2 Generation TPP permission in the form of a signed token. Token is not stored 3 Account owner approval (or reject) of permission via existing customer channel of ASP 4 TPP stores token in order to include it in API request for concerning service and account

12 Scope of PSD2: In simplest terms Account owner Account owner Channel app Channel app e.g. internet banking e.g. internet banking TPP XS2A Bank Account Bank Account (incl. Payments) Bank A Payments Bank A TPP = Third Party Payment Provider XS2A = Access to account

13 Impact of PSD2 on ASPs Account Service Provider (ASP) Implementation of APIs to enable AIS and PIS access by TPPs Security of API requests by TPPs Register accounts for AIS and PIS services and permit TPPs Implement technical guidelines of EBA on secure authentication Apply information transparency rules to the customer Develop a strategy to limit the flow-out of customers to TPPs

14 What should banks be thinking about? Strategically. Does my infrastructure allow me to embrace the API Economy? What are my technology choices & criteria for making the long-term choice? What should my ecosystem look like? Who should I partner with & why? How will I manage the relationships? Why should others partner with me? Why does my customer need me and what must I do to keep the relationship intact? How can I increase my customers loyalty to my firm? How do I analyze my customer? IT FOUNDATION PARTNER MANAGEMENT COMPLIANCE CUSTOMER RELATIONS Are my processes and operations ready for ensuring both legal (external) and operational (internal) conformance with standards? BANK MONETIZATION PRIVACY & SECURITY How will I ensure data and transactions are secured, monitored & accurately reported? How can I benefit from a change in my business model? How can I convert my data assets into new revenue sources?

15 Impact of PSD2 on PSPs (in fact, the whole payments landscape) Payment Service Providers (PSPs) Disappearance of monopoly of account service provider More opportunities for non-banks (Third Party Providers) to provide new innovative services more competition Opportunity for wallet service providers to top-up wallet instantly against low tariffs (instead of credit card) Provide retail payment services via more open credit transfer schemes instead of closed card schemes Fewer dependencies on banks as nonbanks can also participate in payment systems (CSMs)

16 PSD2 Strategic Scenarios Szabó János Industry Solution Architect

17 Implications of PSD2 Culture Ecosystem Open Banking Security IT Infrastructure Technology Business

18 Strategic PSD2 scenarios Role API Scope PSD2 only Extended TPP Base TPP Value adding TPP ASP Base ASP Value adding ASP

19 Life can be predictable, so why not your banking? The more we learn about how you like to behave, the better we ll get at keeping you one step ahead.

20 Focusing on compliancy Szabó János Industry Solution Architect

21 PoV Mind the Gap The Security Imperative With so many strategic options and the evolution of business models, two things are certain: (1) the increasing volume and variety of transactions; (2) the expansion of pre-determined and new sources of transactions. None of these can have gaps in security and integrity. Opinions from all are converged on the importance of security ACCENTURE: As significant quantities of customer data begin to concentrate around the bank ecosystem, the monitoring and protection of this data becomes an increasingly core aspect of a bank s operations and value proposition. Identity Behavior ME 2015 DELOITTE: New controls and tools will likely be needed to protect unbounded potential use cases while providing end-toend effectiveness according to what may be formal commitments in contractual service-level agreements McKINSEY: As a general goal, banks must integrate data instantaneously across disparate systems for immediate insights that increase choice and equip the customer to make smart, highly informed decisions all while maintaining security and privacy. Assets Transactions MONEY PRIVACY New & enhanced Conditional Differentiating Dynamic TRUST How banks need to adapt Base relationship Expected & given Undifferentiated Utilitarian Essence of the CUSTOMER RELATIONSHIP What banks have to secure The GAP is the difference between a customers subjective expectations versus the actual experience.

