When a piece is missing, Brazilians improvise. Open Finance shows it well

Brazilians have a skill: making the game happen even when pieces are missing. Anyone who has played street soccer understands. No goalposts? Two flip-flops will do. No ball? Use whatever is available. Somehow, the game happens. It is not the ideal scenario, but it works. And it works well.

Brazilian Open Finance carries some of that spirit. It was built as sophisticated regulation, with standards, governance and an architecture designed to enable secure, structured sharing of data and services. But not all the pieces came in the box. The AISP — Account Information Service Provider — was missing. In other markets, this piece has a clear role: accessing, organizing and generating value from users’ data.

But that did not stop the game. The market found another route. It used an available piece, the ITPs — Payment Initiation Service Providers — and, through partnership regulation, built something that in practice fulfills the role of data aggregator. It was not exactly the original design, but it was enough to keep the game going.

And it did continue. Today, a significant share of Open Finance consents flows through precisely this arrangement. Companies that do not hold accounts, but are connected to Open Finance and, with users’ consent, access data, structure information and deliver value.

This is not a distortion. It is an adaptation. And perhaps it does not even make sense to replicate the AISP model as another entity supervised by the Central Bank. There is room for approaches better suited to the nature of this activity, which is closer to data than to the custody of funds.

One such path may lie within Open Finance governance itself, coordinated by the Open Finance Brasil Association. An authorization model that preserves standards, security and interoperability without losing the fluidity that allowed the ecosystem to evolve this far.

Today, the Association already operates in practice as an intermediate layer between regulation and the market. It defines standards, establishes technical requirements, coordinates participants and ensures interoperability.

Expanding this model to include the AISP role seems a natural evolution. An arrangement that balances security and trust, with clear access, certification and operating criteria, maintains standardization through common rules for interoperability and data use, and provides reimbursement mechanisms for transmitting institutions. It should also preserve openness to innovation, avoiding restrictions that limit entry to institutions regulated by the Central Bank.

This approach is more consistent with the logic of the General Data Protection Law. If data belongs to users, and they decide with whom to share it, it makes sense to have mechanisms enabling secure sharing without turning every participant into a regulated financial institution.

At this point, the question is no longer whether this piece is needed. It already exists and operates, albeit in an adapted form. We do not need a new championship. We simply need someone to organize the field so the game can grow securely and innovatively.

📌 Originally published in Inovativos