FiDA - The New Data Regulation in Financial Services

What is FiDA? 

FiDA, or regulation on access to financial data, is a major legislative advancement within the framework of Open Finance. Its main goal is to ensure more transparent and secure access to consumers' financial data, whether individuals or businesses, to facilitate a wide range of financial services.

This legislation aims to enhance consumer autonomy by providing them with full control and increased transparency over the use of their financial data. Through FiDA, consumers will have simplified access to their financial information through various channels, offering a clear view of their financial situation.

The Data Sharing Challenges FiDA Aims to Address

FiDA aims to resolve issues related to access and reuse of consumer data, with the goal of improving financial information and providing higher-quality financial products and services to consumers. While most consumers are willing to share their data in exchange for enhanced services, several obstacles hinder them:

• Lack of a clear framework: Consumers lack the necessary tools and rules to effectively manage data sharing permissions.
• Lack of control: Many consumers feel they have little control over the use of their data.
• Concerns about cybersecurity: Privacy protection and data security during sharing remain major concerns.

Moreover, the absence of regulation and oversight of the parties handling this data exposes consumers to significant risks, highlighting the need for stronger control and regulation. Finally, the lack of standardization in data and technical infrastructures leads to additional costs and complicates data sharing, resulting in significant variability in the available information.

A Broader Scope to Ensure Effectiveness

It is crucial that the regulation covers a wide range of customer data from the outset, so that all sectors of financial services can benefit from technological advancements. However, according to a report by ECON, some data, such as health and medical coverage data, would be excluded from the scope. By omitting products like life insurance, this report could limit the options available to users, thereby depriving them of useful and innovative services. Currently, the GDPR imposes strict restrictions and requires explicit consent for the processing of sensitive data, including insurance-related information. This framework is sufficient to ensure the protection of consumers who choose to share information related to their insurance policies, while encouraging innovation in this sector.

Timeline, Scope, and Requirements of FiDA

On April 18, 2024, the ECON committee of the European Parliament adopted the report on FiDA, incorporating several positive elements from the European Commission's initial proposal. This report expands access to financial data, going beyond just payment accounts. It allows customers to consent to the use of their data for the creation of personalized financial products. This framework also supports small businesses by reducing entry barriers, stimulating competition, and encouraging innovation. Consumers will retain control over their data, and its use will require explicit consent. Responsible parties will also be held accountable in case of non-compliance with the rules. Access to data will be facilitated through high-quality technical interfaces, and fair compensation will be provided to data holders. The European Banking Authority will oversee authorized service providers and access mechanisms.

The rollout of FiDA will occur in several phases. Initially, regulatory authorities will develop specific guidelines, followed by consultations with stakeholders. Deadlines will then be set to ensure compliance. Financial institutions and data intermediaries will need to adapt their systems to meet the regulatory requirements.

FiDA covers a wide range of players in the financial sector, including banks, payment service providers, insurance companies, and fintechs. These entities will need to implement rigorous controls to access data, ensuring compliance with the regulation. Additionally, they will need to demonstrate that they have obtained explicit consent from customers and that data sharing adheres to the legal boundaries established.

Compliance requirements will include the use of secure APIs, encryption of shared data, and robust systems for managing customer consent. FiDA will also enforce strict data retention, monitoring, and reporting processes to ensure greater accountability and transparency across the financial ecosystem.

Types of Data and Entities Covered by FiDA Regulation

The scope of the FiDA proposal includes specific categories of customer data related to mortgage loan contracts, investments, retirement rights, non-life insurance products (excluding health/medical insurance), and data used to assess the solvency of businesses. It also applies to entities that hold or use this data, including various financial institutions, cryptocurrency asset service providers, and insurance intermediaries. The goal is to cover a wide range of data and entities, excluding only data related to life, health, and medical insurance.

The definitions used in this regulation are deliberately broad and inclusive. In particular, the definition of "customer data" is crucial as it determines the types of data to be collected and influences the implementation of other aspects of the proposal. "Customer data" is defined as both personal and non-personal data, collected, stored, and processed by a financial institution as part of its normal activities with customers, encompassing data provided directly by the customer as well as that generated through their interaction with the institution. 

