Loading ePaper
Thought Leadership B2B DATA SHARING: DIGITAL CONSENT MANAGEMENT AS A DRIVER FOR DATA OPPORTUNITIES EBA Open Banking Working Group
Copyright © 2018 Euro Banking Association (EBA) All rights reserved. Brief excerpts may be reproduced for non-commercial purposes, with an acknowledgement of the source. The information contained in this document is provided for information purposes only and should not be construed as professional advice. This information paper is the result of an analysis carried out by the Euro Banking Association's Open Banking Working Group (OBWG). The Euro Banking Association does not accept any liability whatsoever arising from any alleged consequences or damages arising from the use or application of the information and gives no warranties of any kind in relation to the information provided. 2
CONTENT 1. EXECUTIVE SUMMARY ....................................................................................................................4 2. INTRODUCTION ................................................................................................................................7 2.1 The Triple A Model – data availability and accessibility ............................................................7 2.2. Platforms – the current state of play ..........................................................................................9 2.3. Digital consent improves data accessibility ............................................................................10 2.4. Reading guide ..........................................................................................................................10 3. THE WORLD OF B2B DATA EXCHANGE PLATFORMS .................................................................11 3.1 The emerging role of B2B data platforms ...............................................................................11 3.1.1 Data openness ...................................................................................................................... 11 3.1.2 Business power relationship ................................................................................................ 11 3.2 B2B data sharing for corporates, SMEs and banks: key pain points and needs .....................14 3.2.1 Corporate pain points in B2B data sharing ........................................................................ 14 3.2.2 SME pain points in B2B data sharing.................................................................................. 15 3.2.3 Bank pain points in B2B data sharing ................................................................................. 15 3.3. Key takeaways and implications for banks ..............................................................................16 4. DATA ACCESSIBILITY AND CONSENT AS A FOUNDATION .........................................................17 4.1. Definition of data accessibility .................................................................................................17 4.2. Definition of consent ................................................................................................................17 4.3. Digital consent to drive B2B data sharing ...............................................................................18 4.4. Key takeaways and implications for banks ..............................................................................20 5. IMPROVED B2B DATA SHARING AS A DIGITAL INNOVATION DRIVER .......................................21 5.1. More agile business through data sharing...............................................................................21 5.2. Different point of views on B2B data sharing ..........................................................................23 5.2.1 Banks ..................................................................................................................................... 23 5.2.2. Platforms ............................................................................................................................... 24 5.2.3. Businesses ............................................................................................................................. 25 5.3. Key takeaways and implications for banks ..............................................................................26 6. PRACTICAL CONSIDERATIONS: HOW TO BENEFIT FROM B2B DATA SHARING .....................27 6.1. Considerations for banks .........................................................................................................27 6.2. Industry considerations for establishing a digital consent network .......................................28 7. CONCLUSION ..................................................................................................................................30 EBA Open Banking Working Group 3
1. EXECUTIVE SUMMARY Data sharing can help to increase efficiencies, lower risks and contribute to service innovation. Over the past two decades, digitisation has not only increased the amount of existing data but also increased the sharing of data between individuals and businesses. However, multilateral (‘many-to-many’) relations in data sharing between businesses and their service providers, including banks, have not yet become widely established. Instead, a scattered landscape of business-to- business (B2B) exchange platforms, actors and bilateral projects has evolved. The rise of B2B exchange platforms has led to business data accumulation by third parties, who use this data for analytics and value creation. For banks, the strategic implications include: Ξ Limited overview and insight into data about the end-to-end trade process, impacting the understanding of customer needs; Ξ Sharing of ‘added value’ with platform service providers that will leverage data capabilities to offer business customers new propositions; Ξ Risk of client disintermediation as platforms increasingly build seamless and comprehensive digital experiences, satisfying both financial and non-financial needs of corporate customers. Meeting these challenges requires improvements in data accessibility, ensuring a free flow of data, enabling market actors including banks to access business data more easily, within businesses directly or indirectly via B2B exchange platforms. ‘Digital consent management’ lies at the heart of any possible solution for the challenges ahead. Digital consent is obtained from businesses, mandating banks (and/or other service providers) to obtain and use business data to innovate their services for the benefit of businesses. This concept is similar to the provisions of the revised Figure 1: COSIP Framework – business data in the B2B trade process CONTRACTING (C) ORDERING (O) SHIPMENT (S) INVOICING (I) PAYMENT (P) SELLER BUYER 4
Payment Services Directive (PSD2) and the General Data Protection Regulation (GDPR). Both aim to improve customers’ control over their data through the right to provide (or withdraw) consent to allow authorised third parties to access their personal and business information in order to use their services. Banks traditionally play a role in the value exchange because of their trusted and regulated position. As data exchange is increasingly fraught with operational complexity and liabilities, banks can leverage this trust to play a crucial role in such consent transactions, thereby improving their access to business data (see figure 1). Improved access to data allows banks to: Ξ Improve the efficiency of financing and risk processes contributing to the financial bottom line; Ξ Reduce cost to serve un- or under-addressed business segments, e.g. long tail of SMEs, opening up additional markets; To foster wide adoption, data sharing needs to be standardised to enable businesses, B2B platforms and banks to seamlessly exchange data in a many-to-many relation. Standardisation of digital consent is also expected to reduce the transaction costs of data exchange. Figure 2 provides an overview of such consent relations and data sharing. In this example the buyer is the business providing consent to the bank, but this could also be the seller. By actively pursuing improved B2B data accessibility, banks have an opportunity to revise their digital agenda for corporate and SMEs through: Ξ Creating awareness among business clients regarding the potential benefits and new value propositions emerging from improved access to data; Ξ Addressing potential changes to operating models (customer relationships, products and management) and business models enabling new value propositions; Ξ Pursue data-driven propositions as part of an open banking strategy to strengthen the relationship with business clients. Ξ Considering options for industry collaboration to drive ubiquitous adoption of standardised consent management and data sharing. For business clients such improved access to data means a higher benefit of their data beyond the bespoke platform applications where the data is currently held. For B2B platforms, it means answering to customer demand to be in control of their data, potential regulatory pressure focused on ensuring free flow of B2B data, while also creating the opportunity to commercially leverage their position as the data holder. EBA Open Banking Working Group 5
