Every bank, building society, credit union and intermediary today manages open finance risk using approaches built for a different structure entirely – and none of them were designed for open finance chains that move horizontally through intermediaries, fintechs and their own sub-processors while regulation governs vertically, within sectors and within borders. That mismatch is a structural feature of how the ecosystem is built, not a failure of any single institution's diligence.
To see why the status quo doesn't hold up, it helps to look at what each existing approach actually assumes:
- Bilateral agreements don't transfer effort: Most banks don't negotiate directly with each fintech – that relationship usually sits with the intermediary, and only the largest banks or directly-connected entities take the extra step of a bespoke data access agreement. But whichever layer does the vetting, the work doesn't transfer: an aggregator that has fully vetted a fintech gets no credit for that when the next aggregator, or the next bank with its own data access agreement, vets the same fintech from scratch.
- Vendor management programs assume a chosen supplier: These frameworks were built for vendors the institution selected itself, such as an IT outsourcer or payment processor. In open finance, the consumer chooses the third party, not the bank – yet the bank still carries the regulatory accountability for what happens next.
- Periodic compliance checks confirm the past, not the present: Due diligence happens at onboarding and then again on a fixed cycle, often annually. Between those checkpoints, a third party's risk profile can change completely – new ownership, new sub-processors, a security lapse – so the check confirms what was true months ago, not what's true today.
- None of the three approaches were built to assess Artificial Intelligence (AI) risk: Intermediaries, fintechs and technology service providers are deploying AI at the same pace as everyone else, often with governance lagging behind adoption, so an institution can pass every existing check and still have no visibility into ungoverned AI experiments running downstream.
The result is fragmented visibility, since no institution sees the full open finance chain, and duplicated effort, since the same fintech gets vetted independently by every aggregator or directly-connected bank it works with. Liability, in practice, lands on whoever holds the customer relationship regardless of where the failure actually occurred – and recovering that cost from the party actually responsible often falls short in either direction: a small fintech or aggregator's balance sheet often can't absorb the exposure, while a large, well-resourced third-party provider can turn recovery into years of litigation rather than a straightforward claim. Either way, the institution is left holding the cost more often than not.
About Invela
Invela is the infrastructure layer that makes open finance trustworthy – accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place. Open finance, covered.
-p-2000.jpg)
