TL;DR: Brazil’s credit portability pilot is showing how consent-based APIs, accredited participants, and regulated settlement can move loan transfers from weeks to as little as five days, with Open Finance Brasil already processing more than 102 billion API calls and nearly 62 million active consents in 2024 according to Raidiam. The governance lesson is that portability at scale depends on identity assurance, not just cleaner workflows.
At a glance
What this is: This article explains how Brazil’s credit portability pilot uses open finance controls to speed loan transfers while tightening participant trust and consent governance.
Why it matters: It matters because IAM, NHI, and platform security teams need to see open finance as an identity governance problem, not only a workflow or API integration exercise.
By the numbers:
- Open Finance Brasil processed more than 102 billion API calls in 2024.
- Open Finance Brasil registered nearly 62 million active data-sharing consents in 2024.
- The credit portability pilot launched with 26 leading financial institutions participating in closed-environment tests.
Context
Credit portability in open finance is a governed transfer process, not just a faster loan refinance journey. The central problem is how to let multiple institutions exchange financial data and execute settlement without weakening identity assurance, consent integrity, or participant accountability.
Brazil’s pilot matters because it combines regulated APIs, accredited participants, and settlement controls inside a national open finance model. That makes it a useful case study for IAM teams, because the security question shifts from who can log in to who can lawfully act across organisations, APIs, and delegated consent.
Key questions
Q: How should banks govern credit portability across multiple participants?
A: Banks should govern credit portability as a cross-organisation identity and consent workflow, not a simple API integration. That means every participant needs validated accreditation, every request needs scoped consent, and every settlement step needs traceable accountability. The control objective is to keep lawful access aligned across the full portability path.
Q: Why does open finance credit portability increase governance risk?
A: It increases governance risk because the same customer action can be executed by multiple accredited parties across shared APIs and regulated settlement. If participant trust, consent scope, or exception handling is weak, the ecosystem can scale errors faster than manual controls can catch them.
Q: What breaks when consent is not linked to settlement controls?
A: The portability process breaks when consent is treated as a front-end approval but settlement is handled as a separate operational step. In that case, the organisation may be able to prove that a request was made, but not that the final credit transfer stayed within the original authorisation boundary.
Q: What should teams do when an open finance participant loses accreditation?
A: Teams should revoke that participant’s ability to initiate or continue portability actions and confirm that no in-flight request can reach settlement on stale trust. Accreditation has to be treated as a live condition, not as a permanent onboarding event.
Technical breakdown
Shared APIs and consent as the authorisation layer
The pilot uses consent-based APIs to move loan data between institutions under explicit authorisation rather than informal sharing. In practice, this means the API layer is doing more than transport. It is carrying proof of customer permission, participant trust, and policy-bound access scope. When that model works, data movement can be automated without turning every request into a manual exception. The security challenge is that consent must remain valid, specific, and attributable across multiple participants and workflow stages, or the process becomes hard to audit and easy to over-extend.
Practical implication: Practitioners should treat consent tokens and API entitlements as governed access records, not just integration metadata.
Accredited participants and trust boundaries
Open finance portability depends on only trusted, accredited participants interacting with the ecosystem. That creates a federation-like trust model where identity proofing, participant onboarding, and ongoing eligibility matter as much as the API itself. If participant identity is weak, portability turns into a lateral trust problem: one weakly governed institution can degrade the assurance of the whole flow. This is why accreditation is not a one-time control. It has to remain current for the full lifecycle of access and settlement participation.
Practical implication: Security teams should align onboarding, certification, and periodic review with participant trust boundaries rather than treating ecosystem access as permanent.
Settlement is where identity governance becomes operational
The pilot routes approved settlements through Brazil’s Reserve Transfer System, which ties an identity and consent decision to a regulated financial action. That linkage matters because the workflow is no longer just about moving data. It is about ensuring the entity that requested portability, the participant that processed it, and the system that settled it all remain traceable and enforceable. In other words, governance spans the whole chain from consent to execution. Without that chain of accountability, a portable credit process can scale faster than the controls that are supposed to contain it.
Practical implication: Practitioners need end-to-end traceability from consent issuance through settlement completion and exception handling.
Threat narrative
Attacker objective: An attacker or abusive participant would seek to move or settle credit activity outside the intended trust and consent boundaries.
- Entry occurs through consent-based API access, where portability requests begin inside a regulated participant ecosystem rather than through a single application boundary.
- Credentialed or authorised access is then used to exchange loan data and validate participant eligibility, making trust in delegated access the key security control.
- Escalation would occur if participant trust or consent scope were overstated across institutions, allowing unauthorised portability or settlement actions to proceed.