22 Overview APIs required for XS2A compliancy (indicative) Permission Admin APIs New Permission (TPP -> ASP) Permission Adjustment (TPP -> ASP) Permission Cancellation (TPP -> ASP) Permission Status Update (ASP -> TPP) Payment Initiation APIs Payment Transfer Instruction (TPP -> ASP) Payment Reservation Instruction (TPP -> ASP) Payment Cancellation (TPP -> ASP) Payment Status Update (ASP -> TPP) Account Information APIs Get Account Balance (TPP -> ASP) Get Account Statement (TPP -> ASP)

23 Challenges with absence of API standards End-users (consumers/businesses) x00 x,000 TPPs TPPs (AISP/PISPs) x,000 ASPs ASPs

24 Standardisation PSD2 APIs No official pan-european initiative for standardisation PSD2 APIs Banks in UK have decided to create an Open Banking Standard to standardise bank APIs including the XS2A APIs CAPS: Initiative from several market participants to define common PSD2 standards Vendor initiated open API initiatives, such as: Open Bank Project (Tesobe) Open Bank (Apigee/Google)

25 Scope of PSD2 : Functional component overview Account owner Account owner TPP Accounts Accounting Account info Account info Payment info Payments Fraud Detection Accounts Accounting Customer Channel Customer Channel API Channel XS2A Consent Payment info Payments Fraud Detection TPP = Third Party Provider XS2A = Access to account

26 Key impact areas XS2A for ASPs Account owner TPP 1 3 API Channel 5 Accounts Accounting Customer Channel Account info 4 Payment info Payments 1 Implementation of XS2A APIs Security of APIs requested by TPP 3 2 TPP permission management & validation XS2A Consent Fraud Detection Approval by account owner for TPP access Real-time payment processing (in particular debtor side). Also for all cross-border payments. 24x7 availability 5 Real-time balance check/debit posting 24x7 availability 6 Real-time fraud check 24x7 availability

27 Different business models CLEARING HOUSE RETAILER ASP CUSTOMER TPP

28 Overview PSD2 related IBM offerings PSD2 Impact and Readiness Assessment Strategy Development Strategy Digital Thinking & Design MobileFirst and Apple + IBM Digital Integration Factory Architecture Development Innovation & Delivery Industry Solutions IBM Bluemix IBM Technology Labs Device Management & Security Payment Gateway + Wallet Software & Accelerators Infrastructure PSD2 accelerator APIs Industry models PSD2 Cloud (IaaS, PaaS, SaaS) API Connect Financial Transaction Manager Safer Payments Security

29 Solutions Account owner TPP Account info Accounts Accounting Customer Channel API IBM API Connect XS2A Channel Consent Payment info IBM FTM Payments Fraud IBM Safer Payments Detection Shadow Accounts

30 Focusing on opportunities Rainer Pirker Bluemix Sales Leader CEE

31 remember them? Do Do youyouremember them?

32 is wherethey they are are nowadays ThisThis is where nowadays

33 Business challenge YES BANK sought to differentiate its brand and its products in the face of growing competition and the Indian customers growing demand for anytime-anywhere banking capabilities. Transformation In the API economy, any company is free to create customized, secure ecosystems that optimize the value of their services and data. The bank leverages IBM API Management software to create a framework for its own business ecosystem and drive its digital strategy, securely and transparently connecting customers with merchants via YES BANK APIs. Anup Purohit, Chief Information Officer, YES BANK Business benefits Extends market reach by exposing services to millions of India s unbanked population on mobile devices Exposes YES BANK Building an API ecosystem to enhance service and expand market reach Solution components IBM API Management software IBM DataPower Gateway IBM Integration Bus software IBM Mobile First software core business data and services securely to multiple strategic partners through APIs Reduces Headquartered in the Lower Parel Innovation District of Mumbai, YES BANK is the fifth largest private sector bank in India, with over 18,000 employees across the country s 29 states and 7 union territories. As of September 30, 2016 the bank operates more than 900 branches and 1700 ATMs nationwide. time required to add new strategic partners and exploit emerging revenue generating channels Share this BXP03021-USEN-00

34 Rabobank APIs for rapid innovation Strategic Intent To respond to changing market conditions, competition and the coming regulatory environment, Rabobank decided to launch into the API Economy and renew its value proposition to a new generation of bankers. Food & agriculture financing; retail bank Founded 1972 Netherlands Worldwide 1000 locations 13 billion revenues Needs & Solution An API solution to expose existing and new business services. Prepare for PSD2 regulations and a rapid innovation platform to meet changing requirements. Create a model to supply business services to trusted partners. Why IBM IBM s guidance and implementation skills for security, API Connect, and technicalities. Options for implementing API management for core business functions and on Bluemix to further innovation, rapid development, and hackathons. 2.5 million Dutch customers

