HACKER Q&A
📣 whyami

Can open banking be end-to-end encrypted?


6 months ago, I left a company working in open banking that does some icky stuff with the data they collect from people. I was regularly tasked to look through people transaction data in complete violation of personal privacy and legal regulations (protected statement under appropriate Whistleblowing laws).

I wouldn't trust any banking app that integrates with their platform, so I began thinking of how this could be done open source and zero-knowledge. The problem is that bank API's require a central server that proxies all the banking data API calls.

Has anyone thought about how to do this without screen-scraping? I like the idea of open banking, but I don't trust any of the companies doing it.


  👤 salawat Accepted Answer ✓
The banking world is very much point-to-point, everyone knows everyone else, because money transfer is a licensed business in the United States. Any money transmitter has a responsibility to comply with AML/KYC requirements, so ZK banking isn't technically a thing. It's an oxymoron.

Now if you're talking about providing interfaces and integrations to the plethora of banks out there, a la what Plaid claimed to be doing, then you've got exactly the issue you're describing. You must have enough process and compliance chops to satisfy the various money transmitters you're integrating with that even giving you the credentials to handle people's financial information is not going to put them at excessive risk. With that comes the need to be profitable enough to pay people to implement said processes, which is generally why B2C financial services companies typically live off fees/monetizing data in some way, shape, or form.

Do not go looking at Plaid for answers, because what they were up to was a gross violation of professional ethics, and they have been the subject of class action suits over it.

It's unfortunate, but we've literally turned our financial system into a de facto arm of law enforcement. Anything that doesn't do so is by definition not a legitimate/compliant enterprise in the United States.

Now you might be able to supply a toolkit such that end users can build their own integrations if you're really good at making domething to do most of the heavy lifting for end users. Good luck on the marketing though.