The Second Wave: Why Open Finance - Not Open Banking, Will Reset APAC BFSI Distribution

Open Banking taught APAC's incumbents that they could expose data through APIs. Open Finance will teach them whether they can still own the customer once that data moves. Between mid-2025 and the end of 2027, five regulatory shifts will convert what has largely been a compliance exercise into a live commercial battle. Australia's Consumer Data Right (CDR) expands to action initiation and non-bank lending in 2026 (Fiskil, 2026; ACCC, 2025). Bank Negara Malaysia's Open Finance framework moves from exposure draft to phased rollout across 2026 (Bank Negara Malaysia, 2025; Digital News Asia, 2026). Hong Kong's Commercial Data Interchange (CDI) and Open API Phase IV are pulling SME credit decisions onto shared data rails, with more than HK$1.6 billion (US$204 million) in loans extended during the pilot alone (HKMA, 2026; Vixio, 2024). Singapore's SGFinDex continues to widen from banking into insurance, CPF and tax data (MAS, 2024). Indonesia's OJK is finalizing its Open API Standard for Payment (SNAP)-adjacent open finance rules.

The strategic point for boards and executive committees is not that these frameworks exist. It is that, in aggregate, they redraw the boundary of the bank. The APAC open banking and open finance market is forecast to grow at a compound annual rate above 22 per cent through the early 2030s, with the region tracking the fastest globally (Astute Analytica, 2026; GlobeNewswire, 2026). Mastercard's 2026 State of Open Finance study finds 75 per cent of executives report that open finance has already driven revenue growth, while institutions leaving 4.6 per cent of annual revenue on the table because they cannot obtain the consumer permissions they need (Mastercard, 2026).

For CEOs, CIOs and CDOs in Banking, Insurance, and Financial Services, this article sets out the shift underway, the four architectural decisions that determine competitive position, and the operating-model choices that separate participants from platforms.

From Compliance Exercise to Commercial Contest

For most of the past five years, Open Banking in APAC has been a regulator-led program: build the APIs, publish the standards, meet the deadlines. The customer's story was thin. Volumes were modest. Boards approved the spend and moved on.

That posture is now obsolete. Open Finance is a categorically different proposition. It expands the scope of shareable data beyond current accounts to superannuation, pensions, wealth, insurance, mortgages, credit history, tax filings and, increasingly, commercial transaction data. It expands the set of authorized third parties beyond fintechs to include large platforms, non-bank lenders, aggregators, and in some jurisdictions, government agencies. And in three APAC markets it will soon allow those parties to initiate actions: payments, product switches, account openings - on the customer's behalf.

This changes the economics of distribution. The incumbent that used to control both the data and the moment of decision is now competing with any authorized recipient of that data for the same moment. The strategic question is no longer "how do we comply?" - it is "when the customer's data leaves us, why do they come back?"

The APAC Regulatory Map, Mid-2026

The regional trajectory is uneven but directionally aligned. Five regulator-led programs matter most.

Australia - Consumer Data Right (CDR). Banking data-sharing has been live since 2020. Two developments in 2026 change the game. First, "action initiation" moves from legislation to live production, allowing accredited third parties to open, switch and instruct products on the customer's behalf (Treasury of Australia, 2025). Second, the scope expands from banking and energy into non-bank lending - bringing buy-now-pay-later providers, mortgage aggregators and fintech lenders into the reciprocal data-sharing regime (Fiskil, 2026). Together, these turn CDR from a read-only pipe into a two-way commercial channel.

Hong Kong - Open API and CDI. Phase IV Open APIs, focused on transactional and cross-institution capabilities, are now in progressive production alongside the Commercial Data Interchange, launched by the HKMA in late 2022. CDI links banks to alternative commercial data sources - logistics, e-commerce, telco, government registries - specifically to accelerate SME credit decisions (Commercial Data Interchange, 2025). In the pilot phase, 23 banks and 10 data providers extended over HK$1.6 billion in SME loans through CDI (Vixio, 2024). The HKMA's Taskforce on SME Lending, meeting on 29 April 2026, reinforced the platform's role in extending credit through the current economic cycle (HKMA, 2026).