35 Citibank Worldwide Prime and first mover Full service Founded 1812 New York City 220,000 group employees Worldwide operations $69.87 billion group revenues >100 million consumers Strategic Intent Soon after the financial crisis of 2008, Citibank saw an opportunity to become a digital bank in the persona of a fintech. Citi pioneered a strategic move into mobile banking, then into adopting APIs, and inviting external developers to contribute to its digital strategy. Citi chose to drive innovation through APIs and therefore is better prepared than most to comply with regulations and meet expectations. Needs & Solution Expose APIs to consumers and business partners to simplify digital interaction with the bank. Provide credit/debit card capabilities in a mobile phone. Create customer loyalty programs for partners and consumers. Link transactional data with key partner promotions (with location based offers). Expand mobile banking services including account look-up, transfer funds, bill payment. Why IBM Citi was an early customer of IBM API Management and has graduated to API Connect, showing its confidence of, and dependence on IBM s API vision and product roadmap. As a DataPower user, it was easy for Citi to decide on another IBM solution that built on and extended the value of DataPower. IBM s solution met Citi s need to scale and securely manage up to thousands of transactions per second.

36 Societe Generale Engaging creative developers Strategic Intent Execute a comprehensive API strategy for internal and external developers. Fence an ecosystem of developers and APIs which already generate over 250 million API calls per day across 80 APIs for mobile and web retail banking. International Retail, corporate, investment banking Founded 1864 Paris 146,000 employees 25.6 billion revenues Needs & Solution Link current APIs for the banks Open Banking Initiative with PSD2 directives. The bank continues to nurture and expand their B2B affiliations using micro-services with accompanying requirements for security and transaction integrity. Validate OAuth2 protocols using DataPower and external token generators. API solution for full life-cycle creation and management of APIs. Why IBM Societe Generale needed an enterprise grade solution which could be rolled out beyond the retail division. Successful PoC with DataPower to meet critical security requirements. Long time user of DataPower as a secure gateway, extended to the API use cases. 31 million customers

37 PSD2 Use Cases Retail payments Payment becomes integrated part of digital shopping experience Continuous digital interaction with customer Customer specific promotions and offerings Stronger customer intimacy through loyalty points Payment seamlessly integrated in customer buying experience Omni channel experience Online Store App

38 PSD2 Use Cases Retail payments Mobile ordering (avoid queueing) Pay with phone Earn and spend loyalty points (stars)

39 PSD2 Use Cases Retail payments Battle of Digital Touchpoint Video : New York Times - How China Is Changing Your Internet (

40 Instant Payments Szabó János Industry Solution Architect

41 Key challenges of Instant Payments for Banks Functional (application) related Non-functional related Real-time processing is fundamentally different from batch processing that is still applied by many legacy systems within banks. As a result, existing systems need to be modernized / replaced. Instant payments has much higher non-functional requirements in comparison with traditional batch-based (SEPA) payments processing : The following bank applications/systems are most impacted by this real-time aspect: Latency (< 2 seconds) 24/7 availability Channels and order management applications Absence of maintenance windows Payment (engine) application Scalability (unpredictable peaks with high volatility) Fraud screening application Fail-over and resilience Current account application Transactional integrity (commitment points) A different approach to the modernization for SEPA compliancy is needed for IP processing. These are the same (nothing has changed) Many of the legacy applications banks can t apply to these requirements and have fundamental shortcomings to be adjusted to meet these requirements. Going to real-time

