ASEAN banks face a loyalty and ecosystem governance shift

At a glance

What this is: ASEAN banks are reframing loyalty around lifestyle ecosystems, where daily utility and third-party integration replace traditional cashback-led engagement.

Why it matters: For IAM practitioners, the model expands identity and access governance into partner services, API-driven journeys, and data-sharing controls that now sit inside the customer experience.

👉 Read Comarch's article on banking lifestyle ecosystems and loyalty strategy

Context

The core issue is not loyalty design alone, but control of the customer interface. ASEAN banks are being pushed to embed third-party services into one digital journey, which means access, data use, and partner trust become part of the product, not just the security layer.

In practical terms, a banking app that behaves like a lifestyle hub changes the identity governance surface. Service integrations, consent handling, and behavioural data flows now matter to IAM, NHI, and lifecycle governance teams because the bank is no longer only protecting transactions, it is orchestrating an ecosystem.

Key questions

Q: How should banks govern third-party services inside a lifestyle ecosystem app?

A: Banks should govern embedded services the same way they govern privileged access paths. Every partner should have a named owner, a defined data scope, a revocation path, and a review cadence. If a service can influence customer journeys or consume behavioural data, it needs lifecycle controls, not just procurement approval.

Q: Why do lifestyle ecosystems increase identity and access risk for banks?

A: They increase risk because the bank no longer controls every identity and control point in the customer journey. APIs, delegated tokens, partner credentials, and shared data flows all become part of the trust chain. That expands the impact of any compromise and makes revocation and oversight harder to enforce consistently.

Q: What do banks get wrong about personalization in ecosystem banking?

A: They often treat personalization as a product feature instead of a governed access and data-use decision. Once behavioural signals are used to drive offers, scoring, or cross-sell, the bank must define purpose, retention, and partner reuse limits. Without that, personalization becomes uncontrolled data propagation.

Q: Who is accountable when a partner service embedded in a bank app fails?

A: The bank remains accountable to the customer, even when the service is operated by a third party. That means contracts alone are not enough. Security, IAM, legal, and product teams need joint ownership of access scope, offboarding, incident response, and customer-impact review before integration goes live.

Technical breakdown

Banking lifestyle ecosystems and the identity boundary

A banking lifestyle ecosystem is a model where the bank becomes the front door to non-bank services such as travel, commerce, or health. Technically, that collapses the old boundary between core banking and external service access. Identity is no longer limited to customer login and internal staff administration. It now extends to partner APIs, delegated authorisation, token exchange, and data-sharing consent across a broader trust chain. The security challenge is that the customer experience depends on identities the bank does not fully own, but still must govern.

Practical implication: Map every partner integration to a named owner, a lifecycle state, and a revocation path before it is exposed in the customer app.

Why behavioural data changes access governance

The article’s value proposition depends on behavioural and intent-based data, not just transaction data. That creates a governance problem because the data used to personalise offers, scoring, and journey orchestration may be collected, processed, and reused across multiple services. In identity terms, the question is not only who can log in, but which systems can act on customer context, infer intent, and exchange attributes across domains. Once data becomes a control input, access policies must account for purpose limitation, third-party sharing, and downstream reuse.

Practical implication: Classify behavioural data flows as governed assets and tie them to explicit access, retention, and sharing controls.

Super app competition raises third-party risk pressure

The competitive logic in the article is that banks must match the convenience of non-bank super apps. That usually means faster onboarding, more integrations, and more delegated access. Every one of those design choices expands the attack surface for partner compromise, token abuse, and overbroad service permissions. The identity lesson is simple: when orchestration becomes the product, third-party trust becomes a security dependency, not a procurement detail. Governance needs to follow the delegation chain, not just the bank perimeter.

Practical implication: Treat partner integration reviews, credential scope, and offboarding as product controls, not periodic vendor checks.

Threat narrative

Attacker objective: The objective is to abuse the broader trust chain around ecosystem integrations in order to reach customer data, service access, or persistent interaction pathways.

1. Entry occurs through the expanded ecosystem boundary, where third-party services and shared interfaces create more places for trust to be extended outside the bank’s direct control.
2. Escalation happens when partner access, customer context, and behavioural data are combined across services, increasing the blast radius of any token, API, or integration failure.
3. Impact is loss of governance over customer trust, with the bank reduced to back-end infrastructure while the ecosystem layer controls interaction, data leverage, and retention.

Breaches seen in the wild

• LiteLLM PyPI package breach — LiteLLM PyPI supply chain attack, credentials stolen from users.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is becoming a product design issue, not a back-office control. When a bank embeds e-commerce, travel, or health services into its app, access decisions move into the customer journey itself. That means entitlement scope, partner onboarding, and offboarding now shape market trust as much as security posture. The practitioner conclusion is that identity teams have to govern the orchestrator, not only the bank core.

