开放银行的法律规制

Legal Regulating Open Banking

开放银行作为一种商业模式创新成为金融市场不可逆的发展趋势,并逐步进阶为开放金融。我国开放银行的推进应从市场驱动模式转变为激励性规制驱动模式。开放银行规制应解决四个重点问题,即厘清商业银行共享消费者数据的义务边界、确定第三方服务提供商的类型及其权义、优化金融消费者行使权利的方式,以及通过合同机制配置数据控制者和数据使用者的义务及责任。为此,开放银行规制策略的选择组合应包括:一是规制目标应界定为金融消费者数据权利和金融权利的双重保护;二是规制取向应保持动态一致性,通过测试与学习机制推动开放银行向高阶发展;三是规制方式应精确调适,灵活运用行政规制和自我规制的工具箱;四是规制依据应分层确立,形成国家立法、部门规章和行业标准相结合的规则标准体系。

Open banking is a set of initiatives by governments and financial industry to implement data portability and improve consumers'access to financial information and services,while preserving privacy and security.As a business model innovation,open banking is facing an evolving trend in many jurisdictions.Most OECD countries have established specific frameworks for open banking.In June 2023,EU legislators released three proposals to be more success in a data driven economy for people and business,which include Proposal for PSD3,Proposal for Regulation on Payment Services,and Proposal for Open Finance.And US financial regulator CFPB issued Required Rulemaking on Personal Financial Data Rights in October 2023.This proposal activates a dormant provision of law enacted by Congress more than a decade ago.For China,the existing market-driven approach is different from EU and US.The promotion of China open banking should be upgraded from market-driven model to incentive-based regulation driven model.The open banking regulation should address four key challenges.(1)clarifying the boundaries of the obligations of commercial banks as data holders to share consumer data.Personal Information Protection Law provides consumer the right to data portability,but data holder's obligation to enable access is ambiguous in existing national financial laws;(2)defining the types of third-party service providers and their rights and obligations.Third-parties accessing to and using financial data should act on behalf of consumers;(3)facilitating the way financial consumers exercise their rights to data portability and financial product and services;(4)allocating the obligations and responsibilities between data controllers and data users through private contract as self-regulation mechanism.In responding to challenges above,open banking regulators should take flexible strategies as follows.First,the regulatory objective of open banking should be defined in Commercial Banking Law clearly.The dual regulatory objectives include protecting both financial consumer's data portability and financial product and services rights.In other words,financial consumers are protected from data laws and financial laws simultaneously which eliminate consumers worry about cybersecurity risks as well as how to protect their data when sharing data.Second,the regulatory orientation and approach should maintain dynamic consistency through testing and learning mechanism.The aim of this approach is to overcome the static,coarse,and backward-looking rules and enable financial regulators to harness and learn from the financial markets.Open banking rules and standards should be adaptive for future open finance.Building on existing open banking frameworks,open finance expands data access and sharing to data sources beyond payment/transaction data,while it also includes other areas of financial activity.Third,the regulation methods should be adjusted precisely with toolbox for administrative regulation and self-regulation.The legal regimes should consist of a collective contractual agreement between data holders and data users with the objective of promoting sharing efficiency and financial innovation to the benefit of consumers.Fourth,the regulatory system should be constructed including public and private rules and standards.Commercial Banking Law should state obligation of data holder to make consumer data available to data user upon request from consumers'express consent.Financial regulators should make a rule on personal financial data rights as well as financial data standards and API technical standards for data holders as well as data users.