42 Instant payments implies high non-functional requirements Originator Originate payment Debtor PSP CSM 3 sec Debit side processing 0.5 sec 10 sec Receive confirmation = Start timing service Confirmation processing 0.5 sec Creditor PSP 1 sec Interbank processing 0.5 sec Interbank processing 0.5 sec 2 sec Credit side processing 1 sec 1 sec = End timing service Note The draft EPC SCT Inst rulebook proposes an end-to-end latency of 10 seconds. Individual countries may apply more strict timelines fore the domestic instant payments. Key non-functional requirements 24x7x365 availability Continuation of service during maintenance windows and upgrades Low latency with payment timeout if exceeded High peaks in volumes expected (more than cards) up- and downwards scalability Support of multiple service levels (= latency) (Netherlands and possibly other countries will follow)

43 Sample process flow in FTM (outbound instant payments transfer) IBM Financial Transaction Manager Data Repository (configurations, master data, files/messages, payments/transactions, activity log, reports, ) Process Manager Payment Business Services 2 db db Integration Layer 1 Customer Channel Customer Fraud scan Account Mgnt. Account Mgnt. CSM Customer Channel Receipt payment instruction from customer channel 2. Determine process flow 3. Start process flow 4. Mapping into internal format 5. Validation of payment, registration in repository and start of execution process 6. Fraud check (performed by external system) 7. Check disposition and reserve funds 8. Determine clearing & settlement mechanism (CSM) 9. Submission payment to CSM 10. Process response from CSM 11. Update status in repository 12. Generate and post accounting entries 13. Submit notifications to debtor 14. End process flow db = Registration/update data in repository = Exception process flow Customer

44 FTM s agility makes it applicable for multiple areas in bank s payment domain Simplification (less applications and interfaces) Less duplication of data and functionality Easier to integrate and deploy Re-use of (service) interfaces (APIs) End-to-end visibility and control Business value Better omni-channel customer experience Higher quality of service Faster time to market Lower IT TCO (change and run) Improved operational efficiency

45 Overview FTM architecture with Instant Payments module FTM Payment Modules SEPA Instant Payments Corporate Payments ACH Checks Swift Order Management Interfaces Parameters Master Data Dash Board templates Operational Data Store Reporting templates WS MQ Cognos Rational Software Architect FTM Configurations Process Flows Business Rules Data Transformations Dash Boards Reports & BI If then else FTM Base Technical Components Process/State Manager Data Repository End User Console (UI) Integration Layer Parameterisation framework Technology Foundation WS Integration Bus WS Transformation Extender WS Business Activity Monitor DB2 (or Oracle) WS Application Server

46 Unique differentiator of FTM : Best-of-both-worlds FTM Instant Payments offers functional richness and completeness of package solution while at the same time keep the flexibility and openness of a build solution with no vendor lock-in. Source : Gartner s Buy-Assemble-Build continuum for payment system modernisation (Gartner, September 2013) Out-of-the box functionality of FTM UIs (configuration, track & trace, exception handling, ) Data repository (master data and transactional data) Process flows Data transformations (mappers) Business rules (e.g. validations) Dash boards Integration Reports

47 IBM Payment and FTM References IBM payments solutions are being deployed worldwide for payments initiatives at industry-leading FI s Executing 40% of the UK s credit transfers at a single bank Processing of instant payments for UK Faster Payments as well as Singapore G3/FAST payment scheme Processing over 25% of the worldwide SWIFT volume Proven scalability to over 4,000 transactions per second FTM products process over 1.2 billion transactions per month FTM is currently implemented at Federal Reserve Bank in US to process 50% of credit transfers in US with peak of 100 mio payments in one day (in production by 2018) FTM is currently implemented by two European CSMs for the intra-bank processing and settlement of SCT Inst

48 Real-time Fraud Detection Szabó János Industry Solution Architect

49 Overview IBM Safer Payments Comprehensive fraud management solution (analyse, define, detect, exception, report) Makes use of Cognitive technology to generate detection rules from production data analysis On average 17% better fraud detection rates and 3 times less false positives Acceleration of implementation timelines Unmatched throughput with ultra low latency (12,000 trx/sec with 2 milliseconds latency) One intuitive UI for all users and activities No limitations in terms of supported data sources Meets highest non-functional requirements (availability, performance, latency, resilience) Supports all types of multi-features (entities, currencies, languages, timezones, ) PCI-DSS compliant