Behavioural data turns the ecosystem into a governance problem. The article treats data as the asset that unlocks personalization and cross-sell, but that only works if customer context can move safely across services. Once identity and data are fused this way, the bank must control not just login, but who can act on intent signals, when those signals expire, and which partners may reuse them. Practitioners should treat data-driven personalization as a governed access path.

Third-party access without lifecycle discipline is the hidden failure mode in ecosystem banking. The model assumes partners remain trustworthy for as long as the customer journey depends on them. That assumption fails when onboarding is fast, relationships change, or service scope expands faster than revocation and review processes can keep up. The implication is that offboarding, recertification, and token scope review must move into the same operational cadence as product release.

Customer mindshare is now coupled to identity assurance. Banks that want to be the primary interface must prove that delegated access, consent, and service integration are controlled consistently across the ecosystem. This is where IAM, PAM, and NHI governance converge: if the bank cannot govern the identities behind the experience, it will lose the trust required to own the experience. Practitioners should align governance with the bank’s orchestration model, not its legacy channel model.

From our research:

• Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant behaviour gap in day-to-day control execution.
• For lifecycle-heavy environments, The 52 NHI breaches Report is the natural next step for understanding how access governance failures become real incidents.

What this signals

Platform banking is turning identity governance into an ecosystem discipline. The issue is no longer whether a bank can authenticate a customer, but whether it can govern every delegated identity, partner token, and shared data flow that makes the experience work. That is where lifecycle controls, scope review, and offboarding become product constraints rather than security afterthoughts.

Customer trust now depends on the bank’s ability to control reused context. Once behavioural data begins to move across services, the organisation needs stricter rules on purpose limitation and retention. Banks that cannot explain where customer context goes, who can act on it, and when it expires will struggle to sustain the loyalty model the article describes.

With 32.4% of security budgets already going to secrets management and code security in one recent study, the direction of travel is clear: banks will keep spending on control points that secure integration paths, not just user login. The governance question is whether those investments are aligned to ecosystem orchestration or still trapped in legacy channel thinking.

For practitioners

• Inventory every ecosystem integration List each third-party service embedded in the banking app, the identity it uses, the data it can access, and the business owner responsible for revocation and review.
• Separate customer context from reusable attributes Define which behavioural and intent signals may be consumed for personalisation, which may be shared, and which must remain confined to the originating service.
• Apply lifecycle controls to partner access Tie partner onboarding, recertification, scope review, and offboarding to the same governance calendar used for high-risk internal access.
• Model delegated trust as an attack surface Assess APIs, tokens, and service-to-service permissions as part of the bank’s identity perimeter, then reduce standing access wherever possible.

Key takeaways

• Banking lifestyle ecosystems shift the identity problem from customer login to delegated trust across partners, tokens, and shared data flows.
• The main governance gap is not rewards design, but lifecycle control over third-party access and behavioural data reuse.
• Banks that want to own the customer interface must align IAM, NHI, and partner offboarding with the ecosystem operating model.

Key terms

• Banking lifestyle ecosystem: A banking model where the app becomes a hub for non-financial services as well as financial ones. The security implication is that identity, consent, and third-party access are now part of the customer experience, so governance has to cover partner services, shared data, and delegated control paths.
• Unified hub: An operating model in which the bank acts as the central interface for daily services instead of only a financial utility. In identity terms, the hub creates a broader trust chain that includes partner identities, service permissions, and lifecycle controls across many integrated journeys.
• Delegated trust: Access that a bank extends to another service or system so that it can act within the customer journey or process shared data. Delegated trust is legitimate only when its scope, duration, and revocation path are explicit. Otherwise, it becomes a persistent control gap across the ecosystem.
• Behavioural data governance: The rules that determine how intent signals, usage patterns, and customer interactions are collected, shared, retained, and reused. This matters because personalization and cross-sell depend on data movement across services, which must be controlled for purpose limitation and accountability.

What's in the full article

Comarch's full article covers the commercial and loyalty-program detail this post intentionally leaves at the strategy layer:

• How the Unified Hub model is positioned for ASEAN banking loyalty programmes
• Examples of ESG-linked rewards and values-based banking features
• The vendor's discussion of customer retention, mindshare, and daily-use engagement
• Quoted perspectives from banking and loyalty leaders on programme evolution

👉 Comarch's full article expands on the loyalty model, customer mindshare angle, and ecosystem positioning.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or governance in your organisation, it is worth exploring.