PSD2: Taking

advantage of open-
banking disruption

Global Banking January 2018

Authored by:
Alessio Botta
Tommaso Jacopo Ulissi
Elia Sasia
Nunzio Digiacomo
Reinhard Höll
Reema Jain
Liz Oakes
PSD2: Taking
advantage of open-
banking disruption
Introduction

The second Payment Services Directive (PSD2) is ties opened up by PSD2. However, banks need
part of a global trend in bank regulation empha- to act promptly to chart a precise business strat-
sizing security, innovation, and market competi- egy and gain a fast-mover advantage. While
tion. By requiring banks to provide other qualified PSD2 is a European initiative, it provides an ex-
payment-service providers (PSPs) connectivity to ample for other markets such as China and the
access customer account data and to initiate United States that are taking gradual steps to-
payments, PSD2 represents a significant step to- ward open banking. As part of a continuing series
wards commoditization in the EU banking sector. on global trends toward open banking,1 this arti-
cle reports on banks’ progress toward PSD2
Our recent survey of bank executives shows that compliance and their preparation to compete for
most are alert to the threat and exploring innova- new retail and corporate business opportunities.
tive and potentially lucrative business opportuni-

1
Articles in this series include: “PSD2: Time for radical change,” McKinsey & Company Global Payments Practice, March 2017;
“Data sharing and open banking” and “Monetizing data: A new source of value in payments,” McKinsey on Payments, July 2017.
Future articles will examine progress on the implementation of PSD2, as well as developments related to the EU’s General Data
Protection Regulation and the SEPA Instant Credit Transfer scheme.

PSD2: Taking advantage of open-banking disruption 1

 Executive Summary

This summary highlights the main challenges Using internal data to optimize risk scoring and
posed by PSD2, key business opportunities, and increase cross-selling among SMEs and mid-size
strategic recommendations. corporates could also boost profits significantly.
On the retail side, most executives consider
PSD2 poses serious challenges “lifestyle” apps (which integrate financial manage-
The key threat to payments incumbents arising ment—payments, consumer finance, invest-
from the implementation of PSD2 is the potential ments, insurance—across multiple providers) to
erosion of transaction volume, revenues, and be the most attractive opportunity.
customer loyalty, as aggressive new service
providers deliver fast, inexpensive, and com- Recommendations
pelling use cases. In addition, payments and fi- To succeed under PSD2, banks need to survey
nance functions are increasingly embedded the full breadth of customer experiences (retail
within digital applications that address the full and corporate) and identify the functions where
scope of the value chain, often within the context they are positioned to add value. Each potential
of a closed-loop ecosystem. PSD2 will make it use case should be evaluated on its capacity to
easier for platform companies to leverage their augment customer touch points and data stores,
vast stores of behavioral data to compete with increase revenue, and expand market share.
traditional financial services companies in offering Bank executives must also decide whether to
consumer finance as well as payments services. lead the market or be a fast follower.

Key opportunities Once use cases are selected, executives should

While PSD2 poses significant challenges, it also choose technology partners with an eye to in-
opens important business opportunities for es- creasing the flexibility of the organization’s IT ar-
tablished payments organizations, both banks chitecture and ensuring its ability to launch and
and nonbanks. Most of the banks we surveyed scale rapidly. Flexibility in technology design is
recently reported that they were on track to com- also crucial for updating fraud prevention tools
ply fully with the new directive when it goes into and complying with ongoing regulatory change.
effect January 2018. In addition to preparing re-
quirements for mitigating fraud risk, banks are In combination with regulatory changes promot-
also developing new use cases to take advantage ing open banking in diverse geographies, the im-
of business opportunities opened up by PSD2. plementation of PSD2 affords banks the
opportunity to leap forward in digital transforma-
On the corporate side, the executives we sur- tion. Banks of all sizes must recognize and evalu-
veyed identified multi-account management, cash ate data (and the touch points through which
management, and cash pooling (mainly targeted data are collected) as a core asset.
for small and medium-size corporations [SMEs])
as the offerings with the biggest potential impact.

