Introduction: The Decentralization of Financial Data Pipelines

Throughout Module 2, we have explored advanced quantitative finance topics including:

  • Deep learning for time-series forecasting
  • Supervised machine learning
  • Unsupervised anomaly detection
  • Reinforcement learning trading agents
  • Black-Litterman portfolio optimization
  • Quantitative risk management

Despite their sophistication, all of these systems rely on one essential requirement:

High-quality, real-time financial data.

Historically, banks stored customer financial data in isolated proprietary systems, making data sharing across institutions difficult.

The emergence of Open Banking, Open Finance, and Banking-as-a-Service (BaaS) has transformed this landscape by enabling secure, real-time exchange of financial data through standardized APIs.

This lesson covers:

  • Application Programming Interfaces (APIs)
  • REST and GraphQL architectures
  • Token Bucket rate limiting
  • Banking-as-a-Service (BaaS)
  • Financial-grade API (FAPI) security
  • OAuth 2.0 authentication
  • JSON Web Tokens (JWT)
  • Open Finance for Artificial Intelligence

Part 1: APIs and Microservices in Quantitative Systems

At the center of Open Finance is the Application Programming Interface (API).

An API enables different software applications to communicate and exchange information automatically.

Instead of transferring financial data using traditional batch files (such as CSV files or SWIFT MT messages), APIs provide secure real-time communication.

1. RESTful Architecture

Most Open Finance platforms use REST (Representational State Transfer).

REST organizes financial services as resources that can be accessed using standard HTTP methods.

Common HTTP methods include:

  • GET → Retrieve data
  • POST → Create new data
  • PUT → Update existing data
  • DELETE → Remove data

Each resource is identified using a unique Uniform Resource Identifier (URI).

Example:

 
GET /accounts
 

retrieves account information.

Stateless Communication

REST APIs are stateless.

Each request must contain everything needed for processing, including:

  • Authentication credentials
  • Request parameters
  • User permissions

The server does not remember previous requests.

This improves:

  • Scalability
  • Reliability
  • Performance

JSON Data Format

REST APIs exchange information using JSON (JavaScript Object Notation).

Example:

 
{
  "account_id": "12345",
  "balance": 2500.75,
  "currency": "USD"
}
 

JSON is:

  • Lightweight
  • Human-readable
  • Easy for machine learning systems to process

2. GraphQL

REST APIs expose predefined endpoints.

Sometimes applications receive unnecessary information.

GraphQL solves this problem by allowing clients to request only the data they need.

Example:

Instead of downloading an entire customer profile,

an AI model can request only:

  • Account balance
  • Monthly income
  • Cash flow

Benefits include:

  • Reduced network traffic
  • Lower latency
  • Faster AI inference
  • Efficient data aggregation across multiple accounts

GraphQL is especially useful for:

  • Credit scoring
  • Portfolio management
  • Financial dashboards

3. API Rate Limiting

Financial institutions must protect their systems against:

  • Distributed Denial-of-Service (DDoS) attacks
  • Excessive automated requests
  • Algorithmic abuse

Most API gateways implement the Token Bucket Algorithm.

Token Bucket Algorithm

The number of available tokens at time t is:

 
T_t = min(T_max, T_(t−Δt) + r × Δt)
 

Where:

  • T_t = Tokens available at time t
  • T_max = Maximum bucket capacity
  • r = Token refill rate
  • Δt = Time interval

When a request requires k tokens,

it is processed only if:

 
T_t ≥ k
 

After processing,

the remaining tokens become:

 
T_t = T_t − k
 

This prevents API overload while allowing temporary bursts of requests.

Part 2: Banking-as-a-Service (BaaS)

Banking-as-a-Service (BaaS) enables companies that are not banks to offer financial services through APIs.

Examples include:

  • E-commerce platforms
  • Ride-sharing applications
  • FinTech companies
  • Retail businesses

Customers can access banking services without interacting directly with a traditional bank.

The Three-Tier BaaS Architecture

Layer 1: Licensed Sponsor Bank

The sponsor bank:

  • Holds the banking license
  • Maintains customer deposits
  • Manages capital reserves
  • Complies with financial regulations
  • Handles central bank settlement

Layer 2: BaaS Middleware Provider

Technology providers build modern API layers over legacy banking systems.

Examples include:

  • Stripe Treasury
  • Galileo
  • Unit

Responsibilities include:

  • API management
  • Ledger translation
  • Payment processing
  • Developer tools

Layer 3: FinTech or Brand

The customer interacts only with the application.

Examples include:

  • Digital wallets
  • Lending apps
  • Investment platforms
  • Buy Now, Pay Later (BNPL) services

The banking infrastructure remains hidden in the background.

