Finteching with Banks: The Co-Creation Upside of Open Banking

When the Consumer Financial Protection Bureau released its final rule under Dodd-Frank's Section 1033, the world of open banking and finance was set to change in unprecedented ways, not least of which is banks' ability to innovate faster and remain agile by "co-creating" value-added products and services developed by fintechs, while still remaining compliant with requirements to protect the consumer data that is accessed and shared. An expert panel discusses the monetization and innovation potentials of APIs-as-a-Service to fintechs and the emergence of open API marketplaces, advantages of proactive compliance, third-party risk management, the need for data architecture upgrades to handle real-time access and sharing, and monitoring systems to track data access and security.


Transcription:

Holly Sraeel (00:11):

All right, if we could get everybody's attention. Thank you for joining us this afternoon. We're going to be talking about FinTech with banks, the co-creation upside of open banking. If you missed my introduction this morning, I'm Holly Sraeel. I'm the SVP of Live Media for American Banker. To my far left is Paul LaRusso, CEO of Akoya, and to my immediate left is Jeff Collemer, SVP of Open Banking at Citizens. So let's get into this. These guys are smart, so make sure, save some questions. Alright guys, let's talk about the implications of the potential death of the consumer Financial Protection Bureau's 10 33 rule. What impact, if any, will this reversal have on the co-creation partnerships between banks and fintechs?

Paul LaRusso (01:01):

Yeah, I'll start on that one. So not dead yet, although just this Friday. So there's a lawsuit going on between Bank Policy Institute, Kentucky Bankers Association and Fork Bank against the CFEB, basically stating that this rule went too far and was not authorized by Congress. Both sides actually submitted their legal brief just this Friday, and they both asked essentially to set aside the rule basically on the grounds that Congress hadn't authorized them to go this far on rulemaking. So we should expect to see some more briefs coming. The one thing to watch the Financial Technology Association is also now been allowed to intervene and also argue the case on behalf of the CFPB. So we expect to see their legal brief by the end of June and we expect them to adamantly be in favor of the rule. So I think the long story short is more to come on this we probably won't know for at least the next few months and maybe get to some sort of decision from the judge by fall and winter.

(02:19):

So we'll kind of follow this going on, but I think to answer your question around does it have a material impact on banks and fintechs working together? I don't think so. Banks and fintechs have been working in the open banking space for more than a decade together and they've been primarily doing it based on consumer demand and the value that they can deliver to the consumers, not so much because it's a compliance and a mandatory regulatory obligation. So I think things around protecting customers, giving them more services, more values, I think that will continue. So I think the short of this is you're not going to see that much a difference in the kind of day-to-day and how banks and fintechs are working together.

Jeffrey Collemer (03:04):

Yeah, I think it's worth noting banks had started this journey before the rule was really solidified or even proposed in any demonstrable way. The banks had already started to say, look, we need to get rid of screen scraping, we need to secure the credentials. Customers want their data in different locations. So this was already underway. The groups such as financial data exchange had already had standards in place. So when the rule came out, I think it was really just reinforcing where the market was already going, where the banks were already going, where the fintechs and data aggregators were working. So assuming it gets vacated, I'm not sure it changes a lot really. I mean the banks, I think it accelerated a lot. It accelerated the attention, but I'm not sure that it materially changed where the customer need was and what they wanted to do.

Paul LaRusso (03:52):

And even if it does vacate, there's still a possibility that the new administration could create a rule as well under the current CFEB. So there's that kind of angle that we'll continue to watch.

Holly Sraeel (04:06):

If there were to be a new rule, let's say the current administration stays in place, so the CFBB remains as it is at the moment, if there were to be a new rule, what might it look like?

Jeffrey Collemer (04:23):

Well, I certainly think there's some areas that difficult for some attention, right? Liability is one that I think could certainly get shored up. I think from what I'm understanding here as far as the economics around building these platforms is up for a lot of debate. So I think those would probably have to get some attention. I don't know what that rule would end up being, but it certainly would be topics of discussion. And then secondary data use I think is another area that really needs to at least has a lot of debate going on at this point with the current role.

Paul LaRusso (04:55):

Yeah, a lot liability for sure. I think also risk management, how banks might manage risks to be able to prove or deny. I think other ones that could change around is there a standard setting body or not? That's one that's kind of been being debated back and forth. So I think those are some of the themes we'd keep an eye out for.