2 PSD2: Taking advantage of open-banking disruption

PSD2: Taking advantage of
open-banking disruption
PSD2 poses challenges for established payments What PSD2 requires and when
organizations, but also opens up significant busi- PSD2 requires banks to grant qualified third par-
ness opportunities. ties automated access to customer transaction
accounts, covering both retail and corporate cus-
PSD2 in the context of market disruption tomers.2 By enabling fintechs, large technology
Several global trends pose serious challenges to firms, other banks, and even certain retail organi-
established bank and nonbank payments organi- zations to go head-to-head with banks as (PSPs),
zations. Technology innovations (for example, PSD2 aims to provide lower costs and higher se-
digital payments and cloud-based applications) curity for consumers and to afford merchants
are lifting customer expectations for both conve- greater flexibility to differentiate customer experi-
nience and security. Upgrades in infrastructures ences, including payments.3
are making faster payments an increasingly com-
mon offering, while also facilitating the conver- The complex regulatory architecture of PSD2
gence of cards, e-wallets, and other payments comprises issues ranging from transparency in
types. Attacks from fintechs and digital ecosys- pricing to security, incident reporting, and tech-
tem owners are exerting additional downward nology. As a set of principles, the directive
pressure on pricing. Due in part to persistently gives national governments considerable lee-
low interest rates and the cap on interchange way in crafting precise legal requirements and
fees, challenging payments economics are thus standards. The broad architecture of the direc-
combining with other disruptive forces to reshape tive can be summarized according to three pil-
the global payments industry. The potential im- lars: Pillar 1 concerns transparency, including
pacts of PSD2 and other regulatory changes pro- stronger customer rights and stricter reporting
moting innovation and competition should be standards for banks, as well as increased
understood within this context. transparency in pricing. It is important to note
that pricing must be nondiscriminatory, mean-
Competition for customer touch points (and se- ing that charges for account access and pay-
cure access to customer data) is fiercer than ments initiation must be the same for end
ever, spurring organizations in diverse industries customers and third parties. Pillar 1 also en-
(media, telecommunications, digital technology, larges the scope of the directive to include
banking) to form partnerships that strengthen transactions where at least one party is located
their position as orchestrators. For banks and in the European Economic Area. Pillar 2 con-
nonbanks alike, this means thinking not only of cerns security, including requirements for
transactions and liquidity management, but look- strong customer authentication (SCA). Pillar 3,
ing broadly at customer journeys. For retail cus- which covers access to accounts, includes the
tomers this might include services supporting technological standards by which financial insti-
buying decisions; for corporates this could mean tutions—referred to as account-servicing pay-
an integrated view of supply-chain management. ment service providers—must allow other PSPs

2
Certain corporate account and transaction management functions, e.g., data exchange using the Electronic Banking Internet
Communication Standard (EBICS), will not change with implementation of PSD2.
3
PSD2 defines three types of PSPs: Account information service providers (AISPs) and payment initiation service providers (PISPs)
may secure direct access to accounts without the consent of the account servicing payment service provider (ASPSP, i.e., the
user’s bank).

PSD2: Taking advantage of open-banking disruption 3

 Exhibit 1

PSD2 Pillar I came into force in January 2018; full implementation 2019

November 2015 Final approval of PSD2 directive by Council of the European Union

European Banking Authority (EBA) consults the industry on first proposal

August-October 2016 for Regulatory Technical Standards (RTS) on strong customer authentica-
tion (SCA)

February 2017 Official EBA publication of draft RTS on SCA

Final deadline for transposition of EU directive into national law

January 2018
Pillar I (transparency obligations, scope enlargement) comes into force

European Commission expected to publish the final RTS on SCA in the

Q1 2018
Official Journal of the European Union

Deadline for implementation within EU/EEA

Q3 2019
Pillar II (security) and Pillar III (access to accounts) come into force

RTS in force after 18 months from the

publication by European Commission

Note: Timeline is simplified

Source: EBA; McKinsey analysis

to connect with their systems to access ac- official publication of the final regulatory techni-
count information and initiate payments on be- cal standards on SCA, which is expected in
half of customers. These standards also require February 2018.
banks to provide a protected “sandbox” to
PSPs for testing and ongoing development of Challenges—and opportunities—for banks
services that use the bank’s interface. Once the new transparency standards are imple-
mented in January 2018, competition on pricing
Compliance with PSD2 is required in two will likely intensify. And, as technologically agile
phases (Exhibit 1). Pillar 1 (transparency) be- PSPs begin leveraging automated access to cus-
came effective upon the directive’s transposition tomer accounts with the implementation of Pillar
into national law on January 13, 2018. The an- 3, the squeeze on both pricing and margins will
ticipated implementation date for Pillars 2 and 3 almost certainly tighten further. Indeed, our recent
is the third quarter of 2019, 18 months after the survey of regional and domestic banks shows

