. in order to protect critical financial information of users and to enforce a mechanism for obtaining proper consent from customers, the consent of the customer to be obtained by the account aggregator shall be a standardised electronic consent format as prescribed under regulations. the aa is required to inform the customer of all necessary attributes to be contained in the consent format and the rights of the customer to file complaints. the customers are also provided a functionality to revoke consent post which a fresh consent would have to be obtained. explicit onus has also been placed on financial information provider ( fip ) to verify – validity of the consent, specified date and usage of it and the credentials of the aa. 12. different jurisdictions have taken a different approach on the issue of open banking. while some have adopted a prescriptive approach, requiring banks to share customer - permissioned data and requiring third party users to register with regulatory authorities, others have taken a facilitative approach by issuing guidance and recommended standards, and releasing open api standards and technical specifications. some jurisdictions also appear to be following a marketdriven approach, currently having no explicit rules or guidance. 13. the aa is a regulatory initiative in india under a hybrid model which is a combination of prescriptive & facilitative approaches and is in its early stages of development. one of the key things to look out for is whether the market forces will drive the adoption of this initiative or further regulatory nudge will be required. the pace of adoption will also depend on the strength of the community to come together and continue to drive the technical specifications standards and scalability potential. now, to continue with the tradition of a central banker and regulator, let me also enunciate few risks and spread some words of caution along the way. risks associated with open banking 14. open banking may offer benefits in the form of convenient access to financial data and services to consumers and streamlining some costs for financial institutions. however, it also potentially poses significant risks and concerns around : financial privacy and data security : in open banking frameworks, risks associated with the loss or theft of personal data on account of poor security, data protection violations, money laundering, and terrorist financing concerns cannot be ruled out. therefore, large scale adoption of open banking frameworks should ideally be preceded by strong data protection and privacy laws. such laws should anchor the ownership rights and ensure control and consent - based use of the data. they should also establish the boundaries of rights and obligations of third - party

use, down - streaming of data to fourth parties and reselling it. india has already embarked upon the same and the personal data protection bill, 2019 has already been introduced. the bill seeks to provide for protection of personal data of individuals and establishes a data protection authority for the same. customer liability : in absence of explicit arrangements for redressal of customer grievances and limiting their liability in case of erroneous or fraudulent activity, the acceptability of open banking frameworks may remain limited. therefore, the jurisdictions should look to address customer liability for third party access of data through customer protection or indemnity laws. rbi has issued charter of customer rights in december 2014 which lists ‘ right to privacy ’ along with ‘ right to grievance redress and compensation ’ among others. the right to privacy requires that customers ’ personal information should be kept confidential unless they have offered specific consent to the financial services provider or such information is required to be provided under the law or it is provided for a mandated business purpose. 3 / 5 bis central bankers'speeches cybersecurity and operational risks : use of open banking architectures, which is premised on the enhanced sharing of data, increases the surface area for cyber frauds. as the open api provides uncluttered access to customer banking data such as transactions and balance stored within the infrastructure, it may also pose a severe cybersecurity risk. losses caused to customers on account of cyber events would require financial institutions to compensate customers for such losses. institutions may also face a variety of potential operational and cyber security issues related to the use of apis, including data breaches, misuse, falsification, denial of service attacks and infrastructure malfunction. compliance and reputational risk : while open banking expands vistas of traditional banking and offers unique business opportunities, it also reposes extreme responsibilities with respect to compliance with applicable prudential regulations and privacy laws. risks arise due to exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements due to omissions and commissions of the third - party service provider. grievance redressal : with more parties and intermediaries involved in the provision of financial services in an open banking model, it is more difficult to assign liability. if the regulations governing customer grievance redressals are not updated to take open banking business models into consideration, the national authorities may find it difficult to provide the customers adequate levels of protections. in