Singapore - SGFinDex. MAS and the Association of Banks in Singapore, working with Smart Nation, have progressively expanded SGFinDex - the Singpass-anchored consumer data exchange - from banking into insurance, CPF and IRAS (MAS, 2024). Uptake, while modest in absolute terms compared with population, has been directionally significant: hundreds of thousands of accounts linked and data pulls in the millions since inception, with adoption accelerating as tax and retirement data have come in-scope (Fintech News Singapore, 2025).

Malaysia - BNM Open Finance framework. Bank Negara Malaysia issued its Open Finance exposure draft on 18 November 2025, with consultation running to 1 March 2026. The framework covers banking, insurance and takaful, and creates a tiered accreditation regime for third-party recipients. Phased rollout is targeted from mid-2026 (Bank Negara Malaysia, 2025; iMoney, 2026).

Indonesia - OJK and SNAP. Bank Indonesia's SNAP payment API standard is now foundational; OJK is progressing complementary open finance rules to bring wealth, insurance and consumer credit data into a consent-based sharing regime, aligned with the country's ID Kependudukan digital identity roll-out.

The wider Asia Pacific region - including Thailand, the Philippines, Korea, Japan and India - is on the same curve, at different velocities. The Asian Development Bank's 2025 review of 16 APAC jurisdictions concluded that the region is moving decisively past regulator-mandated pilots toward interoperable, commercially meaningful open finance markets (Cambridge Centre for Alternative Finance & Asian Development Bank, 2025).

Current Challenges: Why Open Banking Under-delivered

Executives who watched the first wave of Open Banking under-perform are entitled to some scepticism. The reasons for that under-performance are instructive, because they tell us what has to change for the second wave to land.

Thin use cases. Read-only account data, delivered through a compliance API, produced few compelling consumer propositions. Personal financial management dashboards did not shift behavior at scale. The customer story rarely justified the friction.

Weak consent journeys. First-generation consent flows were regulator-safe but consumer-hostile - dense, legalistic and repetitive. Drop-off rates in early Australian and UK deployments exceeded 40 per cent at the consent step (Deloitte, 2024).

Reciprocity asymmetry. Where large tech platforms could receive data but not share it back, banks felt correctly that they were subsidizing competitors. This has slowed voluntary participation in several jurisdictions.

Data quality and API reliability. Latency, downtime and inconsistent field mappings across banks eroded developer trust and slowed third-party product-market fit.

Absence of a monetization model. Regulators mandated the pipes but not the tariffs. Institutions treated Open Banking as a cost center and staffed it accordingly.

Open Finance does not automatically fix any of these. It does, however, raise the stakes such that leaving them unfixed becomes untenable.

Five Shifts Reshaping the APAC Landscape

1. From data-sharing to action-initiation. Australia's move to production action initiation, and comparable capabilities emerging in Singapore and Malaysia, mean the customer will increasingly be able to move money, close accounts and switch providers from an interface that is not the bank's. The moment of decision moves out of the incumbent's channel.

2. From consumer-only to commercial data. Hong Kong's CDI, Singapore's evolving business data initiatives and Australia's non-bank lending expansion pull commercial and SME data into the same regime. This creates larger revenue prizes and steeper competitive stakes, particularly in credit.

3. From narrow accreditation to tiered ecosystems. Malaysia's framework and Indonesia's emerging rules explicitly recognize different classes of participant - from full data recipients to affiliate-only intermediaries. This proliferates the counterparties incumbents must manage.

4. From price competition to permission competition. With Mastercard finding that 4.6 per cent of annual revenue is now dependent on consumer permission grants that are not being obtained (Mastercard, 2026), the ability to earn, hold and re-secure consent becomes a first-order commercial capability, not a compliance one.

5. From batch to real-time reciprocity. Regulators increasingly expect symmetric, near-real-time data movement. Latency and quality gaps that were tolerable in a read-only compliance world now translate directly into commercial losses.

Strategic Analysis: Four Architectural Decisions That Determine Position

Boards should focus on four decisions. Each is a strategic call before it is a technical one.