Figure 2: Organising digital consent management to drive data accessibility at scale BUYER CONTRACTING (C) ORDERING (O) SHIPMENT (S) INVOICING (I) PAYMENT (P) 2 1 3 A B A N K P L A T F O R M B 6 SELLER 4 5 PROVIDING CONSENT 1 2 Buyer registers consent for party B to retrieve data from party A in consent registry Buyer notifies bank of consent registry REQUESTING ACCESS & VERIFYING CONSENT DATA SHARING 3 4 5 Bank requests access to specific data at platform 6 Platform shares data with bank Platform checks consent registry for access rights Consent registry verifies access rights Consent/Access right Access request Data exchange 6
2. INTRODUCTION In its most recent paper “Data Exploration Opportunities in Corporate Banking – Key concepts and applications”1, the Open Banking Working Group (OBWG) assessed data exploration opportunities in corporate and SME banking by taking into account the increasing relevance of data availability, accessibility and analytics. The “Triple A Model” is visualised in figure 3 below. there is ample room for value creation from data analytics in the business banking domain, both in internal application areas and – more importantly – as a new source of creating service components. 2.1 THE TRIPLE A MODEL – DATA AVAILABILITY AND ACCESSIBILITY The increasing openness of various data sources (both financial and non-financial) held by banks, large and smaller businesses and their service providers could act as a catalyst for a new wave in financial services innovation (within and beyond payments) and is therefore a relevant topic to track and understand. The OBWG paper concluded that 1 EBA Open Banking Working Group, ‘Data Exploration Opportunities in Corporate Banking: Key concepts and applications’ (2017) In this information paper, the OBWG continues its data exploration assessment with a focus on the data availability and accessibility layer of the Triple A model, as these aspects are a pre-condition for any data analytics strategy. While the previous OBWG paper focused on banks opening up customer data, driven by PSD2 and GDPR, this paper takes a closer look at the end-to-end trade process between businesses: the focus now lies on banks being granted access by businesses to BUSINESS VALUE CREATION P L A T F O MB R BUSINESS CUSTOMER USE CASES & VALUE PROPOSITION ANALYTICS ACCESSIBILITY AVAILABILITY OPERATING MODEL DATA STRATEGY & POSITIONING SERVICE PROVIDER Figure 3: Triple A Model – business value creation stack EBA Open Banking Working Group 7
Figure 4: COSIP framework – business data in the B2B trade process BUYER CONTRACTING (C) ORDERING (O) SHIPMENT (S) INVOICING (I) PAYMENT (P) SELLER business data held at third party platforms, which could support banks’ open banking strategies. The end-to-end trade process generally includes the following data transactions: contract, order, shipment, invoice and payment, also referred to as the COSIP framework, see figure 4. Emerging B2B networks use platforms 2 to facilitate and automate the end-to-end trade process. As a result, data generated throughout the end-to-end trade process is increasingly accumulated outside businesses and their banks. 2 ‘Platforms’ as a concept are not clearly defined. The concept as used in the context above simply refers to the IT architecture, tools, services, interfaces, rules and standards to facilitate the end-to-end trade process. However, depending on the ‘openness’ of the infrastructure, we may also refer to platforms as a ‘business model’ and platforms as an entity approach. In the latter case, the platform seeks to facilitate the business of others by acting as an intermediary and sharing, providing and leveraging key assets (e.g. data, processes). In this report we will mainly focus on the latter definition. Figure 5: Evolution of value added services ‘on top of’ data VALUE CONTRIBUTION P L A T F O MB R DATA AS A PRODUCT ENABLER DATA AS A PRODUCT PROPOSITION DATA AS A PROCESS ENABLER DATA AS A PROCESS RESULT TIME 8
a European data economy.4 While GDPR already introduces a general right to data portability for personal data related to individuals, the European Commission is assessing whether introducing a general right to data portability for non-personal data (e.g. B2B, machine generated, machine-to- machine) could be seen as a possible means to enhance competition, stimulate data sharing and avoid vendor lock-in. Standardised APIs would offer platforms the opportunity to seamlessly and efficiently exchange data with trade partners, other platforms, banks and other service providers that play a role in the end-to-end trade process. This links back to the data accessibility layer of the triple A model, and requires secure tools and processes for controlled data access and exchange with explicit consent given by the business customer. While improved data accessibility would help banks (and other actors) to use business data to co-create opportunities together with their (business) customers that today remain out of reach, there are also emerging issues that need to be addressed. These issues, inherently related to increased data accessibility, include, amongst others, data ownership, interoperability, (re) usability, access to data, and liability. This data – from contract to purchase order to invoice to payment information – can be leveraged for developing value added services ‘on top of’ this data (see figure 5 below), e.g. for enhancing the efficiency of internal processes, enriching business processes and services, enabling other (financial) products to be offered at lower costs and offering data as a product proposition to facilitate (future) decision making. The platforms with their central role in the COSIP trade process are typically managing a large array of the data needed for developing such added value. The PSD2 will further enable them to enrich data available to them with financial data that they can obtain free of charge based on statutory rights. Therefore, banks that want to leverage the potential of the data need to proactively address open business models to strengthen their competitive positioning. 2.2. PLATFORMS – THE CURRENT STATE OF PLAY Many platforms do not benefit from or allow for the possibility of user-friendly Application Programming Interfaces (APIs) that can serve as safe entry ports for new and innovative use cases for data outside of the platforms. Platforms may not be equipped with the right tools to quantify the economic value of their data, and they may fear losing or compromising their competitive advantage when data becomes available to competitors.3 This is also recognised by the European Commission as evidenced by its efforts to promote the free flow of data to build 3 European Commission, 'Staff Working Document on the free flow of data and emerging issues of the European data economy' (10 January 2017) 4 European Commission, 'Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the Telecommunications Single Market' - COM(2013) 634 (11 September 2013) EBA Open Banking Working Group 9