4 PSD2: Taking advantage of open-banking disruption

that increased pressure on pricing and margins is tions limited primarily to incoming salary deposits
a top concern for bank executives as they plan and outgoing payments to fund transaction ac-
for the implementation of PSD2.4 counts at another PSP. Third parties would han-
dle all transactions and accumulate the
In particular, account-to-account (A2A) payments associated customer data (Exhibit 2, page 8).
alternatives will pose a serious threat to card is-
suing and acquiring businesses, not only on pric- Challengers on all sides
ing but potentially on speed as well, if combined The implementation of PSD2 will bring winners and
with the SEPA Instant Credit Transfer (SCT Inst) losers, with banks facing strong attacks from new
scheme. If third parties leverage speed, pricing nonbank PSPs. Agile organizations with capital to
and benefits (such as loyalty programs for con- invest in innovative solutions and new business
sumers and improved liquidity and customer ana- models stand a better chance of countering these
lytics for businesses), they may well take control challenges successfully. The executives participat-
of customer experiences, depriving banks of ing in our survey hold diverse views on the type of
cross-selling opportunities both among retail con- organization most likely to benefit from PSD2.
sumers and corporate clients. In a large Euro- Some expect that fintech innovators and small and
pean market, the threat posed by new service medium-size “attacker banks” are better placed to
providers offering A2A solutions could potentially move fast and disrupt the payments market. Oth-
place €50 million to €100 million of bank rev- ers expect that large banks will benefit most from
enues at risk. PSD2 implementation (Exhibit 3, page 9).

While PSD2 poses serious threats to current To sustain strong returns under PSD2, a smaller
business models, it also creates opportunities for bank might attack with an integrated payments-
banks to compete as technology innovators and-financial-management solution, while a large
wielding powerful analytical tools to extract valu- incumbent might develop its own ecosystem, of-
able insights from their vast stores of proprietary fering access to a broad selection of applications
data. Market dynamics and customer attitudes from diverse providers. In either approach, banks
may favor banks that can capture opportunities must design highly efficient, scalable technology
quickly and effectively. If third parties do not gain architecture to support innovative solutions. If
the full trust of customers, banks could retain they strike the right balance of financial asset
their role as trusted financial anchor, as cus- management and data-asset augmentation, they
tomers would not find it attractive to provide third have the potential to boost revenue, strengthen
parties access to their data or accounts (unless margins, and increase market share.
recommended by banks). But there are no guar-
antees that banks will be able to defend their sta- Investing to lead PSD2 disruption
tus as secure trusted advisors. In the worst-case The fundamental technology requirement for
scenario, closed-loop ecosystems could emerge mandatory compliance is an interface (for exam-
and reduce banks to the role of balance-sheet ple, an open application programming interface
provider. Customer interactions would be re- [API]) allowing account-information service
duced significantly, with current account transac- providers (AISPs) and payment-initiation service

4
In June, July, and September of 2017, McKinsey surveyed about 20 banks across Europe about their preparation for the imple-
mentation of PSD2. Data were collected through a written survey of 17 questions and executive interviews. Responses are re-
ported as aggregate data.

PSD2: Taking advantage of open-banking disruption 5

 Exhibit 2

PSD2 has a range of implications for banks

Implications for
payments revenues Level of impact Possible scenarios Implications for banks

NEGATIVE Worst-case Closed-loop solutions Banks reduced to pure

scenario emerge; third parties balance-sheet providers;
Decreased revenue due provide liquidity for all current account transac-
to competitive pricing transactions tions limited to incoming
salary and outgoing
Loss of market share to
payments to transaction
AISP/PISPs1
accounts
Fewer customer
interactions, fewer
High negative Banks retain accounts Banks lose customer
opportunities for
impact and transactions, but touch points; cede role
cross-selling
third parties control as financial anchor
financial managers and
initiate all transactions