Decision 1 - Consent as a product, not a page. In a permission-driven market, the consent journey is where retention economics are decided. The institutions that will win are those that redesign consent as an ongoing relationship - with dashboards, granular controls, contextual re-authorization and clear demonstrations of value returned. Best-in-class deployments in Australia and Singapore have reduced consent drop-off from above 40 per cent to below 15 per cent by treating the flow as a product surface, not a legal notice (Deloitte, 2024). This is a design, data and orchestration problem, not a legal one.

Decision 2 - API surface as commercial infrastructure. Beyond the mandated APIs, the institutions extending share of wallet in Open Finance markets have built discretionary API surfaces - for embedded credit, insurance quote-and-bind, wealth advice and payment initiation - that generate direct revenue. BCG's 2025 review of open ecosystem revenue found that leaders derive 3 to 8 per cent of adjacent-product revenue from third-party channels within three years of launching a commercial API programme, against near-zero for institutions that expose only regulator-mandated interfaces (Boston Consulting Group, 2025).

Decision 3 - Data reciprocity strategy. Every institution now has to answer: which external data do we take in, and how do we use it in our own decisioning? CDI in Hong Kong is proving that data ingested from logistics, e-commerce and government registries can materially compress SME credit decisions, from weeks to hours, and reduce loss rates through richer signal. Institutions that treat Open Finance purely as an outbound obligation forfeit this margin.

Decision 4 - Platform posture vs. participant posture. Not every institution can - or should - attempt to be the aggregator. Some will play as premium participants distributing through others; some will attempt to be the customer's primary financial cockpit. The trap is drifting between the two without deciding. Boards should force the strategy: platform, participant, or explicit hybrid, sized by product and segment.

Real-World Examples

Commonwealth Bank of Australia (CommBank). CommBank has invested heavily in a customer-owned data experience within its app, positioning itself as the destination for CDR-enabled consolidation before third parties can. The strategic bet is that Australia's CDR will produce a small number of "primary" digital financial cockpits and that being one of them is worth more than optimizing downstream API monetization. Early adoption metrics inside its CDR proposition have outpaced sector averages (Commonwealth Bank of Australia, 2025).

DBS Bank. DBS's API programme now exposes several hundred production APIs and has integrated deeply with Singapore's SGFinDex. The bank's stated approach is to treat APIs as a distribution channel with commercial KPIs - call volume, partner revenue, cost-to-serve reduction - rather than a technology programme. DBS's public disclosures link its API strategy to material productivity and revenue outcomes over successive years (DBS Group, 2024).

HSBC Hong Kong. HSBC was among the pilot banks on CDI and has publicly reported meaningful improvements in SME credit decision cycle time by combining CDI data ingestion with automated underwriting. The commercial thesis - that better data narrows both approval time and loss rates - is now generalizing across the CDI participant cohort (HKMA, 2025).

Ping An OneConnect and Southeast Asian insurers. In the insurance and takaful segments, several APAC carriers are quietly building data-sharing partnerships that anticipate BNM's framework in Malaysia and the widening of SGFinDex in Singapore. The clearest wins to date have been in accelerated onboarding and pre-filled application journeys, which have reduced underwriting friction and increased conversion at the point of sale (McKinsey & Company, 2024).

Actionable Recommendations

For CEOs, CIOs, CDOs and Heads of Digital across APAC BFSI, six actions merit immediate attention.

First, appoint a single accountable executive for the institution's Open Finance strategy, at the C-1 level, with joint reporting into commercial and technology. Diffuse ownership across compliance and product is the most common failure pattern.

Second, run a permission P&L. Quantify - by segment, product and channel - the revenue currently exposed to consumer permission grants that the institution does not reliably obtain today. This anchors board discussion in commercial terms.

Third, redesign the consent journey as a product. Consent flow, dashboard, revocation and re-authorization should be owned by a product manager with clear conversion and retention KPIs. Bring design research in from day one.

Fourth, build a commercial API strategy on top of the compliance API estate. Identify the two to three adjacent revenue pools - embedded lending, insurance distribution, wealth signals, payments initiation - where the institution can defensibly charge for API access, and stand up an API product organization to run them.