2.3. DIGITAL CONSENT IMPROVES 2.4. READING GUIDE DATA ACCESSIBILITY This paper explores the evolving landscape of B2B data sharing, by addressing the increased data availability and accessibility and how digital consent can be a driver for new data propositions for businesses: Chapter 3: The world of B2B data exchange platforms Chapter 4: Data accessibility and consent as a foundation Chapter 5: Improved B2B data sharing as a digital innovation driver Chapter 6: Practical considerations: how to benefit from B2B data sharing Chapter 7: Conclusion The key hypothesis of this paper is that improved data accessibility for banks and other actors can be achieved through the use of digital consent management. Such consent would be obtained from businesses, mandating banks (and/or other providers) to obtain and use business data (available in platforms or other specific business software) to innovate and co-create services for the benefit of business customers. It is important to remember that irrespective of who owns the platform(s) where data access is managed, the data owners will remain in control of their data. To truly drive innovative data propositions, digital consent management and a standardisation of data exchange is required. This will support secure and controlled accessibility of data at scale and with explicit consent given by the data owners, enabling banks and other service providers to address the emerging needs of business customers. Equally, business customers may create more possibilities for themselves to leverage their own B2B data. While this may be achieved by individual banks, this is also an opportunity for industry collaboration as the set-up of digital consent management and the exchange of data requires trusted relationships amongst multiple parties. A multilateral (many- to-many) trust relationship in turn is expected to minimise transaction costs for data access and exchange, while lowering the barriers for adoption. 10
3. THE WORLD OF B2B DATA EXCHANGE PLATFORMS This chapter describes a typology of four archetypes of platforms underlying B2B commerce networks. These archetypes differ in terms of data openness (for third parties) and the balance of power (“buyer driven” vs “size neutral”). Several B2B platforms are analysed in detail and classified according to the typology to develop a solid understanding of how they work. This chapter concludes with insights into the key pain points and needs of corporates, SMEs and banks in relation to B2B data sharing. 3.1 THE EMERGING ROLE OF B2B DATA PLATFORMS B2B data platforms play an important role in B2B transactions by facilitating the data flow between businesses and deep-level integration within a company’s internal systems to ensure data is received and processed correctly. These B2B data platforms support one or multiple forms of B2B transaction data described in the COSIP framework in the introduction. On top of transaction data flowing through the B2B platform, various analytics tools are applied to cater for innovative data propositions. Through their direct access to business data, these platfroms are increasingly relevant for businesses for extracting value out of transaction data to support business operations, provide better financing options and improve operational efficiency in general. B2B data platforms can be classified according to four archetypes that describe the way the platforms interact with businesses and their role in facilitating and enriching data transactions. The archetypes are determined based on data openness of the platform and on the nature of the balance of power between businesses. 3.1.1 Data openness B2B data platforms can deliver added value to business customers in two different ways. First, the service provider owning the platform can develop service propositions on top of the transaction data that runs through the platform. These are closed systems where the platform itself applies data analytics techniques to extract insights and intelligence and based on that creates additional value for the businesses.5 Examples of this are facilitating just-in-time (JIT) delivery and multiple types of financial services, including dynamic discounting, credit and reversed factoring. Secondly, there are open systems in which the service provider acts as a platform ‘agent’ for third parties to access B2B transaction data and offer products and services to businesses that are connected to the platform. The platform facilitates the data transactions and the curation of third party providers eligible to connect to the platform, while the third party providers are provided with the reach to distribute their data-driven services to the connected businesses. This can be done either white-label where the third party service provider is customer facing, or through an Application Programming Interface (API) connection where the third party service provider connects to the platform’s interface. The latter case is a form of a co-branding partnership model. 3.1.2 Business power relationship The second variable in the B2B commerce network typology is the power balance in the business relationship between two parties. First, this can be driven by the buyer, typically a corporate with 5 EBA Open Banking Working Group, ‘Data Exploration Opportunities in Corporate Banking: Key concepts and applications’ (2017) EBA Open Banking Working Group 11
smaller SME suppliers. In this situation, the buyer has a powerful position in the trade relationship with suppliers and can demand suppliers to interact and transact with the buyer in a particular way. The supplier can, for example, be required to use a particular software or an online portal to communicate with the buyer. The corporate buyer is motivated to standardise the communication format with its suppliers in order to eliminate the complexity of having to manage a large number of different channels for a large number of suppliers. This typology is therefore (big) buyer-driven. Secondly, the transaction channel between businesses can be size neutral. This type of channel does not distinguish between corporates and SMEs, but rather provides a single connection for all types of businesses. The power balance between corporate buyers and SME suppliers is therefore neutralised when it comes to integration or use of an interface. For organisations using a form of automated administration software (ERP, P2P, O2C etc.), there is typically a plug-in or API connection available. Figure 6: Platform typology consisting of four archetypes POWER BALANCE BUYER DRIVEN NEUTRAL Examples Examples SUPPLIER BUYER BUYER THIRD PARTY PLAT- FORM SUPPLIER Buyer Platform Indirect platform involvement Buyer determined Direct platform involvement OPEN BUYER THIRD PARTY S S E N N E P O A T A D CLOSED BUYER SUPPLIER BUYER BUYER PLAT- FORM SUPPLIER Examples Examples 12
The platform typology consisting of the four archetypes is depicted in figure 6. Indirect platform involvement Indirect platform involvement means the service provider plugs into the system of both parties in a trade relationship for access to transaction data. The platform may make transaction data available to third parties that offer value added (financial) services on top of this transaction data. Direct platform involvement In the ‘direct platform involvement’ archetype, the solution provider is directly involved in the transaction, either by processing the transactions themselves or by facilitating transactions on the platform. In both cases, the platform is part of the transaction data flow. Furthermore, the platform itself directly offers services on top of transaction data generated on the platform. Buyer platform In this archetype, the corporate determines the data standard for its network of suppliers by using a particular B2B transaction software solution provider. The solution provider acts as a platform for third parties (e.g. banks) to access the transaction data directly to offer services such as supply chain finance, reversed factoring, shipment optimisation etc. Buyer determined The (corporate) buyer leverages its power position by defining the interaction standard for its network of suppliers. The interaction standard will be based on the software solution used by the buyer. The software solution provider facilitates all B2B data flows and offers the buyer services directly on top of the transaction data that flows through the system. EXAMPLE 1: B2B DATA PLATFORM EXAMPLE – SIX B2B NETWORK FOR INVOICING IN SWISS HEALTHCARE SECTOR The healthcare sector in Switzerland involves many different stakeholders, including hospitals, suppliers, and health insurance companies. SIX’s B2B network connects these stakeholders across Switzerland, enabling them to process invoices seamlessly. Since, eventually, the healthcare services are charged to the insured individual, SIX also provides eBill, a digital and fast way to manage and pay bills that is digitally integrated in the eBanking environment of Swiss retails banks. By combining a B2B network with a bank-linked digital billing infrastructure for consumers, an entire industry sector is able to digitise one of its core processes and operate more efficiently. SIX facilitates both invoicing and bill payments with its solutions. EBA Open Banking Working Group 13
