Topic starter
25/06/2026 12:50 am
TL;DR: Open banking in North and South American financial services is accelerating API-first customer experiences, but the real dependency is financial-grade APIs interacting with enterprise IAM standards, according to Ping Identity. The governance challenge is not just customer experience, but whether identity and access controls can keep pace with standards-based data sharing and trust relationships.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “Accelerating Financial Service Innovation With Identity-Powered Open Banking in the Americas”.
Key questions
Q: How should banks govern third-party access to open banking APIs?
A: Banks should govern third-party API access as a lifecycle-managed identity problem.
Q: Why do legacy IAM controls struggle with financial-grade APIs?
A: Legacy IAM struggles because it was built for direct user-to-application access, while financial-grade APIs introduce delegated, multi-party trust relationships.
Q: What breaks when API consent and IAM policy are managed separately?
A: When API consent and IAM policy are managed separately, organisations can approve one part of access while leaving another part uncontrolled.
Practitioner guidance
- Map delegated API access paths Inventory which third parties, partner applications, and internal services can reach customer data through open banking interfaces.
- Review token and consent lifecycles Verify that token expiry, consent withdrawal, and client credential rotation are governed together rather than as separate controls.
- Test policy consistency across APIs Check whether the same authorisation decision is enforced consistently across banking portals, partner APIs, and downstream services.
Bottom line: Open banking shifts IAM from a login-centred control model to a trust-centred operating model across financial-grade APIs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:52 am
Open banking moves identity control from the perimeter to the trust relationship. Once financial services expose customer data and actions through APIs, the decisive security issue is no longer only who signed in, but which parties are allowed to exchange, delegate, and reuse trust across sessions and organisations. That changes IAM from a login system into a policy engine for ecosystem participation.
A question worth separating out:
Q: How do banks know whether their open banking controls are actually working?
A: Banks know the controls are working when every externally exposed API action can be traced back to a specific consent, policy rule, and accountable party. If the organisation cannot prove that linkage consistently, then open banking access is being granted faster than it is being governed.
👉 Read our full editorial: Open banking is exposing the limits of legacy IAM controls