POSITIVE Low/medium Third parties fail to gain Banks retain customer

positive market share trust, control of cus-
Revenues from new impact tomer data, and role as
Fintechs serve as finan-
products and services financial anchor
cial managers
Opportunity to gain
market share from Best-case Attackers offer Banks solidify role as
other banks scenario integrated payments trusted advisor; gain
Provide (domestic and market share
technology/platform cross-border) and
services to other financial management;
banks (e.g., API leverage customer data
management) to improve risk pricing
and cross-selling

1
Account information service provider; payment initiation service provider
Source: McKinsey Global Payments Practice PSD2 Survey 2017

providers (PISPs) access to client account and agement. Banks are responsible for mitigating fraud
transaction information.5 Most of the banks sur- risk and will need to implement advanced controls,
veyed reported that they were on track to comply including advanced analytics (for example, to vali-
fully with the directive when it goes into effect. date the origin of inbound calls to the API) and
strong tools to detect fraud attacks. The survey re-
Most banks report that they do not expect security spondents indicated that the risk of fraud arising
to become a problem under PSD2; however, they from third-party access to accounts is a serious
also recognize that they must invest in fraud man- concern and that fraud prevention is a top priority.

5
Banks must provide system access to diverse client-facing AISPs and PISPs, enabling them to seamlessly access bank account
systems via an open interface to verify availability of funds, block funds, initiate transactions, and conduct transaction-risk anal-
ysis. Some existing standards, such as EBICS, are already compliant.

6 PSD2: Taking advantage of open-banking disruption

 Exhibit 3

Bankers respond: Which organizations will lead the attack once PSD2
goes into effect?

Q: Which “actor” in the payments arena do you believe will benefit the most from the
implementation of PSD2? % of respondents, multiple answers

Large commercial banks 25%

Small and medium

attacker banks 30%

Fintechs 35%

Digital ecosystem owners 20%

Telcos 5%

IT outsourcers 20%

1
Account information service provider; payment initiation service provider
Source: McKinsey Global Payments Practice PSD2 Survey 2017

Most of the banks surveyed are looking beyond Survey results also show that most regional
compliance toward new business opportunities. banks are crafting strategies for capturing new
Several are aiming high and investing to lead the revenue and extending market share with innova-
PSD2 revolution. Indeed, many executives report tive, data-intensive use cases for both retail and
that they view PSD2 compliance as part of a corporate clients. On the corporate side, execu-
broad digital transformation. In addition to imple- tives consider multi-account management, trans-
menting the API interfaces necessary to support action management, and cash management/cash
PSP connectivity, most banks are using the imple- pooling as the use cases with the highest poten-
mentation of PSD2 to build new processes, ac- tial impact. As an indication of how far these de-
quire new skill sets, and realign organizational velopment efforts have advanced, nearly 40
structure around data collection and analysis. percent of the banks surveyed report that they

PSD2: Taking advantage of open-banking disruption 7

 Exhibit 4

Bank responses to PSD2 are well underway

Q: In terms of your bank’s overall positioning toward clients under PSD2, please choose the
activity(ies) currently under development or already completed,
% of respondents, multiple answers

Defining clear
value proposition 30%

Defining
customer journey 5%

Defining customer
segmentation 20%

Designing market
communications 20%

Selecting partners/vendors 40%

Developing retail and/or

corporate use cases 55%

None at
the moment 25%

Source: McKinsey Global Payments Practice PSD2 Survey 2017

have also selected technology partners to deliver ments. In both retail and corporate environments,
new offerings under PSD2 (Exhibit 4). payments and finance use cases will increasingly
be embedded within digital applications that ad-
Retail and corporate business opportunities: dress the full value chain (Exhibit 5).
Banker views
In retail and corporate payments alike, the In consumer-to-business (C2B) payments, sev-
biggest opportunities combine capabilities asso- eral banks are developing A2A solutions for in-
ciated with PSD2 (data aggregation and A2A store and e-commerce transactions, bill
transactions) with improvements in settlement payments, and tax payments. Banks should de-
and clearing infrastructures, including faster pay- sign the A2A platform to accommodate faster

8 PSD2: Taking advantage of open-banking disruption

 Exhibit 5

PSD2 unleashes and accelerates a number of concrete business

opportunities in the retail and corporate banking segments

Use cases
Link all accounts; track expenses; set and plan
Retail Account aggregation
savings goals; self-administration

