ASEAN banks face a loyalty and ecosystem governance shift

At a glance

What this is: This is Comarch’s analysis of how ASEAN banks are being pushed toward lifestyle ecosystems that combine third-party services, behavioral data, and daily-use engagement to compete with super apps.

Why it matters: It matters because the operating model change pulls IAM, partner governance, and data access into the same control plane for banking ecosystems, not just customer experience teams.

Context

ASEAN banks are facing a structural shift in how digital banking platforms are judged. The article argues that transaction processing is no longer enough, and that banks must become lifestyle ecosystem orchestrators if they want to stay relevant to customers who increasingly use super apps for everyday activity.

In IAM terms, the problem is that this model widens the governance boundary. A bank that embeds travel, e-commerce, health, ride-hailing, or ESG features is no longer managing only internal users and customer authentication. It is also governing partner access, data sharing, and the trust relationships that make the ecosystem usable without creating uncontrolled exposure.

Key questions

Q: How should banks govern third-party services inside a lifestyle ecosystem app?

A: Banks should govern embedded services the same way they govern privileged access paths. Every partner should have a named owner, a defined data scope, a revocation path, and a review cadence. If a service can influence customer journeys or consume behavioural data, it needs lifecycle controls, not just procurement approval.

Q: Why does a lifestyle ecosystem increase access and data risk for banks?

A: It increases risk because every added service creates another trust relationship, another data path, and another potential exception to the bank’s normal controls. The more the app becomes a daily-use hub, the more attractive it is to expand access for personalisation, and that is exactly where governance pressure starts to build.

Q: What breaks when broker and partner access is not lifecycle-managed?

A: Access drifts away from the business relationship that justified it. Broker and partner accounts can retain privileges after onboarding changes, contract changes, or offboarding events, leaving the organisation exposed to unnecessary access and weak audit evidence. In practice, this creates compliance gaps even when authentication itself is sound.

Q: What is the difference between a transaction bank and a lifestyle ecosystem?

A: A transaction bank primarily processes deposits, payments, and lending, while a lifestyle ecosystem also brokers third-party services, behavioural data, and everyday engagement. The governance difference is that the ecosystem model adds partner identity, data-sharing, and delegated access control to the bank’s core operating model.

Technical breakdown

Why lifestyle ecosystems expand the identity perimeter

A banking lifestyle ecosystem is not just a mobile app with more features. It is a composite service model where the bank brokers access to external services, consumes more behavioural data, and exposes APIs or embedded workflows to partners that were previously outside the core banking boundary. That means identity governance now extends into third-party authentication, entitlement boundaries, and lifecycle control for partner integrations. The key technical issue is not just who can log in, but which services can act on behalf of the bank, which data they can read, and how their access is reviewed or removed over time.

Practical implication: treat ecosystem partners as governed identities and map each integration to its own access, ownership, and offboarding model.

Behavioral data changes the access-risk equation

The article ties ecosystem value to high-frequency behavioural and intent data. That matters because the more a bank personalises offers or surfaces adjacent services, the more sensitive the underlying access pathways become. Data that supports proactive recommendations can also reveal financial habits, location patterns, and lifestyle signals, so access control and data governance cannot be separated. The operational question is whether the bank can constrain partner visibility to the minimum needed for service delivery while still supporting personalisation and cross-sell logic.

Practical implication: classify behavioural and intent data as a governed asset, then limit each partner to the narrowest data view required for its function.

Super app competition creates control sprawl

The article’s competitive premise is that banks are losing customer mindshare to platforms such as Grab, WeChat, and Gojek because those ecosystems become the primary interface for daily tasks. From an identity perspective, that creates pressure to move faster by adding services and partners, which often produces control sprawl before governance catches up. The risk is not only more integrations, but more exceptions, more shared data paths, and more ambiguous accountability for third-party access inside a banking environment.

Practical implication: establish a partner governance model before expanding the ecosystem, so speed does not outpace access review and data-sharing controls.

Threat narrative

Attacker objective: The objective is to reach valuable customer data or trusted customer-facing pathways through a partner-rich banking ecosystem.