50 Cognitive model generation Statistical Analysis Modelling Rules

51 Reference case : Carte Bancaire / STET 4,000 TRANSACTIONS PER SECOND

52 API Connect Rainer Pirker Bluemix Sales Leader CEE

53 How PSD2 is served by APIc TPP Self Service developer portal Create Run XS2A API Creation XS2A API Security XS2A API Lifecycle Management XS2A API Analytics Hybrid Deployment model for maximum scalability Full lifecycle API management Secure Manage Optional solutions for security, integration and platform services

54 Banks will need APIs to support third party providers What banks, acting as ASPs, must do to be compliant with PSD2 IBM s sample list of APIs per current EBA guidelines. The list will expand as more EBA rules are announced. Service subscription APIs New Subscription (TPP ASP) Subscription Adjustment (TPP ASP) Subscription Cancellation (TPP ASP) Subscription Status Update (ASP TPP) Payment Initiation APIs Payment Transfer Instruction (TPP ASP) Payment Reservation Instruction (TPP ASP) Payment Cancellation (TPP ASP) Payment Status Update (ASP TPP) Account Information APIs Get Account Balance (TPP ASP) Get Account Statement (TPP ASP) Account Statement Report (ASP TPP) 1. Purchase Merchant Buyer 2. Payment request 3. Payment instruction Payment Gateway 2. Payment request 4. Account statement 4. Account statement TP PISP (+ wallet SP) Merchant processor (PSP) 4. Payment instruction (API) 5. FI2FI transfer Buyer ASP 6. FI2FI transfer Credit transfer CSM PISP ASP PSP TPP Merchant ASP Payment Initiation Service Provider Account Service Provider Payment Service Provider Third Party Provider Transaction Flow Representation under PSD2

55 The place of API Connect Account owner TPP Account info Accounts Accounting Customer Channel API IBM API Connect XS2A Channel Consent Payment info Payments Fraud Detection

56 DEMO

57 API Connect: Topology Component View External App Partner App Developer Developer API Management Node2 Developer Portal1 Developer4 Toolkit Collective Controller5 Microservices Traffic Internal App Developer Mobile & Business Web Apps Partner Apps Data Store Microservices App Computer Runtime6 (Node.js/Java) API Gateway3 (DataPower/MicroGW) Enterprise Internet of Internal Apps Things Cloud Service API Traffic Application Server ESB / Middleware z System / Legacy Apps

58 IBM API Connect: Capabilities Rapid model-driven API creation Datasource to API mapping automation Standards-based visual API spec creation in Swagger 2.0 Local API creation and testing On-cloud & on-premises staging Create of APIs, Plans & Products Policy enforcement Enterprise security Quota management & rate limiting Content-based routing Response caching, load-balancing and offload processing Message format & transport protocol mediation Secure Run Manage Node.js & Java Microservice runtime Node.js & Java integrated runtime management Enterprise HA & scaling On-cloud & on-premises staging of Microservice applications API discovery API, Plan & Product policy creation API, Plan & Product lifecycle mgmt. Self-service, customizable, developer portal Advanced Analytics Subscription & community mgmt.

59 What the experts are saying Forrester, 4Q2016 API MANAGEMENT SOLUTIONS In 3Q2014, IBM was rated as a Strong Performer with an acknowledged speed to enhance its solution capabilities. Until 2016, IBM had been behind leaders like Apigee, CA Technologies, and Akana. The inflection point in 4Q2016 is accompanied by a market presence that dominates all competitors and a strong roster of customer logos across industries and geographies. Today, among its competitors IBM ranks: #1 Current Offering #1 Strategy #1 Market Presence Forrester would like to see improvements in API product definition and analytics. IBM is one of the leaders in portal richness, API product management, and API Economy vision.