3.2 B2B DATA SHARING FOR CORPORATES, SMEs AND BANKS: KEY PAIN POINTS AND NEEDS This chapter looks at the key pain points and needs for corporates, SMEs and banks in the current end-to-end B2B data flows (figure 7 below provides a short summary). 3.2.1 Corporate pain points in B2B data sharing The main challenge for corporates is managing the complexity of the internal organisation and the extensive network of partners and suppliers. Most corporates run on legacy IT infrastructure that was developed decades ago and has become outdated, but is still vital to critical components of the business.6 The challenge is to simplify and harmonise these systems, particularly as these structures usually evolve as companies grow over a long period of time (either organically or through mergers & acquisitions) and as the number of departments, physical locations and products increased. With this growth, the number and complexity of relationships with suppliers and partners have increased significantly as well. Furthermore, corporate legacy systems require particular data formats to be used and the specific way in which processes and reporting is organised internally means standard procedures need to be followed. This is problematic when it comes to 6 Accenture, ‘Redefine your company based on the company you keep’ (2018) Figure 7: Pain points and needs of corporates, SMEs and banks Corporates SMEs Banks • Managing complexity of • Limited transaction data internal organisation services available • Rigid legacy systems • No leverage to apply for and organisation tailored data services Pain Points • Limited overview and insight in transaction data • Not utilising full potential of end-to-end B2B data value stack • Risk of client disintermediation with third party platforms • Streamlining data flows • Ensuring interoperability • Access to transaction • Strategy to tap into B2B data propositions transaction data Needs with partners/suppliers • Ensuring interoperability with (corporate) buyers 14
interacting with (SME) partners and suppliers on which corporates strongly rely for production and daily operations. These partners and suppliers may use various forms of software tools for commerce activities and may not always be equipped to conform to the corporate’s specifications and way of interacting. Corporates would strongly benefit from services that streamline data flows across processes that are currently distributed across departments and possibly even geographical locations. Connecting these data flows and processes requires advanced software packages that are deeply integrated in the corporate systems and ideally accessible to the network of suppliers and partners as well. Propositions developed on top of data flows could provide much needed insight into operations and access to better (financial) service offerings. 3.2.2 SME pain points in B2B data sharing SME businesses are generally underserved in their data needs, due to their small scale. Most advanced software solutions that converge data flows are primarily focused on corporates. SMEs are therefore often offered less extensive, cloud- based solutions for process automation to make administrative activities more efficient. Particularly the long tail of SMEs is underserved and may only use basic software tools. Furthermore, when corporate buyers enter into a business relationship with SME suppliers, they may require suppliers to interact according to a particular data format or standard. For the corporate this is a way to minimise the number of different channels that need to be connected and managed. For the SME, on the other hand, managing multiple channels and data formats for various corporate customers is both cumbersome and complex. SMEs therefore need solutions that ensure interconnectivity of their software solution(s) with that of many corporates. Most types of automation software include this type of functionality, including most ERP, Procure-to-Pay (P2P) and strategic sourcing software. The majority of SMEs, who do not use such software and rely on more basic tools, is required to manually transfer data into the format requested by the corporate buyer. 3.2.3 Bank pain points in B2B data sharing For banks, the fact that B2B transaction data flows are increasingly accumulated by third parties outside of the business concerned, has several implications. First of all, banks have a limited overview of and insight into data of the end-to- end trade process. This negatively impacts their understanding of a business customer’s needs and thus the ability to deliver relevant services. Furthermore, smaller SMEs are often forced to accept available offerings. They lack the negotiation power to leverage their position as a customer for tailored services, as this is often not profitable for the service provider. The services on offer may therefore not always be a close fit with the SMEs’ needs in terms of options, pricing structure, customer support etc. Secondly, banks are currently not utilising the full potential of the end-to-end B2B data value stack. Banks facilitate payment transactions between businesses, but base key financing decisions partially on other transaction data as well. There is underused potential value of other transaction data that is currently shared with B2B platforms that banks could tap in to. EBA Open Banking Working Group 15
Arguably most concerning, however, is the risk of disintermediation with their clients banks face as platforms increasingly build seamless and comprehensive digital experiences satisfying both financial and non-financial needs of businesses. As ecosystem models and strategic partnerships among software solution providers increasingly drive digital B2B data flows and value added services on top of these data flows, the role of banks as financial service providers is increasingly under pressure. Banks find themselves on a strategic cross-road, where they need to decide whether to become the platform, join a platform and/or enable access to platforms to gain access to B2B transaction data. 3.3. KEY TAKEAWAYS AND IMPLICATIONS FOR BANKS Ξ B2B platforms increasingly drive digitisation within and between businesses in the end-to-end trade process, with data being accumulated outside of banks. Ξ The role of banks as financial service providers is increasingly under pressure as ecosystem models and strategic partnerships among B2B platforms increasingly drive digital B2B data flows and value-added services on top of these data flows. Ξ Access to B2B transaction data held within platforms could enrich banks’ open banking strategy by strengthening their client relationships. 16