This broad approach aims to offer equal and unrestricted access to the data of EU citizens, thereby fostering a transparent and non-discriminatory data-sharing environment. Such a definition of customer data will encourage innovation, both in existing use cases and in new areas to explore. This expanded data sharing could drive innovations across various financial categories, covering the entire financial life of a citizen, with the exception of life, health, and medical insurance products. 

However, the current proposal leaves the possibility open to include these insurance products in the FiDA framework in the future, once it is proven that their sharing is secure for the average European citizen.

As for the entities involved, FiDA applies to both established players and new entrants in the financial sector. This includes insurance and reinsurance companies, insurance brokers, pension providers, investment firms, third-party payment service providers, fund managers, credit and payment institutions, credit rating agencies, and companies in the crypto-asset sector.

Financial Data Sharing Schemes under FiDA

Financial data sharing schemes refer to the alliances between data holders and users, and define the terms for sharing these specific data or accounts. While FiDA provides a legal basis for sharing financial data, notably through its articles on scope and definitions, it does not go into practical details, leaving much of the decision-making to the schemes and their participants (data holders and users).

As stakeholders directly involved in real-world use cases, we know that data sharing is a complex challenge. It requires the different parties to agree on common standards, formats, and protocols, among other things. This process can be even more difficult when major financial institutions (i.e., data holders) must collaborate to define the organization of these exchanges, as each institution is powerful and attached to its own practices. This represents an ambitious requirement from FiDA for data holders.

To ensure the success of this process, several key elements must be incorporated into the schemes:

• Strong and independent governance.
• A fair balance of power among all members.
• Clearly defined procedures and processes.
• Strict deadlines, set by the central entity responsible for implementing data sharing.

Without these structural elements, it could be difficult for data holders to know where to start.

How Can Data Sharing Schemes Work in Practice? 

It is important to note that the main complexity of data sharing often lies in defining common standards that data holders must follow. Two approaches can be considered to address this issue:

1. Data Holders Manage the Entire Process:

In this approach, currently proposed under FiDA, all data holders come together in a scheme and collectively determine how to structure the data to be shared. Typically, in these scenarios:

• The use case is clearly defined.
• The necessary participants for data standardization are well identified.
• Strong governance is in place to facilitate compromises between the parties.

In this model, data holders take on the complex part of the work, while data users have a relatively simple task: to access and use the standardized data made available to them.

However, past experience shows that such efforts can take several years. For example, a standardization initiative led by the EMA (European Medicines Agency) with its IDMP program lasted over 10 years, even though it was supported by existing ISO standards. This illustrates how powerful data holders can slow down a standardization process initially planned to last 3 to 5 years.

2. Data Users Manage the Entire Process:

In this approach, the reverse of the previous one, data schemes are formed optionally. Data holders have a minimal responsibility: to make the data accessible in any format and via any interface in real-time, as long as data users can access it.

In this model, it is the data users who take on the workload of collecting the data from each holder and standardizing it in a way that makes it usable for their use cases. Data users thus bear the entire process in this scenario.

Long-Term Schemes Led by Data Holders: A Possible Future? 

At RollingFunds, we envision a future where data holders will forge schemes, likely for specific use cases, and provide high-quality APIs with standardized data. This will likely materialize for the most common use cases in contexts where there is an obvious incentive to do so, such as KYB processes or B2B BNPL (Buy Now Pay Later).

For example, if data holders are also the main users for a certain use case, they could significantly reduce market costs by offering a schematic API with already standardized data. In this case, data users would no longer have to bear the costs or efforts of standardization, as the data they would receive would already be ready for use.

This approach would provide a much more realistic basis for data holders to determine the cost of a service, compared to a situation where they would be forced to make estimations, as in the first scenario.

What is the FiDA Permissions Dashboard? 

The FiDA Permissions Dashboard is a key tool introduced by the regulation. It is a user-friendly interface that allows users to manage their data-sharing permissions between different financial institutions and third-party providers.

With this dashboard, consumers can view which companies have access to their data, revoke this access at any time, and set limits on how long their data can be shared. This provides consumers with direct control over their information, thereby strengthening trust in digital financial services. Moreover, the dashboard facilitates tracking of data usage and ensures compliance, contributing to the protection of users' personal data.