Holly Sraeel (05:14):

Alright, let's shift gears a little bit. So we're all agreed that open banking is here to stay and that it's table stakes. The argument is for banks to develop a sound open banking playbook. Can we talk a little bit about what that playbook component includes?

Paul LaRusso (05:31):

Yeah, I'll start. I think of four major components for banks and an open banking playbook. The first is around the actual strategy. What is the problem that you actually want to solve? Who's the customer that you're trying to target and what need or value you're trying to deliver to them? I think you've got to have that crystal clear. There's a lot of problems and opportunities in this space, and I think if you don't have a clear vision on the strategy around what you want to accomplish, everything else doesn't work. So number one is the strategy. Number two is the business model. Once you figure out the strategy, then the business model is, if you think about open banking and two dynamics, you have data that can go out of the bank that leaves the bank, and then you have data that comes into the bank and you really want to start to think about what use cases or value you're trying to achieve from each of 'em on data out.

(06:28):

A lot of banks have approached that by trying to reduce a significant amount of risk, improve their security because they're getting screen scraped, they have usernames and passwords going out into the ecosystem. Their customers don't have visibility or control around who's accessing their information. So you see a lot of banks try to improve that security and risk management. And then if you think about the data inside, there's opportunities around retention. Banks want to become or maintain a primary relationship with their customers. About 10 to 15% of customers plan on leaving their primary bank within the next year. So how do you use external data, held away data to actually deliver better experiences to retain that customer? There's also areas around new market could you get into new businesses like underwriting, cashflow lending and so forth. And then also opportunities around expense reduction or efficiencies. So I think having that value chain around what are the use cases you want to go after and what you want to solve.

(07:33):

And then the third component is really the talent in the organization and how your organization is actually structured. Some banks aren't actually structured yet to play in the space. Traditionally, this has come out of online and mobile banking and we've set up a lot of banks have set up those channels to have online and digital and so forth. We've also got to pivot the organization to think about a third party banking or an API channel where you have data leaving the bank and you have data coming into the bank, and do you have the right people in the organizational model within to set that up? And then the last piece is like the tech and the infrastructure. When you're now pulling all this data in, are you managing it? Are you handling it correctly? Do you have traceability and purging when the customer actually wants to remove it? All those procedures and processes to make sure you're having that trusted relationship with the customer is super critical in the playbook.

Jeffrey Collemer (08:27):

Yeah, no, I completely agree. And I think the strategy, knowing what problem you're solving is key, but I think a lot of banks may be in a position of where do I get started? And there's a lot to bite off there. I think as far as a playbook, I look at it as a maturity. The table stakes are getting an open banking basics up and running where you can share the data and as you said, that's getting the right talent, the team. So from a kind of tactical approach, it's starting to engage with online banking and mobile teams. Where's the data coming from? How do we start figuring that out? How do we educate our institution to understand these are partners and they're not vendors in that we need to build a new channel? I mean, there's a lot of components to it. I think the trick is to start small and start building that maturity because learn it along the way.

(09:21):

As you get more and more involved with the fintechs and the financial data aggregators, you'll start to understand how to engage with them. As you start to access your data, you'll start to understand where there's gaps in that data that you need to fill in to be able to provide open banking APIs. As you keep going through a bit further, you'll start figuring out the audit, all the other pieces. So you want to think about it from a top down, but you really want to bite it off piece by piece in some regards from the bottom up.

Paul LaRusso (09:49):

And the reality is that it's actually already been started for the bank based on consumer demand. Like most bank customers are actually already doing it. It just might not be in the safe securest way possible. So it's already happening. I think it's now how do you bring the visibility and control back to your customer and do it in a secure channel.

Holly Sraeel (10:10):

Okay. Just a side note, I have motion sickness and every time Jeff nods, I am rocking on here, so if I faint, that'll be why. I'll rephrase. So Jeff, do me a favor. Let's talk a little bit about the Citizens creating its open banking platform for retail customers. Can you give a little detail on that?

Jeffrey Collemer (10:31):

Yeah, sure. So Citizens started, we started about three years ago creating our open banking platform. So we set out to with a goal, to your point about we wanted to stop screen scraping. That was our initiative. We wanted to secure the credentials for our customers and make sure they could still get their data. So we started and what that's involved has been quite the journey. It's been great, but it's involved a lot of things that didn't quite initially expect between getting involved with sourcing and vendors, getting legal, building the tech. So as we've progressed over the past three years to the point now where we've got APIs, we're engaged with multiple aggregators, hundreds of thousands of customers are now getting their data through the secure APIs. So we've gone and built the platform and the bank's maturity through this process. We had to bring many teams up to speed. We had to change policies, procedures, really build a new PI channel along the way. So it's been a challenge, but it's very rewarding when you start realizing, okay, great. Customers can engage with us, they can get their data where they want. They can get it real time in all these apps. And when you hear the number of apps and the number of customers that we have been able to enable, it's really, really fairly impressive.