4. DATA ACCESSIBILITY AND CONSENT AS A FOUNDATION This chapter explains how banks can provide more value to their customers by gaining access to external data sources through consent mechanisms. First, the chapter explains the role of data accessibility in creating value from data. Next, the chapter introduces the concept of consent and mechanisms banks can use to obtain consent from their business customers. 4.1. DEFINITION OF DATA ACCESSIBILITY Innovative technologies support the creation of value from data by improving data availability, accessibility and analytics, thereby providing a solid basis for new value propositions. While data availability concerns the sources of data that can be leveraged in the value creation process, data accessibility determines whether an organisation has access to a specific source of data, internal or external, in order to create value from it. Once data is available and accessible, the quality of the data analytics capabilities determines to what extent value can be created from it. This paper addresses data accessibility with a focus on gaining access to external sources of B2B data from a bank’s point of view. 4.2. DEFINITION OF CONSENT One way for banks to gain access to external data sources is to obtain consent to access these data sources. This strategy entails banks to obtain consent from a business to retrieve its (bespoke) data from its B2B platform provider and/or other business software solution in use. The (business) customer authorises the bank to access its data records at platforms used to facilitate B2B transactions. This strategy allows banks to provide their customer with value propositions from advanced data capabilities, without entering into the ‘platform race’ that is already emerging across industries, the financial services sector included. The concept of providing consent for data access through authorisation has been around for a long time. Until recently, consent was given mostly bilaterally through analogous processes such as paper authorisation agreement forms. An example of such an analogous bilateral consent is the paper EXAMPLE 2: INDUSTRIAL DATA SPACE: DECENTRALISING DATA SHARING Industry 4.0 (also referred to as Smart Industry) is a term used to describe the vision that the next phase of industrial development will see an exponential growth of process automation, both within companies, but especially between companies. A prerequisite for this is data sovereignty, making data available and accessible across supply chains, organisations and jurisdictions. The underlying data infrastructure is defined as “Industrial Data Space”. Based on a research project supported by the German government, the initiative took the form of a registered association in 2016. Large organisations worldwide are joining the Industrial Data Space Association. The aim of the Association is to promote the concept and its adoption across various industrial sectors. EBA Open Banking Working Group 17
EXAMPLE 3: CONSENT AS A LEGAL CONCEPT Consent can be seen as the designated way to impute the voluntary will of a person to (legal) actions and is vital for allowing parties to enter arrangements on the terms they choose. Consent generally can take various forms, e.g. implied, expressed, informed and substituted consent and different legal systems attach different value to the form of consent. The expression of the will of the person and the acknowledgement of the consequences of the expressed will is the basis for the ‘freedom of contract’ that is typical for contract law. Increased complexity resulting from digital transactions as well as asymmetry that often exists between two contracting parties has led to intervention by the legislator by setting out strict rules regarding consent under GDPR legislation. By setting out explicit forms of consent regarding the use of external data, the EU has laid the foundation for clear relationships between consumers and service providers. Particularly in the context of digitisation of B2B data transactions, digital consent management at scale will become increasingly relevant for managing client data. forms businesses sign when authorising their bank to connect certain accounts to their ERP solutions through a File Transfer Protocol (FTP). This mechanism of giving and receiving consent for data access is still relevant for banks, but provides poor user experience and is not scalable, especially when customers need to give consent multiple times on a recurring basis. 4.3. DIGITAL CONSENT TO DRIVE B2B DATA SHARING The notion of giving and receiving consent for access and use of data is a similar concept as foreseen under PSD2 and GDPR, i.e. to give customers control over their data through the right to provide consent to authorised third parties to access and use their personal and business EXAMPLE 4: iSHARE: B2B DATA SHARING IN LOGISTICS Improved data sharing between all parties involved is seen as the foundation for growth in the logistics sector to increase efficiency and improve services, while at the same time reducing the carbon footprint and usage of roads, railways and waterways. In 2016, the Dutch logistics sector has embarked on “iSHARE”, a project which allows for decentralised sharing of B2B data at the source. Data sovereignty is achieved through a collaborative scheme with rules for identification, authentication and authorisation (consent) for business and natural actors in logistics chains. Parties can set their own conditions for data sharing (e.g. based on time, event, or context), which allows sharing of data, also between actors who do not have a direct commercial relationship. 18
data. These concepts drive openness between companies with the ultimate goal to provide more value to their customers while putting the customer in control of their (personal) data. As the digital transformation continues, new mechanisms for giving and receiving consent emerge. A consent mechanism that is more scalable and user friendly than analogous consent is digital bilateral consent. This mechanism allows businesses to give consent (either automated or manually) to access specific data through digital channels, such as their enterprise resource planning (ERP) system. Consent is specified using variables such as duration (the period for which consent is given), parties involved, and the type of data that the given consent governs. This consent specification is then stored in an independent Figure 8: Organising digital consent management to drive data accessibility at scale BUYER CONTRACTING (C) ORDERING (O) SHIPMENT (S) INVOICING (I) PAYMENT (P) 2 1 3 A B A N K P L A T F O R M B 6 SELLER 4 5 PROVIDING CONSENT 1 2 Buyer registers consent for party B to retrieve data from party A in consent registry Buyer notifies bank of consent registry REQUESTING ACCESS & VERIFYING CONSENT DATA SHARING 3 4 5 Bank requests access to specific data at platform 6 Platform shares data with bank Platform checks consent registry for access rights Consent registry verifies access rights Consent/Access right Access request Data exchange EBA Open Banking Working Group 19
consent registry and verified whenever data access is requested. Figure 8 shows the interaction between different actors in a digital bilateral consent mechanism. It describes a situation in which a business (a buyer) wants to authorise its bank to obtain access to specific data at a platform that aggregates data from ordering, shipment and invoice transaction streams. In this example, the buyer is the business providing consent, but this could also be the seller. Digital bilateral consent mechanisms require a business to make bilateral agreements for each separate transaction partner. These agreements concern matters such as API specifications, messaging formats, consent scope and specifications, etc. The most scalable and user-friendly consent mechanism is digital multilateral consent, in which the mechanism for digital bilateral consent is combined with a scheme of multilateral agreements among industry participants.7 The idea behind such a scheme of agreements is that if all parties in an industry adhere to the same agreements, the barriers to new data sharing relationships are significantly lowered. By agreeing on a shared way of giving – legally compliant – digital consent for B2B data sharing, banks, platforms and businesses minimise transaction costs for obtaining access to new external data sources. Giving, obtaining and managing consent becomes a multilateral (many- to-many) transaction type, for which classical two- sided market dynamics apply. 4.4. KEY TAKEAWAYS AND IMPLICATIONS FOR BANKS Ξ Banks can improve the accessibility of business data through consent given by their business customers. In return for giving consent, business customers can expect to receive improved data-driven service offerings from banks. Ξ Similarly, businesses can also give consent to B2B platforms to access business data held by banks, as envisioned under PSD2. Ξ Offering consent management services may strenghthen banks’ position between B2B platforms and their business customers. This position would enable banks to obtain access to data that was difficult to retrieve at best or completely out of reach in the past. 7 Mechanism refers to a set-up where parties exchange B2B data in a secure and trusted way based on a multilateral set of agreements (scheme) governing consent management and data exchange. In this situation, parties rely on the scheme and its supervising body to enforce adherence to the agreements contributing to trust among the participants of the scheme. Digital consent is in this case therefore not agreed in a bilateral set-up, but multilaterally contributing to scalability. 20