Fifth, treat data ingestion as strategically important as data exposure. The most under-invested capability in APAC BFSI today is the ability to ingest, cleanse and reason on third-party data at production quality. This is where credit, underwriting and personalization margin will be won.

Sixth, harden the operating rails. Latency, availability, versioning discipline, developer experience and observability are not back-office concerns in an Open Finance market - they are competitive assets. Institutions should target 99.95 per cent API availability and sub-500 ms P95 latency on customer-facing surfaces as a baseline.

The sourceCode Perspective

At sourceCode, we work with banks, insurers and financial services firms across APAC and Southeast Asia to move from compliance-scale API estates to Open Finance-grade commercial platforms. Three patterns from our engineering practice are worth highlighting.

The first is that consent orchestration - not core API build - is where most institutions under-invest. Getting to sub-15 per cent drop-off requires a genuine product surface: server-driven UI, contextual re-authorization, clear data lineage back to the customer and multi-channel revocation. This is achievable, but it requires design, engineering and data working as one team.

The second is that the winning API estate is a two-tier one: a lean, standards-compliant regulatory tier and a curated, commercially-priced product tier. Treating the two as one leads to over-engineering the compliance surface and under-investing in the surfaces that actually earn revenue.

The third is that the ingest side of Open Finance - the ability to take in third-party data and use it in real decisioning - is where our BFSI clients see the fastest margin improvement, especially in SME credit and insurance underwriting. This capability rests on modern data platforms, event-driven architectures and disciplined data contracts.

Wherever institutions sit on this curve, the direction of travel is consistent: platform-grade engineering, product-grade consent, data-grade decisioning.

Conclusion

Open Banking was a compliance program that produced modest customer outcomes and modest commercial ones. Open Finance is a different animal. It broadens the shareable data set, invites more capable counterparties into the ecosystem and, crucially, hands the customer the ability to move money and switch providers from surfaces the incumbent does not control. In APAC - the fastest-growing region in the global open finance market (GlobeNewswire, 2026) - the regulatory calendar has become the commercial calendar.

The winners will not be the institutions with the most APIs. They will be the institutions that treat consent as a product, data ingestion as a source of margin, and their API estate as commercial infrastructure. The rest will discover that they still exist in the value chain, but no longer at the center of it.

If your leadership team is shaping its Open Finance strategy - from consent design to commercial API pricing, or from CDI-style data ingestion to Action Initiation readiness - sourceCode's BFSI engineering and advisory teams work with banks, insurers and financial services firms across APAC to move from compliance posture to commercial position. Explore how we can help at sourcecode.com.au.

Frequently Asked Questions

What is the difference between Open Banking and Open Finance? Open Banking refers to the regulated sharing of consumer banking data (typically current and savings accounts) with authorized third parties via APIs. Open Finance extends the same consent-based framework to a wider scope of financial data - including insurance, superannuation and pensions, wealth, mortgages, credit history and tax data - and to a wider set of authorized participants. In several APAC markets it also incorporates action initiation, allowing third parties to move money and switch products on the customer's behalf.

Which APAC jurisdictions have live Open Finance frameworks in 2026? Australia (Consumer Data Right, expanding to non-bank lending and action initiation), Hong Kong (Open API Phases I-IV and the Commercial Data Interchange), Singapore (SGFinDex, expanding beyond banking), and Malaysia (BNM Open Finance framework, phased rollout from mid-2026) have the most mature programmes. Indonesia, Thailand, the Philippines, Korea, Japan and India are progressing on parallel tracks.

How large is the APAC open banking market? The global open banking market is forecast to grow from approximately US$28.7 billion in 2024 to over US$114 billion by 2031, at a compound annual growth rate above 22 per cent, with Asia Pacific the fastest-growing region (Astute Analytica, 2026; GlobeNewswire, 2026).

What is the biggest execution risk? Under-investing in consent journeys and third-party data ingestion. Both are commercial capabilities, not compliance ones, and are where the widest performance gap between leaders and laggards is emerging.

How should institutions organize for Open Finance? Assign a single C-1 executive with joint commercial and technology accountability; run a "permission P&L"; treat consent as a product; build a commercial API tier on top of the mandated one; and invest as heavily in data ingestion as in data exposure.