Peer-to-peer payments services Mobile money transfer directly from account

Point-of-service money transfer directly from

Consumer-to-business payments
account (offline and online)

Banking products Identify leads for lending or investment products

Products
cross-selling
Nonbanking Identify leads for insurance and utilities offers

Enable payments and services beyond payments;

Lifestyle offerings offer alternative payments methods on bank's
platform (e.g., Alipay)

Identification and authentication Provide digital identity, e.g., for secure login to tax
services department

Corporate Balance sheet simulation Balance sheet/P&L simulation across accounts

Multi-account management Improve multi-account aggregation and management

Cash pooling and liquidity management across

Integrated cash management accounts

Enhanced risk scoring Use multi-account data to enhance risk scoring for
lending

Source: McKinsey Global Payments Practice

payments (as the European Payments Council’s have such services available). Leveraging A2A so-
SEPA Instant Credit Transfer scheme goes live), lutions potentially in conjunction with faster pay-
and the business-case justification should con- ments, a bank could help small and medium-size
sider the likely cannibalization of card revenues enterprises (SMEs) and midsize corporates in par-
as merchants adopt the lower-cost A2A model. ticular to streamline B2B payments, improving
working-capital management with integrated
On the corporate side, most bank executives ex- payables and receivables. PSD2 also opens the
pect use cases in multi-account management and way for new use cases in cash pooling and for-
cash management to have the biggest impact on eign exchange across multiple banks. Large cor-
client operations (although some markets already porates will most likely continue to use their

PSD2: Taking advantage of open-banking disruption 9

 current cash-management solutions, as these ser- tions and account information at other institu-
vices already embed advanced features that tions. Insights could trigger finely tailored cross-
would require long development times under the selling offers and support highly precise
PSD2 framework. Developing a state-of-the-art risk-scoring for more competitive pricing of
cash-management solution tailored for SMEs and loans and reduction in risk costs. The primary
mid-size corporates could generate €15 million to measure of success would be the incremental
€30 million in additional revenue for a leading Eu- increase in the bank’s share of the client’s trans-
ropean bank (depending on the bank’s customer action-banking wallet.
base). In this context, incumbents will probably
have a competitive advantage over regional banks The use cases described above can be inte-
(given their current operations and client fran- grated with diverse applications in an open digi-
chise); however, fintechs could gain market share tal platform supporting an ecosystem of
by developing solutions for specific verticals. providers and end users. The diversity of use
cases available on the platform both enhances
Another potentially high-impact opportunity the ecosystem’s ability to attract users and in-
among corporate clients is to optimize the use of creases the number of touchpoints and interac-
internal data for risk scoring and cross-selling. tions. These interactions not only generate
Several banks in our survey group already aggre- revenue, but also data, which can in turn be
gate data from other institutions where their retail used to personalize services and to develop new
customers hold accounts, providing a sound solutions for adjacent use cases. For example,
foundation for broadening the scope of their digi- Alipay, which originally developed as a way for
tal offering. buyers and sellers to transact business on Al-
ibaba’s e-commerce marketplaces, generates
On the retail side, lifestyle apps would likely in- extra liquidity that users can invest in an online
tegrate consumer budgeting tools, consumer fi- money-market fund (Yu’e Bao). Alibaba and its
nance, mortgages, insurance, and investments. financial services affiliate, Ant Financial, also use
This solution involves a much broader functional the vast data generated by users on its e-com-
scope than banks typically offer, spanning the merce marketplaces to rate the creditworthiness
full customer shopping journey and drawing on of users and extend loans to consumers and
data from diverse sources, such as social SMEs that trade on its platform.
media, Internet, and in-store searches. Half of
the banks we surveyed view “lifestyle apps” as The functional breadth of applications delivered
the most important retail use case arising from and accessed through the platform depends on
PSD2. the core value proposition of the ecosystem. In
the case of China’s Alipay, the ecosystem has
By consolidating customer data from diverse developed around Alibaba’s platform for retail
sources across the enterprise (in keeping with and wholesale e-commerce. In other cases, the
the EU’s General Data Protection Regulation), ecosystem may be more focused on financial
banks can generate a 360-degree view of cus- services, or it may be designed to meet the
tomer interactions. With customer permission, procurement and financing needs of companies
this view could be expanded to include transac- in a particular vertical. 6