5. IMPROVED B2B DATA SHARING AS A DIGITAL INNOVATION DRIVER This chapter describes how B2B data sharing could act as a driver of digital innovation for banks, enrich the product portfolio of data platforms and add value for businesses. Chapter 5.1 describes how PSD2, by fostering open banking, could spark a move towards open business models in B2B data platforms as well, including use cases of end-to-end B2B transaction data. The chapter continues with an analysis of key pros and cons for banks, B2B data platforms and businesses when sharing data. 5.1. MORE AGILE BUSINESS THROUGH DATA SHARING In order to extract the maximum value from data, businesses need to have access to large and diverse datasets. This is difficult to achieve if data remains within the confines of an organisation. An important driver for turning data into (customer) value is partnerships between businesses, which are increasingly based on sharing data to deliver value-added services that would be impossible to achieve in isolation. Organisations in various industries increasingly recognise the value of strategic partnerships as a competitive advantage. Combined service offerings, sharing resources and exchanging data with the right partner could strongly improve market position and customer relevance. These open business models, driven by PSD2 and GDPR, are fostering innovation in various industries, including banking. Compliance is not the only driver for openness, however. The increasing use of micro-services enables businesses to forge digital partnerships at scale relatively easily. In a micro-service architecture, applications are broken down to their simplest, most ‘narrow’ function and are built to serve as modular building blocks. Larger applications of software are built by connecting multiple building blocks (micro-services) together. These small, modular building blocks can be connected to a building block outside an organisation’s boundaries relatively easily, thus supporting digital partnerships and data exchange. Important technological developments supporting micro-services are the increasing use of cloud software and standardised APIs. As cloud software is maturing and proving to be secure, it has seen a strong increase in uptake in recent years. Cloud-based software is increasingly becoming the standard for SMEs as it is relatively easy for IT suppliers to build scalable software in the cloud and even ‘narrow’, specific software applications can be feasible to build. Perhaps most importantly, APIs enable systems and solutions to interact and exchange information. APIs have been around for a long time, but recent developments (including PSD2) are increasingly driving openness and standardisation of APIs. Open and standardised APIs are essential in establishing digital partnerships as they enable scalable interoperability of cloud applications. As accessibility of data across organisations increases, the need for data protection and privacy safeguards grows. Standardised, controlled and secure access control, consent management and data exchange are essential in ensuring scalable data business models. As banks increasingly move beyond mere compliance towards adopting open banking strategies, financial service providers also recognise the potential of adopting open business models and data exchange beyond compliance. The financial industry is faced with regulation that fosters open business models and promotes innovation to provide better, more innovative services for customers. Banks may be placed at EBA Open Banking Working Group 21
Table 1: B2B transaction data use case examples g n i t c a r t n o C g n i r e d r O t n e m p h S i i g n c o v n i I t n e m y a P Reputation data Automated fulfilment platform Why: Perform KYC when onboarding new suppliers to prevent fraud How: When a (corporate) buyer wishes to onboard a supplier to its procurement software platform, the supplier needs to present particular (reputation) data to gain access to the buyer procurement portal. The information is verified with open source databases (e.g. chamber of commerce), details specified by the buyer and general trend data. Why: Manage shipments easily and flexibly across multiple physical locations How: A platform is plugged into business software with an API to obtain product catalogue information, up-to-date inventories and ordering data. The platform automatically selects the shipment option with the most affordable rate. The platform may even provide suggestions in terms of packaging and complement shipping notes for customs and legal authorities. Advanced real-time shipment data Why: Obtain real-time insight and control of shipment process How: Sender accesses a dashboard with detailed shipment data that may include, for example, real-time location, shipping company details and container conditions (e.g. temperature, humidity etc.). The sender may provide receiver access to the dashboard for updated shipment details. Sharing invoice status data Historic cash-flow based credit Why: Access to financing options based on invoice status data How: A platform could function as a marketplace for financiers by accessing and sharing/selling invoice data that resides within a company’s software systems. Through API connections with ERP, procurement and accounts payable software, invoice data can be extracted. This is valuable input for financiers (banks, factoring companies, supply chain finance providers etc.) to better determine risk of financing and therefore the interest rate. Why: Forecast future cash position based on historic payment meta data How: Organisations that process payments of businesses (SMEs, corporates and retailers) can, with reasonable certainty, predict future cash flow based on historic payment meta data that flows through the platform. This insight can be leveraged to provide credit options at competitive rates. C O S I P 22
a disadvantage vis à vis other sectors in terms of data accessibility as not all of their business customers may be following a strategy of opening up their business data. The potential value of sharing transaction data can be substantial for banks and B2B data platforms alike. For banks, this data is an opportunity to deliver a more extensive and rich service portfolio as well as strengthening current services and business processes. For example, B2B transaction data could add significantly to improve risk assessment of financial products such as credit, factoring and supply chain finance. Significant effort will need to go into defining specific use cases and business opportunities to further shape and seize the opportunities of B2B transaction data for banks, businesses and data platforms. Table 1 introduces use cases of B2B transaction data that are currently observed and could provide inspiration for other emerging use cases. Banks currently base financing decisions on available information on the historic payment data of their business customers and may request businesses to share further data on available assets and liabilities (e.g. inventory, debtors, creditors etc.). Banks’ data sources are thus rather limited to using invoicing and payment data as input for financing decisions, whilst ordering and shipment data may provide valuable insight in the risk and capital needs of a business. Access to other forms of B2B transaction data may therefore support risk assessments and lead to better and more competitive service offerings by banks. 5.2. DIFFERENT POINT OF VIEWS ON B2B DATA SHARING 5.2.1 Banks Figure 9: Banks' point of view on B2B data sharing Banks Opportunities • Strategic response to data accumulation outside of banks • Aid Open Banking strategy by ‘consuming’ B2B data (through APIs) • Feasible to address smaller businesses (long-tail) • Acceptance by customer of bank acting as data aggregator beyond payment transactions Challenges • Need for customer education on added value of B2B data sharing For banks, B2B data sharing could be a strategic response to the challenges created by the increasing amount of data that is currently accumulated outside of the bank. Access to a significant amount of relevant B2B data can help banks to improve their understanding of their customers' business processes, ultimately improving efficiency of financing and risk processes. Furthermore, seamless access to B2B EBA Open Banking Working Group 23
