Annual API reviews can't keep up with who's on the other end
One of the clearest messages from Money20/20 USA came from a session on standards. Jean-Paul LaClair, SVP of Product at the Financial Data Exchange (FDX), and David O'Neill, COO of APIContext, agreed that compliance for open finance APIs is moving from annual conformance testing to continuous verification, run daily or several times a day. They also expect ownership of that work to move from engineering teams to risk and compliance.
That shift is overdue, and much of the reason has little to do with APIs themselves. The businesses on the other end of them now appear and change far faster than they used to.
Building a financial app now takes minutes
O'Neill put the supply side bluntly: anyone with a $100-a-month AI coding license can build a working financial app against public API definitions in about 20 minutes. The wider numbers point the same way. Anthropic reported that its AI coding tool, Claude Code, passed a $2.5 billion annualized revenue run rate within about nine months of launch.
And Gartner forecasts spending on AI agent software will reach $206.5 billion this year, up from $86.4 billion in 2025. When building is that cheap and that fast, the population of companies connecting to bank data grows and changes far faster than it did when an integration took a team months. The fireside chat made the same point about standards: consensus that used to take a decade now needs to happen in months.
A certificate isn't the same as trust
O'Neill also drew a line that matters for anyone relying on accreditation alone. Holding a certificate doesn't make an entity trustworthy, he said, and his biggest fear was mass data exfiltration by a “helpful” agent operating under someone's legitimate certificate. The credential would check out. What sits behind it might not.
The industry knows this needs answering. LaClair said FDX's call for input on agentic AI drew responses from more than 30 organizations, running to over 500 pages, and that the common thread was a governed path for this kind of access rather than a free-for-all.
The counterparty is a moving target
Continuous verification of APIs tells a bank whether a connection is behaving as it should. Risk teams also need a second answer: whether or not the business behind that connection is still the one they approved.
“When a small team can build, rebuild and redeploy a financial app in days, the third-party landscape turns over faster than any annual cycle can follow. Banks need to know continuously what's on the other end of their APIs, whether that's a fintech, a person or an agent acting for one.”
— Nathanael Coffing, Chief AI Officer at Invela
A fintech can change ownership, swap a key supplier or lose a security control between annual reviews just as easily as an agent can appear behind a familiar front end. As ownership of compliance moves to risk teams, they'll need a current view of both the connection and the company behind it. That's the layer Invela is building.
Invela is the infrastructure layer that makes open finance trustworthy - accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place.