6
For more on ecosystems, see Remaking the bank for an ecosystem world, October 2017, McKinsey.com.

10 PSD2: Taking advantage of open-banking disruption

Recommendations customer data to jump ahead of the competition.
Continuing from the steps we outlined earlier Over the next 18 months, banks should act ag-
this year, 7 banks should look broadly at the evo- gressively to optimize the use of proprietary data,
lution of customer journeys (in both retail and particularly for cross-selling and loan pricing, in
corporate environments) and at the changes in retail as well as corporate banking.

■ Consider building a finance-based ecosystem or

how participants interact in diverse ecosystems.
What value is at risk? Which pieces of the value
leveraging an existing one. While requiring signifi-
chain must the bank support to increase value
cant management attention and potentially capital
under PSD2? No bank can deliver all use cases
investments as well, ecosystems offer the oppor-
to all customer segments. Depending on the
tunity to co-opt some third-party organizations,
markets they serve, some banks will emphasize
retain customer touchpoints, generate additional
consumer-oriented “lifestyle” use cases, and
data on customers, increase pricing power, and
others will focus on new use cases for corporate
tap new sources of revenue. Developing an
clients. Staying focused on the markets and use
ecosystem strategy is particularly relevant for
cases where they can beat the competition on a
larger, primarily branch-based incumbents.

■ Define the groupwide strategy for opening up

sustained basis, banks should follow the steps
below as they build a strategy for PSD2:
under API banking. Banks should assess the IT
■ Define the bank’s ambition, and be prepared ei- implications of PSD2 both for transaction plat-
ther to lead or to execute a fast-follower ap- forms and groupwide systems and architecture.
proach. It is critical to establish a mechanism to Winning under PSD2 is not simply a matter of
identify, test and, if successful, scale up use maintaining connectivity for account queries and
cases faster than the competition. transaction initiation, but also seizing the opportu-

■ Conduct a comprehensive use-case evaluation.

nity to reduce costs and improve response times
by streamlining the IT architecture, from account
Banks should weigh carefully the strategic impact
servicing to groupwide data management. IT de-
of potential business opportunities arising from
sign should be flexible to accommodate fast-
PSD2. What is the potential of each use case to
evolving fraud controls and regulatory standards.
augment customer touch points and data stores,
increase revenue, and expand market share? In ■ Identify potential technology partners. How can a
addition to gains and losses in revenue and the bank attract the right PSPs to their solutions-de-
cost of technology upgrades, the use case should velopment “sandbox”? Banks should leverage the
also consider the necessary changes in bank cul- strengths of fintech innovators, established tech-
ture and talent pool. nology providers, and even other banks that can

■ Evaluate the potential of data (and customer

deliver flexible technology solutions for customer
use cases to support continual innovation.
touchpoints) as a core asset. Recognizing the po-
tential to apply advanced analytics to internal data ■ ■ ■
reserves to enhance fraud detection, customer re-
Building selectively on existing market solutions,
lationship management, and credit scoring, sev-
PSD2 consists primarily of a set of principles and
eral banks are already leveraging existing
generally avoids concrete prescriptions. It is thus

7
“PSD2: Time for radical change,” McKinsey & Company Global Payments Practice, March 2017.

PSD2: Taking advantage of open-banking disruption 11

 very clear about the what, but uncertain about new regulation opens highly attractive opportuni-
the how and to what end. While there is consider- ties for established payments organizations. But
able uncertainty about both the gravity and timing to win, banks will need to capture this disruption
of the threats to emerge under the PSD2, the and turn it to their advantage.

Alessio Botta is a partner in McKinsey’s Milan office, where Tommaso Jacopo Ulissi and Elia Sasia
are consultants. Nunzio Digiacomo is an associate partner in the Rome office and Reinhard Höll is
an associate partner in the Dusseldorf office. Reema Jain is a knowledge expert in the Gurgaon of-
fice, and Liz Oakes is an associate partner in the London office.

12 PSD2: Taking advantage of open-banking disruption

Global Banking Practice
January 2018
Copyright © McKinsey & Company
www.mckinsey.com/clientservice/financial_services