data through (standardised) APIs would contribute to banks’ open banking strategy. The combination of the wealth of (financial) data that banks already hold, combined with B2B data, could drive relevant service offerings for clients and establish banks as the go-to service provider for B2B data propositions. Besides a better fit with customer demands and a closer customer relationship, improvements in efficiency will contribute to financial bottom line improvement. As data is increasingly available at scale and analytics enable processing large volumes of (un-) structured data, it becomes feasible to target and service smaller companies as well. Banks will better be able to service the long tail of SMEs that are currently underserved. In order to reap the benefits of B2B data sharing, several strategic challenges will have to be addressed. Customers might not accept banks as data aggregators. In addition, businesses might not be willing to share extensive datasets with their banks, as this might be perceived as creating too much transparency regarding the (financial) position of the business. Banks therefore need to carefully consider their positioning and educate customers on the value banks can provide to businesses with data-driven products and services. 5.2.2. Platforms Although B2B data sharing could increase competition for platforms and impact their control over data, there are several reasons why platforms might ‘open up’ and share data with banks. First of all, customer demand could drive platform participation. That is, customers could leverage their position as data owners to ask platforms to share their data with selected partners (e.g. banks). Figure 10: Platforms' point of view on B2B data sharing Platforms • Fulfilling customer demand to be more in control of own data • Anticipate potential future regulatory pressure to open up platforms to banks as strategic partners to enrich services and introduce new business models • Losing monopoly position on the data accumulated in the platform • Increased competition for the client (business) interface Opportunities Challenges Secondly, possible future regulatory pressure could drive B2B data platforms to open up, as evidenced by current efforts of the European Commission investigating B2B data sharing opportunities and how regulation could act as a catalyst in this respect.8 Regulation asking large data holders to share data for the purpose of facilitating competition, innovation and a level playing field would be in line with the move towards openness instigated by PSD2 in the financial services sector. 8 European Commission, 'Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the Telecommunications Single Market' - COM(2013) 634 (11 September 2013) 24
Finally, and perhaps foremost, banks could be a strategic partner for B2B data platforms to further enrich their service portfolio and consider new business models by opening up their resources. Example 5 below introduces an initiative in Switzerland where large banks and third party service providers work together to enable data exchange between businesses and banks and vice versa. 5.2.3. Businesses The value created for businesses plays a key role, as their consent to use data is the enabler of any B2B data sharing strategy. The main reason for businesses to give consent is the added value that sharing data can unlock. Banks could combine data from B2B data platforms with financial data to offer new insights and services to businesses. Figure 11: Businesses' point of view on B2B data sharing Businesses Opportunities • Added value created by combining B2B transaction data for better financial services and insight Challenges • Increased insight and transparency of business data accessible by banks However, business customers may also want to restrict data accessibility for banks in order to limit the visibility of their business towards their bank. This in turn limits the possibilities of data sharing and impacts data accessibility for banks. EXAMPLE 5: “SWISS CORPORATE API” PLATFORM SIX identified the need for improving data sharing capabilities between SMEs and banks, and therefore started the initiative to form the “Swiss Corporate API” Working Group engaging large Swiss banks and third party service providers (TPPs). The objective is to define use cases and technical standards to establish an API platform connecting Swiss banks and offer one single API end-point to TPPs. Initial use cases of the API are banks providing account information and payment initiation. Future use cases include tax, annual report data and even involve TPPs sharing data with banks as well. Swiss Corporate API helps to improve digitisation of banking services for businesses – with banks offering better services to their customers and TPPs enhancing product offerings and reducing implementation and maintenance cost. This is realised by offering one API via the SIX API platform instead of multiple bank- specific APIs. EBA Open Banking Working Group 25
5.3. KEY TAKEAWAYS AND IMPLICATIONS FOR BANKS Ξ Customer demand, regulatory pressure and search for alternative business models might be strong drivers for B2B platforms to open up their data to other service providers, including banks. Ξ For banks to fully leverage this potential of increased openness of B2B data, concrete use cases need to be identified to ensure a fair value exchange with their business customers, which will help to increase the inclination of business customers to provide consent to access and use their data in return for better and innovative services. Ξ Engaging in B2B data sharing is part of banks’ open banking strategy and a means for banks to increase customer relevance whilst enriching their product portfolio and realising operational efficiencies. 26
6. PRACTICAL CONSIDERATIONS: HOW TO BENEFIT FROM B2B DATA SHARING With B2B platforms able to leverage transaction data flowing through their respective platforms to better serve business needs, the competitive advantages of strategic partnerships are becoming increasingly evident. As a result, banks need to reassess their role in this new B2B platform landscape. These trends have an impact not only on the internal organisation of banks but also on the industry at large, which needs to (re)assess possibilities for collaboration to strengthen the positioning towards business customers. 6.1. CONSIDERATIONS FOR BANKS Customer relationship An important part of the repositioning of banks is the nature of the relationship they will have with their business customers. Rather than being solely a financial service provider, banks can take on the role of data custodian. The decision of business customers to share non-payment related transaction data with banks is, however, not easily made. Particularly as banks may gain access to data that negatively impacts services available to the business and may affect the power Figure 12: Key internal considerations for banks balance between the business and its bank(s). It is therefore of vital importance for banks to explain to customers the benefits of giving consent and to be transparent in the way data is used, processed and stored with the objective of adding value for the customer. Products Use cases of B2B data sharing between businesses, platforms and banks are in an early stage of development. Banks will need to invest in identifying and co-creating use cases with businesses that generate both value and deliver positive business cases. While this can be achieved in isolation, better results may be reached in collaboration with a strategic data platform partner and customers. Such a customer-centric approach allows for an optimal fit of the solution, while the value for the data platform, customer and bank is maximised at the same time. Capabilities Delivering value-added services on top of the large pool of transaction data requires banks to CUSTOMER RELATIONSHIP PRODUCTS Educate customers on new role Explore use cases and value propositions as data custodian together with customers CAPABILITIES Strengthen data analytics capabilities to extract value from B2B data BUSINESS MODEL Change in mindset needed for strategic partnerships EBA Open Banking Working Group 27