References

Asian Development Bank & Cambridge Centre for Alternative Finance (2025) The APAC State of Open Banking and Open Finance Report. Manila: Asian Development Bank. Available at: https://www.adb.org/publications/the-apac-state-of-open-banking-and-open-finance-report (Accessed: 22 July 2026).

Astute Analytica (2026) Open Banking Market Size, Share, Growth [2035]. Available at: https://www.astuteanalytica.com/industry-report/open-banking-market (Accessed: 22 July 2026).

Bank Negara Malaysia (2025) Exposure Draft: Open Finance, 18 November. Kuala Lumpur: BNM.

Boston Consulting Group (2025) Open Ecosystems in Financial Services: The Second Wave. Available at: https://www.bcg.com/industries/financial-institutions/insights (Accessed: 22 July 2026).

Commercial Data Interchange (2025) Home - Commercial Data Interchange. Hong Kong Monetary Authority. Available at: https://cdi.hkma.gov.hk/ (Accessed: 22 July 2026).

Commonwealth Bank of Australia (2025) Annual Report 2025. Sydney: CBA.

DBS Group (2024) API Programme and Ecosystem Update. Singapore: DBS.

Deloitte (2024) Reimagining Consent in Open Finance. Deloitte Insights.

Digital News Asia (2026) Malaysia advances open finance: Strengthening trust, inclusion, and innovation in financial services. Available at: https://www.digitalnewsasia.com/business/malaysia-advances-open-finance-strengthening-trust-inclusion-and-innovation-financial (Accessed: 22 July 2026).

Fintech News Singapore (2025) How SGFinDex Drives Digital Transformation in Singapore's Financial Sector. Available at: https://fintechnews.sg/72688/openbanking/sgfindex-drives-digital-transformation-in-singapores-financial-sector/ (Accessed: 22 July 2026).

Fiskil (2026) Open Banking Australia: CDR Guide for 2026. Available at: https://www.fiskil.com/grow/banking-api/open-banking-au (Accessed: 22 July 2026).

GlobeNewswire (2026) Global Open Banking Market: Europe's Leadership and Asia Pacific's Fastest Growth Highlight Regional Dynamics, 1 July. Available at: https://www.globenewswire.com/news-release/2026/07/01/3320424/28124/en/global-open-banking-market-europe-s-leadership-and-asia-pacific-s-fastest-growth-highlight-regional-dynamics.html (Accessed: 22 July 2026).

Hong Kong Monetary Authority (2025) Open Application Programming Interface (API) for the Banking Sector: Phased Approach. Available at: https://www.hkma.gov.hk/eng/key-functions/international-financial-centre/fintech/open-application-programming-interface-api-for-the-banking-sector/phase-approach/ (Accessed: 22 July 2026).

Hong Kong Monetary Authority (2026) HKMA and banking sector introduce new round of measures to support SMEs, 29 April. Available at: https://www.hkma.gov.hk/eng/news-and-media/press-releases/2026/04/20260429-4/ (Accessed: 22 July 2026).

iMoney (2026) Open Finance Malaysia 2026: What BNM's New Framework Means for Your Money. Available at: https://www.imoney.my/articles/bnm-open-finance-malaysia-2026 (Accessed: 22 July 2026).

Mastercard (2026) State of Open Finance 2026. Purchase, NY: Mastercard.

McKinsey & Company (2024) Asia's insurance markets: The next wave of distribution. Available at: https://www.mckinsey.com/industries/financial-services/our-insights (Accessed: 22 July 2026).

Monetary Authority of Singapore (2024) FinTech and Innovation. Available at: https://www.mas.gov.sg/development/fintech (Accessed: 22 July 2026).

Treasury of Australia (2025) Consumer Data Right: Action Initiation and Non-Bank Lending Expansion. Canberra: Australian Government.

Vixio (2024) Hong Kong Launches Next-Gen SME Open Banking Data Platform. Available at: https://www.vixio.com/insights/pc-hong-kong-launches-next-gen-sme-open-banking-data-platform (Accessed: 22 July 2026).