IT Briefcase Exclusive Interview: Why Fintech Must Forge an API Integration Strategy

Sep 6, 2017 | App Modernization, Cloud, Data, Fresh Ink

Over the past five to seven years, organizations have come to understand that APIs are fundamental not just to their technology strategy, but their overall business strategy too. While many banking institutions have moved slower towards an Open API strategy, market forces are now demanding that they move more quickly.  Cloud Elements’ Head of Product Marketing Ross Garrett shares his thoughts on the imperative of adopting an open API strategy at financial institutions and fintech companies.

  • Q. Why are APIs becoming more important to financial institutions in the digital age?

A. There are three key reasons why financial institutions need to execute (quickly) on their API strategy:

1. Regulatory pressure: There are new regulations, such as PSD2 in Europe, that demand banks and financial institutions enable openness and cooperation. The payment service directive is a new era of banking regulation. The purpose of PSD2 is to inspire innovation and create a level playing field in the payment space. The key objective of this regulation is that customers should own their data, not the banks. Consequently, PSD2 requires that banks offer payment services to third- party providers (TPPs) via an API.

2. Collaboration and engagement with Fintech: As the Fintech space grows, financial institutions need to collaborate, injecting the value they offer across new third-party services. This allows innovation to flourish and grow, driving more transactions and additional banking use cases that could not be possible without external intervention. Providing secure API access to systems that were once closed may be costly and expose financial institutions to additional risk, but the opportunity cost should justify the investment required.

3. Building new digital products: Traditional financial institutions are being disrupted in the rapidly changing competitive landscape. Consumer banks use mobile applications, and new digital processes to differentiate their product offering. For example, digital check deposit has become a must-have feature in the U.S. market, and real-time, global payments are key for B2B banking. APIs are the building blocks for these new digital products, providing a re-usable service layer that turns legacy systems into developer-friendly platforms.

  • Q. How do APIs provide a crucial bridge between fintech companies and financial intuitions?

A. “To be truly digital, banks must pair an emphasis on customer-facing capabilities with investment in the technical, architectural, analytic and organizational foundations that enable participation in the financial services ecosystem.” – Gartner, Hype Cycle for Digital Banking Transformation, 2015

It’s generally agreed that fintech firms already play a significant role in shaping the banking platform of the future, largely because long standing financial institutions are constrained by legacy systems that can stifle innovation and agility.

But, fintech firms lack the customer base of the banking industry, and banking firms have the advantages of stability, trust and experience navigating regulations and compliance requirements in addition to access to significant capital.

Banks must transform into platforms that enable the applications and services their customers want to use. They need simple, user-friendly and reliable APIs to offer developers and partners the opportunity to innovate. They should look to the fintech community for inspiration around the digital business apps that can help maintain a competitive edge and improve customer engagement and satisfaction.

  • Q. Why is it taking financial institutions longer to open their APIs?

A. One key reason that banking has been slower to embrace an Open API model is risk. There are many factors why the risk of opening APIs has (up until now at least) outweighed opportunity, but this can perhaps be boiled down to two reasons: banking is a highly regulated market; and customer trust in banks and the banking system is paramount.

With financial institutions acting as the backbone of the global economy, any uncertainty in the system or security flaws in new digital channels can have a disastrous, destabilizing effect.

Despite the risk, however, it is this trust and reach that makes access to banking APIs and a more open approach across banking product development and integration so appealing.

  • Q. As data continues to explode, is there a projected outlook for increasing (or decreasing) adoption of APIs in the financial space?

A. Today’s predictions around growth and opportunity are little more than informed opinion. Therefore, clear objectives and tactics around adoption for any API solution is vital to success.

A fundamental issue when defining the business case for API services is that of volume: how many people will sign-up, how many third-party developers, how many apps, how many API calls, etc.?

In other industries, simply opening up an API and waiting for developers to come doesn’t work. Adoption must be driven, and this often means shifting the burden of integrating APIs away from customers and developers by offering pre-built integration templates and workflows between products helps customers to understand what’s possible.