Holly Sraeel (11:58):

It sounds difficult, but you say it's worth the journey. You have to invest the time upfront to know where you want to go.

Jeffrey Collemer (12:04):

Yep. Yeah, it is not an easy journey. I mean, I think the CFPB put out in the rule, I mean, it can cost millions of dollars to take multiple years. You're going to encounter a bunch of challenges, like I said, engaging with different parts of your organization, explaining why this is important, dealing with data cleanliness, dealing with standards. There's a lot of pieces that go along the way to building the new channel. But if you can get the support within the bank, get others, leverage the other teams, the security teams, the audit teams, the risk teams, and bring them, explain why this is important, it gets a lot easier.

Holly Sraeel (12:49):

So the other day when we were prepping for this call, we talked about open banking being dependent on customer data being shared with authorized third parties facilitated by data aggregators, and that it was important to marry up the data with the spec, which can sometimes be problematic. How often is it problematic?

Jeffrey Collemer (13:12):

It's problematic in various different areas. There's some customers, there's certain applications that want all the data, and you may not be able to start with all the data. You may start with deposit accounts and you start building. There are some that will require certain data fields that you just may not have access to, which is interesting, whether it be a mortgage rate or when the account was opened. Some of that stuff with the banks dealing with mainframes and legacy systems just isn't accessible so much like dealing with different vendors, the partners is a bit of negotiation. There's a bit of what can we do? What can we get the customer right? The good news is, as you mentioned, they're already getting the data. So if it's available through your online banking and it's being scraped, then it's probably accessible somewhere. And that's really the trick. But it is a different data format. It is going to different partners, so there's always lots of little things to work out.

Holly Sraeel (14:11):

And do you see that Paul?

Paul LaRusso (14:13):

Yeah, I think one way that is really helpful for banks to look at is to start with an inventory of what data is actually available on your mobile banking website and your online banking website. And then you can start to go from there, what is the right data to actually expose through APIs and endpoints and allow for third parties? But I think the nice thing is today there are actually a lot of partners in the industry who can help with a lot of that normalization and a lot of that standardization, whether it's through standards groups like FDX or whether you're a data access network intermediary player, a lot of those companies now are helping banks actually standardize and make that data a little bit more consistent. So it's a ultimately better experience for their customer who's using it on the other side with a third party.

Holly Sraeel (15:04):

The fundamental building blocks of open banking rely on solid partnerships between banks, fintechs and aggregators. We talk a little bit about the nature of partnerships at present and how you think they might change going forward and the value of 'em.

Jeffrey Collemer (15:20):

Sure. I can take a first stab at some of this. The aggregators are our partners, at least that's our view. And they're great partners. They're built to be able to interface with tens of thousands of FinTech apps. They're used to transmitting and delivering data. Traditionally, banks aren't really well at dealing with hundreds or thousands of different partners. So if you can work with the ad data aggregators, if you can leverage their skills to get the data to them, they can distribute it. Now the bank's role is to make sure the data is good, it's accurate, it's timely, and in the format needed. And so developing that partnership is key because as I said, I don't think there's many banks out there that could engage with what I think is 20,000 FinTech apps out there individually. I mean, it's a lot of work, but just the legal agreements, the onboarding, the engagement, the tech side, that's awfully challenging. So partnering with a financial data aggregator gets the data distributed to a lot of the places that your customers want to use it.

Holly Sraeel (16:33):

And Paul, so what do you see? What are some of your observations in working with all your partner banks?

Paul LaRusso (16:38):

Yeah, the partners. I mean, Akoya plays a role as an intermediary. So we actually help banks stand up the open banking program and then actually distribute it at scale. We actually help accelerate the process. Partnerships are absolutely, you can't do open banking without any type of partnership. There's always going to be some additional entity there. I think one of the most important things I've seen is ensuring that the values are aligned with the partner. Koya was founded on four principles, security, consumer control, choice and privacy. And we look to partner with organizations who really value those components overall around that particular piece of work. So I think having those shared goals, expectations, and then you're working with companies of all shapes and sizes and ensuring that there's a right operating model, what those expectations are going to be of how you're actually going to get the work done, do the implementation, serve the customer now that you have mutual customers that you're kind of serving. I think getting those things right, really go a long way instead of the finger pointing of not my problem and so forth. So it's getting those values done really well.