60 What the experts are saying Gartner, December 2016 FULL LIFECYCLE API MANAGEMENT IBM has an established and powerful market position, with worldwide support capabilities, diversified geographical strategies across all industries. API Connect s embedded micro-gateway along with the stand-alone secure gateway gives customers implementation choices across all use cases, user types, and deployment instances. According to a May 2016 analysis by Gartner, IBM has more licensing options than its competitors. Gartner suggests that IBM s wide portfolio of software offerings may add to cost and complexity of integrations. [PoV - This is neither reasonable nor logical: backwards and forwards integration is required with any mix of vendor applications. Second, while IBM software is mostly SOA-style decoupled, integrating with IBM software is easier due to open standards, adapters, protocols, and development methods. Third, cost and complexity are predicated on scope and customer strategies should play out over time.]

61 IDC September 2016 IBM growing 1.6x faster than the market IBM is #2 in market share, just 0.3% away from top spot IBM growing 1.7x faster than leading vendor IBM growing 3.5x faster than next closest vendor API MANAGEMENT SOLUTIONS What the experts are saying IDC & Ovum 2016 OVUM April 2016 for outlook IBM s compelling end-to-end API management capabilities IBM s simple extension of integration capabilities for a range of use cases Only few vendors (like IBM) can provide an extensive set of capabilities for supporting digital business initiatives

62 IBM Integration Bus: Satisfying PSD2 Requirements IIB is designed to integrate both with API Connect and z/os Connect, giving clients the flexibility and choice to expose REST APIs for PSD2 DMZ Packages (SAP, PeopleSoft) Adapter SOAP/HTTP External Services Process MQLight/AMQP External Developer communities MQ File MQLight/AMQP IBM Integration Bus REST/HTTP SaaS Endpoints IBM DataPower Gateway SOAP/HTTP SOAP/HTTP Data ODBC/JDBC Apps MQ / JMS Legacy File REST/HTTP MQ / JMS REST/HTTP Internal developers REST/HTTP API Connect Partners REST/HTTP z/os Connect REST/HTTP z/native z Systems CICS / IMS / Z SOAP/HTTP

63 IBM Bluemix: Integrating Banking into the Cloud ecosystem Console to enforce runtime policies, monitor &control API traffic Next Gen App Existing Bank SOA services Cloud-native digital extensions PSD2 / XS2A Third party APIs (Fintechs) Digital Systems IBM API Connect Apps/Services in Java, NET, Cobol, etc.

64 API Monetization Options Rainer Pirker Bluemix Sales Leader CEE

65 Approaches to opening APIs to ecosystem Private API Accessible within the bank, limited to one s organization (scoped to LoB or enterprise) Partner API Based on bilateral agreements (eg. B2B) Member API Available to community members (eg. A registered third party provider can use PSD2 account information and payment initiation APIs) Acquaintance API Public API Open to everyone complying with a set of pre-defined reqts (eg. Retailer POS APIs) Open to everyone, typically with basic registration (eg. branch, ATM locator, product information, interest rates)

66 The Business of APIs For Free Developer Pays Drives Adoptions of APIs Business Asset must be of high value to the Developer Typically low valued assets For example, marketing Drive brand loyalty analytics, news, Enter new channels Capabilities such as credit Gaining reach checks Example: Example: Facebook Login API provides free authentication for any Web / mobile app IBM Bluemix Developer Cloud No cost trials, pay per use, scale up and down Transactional Usage of API generates revenue on a per transaction or transaction tiers model Often a freemium model: Product sell The monetization model is dependent on the sale of the products and services to the consumer The revenue is free at low volumes, with paid tiers beyond a threshold, or Premium quality of service generated by fixed fees Example: Example: Google AdSense APIs pay developers who include advertising content into apps Airbnb charges for occupied inventory, duration of a stay and services availed during the stay API Monetization Understanding Business Model Options

67 Business cases for API Economy Rainer Pirker Bluemix Sales Leader CEE

68 Ratnakar Bank (RBL Bank) Introduction of APIs as standardinterfaces Self Maintenance and -documentation IBM DataPower Gateway acts as First line of defence and API Gateway API Connect is used as standard Development Platform for APIs The multi-tenant API Portals make onboarding of internal/external/partner Developers easy and fast

69 RBL Bank architecture

70 Citi Developer Hub

71 BBVA

72

73 API how Bank can use it Mobile Backend Clients Ecosytem Internal Innovation Partners Ecosystem Transactions Distribution API as a business Content Distribution