Response times and service levels are increasingly important in a world demanding instant gratification. APIs need to be able to respond in real-time to external requests, and this could mean that offline business processes and back-office tasks need to be automated or replaced with digital tools.

Banking is an “always on” industry. It is vital that a financial institution’s infrastructure supports 24/7 API availability with zero downtime.  The performance of the API platform will impact the end-user experience. Badly performing APIs lead to lower customer satisfaction and this not only impacts the service third parties are able to provide around the APIs, but also has a negative effect on a bank’s reputation.

Man

Ross Garrett is the head of product marketing at Cloud Elements, where he is responsible for market strategy, product positioning and evangelism. He is a well-known speaker at developer events and other industry conferences. Ross has over 10 years of product and marketing leadership experience in the integration space, most recently at Push Technology and previously with Axway, CA and Layer 7.

Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

Top 10 Cybersecurity Stories This Week: Microsoft’s Largest Patch Tuesday Ever Tops 1,411 CVEs With Live Windows Shell Zero-Day, GhostAction GitHub Supply Chain Wave Hits 500+ Accounts and Tens of Thousands of Repositories, Ransomware Smashes Monthly Record at 1,073 Victims in August

October 16, 2026 | ITBriefcase.net Why it matters: Microsoft's October 2026 Patch Tuesday is the largest software security release in the company's history — 1,411 flaws, three zero-days, 75 critical vulnerabilities, and a live Windows Shell security feature bypass...

read more
Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

Top 10 Cybersecurity Stories This Week: FBI Warns FortiBleed Is Locking Admins Out of Their Own Firewalls, Attackers Hijack Three Country-Code Domain Registries to Obtain 12 Google HTTPS Certificates, ShinyHunters Suspect Arrested in Jordan

October 9, 2026 | ITBriefcase.net Why it matters: The FBI and US Secret Service issued a joint advisory on October 6 confirming that the FortiBleed credential-harvesting campaign — which has compromised credentials for 86,644 Fortinet FortiGate firewalls and SSL VPN...

read more
Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

Top 10 Cybersecurity Stories This Week: Citrix NetScaler Dual Zero-Days Under State-Sponsored Attack, Pentagon DMDC Breach Exposes 3 Million Military Personnel Records for Nine Months, AI Agent Breaches Dutch Vulnerability Disclosure Organization Using Zammad Zero-Days

October 2, 2026 | ITBriefcase.net Why it matters: Citrix disclosed two critical remote code execution zero-days in NetScaler ADC and NetScaler Gateway on September 27 — CVE-2026-88771 (CVSS 9.5, unauthenticated RCE in default configuration, no special setup required)...

read more
Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

Top 10 Cybersecurity Stories This Week: Brevo Supply Chain Attack Serves Malware to 100,000+ Websites via Stolen CDN API Key, Revolut Discloses Breach via Fake Government Requests, Gyazo 23.6 Million User Records Stolen

September 25, 2026 | ITBriefcase.net Why it matters: Attackers compromised Brevo — the email marketing and CRM platform used by eBay, Louis Vuitton, Michelin, Amnesty International, and more than 100,000 other businesses — by exploiting a hardcoded, long-lived...

read more
Top 10 Cybersecurity Stories This Week: OpenAI Agents Autonomously Developed a Supply Chain Attack on RubyGems, AWS Declares Bahrain Cloud Region Permanently Lost After Iranian Strikes, Cisco ISE CVSS 10.0 Auth Bypass Under Active Exploitation

Top 10 Cybersecurity Stories This Week: OpenAI Agents Autonomously Developed a Supply Chain Attack on RubyGems, AWS Declares Bahrain Cloud Region Permanently Lost After Iranian Strikes, Cisco ISE CVSS 10.0 Auth Bypass Under Active Exploitation

September 18, 2026 | ITBriefcase.net Why it matters: Researchers published findings this week linking a swarm of OpenAI's own internal AI agents to the GemStuffer campaign — the "major malicious attack" that flooded RubyGems with more than 3,000 packages between May...

read more