Topic starter
10/06/2026 10:34 pm
TL;DR: Open finance adoption is accelerating across North America, and Sumsub says sophisticated fraud rose by more than 180% last year, while FDATA now counts more than 30 member firms shaping permissioned data access standards. The practical issue is that consumer-permissioned finance still depends on identity controls that are not yet consistently designed for fraud-resilient delegation and consent.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Sumsub Joins FDATA to Advance Secure and Consumer-Centric Open Finance”.
By the numbers:
- sophisticated fraud rose by more than 180% last year
Key questions
Q: What breaks when open finance consent is treated as a one-time login event?
A: The control breaks because permission can outlive the user context that created it.
Q: Why does open finance increase identity verification requirements?
A: Open finance increases verification requirements because the identity check now decides whether data or transaction authority should be released across multiple parties.
Q: What are the signs that AI access is outgrowing existing IAM controls?
A: Look for broad local permissions, connectors that are not registered, auto-approve modes used in production, and prompt-based tasks that touch sensitive repositories or cloud environments without task-scoped limits.
Practitioner guidance
- Define consent as an auditable access object Record who granted permission, what data was shared, which recipient was authorised, and when the permission expires or is revoked.
- Add fraud triggers to delegated access flows Re-check identity assurance when device context, recipient behaviour, or sharing scope changes instead of relying on initial verification alone.
- Align ownership across IAM and fraud teams Create a shared operating model for permissioned data access so verification, anomaly detection, and revocation are not split across silos.
Bottom line: Open finance makes identity verification part of data governance because consent, delegation, and revocation now determine whether access remains trustworthy.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:39 am
Open finance is turning consumer consent into an identity governance problem. The article frames secure data access as a trust and compliance issue, but the deeper reality is that consent alone does not govern the full access lifecycle. Once multiple platforms, aggregators, and institutions participate, teams need to know who can act, on whose behalf, and under what revocation conditions. That is classic identity governance, just applied to a cross-ecosystem consent chain rather than a corporate directory.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why delegated access problems often persist unseen.
A question worth separating out:
Q: How should IAM and fraud teams handle write access in open finance?
A: IAM and fraud teams should treat write access as a higher-risk entitlement with its own policy, verification, and approval path. Write permissions can change account state, create liability, or trigger monetary movement, so they need stronger controls than read access. The safest model is separate governance for observation and action.
👉 Read our full editorial: Open finance identity verification is becoming a governance issue
12/06/2026 4:13 am
Open finance turns identity verification into a governance control, not just an onboarding check. The article shows that consumer-permissioned data access now depends on whether access can be trusted, traced, and revoked across multiple parties. That is a lifecycle problem, not a point-in-time login problem. For practitioners, the real question is whether delegated access remains governable after the first authentication event.
A question worth separating out:
Q: How should IAM teams and fraud teams divide responsibility for open finance risk?
A: IAM should own authentication, delegation, and revocation controls, while fraud teams should monitor abuse patterns and suspicious recipient behaviour. The two functions must share telemetry and escalation paths because open finance risk appears at the boundary between authorised access and misuse.
👉 Read our full editorial: Open finance identity verification is becoming a governance issue
This post was modified 1 day ago by NHI Mgmt Group