Romanian Competition Council's Preliminary Conclusions On The Retail Banking Sector Inquiry Launched In 2016

November 2018 - Following the adoption of EU Directive (EU) 2015/2366 of the European Parliament and Council of 25 November 2015 on payment services in the internal market (“PSD2”), the Romanian Competition Council (the “RCC”) launched in 2016 a comprehensive study of the Romanian retail banking market.

PSD2 is expected to fundamentally change the way payment and account information accessing operations are performed by eliminating the monopoly that banks currently hold over their customers' banking data. PSD2 allows third-party payment service providers (“TPPs”), such as fintech companies, to enter the market. For this to happen, banks must ensure TPP access to their payment infrastructure and client data through application programming interfaces (“APIs”) for the latter to eventually develop information and payment services as well as other financial services targeting banking customers.

Although requiring banks to open their client databases to fintech companies, PDS2 does not specify the method to achieve this, which allows the national authorities to opt for the solution that best suits local market requirements.

Through its analysis, the RCC observed that banks in Romania are currently free to offer services using their own API, which has the effect of stifling integration and communication between TPPs and banks. Moreover, developing, implementing and managing so many interfaces could prove inefficient for TPPs, resulting in them preferring banks with the most customers over banks with a reduced client portfolio. It is in this context that the RCC put forth its recommendations.

1 RCC recommendations on PSD2

1.1 Common API

The RCC recommends adopting a common API for the entire Romanian banking system. This solution, the RCC argues, has certain advantages, such as:

Simplifying the process of market entrance for service providers. Separate APIs could be considered as a barrier to entry by allowing access only to those providers capable of developing and managing a considerable number of APIs, which would eventually limit the number of service providers that customers can choose from; The same level of security for all banks, which would translate into a more efficient system for security control management; A more dynamic authentication of Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs); Simplified implementation for both banks and TPPs; Reduced costs for banks; simplified access for...