- Impact is financial and operational, because incorrect trust decisions could undermine loan transfer integrity, consumer confidence, and market-wide portability controls.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Credit portability turns identity governance into market infrastructure: when a borrower can move financial relationships across institutions, the real control plane is participant identity, consent scope, and settlement accountability. The article shows that open finance succeeds only when those controls are trusted across organisational boundaries. Practitioners should read portability as an identity programme, not just a product workflow.
Consent is only durable if it survives the full delegation chain: the article’s model depends on customer permission, accredited participant status, and regulated execution all staying aligned. That is a cross-organisation governance problem, not a single-system permission problem. If consent, participant trust, and settlement authority drift apart, portability can scale faster than the controls around it. Practitioners need lifecycle thinking across all three.
Open finance expands the blast radius of weak onboarding: once institutions join a shared portability ecosystem, poor participant vetting stops being a local issue. It becomes a shared trust weakness that can affect market confidence, interoperability, and dispute handling. The practical lesson is that ecosystem scale magnifies identity assurance failures, so accreditation and periodic revalidation become central controls.
Identity assurance, not workflow automation, is what makes portability competitive: the pilot’s five-day transfer outcome is only meaningful because the ecosystem can prove who is acting, under what consent, and through which settlement path. That is why portability programmes should be measured by governance quality as much as speed. The market is moving toward regulated interoperability where trust is the differentiator.
Participant trust debt: once open finance ecosystems accumulate many institutions, stale accreditation, weak consent lineage, and unclear settlement accountability become hidden liabilities. This article shows that the next phase of open finance will be won by ecosystems that can prove and refresh trust continuously. Practitioners should treat trust refresh as an operating requirement, not a one-off launch condition.
What this signals
Identity governance is becoming the operating model for open finance: as credit portability expands, the hard part is no longer API availability but proving who may act, under what consent, and through which settlement path. That changes IAM from a back-office control into a market-enabling discipline.
Participant trust debt: open finance ecosystems accumulate hidden risk when accreditation, consent lineage, and settlement authority are not refreshed together. The practical challenge for programme owners is to make lifecycle controls continuous across institutions, not just at onboarding.
Brazil’s model shows that portability at scale depends on a governed delegation chain. When consent, participant identity, and settlement execution stay aligned, faster transfers become possible without weakening accountability.
For practitioners
- Govern participant accreditation as a lifecycle control Tie onboarding, certification, and periodic revalidation to every institution that can initiate or process portability events, so ecosystem trust does not persist by default.
- Track consent scope across the full portability path Map each consent record to the exact data set, participant, and settlement stage it authorises, then verify that downstream use never exceeds that scope.
- Require traceability from request to settlement Maintain evidence that links the portability request, participant identity, consent decision, and final Reserve Transfer System settlement outcome.
- Review exception handling for trust drift Test how revoked consent, expired accreditation, or participant disputes are blocked before they can propagate into approved portability execution.
- Measure portability against governance quality Use transfer speed as a secondary metric and prioritise whether the programme can prove lawful access, participant identity, and settlement accountability at scale.
Key takeaways
- Credit portability in open finance depends on governed identity and consent, not only on digital workflow speed.
- The article ties the pilot to large-scale ecosystem adoption, with more than 102 billion API calls and nearly 62 million active data-sharing consents in 2024.
- Practitioners should focus on participant accreditation, consent scope, and settlement traceability if they want portability to scale safely.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The pilot depends on trusted participant access across regulated APIs and consent flows. |
| NHI-05 — Overprivileged NHI | Accredited participants must not retain broader access than the portability workflow requires. | |
| Recommendation — Strengthen participant authentication and trust validation before allowing portability actions. Limit participant access to the minimum scope needed for each portability step. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governed authorisation across institutions and settlement steps. |
| Recommendation — Define and review portability entitlements so access never exceeds approved consent scope. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud and API-based financial ecosystems need governed identity lifecycle and access control. |
| Recommendation — Apply IAM controls to participant onboarding, authorisation, and lifecycle review in open finance. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The trust chain could be abused if participant access or delegated authority is misused. |
| Recommendation — Map portability abuse scenarios to credential access and lateral movement patterns in monitoring. | ||
Key terms
- Credit Portability: Credit portability is the ability to move a loan or credit relationship from one provider to another through a standardised digital process. In open finance, it depends on authenticated participants, governed consent, and auditable settlement so that customer choice does not weaken control.
- Consent-Based API: A consent-based API is an interface that only permits data access or action after a customer or authorised party has granted specific permission. The important control issue is not connectivity alone, but whether the permission remains scoped, attributable, and enforceable throughout the workflow.
- Participant Accreditation: Participant accreditation is the trust decision that a company, system, or institution is permitted to take part in a regulated ecosystem. It combines identity proofing, technical certification, and governance checks so that access to shared data and workflows remains controlled.
- Settlement Traceability: Settlement traceability is the ability to link a business request, consent decision, and final financial execution into one accountable chain. For open finance and portability programmes, it is what turns a digital workflow into a controlled financial control system.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org