Holly Sraeel (17:50):

So in establishing and working through these partnerships, what typically are there things that are typically causing friction between bank and partner?

Jeffrey Collemer (18:03):

I think the friction points are kind of twofold. I think one is just expectations, which I think you alluded to as far as what you're trying to get out of it, making sure that both parties are working on the same goals. I think liability, look, we're a bank. Every bank loves to focus on liability. Getting that ironed out. The CFPB didn't put much guidance in the rule. That's still an open issue that still creates friction. You're always going to get down to limitation, liability, indemnification, that kind of stuff is always going to probably be the last thing you work out in kind of a data sharing agreement. And that's always fun discussion. But I think it's established now at this point where it's somewhat straightforward, but there are certainly a bit of friction around the, okay, who's responsible for what?

Paul LaRusso (18:54):

Yeah, one of the things I've seen is access frequency and then the throughput of how much access could come back to the bank to get a piece of data. Is it one time a day, four times a day, 10 times a day, 40 times a day? And I think ultimately the values are aligned where you want to serve the customer on that app. They might be trying to manage the budget or seeing if they have enough money in the account, but then if you look at from the bank angle, like some bank legacy systems weren't able to take that much demand on the access frequency and they're trying to shrink down that amount of time. Whereas the FinTech app is saying, look, I want to serve the customer with the best, most readily available data. So that area I've seen as a friction, but generally I've seen you can sort that out and get to a common ground, something that allows the use case for the customer to work really well and not put too much burden on the infrastructure of the banking system. You've seen that?

Jeffrey Collemer (19:54):

Yeah,

Paul LaRusso (19:55):

seen that?

Jeffrey Collemer (19:55):

Yeah, the bank's infrastructure isn't necessarily built on all modern day technologies. So yeah, we've certainly seen that. We've seen aggregators ask for data many times a day. Some will say, why not 24 times? Why not 360 times? The infrastructure's not necessarily there, especially if you get into documents, serving up documents, statements, stuff like that becomes fairly heavy lift if you're delivering large PDFs versus other data. But usually, again, this all tends to come out in your data sharing agreement, negotiations.

Paul LaRusso (20:26):

The counter argument is, well, I can log into my bank as many times as I want to, so why can't you just give me the data?

Jeffrey Collemer (20:31):

Right.

Paul LaRusso (20:31):

So you've got to figure out how to reach the common ground that works on both sides,

Jeffrey Collemer (20:36):

And you're trying not to get to that. Okay, but you're screen scraping and we could just shut you off, right? I mean, it is half joking, but this is the look, we didn't consent to it, but the customer's getting the data. It's the customer's data. They want access to it. So this is the balance that a lot of these discussions go down. And so you're talking about some friction points. It's kind of a funny and slightly tense conversation sometimes.

Holly Sraeel (21:01):

Well, it's actually a good transition. We're going to talk about what's different about serving customers who are digitally savvy and why that matters and what it requires of banks to remain at the center of the customer relationship. You guys want to talk a little bit about that?

Paul LaRusso (21:16):

Yeah, I'll start. So I spent a lot of time looking at demographics of banking customers who are doing open banking. And at a high level, they typically over-indexed in three areas. One was youth. They were a younger segment, typically Gen Z, millennial. The second was affluence or wealth for their segment. They tended to have a little bit higher balances than their peers. And then the last piece was actually digital engagement. They were actually much more engaged than non-open banking customers. So youth affluence and then digital savviness or engagement were kind of like the typical open banking user, and that's the bank sweet spot. That's what the bank wants to serve. So when you're thinking about, Hey, how do you actually help your customer by doing this or not? You've got to be relevant to one of your top target customers. And then you've got to build the tools and be relevant and easy to integrate with where that customer wants to be.

(22:23):

If that customer wants to add a tax preparation solution or look at another way to get a line of credit, you've got to be easy to integrate with those applications. I think the play for the bank is ultimately how do you be that hub to have that primary relationship and that trusted relationship with the customer? And you've seen some banks go out and start to build these hubs. Wells Fargo did it with control tower. Chase did it with Security Center, US Bank did it with a subscription management. If you kind of think about how the customer is interacting off your platform, they have their credit card stored in different merchants. They have their data going to different fintechs, they've got subscription services, and you can try to be that hub for the customer and increase the engagement and be that trusted partner to them for someone who is really digitally savvy and inactive.