Embedded Finance

Embedded Finance integrates banking services directly into non-financial applications.

Examples include:

  • Instant loans inside shopping apps
  • Insurance offered during online purchases
  • Business banking inside accounting software

Alternative Data for AI

Embedded Finance generates valuable proprietary data that traditional banks often cannot access.

Examples include:

  • Merchant foot traffic
  • Customer purchase behaviour
  • Supply chain activity
  • Platform engagement
  • Software usage patterns

Machine learning models use these alternative data sources to improve:

  • Credit scoring
  • Fraud detection
  • Default prediction

Part 3: Security and Financial-Grade APIs (FAPI)

Financial APIs require stronger security than ordinary web applications.

Open Finance platforms follow Financial-grade API (FAPI) standards to protect sensitive financial data.

1. OAuth 2.0

OAuth 2.0 allows users to authorize third-party applications without sharing their banking passwords.

Instead,

users grant temporary permission through secure access tokens.

The Authorization Code Flow is the most secure implementation.

Benefits include:

  • No password sharing
  • Limited permissions
  • Temporary access
  • User-controlled consent

2. JSON Web Tokens (JWT)

Access tokens are commonly represented as JSON Web Tokens (JWTs).

A JWT contains:

  • Header
  • Payload
  • Digital Signature

The signature is created using:

 
Signature =
HMAC-SHA256(
base64url(Header) + "." + base64url(Payload),
SecretKey
)
 

The digital signature guarantees:

  • Data integrity
  • Authenticity
  • Tamper resistance

If the token changes,

the signature becomes invalid.

3. Mutual TLS (mTLS)

Traditional HTTPS verifies only the server.

Financial-grade APIs use Mutual Transport Layer Security (mTLS).

In mTLS:

  • The client verifies the server.
  • The server verifies the client.

Both sides authenticate using X.509 digital certificates before encrypted communication begins.

Benefits include:

  • Protection against man-in-the-middle attacks
  • Strong client authentication
  • Secure encrypted communication

Part 4: Open Finance as the Data Engine for Financial AI

Artificial Intelligence is only as effective as the quality of its data.

Open Finance provides continuous, standardized financial data streams that power modern AI systems.

1. Natural Language Processing (NLP)

Bank transaction descriptions are often messy and inconsistent.

Example:

 
POS 8473 MCDONALDS NAIROBI 05/08
 

Transformer-based NLP models automatically:

  • Identify merchants
  • Categorize spending
  • Detect recurring payments
  • Estimate carbon footprints
  • Improve budgeting recommendations

This converts raw transaction data into structured information suitable for machine learning.

2. Federated Credit Scoring

Traditional credit scoring depends heavily on credit bureau reports.

These reports are often:

  • Outdated
  • Incomplete
  • Updated infrequently

Open Finance allows AI models to access live financial information across multiple accounts simultaneously.

Examples include:

  • Current account balances
  • Cash flow
  • Salary deposits
  • Savings
  • Spending patterns

Machine learning models then estimate:

 
Probability of Default (PD)
 

using real-time financial behaviour instead of historical credit reports.

This enables more accurate and dynamic credit decisions.

Summary

Open Finance and Banking-as-a-Service have transformed traditional banking by replacing isolated financial systems with interconnected, API-driven ecosystems that support real-time data sharing and innovation.

Key concepts include:

  • APIs: Enable secure communication and real-time data exchange between financial systems.
  • REST Architecture: Uses stateless HTTP methods (GET, POST, PUT, DELETE) and JSON data formats to provide scalable, standardized financial services.
  • GraphQL: Allows applications to request only the data they need, reducing latency and improving efficiency for AI-driven financial applications.
  • Token Bucket Algorithm: Controls API request rates by regulating access through refillable tokens, protecting systems from overload and abuse.
  • Banking-as-a-Service (BaaS): Allows non-bank companies to embed regulated banking services into their applications through API providers and licensed sponsor banks.
  • Embedded Finance: Generates valuable alternative data, such as customer behaviour and platform activity, which enhances AI models for credit scoring and fraud detection.
  • OAuth 2.0: Enables secure, user-controlled authorization without exposing banking credentials.
  • JSON Web Tokens (JWT): Provide digitally signed access tokens that ensure authentication, integrity, and tamper resistance.
  • Mutual TLS (mTLS): Strengthens API security by requiring both client and server to authenticate using digital certificates.
  • Open Finance for AI: Supplies continuous, high-quality financial data that powers natural language processing, transaction categorization, cash-flow analysis, and real-time credit underwriting.

Together, these technologies form the digital infrastructure that enables modern quantitative finance, machine learning, and secure financial innovation.

PreviousNext