74

75 Legal Disclaimer IBM Corporation All Rights Reserved. The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. If the text contains performance statistics or references to benchmarks, insert the following language; otherwise delete:performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon many factors, including considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve results similar to those stated here. If the text includes any customer examples, please confirm we have prior written approval from such customer and insert the following language; otherwise delete:all customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Please review text for proper trademark attribution of IBM products. At first use, each product name must be the full name and include appropriate trademark symbols (e.g., IBM Lotus Sametime Unyte ). Subsequent references can drop IBM but should include the proper branding (e.g., Lotus Sametime Gateway, or WebSphere Application Server). Please refer to for guidance on which trademarks require the or symbol. Do not use abbreviations for IBM product names in your presentation. All product names must be used as adjectives rather than nouns. Please list all of the trademarks that you use in your presentation as follows; delete any not included in your presentation. IBM, the IBM logo, Lotus, Lotus Notes, Notes, Domino, Quickr, Sametime, WebSphere, UC2, PartnerWorld and Lotusphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Unyte is a trademark of WebDialogs, Inc., in the United States, other countries, or both. If you reference Adobe in the text, please mark the first use and include the following; otherwise delete:adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. If you reference Java in the text, please mark the first use and include the following; otherwise delete:java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. If you reference Microsoft and/or Windows in the text, please mark the first use and include the following, as applicable; otherwise delete:microsoft and Windows are trademarks of Microsoft Corporation in the United States, other countries, or both. If you reference Intel and/or any of the following Intel products in the text, please mark the first use and include those that you use as follows; otherwise delete:intel, Intel Centrino, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. If you reference UNIX in the text, please mark the first use and include the following; otherwise delete:unix is a registered trademark of The Open Group in the United States and other countries. If you reference Linux in your presentation, please mark the first use and include the following; otherwise delete:linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. If the text/graphics include screenshots, no actual IBM employee names may be used (even your own), if your screenshots include fictitious company names (e.g., Renovations, Zeta Bank, Acme) please update and insert the following; otherwise delete: All references to [insert fictitious company name] refer to a fictitious company and are used for illustration purposes only.

76 Legal

77 Article 97 - Authentication Article 5. Member States shall ensure that the account servicing payment service provider allows the payment initiation service provider and the account information service provider to rely on the authentication procedures provided by the account servicing payment service provider to the payment service user in accordance with paragraphs 1 and 3 and, where the payment initiation service provider is involved, in accordance with paragraphs 1, 2 and 3. 77

78 Scope of Application The subject matter deals with providing the legal foundation for the creation of an EU/EEA wide single market for payments. Directive covers the following categories of payment service providers ( PSPs ): PSD II contains 117 Articles and covers a number of payment services: Enabling cash deposits and withdrawals Execution of credit transfers, standing orders and direct debits Credit institutions E-Money and payment institutions Post office giro institutions European Central Bank (ECB) and national central banks Payments through cards or similar devices Issuing of payment instruments Money remittances Payment initiation services Account information services PSD II is applicable to: Transactions where at least one of the payment service providers is located inside the EU/EEA Transactions in all official currencies, including non-eu currencies

79 Exemptions Exclusion of specific payment instruments: Cash payments (direct) Cheques Payments between PSPs for their own account Payments between parent companies and subsidiaries, or between subsidiaries of the same parent (no PSP involved) Payments within a payment or securities settlement system between PSPs, settlement agents, central counterparties, clearing houses and/or central banks, and others Payments relating to securities asset servicing, including dividends, income or other distributions, or to redemption or sale, or payments by investment firms, credit institutions, collective investment undertakings or by asset management companies and other entities having custody of financial instruments.

80 Sanctions PSD II requires MS to align their administrative sanctions, to ensure that the appropriate administrative measures and sanctions are in place for breaches of PSD II provisions and to ensure that these sanctions are duly applied. MS are required to lay down effective, proportionate and dissuasive penalties. Competent authorities will have the right to take appropriate administrative measures and impose administrative sanctions where a PSP breaches duties imposed by the PSD II.