Application programming interfaces (APIs) are shortcuts that make it easier for software developers to build new applications. In the banking context, however, they are something more. APIs enable easy access to banking services, products, and data. This transforms them into keys, capable of unlocking a range of business opportunities. Add the impact of regulation and they change again, becoming agents of disruption with transformative potential.
APIs are in effect multipurpose tools, enabling compliance with open banking regulation such as Europe’s Payment Services Directive 2 (PSD2), access to ecosystems of related businesses, and simplification of legacy IT systems. They represent a significant opportunity to innovate, work more efficiently, and develop new products and services.
When it comes to API implementation, progress is patchy. Many banks have taken initial steps, and have seen positive returns in terms of technology development, customer engagement, and business expansion. In China, for example, various ecosystem models are bringing together fintechs, companies, banks, and other financial services providers to buy and sell products, share technology, and expand their networks. Banks in Europe and the US are also starting to get involved, often working with, or investing in, fintechs to create new revenue streams and more tailored customer experiences. Some have launched aggregator apps, bringing together account information from a number of institutions, or have created online marketplaces in which partners can pick and choose products and services, sometimes to integrate into their own platforms.
Still, while some banks are ahead of the curve, the majority have work to do. Most are in the development phase, and few fully understand how a data-driven business model will work for them. McKinsey estimates that the value at stake across global banking is significant — approximately 50 percent of revenues or 65 percent of profits (the money banks make from distribution rather than manufacturing) over the coming decade. On that basis, efforts to date represent the tip of the iceberg.
Three basic models, but no big bang
As API-driven financial services expand, individual institutions are developing applications based on their own priorities. These are aligned with three generic API models, which most banks apply in combination. One is focused on internal processes, systems, services, and data and two are external-facing and oriented either to commercial partners or the general public.
Each model is associated with a distinct set of business priorities. Internal APIs are designed primarily to streamline software development and simplify systems and operational processes. These currently represent the vast majority of use cases. Partner APIs, meanwhile, allow external firms to access data that can enhance products and services or create new ones. Finally, public APIs open up bank data, products, and services to communities of developers, with the aim of encouraging rapid development and commercialization. One example of this kind of innovation is integration of a credit application on a real-estate website.
For now, most banks are focused on internal API development. A McKinsey survey conducted in late 2018 shows that more than 91 percent of APIs are internal (Exhibit 1). Just 7 percent are partner APIs (mostly arising from regulation such as PSD2). Partners are mainly fintechs and customers. Less than 2 percent are public.
Exhibit 1
Where they are building external models, many banks are providing banking-as-a-service to fintechs, aiming to use existing assets to construct new products and services. Another powerful use case is to integrate offerings into customer IT platforms. One large European bank, for example, is developing a “treasury cockpit,” which can be integrated with customer systems to enhance transparency and enable faster interactions.
While the majority of APIs by number are internally focused, most banks have some kind of outward-looking program. According to a McKinsey survey and publicly available data, some 65 percent of the 40 European institutions among the 100 leading global banks (ranked by balance-sheet assets) have a developer portal to share APIs externally. On a global level, 47 percent of the top 100 do the same thing. Regulation is often a primary driver, but equally banks are seeking to innovate where they see an opportunity.
Where banks have externally facing portals, some 43 percent of APIs are focused on complying with PSD2. These may, for example, offer access to account data or enable third-party payments. The rest relate to functions outside PSD2 requirements, including services such as branch/ATM finders, account opening and closing, FX, and loan applications (Exhibit 2). In fact, some 57 percent of external APIs are not required under PSD2 compliance.
Exhibit 2
Banks’ willingness to innovate beyond regulation is usually a reflection of strategic objectives. Respondents to our survey say their most important rationale for API investment is reduction of IT complexity. Next come revenues and cost cutting, followed by regulatory requirements and to enable partners. Of course, API development also represents an opportunity to boost fee income, a welcome benefit in a low-interest-rate environment.
Despite this wide range of motivations, the API “revolution” is still in its infancy. One reason is that many banks suffer from a strategic deficit. Executives understand the principles, but are unsure of how they create a material impact on the bottom line. As a result, there is little sign of a “big bang” in API-based propositions.
What does it take to unlock the potential?
Based on our work with financial institutions and insights from our survey, McKinsey has developed a standardized framework for building a cutting-edge API capability. The framework comprises four key elements: strategy, operating model, technology, and people (Exhibit 3).
Exhibit 3
One core underlying principle is that API development must be business-value focused. This means for external APIs, banks need a well-thought-through API monetization model, potentially including a combination of schemes such as freemium and pay-per-use. Internal APIs should add value through factors such as costs savings, speedier time to market, and increased quality of products and services.
From an operating model perspective, there are two basic steps, starting with a centralized model and progressively moving to a decentralized approach. Centralized models, with a single team developing APIs, can create critical mass and act as a focal point for learning. A decentralized version, meanwhile, suits more mature scenarios. It most often comprises agile teams working across the business. Funding strategy may echo this approach, with funding initially provided centrally but later shared between teams.
From a technology perspective, it makes sense to build a central API management platform, which can act as a single source of truth for developers. A single platform is also an antidote to duplication and supports the use of monitoring tools. In addition, principles of recycling should apply. APIs should be designed to be reusable, and over time should become first choice for delivering new business features. Equally, in a dynamic marketplace, banks should aim to develop API capabilities quickly and to focus on continuing to innovate, even as they reach maturity.
Finally, talent is crucial. Banks need to recruit the best people and hold onto them. This is a sure route to competitive advantage. A related point is the necessity of senior level buy-in. The most successful API initiatives are supported by senior management, in most cases directly by CXOs—ensuring a strong focus on business value. Still, senior executives may require education on the relevance and potential of APIs—it makes sense to develop ways of talking about APIs that are not too technical. Once engaged, leaders should adopt an API-first mentality, so that every product initiative is gauged in terms of its API potential. Incentivization schemes should also reflect this priority.
API-driven products and services represent both a competitive threat to incumbent banks and a significant opportunity. Most management teams understand the potential and are starting to roll out projects to streamline internal processes and reach out to third parties. Some are already realizing significant benefits. Still, as digitization accelerates, the competitive temperature is rising. Banks that have made a slow start need to accelerate and focus more intently on turning innovation into real impact on the bottom line.
More information on our API transformation approach, case examples, and the API survey results can be requested via Global-API-Survey@mckinsey.com.