Jeffrey Collemer (23:18):

Yeah, I think what you mentioned as far as getting the data to where they want it, that is the key with the open banking API channels, they're going to tell you where to get the data. And in our case, at least with citizens, we support not only retail, but our private bank and our commercial clients. So getting that data to the app that they specify is key. And like you said, they're digitally savvy. They know what they're doing. They want to make payments, they want to link accounts, they want to reconcile, they want to see their balances and their net worth. You're not going to tell them where to do that. So traditionally, I think the banks are trying to build interfaces through mobile banking and online banking that gives them what they need. In this case, what they need is the data delivered. So it's more of a technical challenge, I think, to get that. And that it goes back to the partnerships. The partnerships with the aggregators or the fintechs or wherever you need to enable that channel to get all the data all the way to the end. And it is really useful to the customer, and that's what you need to do. It's not telling them, here's how you want to look at your data anymore.

Holly Sraeel (24:28):

So as innovation of bank FinTech partnerships increase, there's ongoing responsibility for banks to ensure the integrity of linking data and the bank accounts. What hidden liabilities or vulnerabilities should banks get out in front of before there's an issue?

Jeffrey Collemer (24:46):

I think the hidden liability is liability. That's the first one to get out in front of start having that engagement on the data and the liability that associated, whether it be data breaches, whether it be inaccurate data, get ahead of that. That's one of the key conversations to get going within your institution. I think security is the other one. A lot of this API pieces and parts have been done, but when you get into open banking, you get into three legged OAuth, you get into token management, you get into consent management, which is a little different. So you're pulling an audit and risk. Those are really the areas that are going to take a while to figure out they're going to have liability because it's security, because it's the data, because it's PII, I think the two areas I'd say to start focusing on early in the journey.

Paul LaRusso (25:38):

So three things that I see banks spending a lot of time on and trying to solve. It's a login credentials, payment credentials, and third party risk management login credentials. You've seen a lot of banks start to move and eliminate screen scraping. That's number one. If they haven't done that, they really want to move quickly on that. Work with a partner, stand up the APIs, get yourself in a position where you can enable all the data in a secure front door so that you can actually close the back door and have a whole bunch more better security and control for your customers. The second I start to see banks look at is around the payment credential is starting to tokenize the deposit account number. Instead of letting that number out, even through an a p, I see banks moving to actually starting to tokenize that and then tie it to consent with the particular application.

(26:41):

So if your customer at one point actually deleted that application, the account number that they once shared with that application could no longer be used to facilitate payments. I see banks spending a lot of time thinking about that and how they might implement it. And then the last piece is the third party risk management. As Jeff alluded to, you've got thousands and thousands of financial technology companies out there that banks want to work with and partner with. And you've really got to think about how you're managing your third party oversight. Yes, there's the liability, and then there's all of the data, the data handling, the risk tiering and so forth. And in this environment of open banking, you might be working with a third party directly who then might be working with other fintechs and so forth. And I think you've got to think about how you approach that entire landscape and put the right controls in place so you can ultimately protect your customers.

Holly Sraeel (27:40):

Why don't you mention to me API Security is a non-trivial undertaking? That's an understatement.

Jeffrey Collemer (27:48):

Yeah. Yeah, it is. Look, there are solutions out there you can buy, and that helps and that may accelerate. But yeah, this security piece is non-trivial. There's so many components. I mean, even if you have ping identities, even if you've got Akamai networks, even if you've got a really solid tech team, it takes a while to stand up. It really is the larger piece. I think the banks traditionally are good at handling data and moving data. The external security, most banks, at least the ones I'm aware of, aren't really set up to go, yeah, let's let the data out of the bank. That sounds good, right? So it's really the technical piece is hard and so is convincing the bank and the policy and the audits and the risks and all your different departments that, look, this is got to happen. The customer and mandate is going to mandate it and it's a good thing, but it needs to be done. Right.

Holly Sraeel (28:40):

Paul? Nothing?

Paul LaRusso (28:41):

No, I think you got it.

Holly Sraeel (28:42):

All right. So final question before we take questions from the audience. What additional upside do you see for banks and fintechs as they weigh deeper into these types of relationships? And what about upside for customers over the next one to three years?