1. Entry occurs through the bank’s expanding ecosystem boundary, where third-party services, embedded partners, or external data sources become part of the customer experience.
2. Privilege escalation follows when those integrations receive broader data access or workflow authority than the specific use case requires.
3. Impact emerges as customer data, engagement channels, or partner workflows become harder to govern, making the ecosystem more attractive but also more difficult to control.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Banking ecosystem governance is now identity governance by another name. Once a bank turns its app into a daily-use orchestration layer, it is no longer just managing customer sessions. It is governing third-party access, delegated data use, and the lifecycle of partner integrations across a much wider estate. The practical conclusion is that loyalty strategy and identity strategy can no longer be run as separate programmes.

Partner access without lifecycle discipline becomes the hidden failure mode. The article’s lifestyle ecosystem model depends on third-party services being present inside the bank’s digital experience, but that same presence creates persistent access paths if onboarding and offboarding are not tightly controlled. This is the same structural problem seen in third-party NHI exposure: access is granted for convenience and then outlives its original purpose. Practitioners should treat ecosystem growth as a governance load, not just a product roadmap.

Behavioral data turns consumer experience into a higher-stakes authorisation problem. When banks use activity signals for personalisation, cross-sell, or ESG incentives, they create more reasons for partners and internal teams to request broad access to customer data. That widens the blast radius of every integration decision. The implication is that access policy, data minimisation, and partner accountability must be designed together.

Primary-interface competition is reshaping the market’s control assumptions. Super apps are winning because they own daily engagement, not because they merely offer payments. Banks that respond by adding services without matching governance will increase complexity faster than they increase control. The market is moving toward ecosystem orchestration, but the identity security question remains the same: who gets access, to what, and for how long?

Unified Hub is really a control-plane problem. The article’s orchestration model only works if the bank can unify service discovery, partner governance, and customer data use without creating unmanaged trust edges. That makes this a control-plane design issue, not a loyalty campaign issue. Practitioners should expect more scrutiny of third-party access, entitlement boundaries, and data-sharing accountability as these ecosystems mature.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Banking lifestyle ecosystems are a governance expansion, not just a commercial strategy. The bank that embeds third-party services into its app is also expanding the number of identities, entitlements, and data paths it must govern. That makes third-party access discipline a core part of customer experience design, not an afterthought.

Partner lifecycle control will become the deciding control for ecosystem banking. If an integration remains live after its original purpose has passed, the bank inherits unnecessary trust exposure. The practical question for IAM and IGA teams is whether they can recertify and remove ecosystem access as quickly as they can launch it.

For practitioners

• Map every ecosystem partner to a governed identity Inventory each external service embedded in the banking experience, then assign ownership, access scope, and offboarding criteria before the partner is exposed to customer journeys.
• Separate customer data classes by use case Define which behavioural, transactional, and intent signals can be used for personalisation, analytics, or partner workflows, and restrict partner visibility accordingly.
• Set lifecycle controls for partner integrations Tie onboarding, recertification, and removal to a formal partner lifecycle so access does not persist after a service stops being relevant to the business need.
• Review delegated access against daily-use workflows Check whether any integration can read or trigger more customer activity than the use case requires, especially where the service is embedded into a high-frequency interface.

Key takeaways

• ASEAN banks are being pushed into ecosystem models that widen identity and data governance beyond the traditional banking perimeter.
• The core risk is not the presence of more features, but the growth of partner trust edges, delegated access, and behavioural data sharing.
• Banks that want daily customer relevance will need lifecycle-managed partner access and tighter data minimisation, or the ecosystem will outgrow their controls.

Key terms

• Banking lifestyle ecosystem: A banking model where the app becomes a hub for non-financial services as well as financial ones. The security implication is that identity, consent, and third-party access are now part of the customer experience, so governance has to cover partner services, shared data, and delegated control paths.
• Partner Identity: A partner identity is a non-human identity created for an external client, service, or organisation that needs API access. It usually depends on client registration, certificates, tokens, and policy bindings, which makes lifecycle control more important than one-time authentication.
• Behavioral Data Minimisation: The practice of limiting how much customer behaviour data is exposed, retained, or shared across services. For banking ecosystems, it means using only the data required for personalisation or service delivery and preventing partner integrations from inheriting broader visibility than necessary.
• Customer Mindshare: The share of a customer’s attention and routine digital activity captured by a platform. In identity and access terms, it matters because a platform that becomes the daily interface tends to accumulate more integrations, more delegated access, and more governance pressure over time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.