Every bank, building society, credit union and intermediary today manages open finance risk using approaches built for a different structure entirely -- and none of them were designed for chains that move horizontally through intermediaries, fintechs and their own sub-processors while regulation governs vertically, within sectors and within borders. That mismatch is a structural feature of how the ecosystem is built, not a failure of any single institution's diligence.
To see why the status quo doesn't hold up, it helps to look at what each existing approach actually assumes:
- Bilateral agreements don't transfer effort: Most banks don't negotiate directly with each fintech -- that relationship usually sits with the intermediary, and whichever layer does the vetting, the work doesn't carry over: an aggregator that has fully vetted a fintech gets no credit when the next aggregator or directly-connected bank vets the same fintech from scratch. And the fintech doesn't get any credit either -- and also has to start over.
- Vendor management programs assume a chosen supplier: These frameworks were built for vendors the institution selected itself, such as an IT outsourcer or payment processor. In open finance, the consumer or business chooses the third party, not the bank -- yet the bank still carries the regulatory accountability for what happens next.
- Periodic compliance checks confirm the past, not the present: Due diligence happens at onboarding and then again on a fixed cycle, often annually. Between those checkpoints, a third party's risk profile can change completely -- new ownership, a new sub-processor, a security lapse -- so the check confirms what was true months ago, not what's true today.
- None of the three approaches above were built to assess Artificial Intelligence (AI) risk: Intermediaries, fintechs and technology service providers are deploying AI at the same pace as everyone else, often with governance lagging behind adoption, so an institution can pass every existing check and still have no visibility into ungoverned AI experiments running downstream.
The result is fragmented visibility, since no institution sees the full open finance chain, and duplicated effort, since the same fintech gets vetted independently by every aggregator or directly-connected bank it works with. Liability, in practice, lands on whoever holds the customer relationship regardless of where the failure actually occurred -- and when that institution tries to recover the cost from the party responsible, a small fintech or aggregator's balance sheet often can't absorb the exposure regardless, and a large counterparty might be minded to keep the matter tied up in the courts.
About Invela
Invela is the infrastructure layer that makes open finance trustworthy -- accrediting who's in the network, monitoring risk in real time, and ensuring liability lands in the right place. Open finance, covered.