Paul LaRusso (28:59):

Yeah, so the first upside I see for consumers, I have a vision where the consumer ultimately can have control to all of their financial data, wherever that sets banks, credit unions, investment payment applications, wallets and so forth. And I see this vision of them being able to do it in a secure way. They control their data, not anyone else. The CFPB put out this proposed rulemaking two years ago. They projected only about half of all inquiries of transactional data was happening through APIs. So there's a significant amount that can happen more through the industry. So we've made progress, but we've got a lot more work to do. And I do see this world where it's the consumer at the center, they control their data, not anyone else, and they can access this in a safe and secure way across the board. The other area I see is a benefit for consumers is around personalization and engagement.

(30:06):

And that once you can start to bring in a full view of the consumer's data, you can start to engage with them more, which then leads into things you can do on top of the data with ai. And you can actually start doing more what I would call ag agentic and starting to give directions potentially on a consumer's behalf around how they might want to allocate funds or pay bills and so forth. So you can start to put that consumer in full control, but also not having to do all the minimal tasks that they might have to do on the daily piece. And then I think we will see what happens with regulation, but I also think standards and having a technical specification around how the entire industry can rally around how data is accessed, consumed, handled, and shared will ultimately drive efficiencies for all players in the market. And I think that will benefit consumers for a much better experience of how they're interacting with all this data, whether it's with the bank or with the FinTech

Jeffrey Collemer (31:10):

Jeff, get's the last word.

(31:12):

Yeah, no, I think you summarized it well. The customer having the control and being able to meet the needs of the customer. Banks may not be able to build every app, let's say, and solve every problem. So being able to expose that data, solve the customer problem for them, and where they can't or don't want to be able to let the customer go to other applications to do it. But I do think it's around the control. It's around the real time nature of it, which has traditionally been a challenge to get the data out quickly when it can be used in near real time. So I think there's a lot of upsides for the banks that can actually deliver this, right, I think a differentiator. And then beyond that, what other problems can the bank solve is really where do you go with commercial? With payments? There's a lot of opportunities to solve problems for the customers that the banks can build. Whether they're pulling data from others or whether they're producing it, it's going to unlock a lot of ability to, much more ability to actually solve the root of what that customer is trying to do in their financial journey.

Holly Sraeel (32:16):

Alright, we have time for a couple of questions. Questions in the audience? Anybody? Everybody's good with open banking? Go ahead.

Audience Member 1 (32:33):

Thank you. Great conversation. I have a question with open banking, the main use case right now is data sharing. We're giving data to customers, but you mentioned payments. What's your vision regarding the controls once the client starts to bang with us with, I mean I work for citizens, so when the client starts to bank with us, transact with us, how do you see the control shifting from the bank to the external platform? Right? The client is not using our channel anymore. The client is using their own application right now to pull data. But in the future, in the near future to initiate transactions, initiate payments, right now we put a lot of controls, multifactor authentication, things like that. So when the user is initiate payments, how do you see that evolving the controls, how we are going to distribute the controls and the security between the banks and the external platforms?

Paul LaRusso (33:38):

Yeah, it's a great question. So a couple things, and one I would say first off, just to think about the customer may be doing that even without open banking, they always have the ability to interact with a FinTech application, put in their account routing number and go facilitate payments. So that's been going on for a while. But I think back to your question around how do you ensure that there's the right controls, I think consent is super important and making sure that your customer understands what they're consenting to, who they're consenting with and what that application can do with the consent. And that the customer always has the ability to toggle off that consent at any time. I think that is paramount on engaging with something off the platform. And then the second piece, I think there are ways that the bank can help put more security around that, whether it's tying that consent of the payment to that specific application so that if the customer turns that application off, no payments could actually be transmitted from that application. That's an additional layer of control that could be brought to the customer. And then a lot of banks now are showing the visibility into a dashboard so that you can actually see who's been authorized, what action that application could actually do. And then reminding customers no different than if it was a subscription or a stored card with a merchant, that this is all of the permissions that they've given. So they kind of are put in the driver's seat around what to turn off or what to keep on.

Holly Sraeel (35:17):

Alright guys, we're at time, so we're going to have to end here, but Jeff and Paul are hanging around. Jeff is actually being honored with the Citizens team. They are one of our 10 American Banker Innovation of the Year award winners. So congratulations to Jeff and his team. Paul is going to be my guest tonight, so catch us in the hallway. Thank you so much. Please join me in thanking these guys.