strengthen their data analytics capabilities.9 The increasing availability and accessibility of data is only relevant if banks have the analytics capabilities to turn data into value. This may require banks to invest in new capabilities in terms of staff and technical infrastructure to deliver on the promise of fair value exchange with their business customers. Legacy systems may need to be replaced or supplemented by systems composed of flexible and scalable components (e.g. micro-services and cloud solutions). Business model Finally, strategic partnerships are a fundamentally different business model from banks’ conventional way of working. Banks need to change their mindset to move to a collaborative approach aiming to "be better together" with the rest of the ecosystem. Cooperative business models need to be explored that maximise customer relevance and simultaneously deliver value for both banks and platforms. 6.2. INDUSTRY CONSIDERATIONS FOR ESTABLISHING A DIGITAL CONSENT NETWORK In order to establish the multilateral digital consent network described in chapter 4, banks and other industry players need to jointly discuss and set common framework agreements. Through these agreements, participants adhere to business, legal, operational, functional and technical (BLOFT) standards and requirements through which they can share digital consent and data at scale against minimum transaction costs. 9 For more information, see: EBA Open Banking Working Group, ‘Data Exploration Opportunities in Corporate Banking: Key concepts and applications’ (2017) Stakeholders In order to establish a consent network on an industry-wide scale, several groups of stakeholders have to be involved. First of all, banks and platforms involved in the network will need to agree on standards for matters such as data sharing APIs, data exchange formats, legal agreements, etc. Secondly, businesses will need to be involved in an early stage in order to ensure their expectations and concerns are addressed. Finally, it could be necessary to involve an external party as an independent ‘consent registry’, in which businesses store their consent specifications. The process of co-creation The development of a multilateral consent network would benefit greatly from a collaborative approach by the industry. One might even argue that in order for such a network to become a success, a co-creation approach is necessary, as such an approach would ensure that the diverging interests of all parties involved in a consent network are met. If all parties involved collaboratively designed both the business and technical side of the consent network, the chance of introducing the right, mutually beneficial services in the initial launch of the network would be optimised. This would give adoption of the network, which is often a challenge for industry-wide initiatives, a strong impulse. The then following implementation of the network is mostly a decentralised effort by all the participating parties who need to create the API interfaces in their own infrastructure as a landing point for the consent network-related API calls. The central consent registry and governance needs to be created in parallel by the party (or parties) that will act as the centralised trust bearer. 28
Potential next steps The first step in realising a digital consent network is to find banks, platforms and businesses that are willing to participate in the consent network. It is paramount to obtain as much support as possible from businesses, as their participation would be a strong incentive for platforms to participate in the network as well. If an early critical mass of participants is reached, other parties are incentivised to also participate in the network. If more businesses participate in the consent network, it will become more attractive for platforms to participate and vice versa. EBA Open Banking Working Group 29
7. CONCLUSION While previous OBWG thought leadership papers focused on banks opening up customer data, driven by PSD2 and GDPR, this paper followed a more holistic approach and took a closer look at the end-to-end trade process, ‘mirroring’ the concept of opening-up: instead of banks making their data available, this paper looked at how banks may gain access to business data in third party platforms with consent of the business customers to enrich their open banking strategy for the benefit of their customers. A case for change The rise of Business-to-Business (B2B) exchange platforms leads to business data becoming increasingly accumulated outside of businesses by third parties, which use it for data analytics and value creation. Banks need to proactively address open business models to strengthen their competitive positioning. Otherwise, banks face: Ξ A limited overview and insight in data and thus understanding of their customers' business needs; Ξ The risk of client disintermediation, as platforms increasingly build seamless and comprehensive digital experiences satisfying both financial and non-financial needs of businesses. A potential solution Resolving this challenge requires improvements in data accessibility ensuring a free flow of data, enabling market actors, including banks, to more easily access business data, within businesses directly or indirectly via B2B exchange platforms. Digital consent management is at the heart of the solution. Such consent is obtained from businesses, mandating banks (and other providers) to obtain and use business data to innovate their services for the benefit of business customers. Benefits for stakeholders Better access to data allows banks to: Ξ Improve efficiency of financing and risk processes; Ξ Reduce the cost of serving the long tail of SMEs, thereby opening up additional markets; Ξ Pursue data-driven propositions to strengthen the relationship with business clients. For businesses improved data accessibility means increased benefit of their data beyond the bespoke platform applications where the data is currently held. For platforms, it means answering to the desire of customers to be in control of their data, potential regulatory pressure to ensure free-flow of B2B data, while also creating the opportunity to commercially leverage their position as the data holder. 30
The way forward By actively pursuing improved B2B data accessibility, banks have an opportunity to revise their digital agenda for corporates and SMEs. Banks can pursue an individual strategy by future- proofing their operating models and creating awareness among business clients regarding the potential benefits and new value propositions emerging from improved access to data. Consent would be arranged in a bilateral setting with the respective business client. However, there is also a collaborative perspective that needs to be considered. Indeed, ubiquitous adoption can be facilitated through standardisation of consent enabling businesses, B2B platforms and banks to seamlessly exchange standardised data in a multilateral (many-to-many) relationship. This is expected to reduce the transaction costs of data exchange and act as a catalyst for the creation of new data propositions. EBA Open Banking Working Group 31