Back
Open banking, open finance, and open data are often used interchangeably, but for a regulator they describe three different perimeters. Open banking covers payment-account data and payments. Open finance covers the whole financial sector. Open data goes beyond finance entirely. The term a regulator chooses sets the scope of the mandate, the institutions in it, and the consent and governance it must build. Malaysia’s PayNet-operated hub is the clearest working example of open finance done at national scale, and this piece uses it to show what the distinctions mean in practice.
What is the difference between open banking, open finance, and open data?
The three terms describe widening circles of data. Open banking is the innermost: the sharing of payment-account data such as balances and transactions, plus payment initiation, through secure APIs with the customer’s consent. Open finance extends that same consent-based model to the rest of the financial sector, including insurance, pensions, investments, mortgages, and other credit. Open data widens the circle again to information outside financial services altogether, such as telecommunications, utilities, and retail. Each step adds more data holders and a larger supervisory surface.
Why do these definitions matter for regulators?
Choosing open banking scopes the regime to banks and payment accounts. Choosing open finance brings insurers, takaful operators, pension and investment providers, and other lenders into the same framework as data providers, which is a far larger set of obligated institutions and a broader consent and liability problem. Open data usually sits outside a financial regulator’s authority, since it reaches sectors it does not supervise. Getting the term right early avoids designing a system for one scope and then discovering the mandate is another. It also tells the market which institutions must build, what data must flow, and who is accountable when something goes wrong.
For the underlying choice of how to build the infrastructure itself, see our explainer on centralized vs. decentralized open finance and our overview of what a national open finance hub is and who runs one today.
Case study: how PayNet operationalizes open finance in Malaysia
Malaysia is building open finance, not just open banking, and it is doing so through a national hub operated by Payments Network Malaysia (PayNet) under Bank Negara Malaysia’s oversight. On 18 November 2025, BNM issued its Open Finance Exposure Draft, setting out consent-driven data sharing across the financial sector. It is a useful case study because it shows the four things a national regime has to get right: architecture, consent, conformance, and governance.
Architecture
The PayNet platform transmits encrypted, consent-based data between financial institutions and approved third parties without storing or viewing customer information. It acts as a secure pipe, not a database. That design choice matters: a hub that moves data without holding it concentrates connectivity and supervision in one place while keeping customer data with the institutions that already hold it, which narrows the attack surface and the data-protection burden.
Consent
BNM requires consent to be specific, voluntary, explicit, deliberate, and revocable. Every participating provider must offer a digital consent dashboard where customers can view, manage, and revoke permissions, and recurring data access is time-bound to a maximum of six months before the customer must renew. Consent is therefore bounded by default, which is easier to supervise than open-ended access and gives customers a single place to see who holds permission to their data.
Conformance
Participating institutions connect to the platform through standardized API gateways rather than building a different integration for every counterparty. Under the Exposure Draft, mandated data providers span the financial sector, including licensed banks, investment banks, Islamic banks, insurers, takaful operators, prescribed development financial institutions, and eligible e-money issuers. Conformance to one shared specification, enforced through the hub, is what turns a policy into interoperable infrastructure.
Governance
PayNet builds and operates the platform as a neutral operator, setting the rules, standards, and infrastructure and carrying responsibility for security and uptime, while BNM provides regulatory oversight. Because PayNet is the central bank’s own payments operator, the hub runs on national rails the market already trusts. Implementation is phased from 2027 as part of Malaysia’s Financial Sector Blueprint through 2030, giving institutions a staged runway rather than a single deadline.
What can regulators take from the PayNet model?
First, name the scope honestly: Malaysia committed to open finance and built its standards, consent model, and conformance regime for the whole financial sector from the start. Second, separate the pipe from the data: a hub that routes consented data without storing it keeps the data-protection burden with the institutions and the supervision in one observable place. Third, make consent bounded and visible: specific, revocable permissions with a hard time limit and a mandatory dashboard are easier to govern than broad, indefinite access. None of this requires copying Malaysia’s exact design, but the sequence, define the scope, then build consent, conformance, and governance to match, is the part worth borrowing.
Frequently asked questions
What is the difference between open banking and open finance?
Open banking is the consent-based sharing of payment-account data and payment initiation through APIs, limited to banks. Open finance extends the same model to the wider financial sector, including insurance, pensions, investments, and other credit, bringing many more types of institution in as data providers.
What is open data?
Open data is the sharing of data beyond financial services, such as telecommunications, utilities, retail, and public-sector information. It is a broader concept than open finance and usually reaches sectors outside a financial regulator’s authority.
Is Malaysia doing open banking or open finance?
Open finance. BNM’s 2025 Exposure Draft scopes mandated data providers across the financial sector, not only banks, and the regime is operated through a national hub run by PayNet.
Who operates Malaysia’s open finance platform?
Payments Network Malaysia (PayNet), the central bank’s national payments operator, builds and runs the platform as a neutral operator, while Bank Negara Malaysia provides regulatory oversight.
How long does open finance consent last in Malaysia?
Recurring data access is capped at a maximum of six months before the customer must renew, and consent can be revoked at any time through a mandatory digital consent dashboard.
Brankas, an open finance infrastructure provider with implementations across nine markets in APAC and MENA, including in-market experience with Malaysia’s open finance specification. Brankas builds the Open Finance Suite and helps regulators and banks turn open finance frameworks into working infrastructure.
Designing an open finance framework or national hub? Talk to our team.