Diagnosing Open Finance Regulatory Readiness in ASEAN-6: A Content Analysis Index Construction with Policy Implications for Malaysia

Abstract

Open finance refers to the sharing and use of customer-permissioned data by financial institutions with third-party firms, other financial institutions and developers to build applications and services (Eroglu et al., 2026). It is broader than open banking because open banking mainly focuses on bank account and payment-related data, while open finance may cover wider financial products such as insurance, investment, lending and mortgages (Eroglu et al., 2026). Through standardised application programming interfaces (APIs), open finance enables customer data to be shared in a more secure, consistent and consent-driven way.

This technical architecture creates a foundation for alternative credit assessment based on transactional and behavioural data, personalised financial products and embedded finance services. For developing economies, open finance is relevant because it may help widen access to credit for individuals and firms that lack collateral or formal credit histories (Babina et al., 2025). However, these benefits should not be assumed automatically, as open finance also creates regulatory and market risks involving informed consent, data protection, cyber-fraud, algorithmic discrimination, market concentration and the potential dominance of data aggregators (Awrey & Macey, 2023).

Successful open finance implementation therefore requires more than a policy mandate. According to Bank for International Settlements (BIS) Paper No. 168, successful implementation depends on standardised data-sharing protocols, interoperability and robust regulatory frameworks (Eroglu et al., 2026). This makes regulatory readiness important because open finance requires more than technical data sharing. It also requires clear rules on consent, data protection, third-party oversight, interoperability and accountability to prevent risks such as data breaches, cyber-fraud, algorithmic discrimination, market concentration and the potential dominance of data aggregators (Awrey & Macey, 2023). These conditions matter most in emerging markets where digital finance development, regulatory maturity and institutional capacity differ substantially across jurisdictions.

In Malaysia, this issue became more important after Bank Negara Malaysia (BNM) issued its Exposure Draft (ED) on Open Finance in November 2025. The ED proposes a framework for consent-driven sharing of customer information across the financial sector in a secure, open, accessible, interoperable and timely manner (BNM, 2025). The proposed implementation is planned in three phases: institutions with more than one million customers from January 2027, institutions with more than 100,000 customers from January 2028, and development financial institutions and e-money issuers from January 2029 (BNM, 2025).

This study is motivated by Malaysia’s proposed open finance timeline and the uneven development of open finance readiness across six major Association of Southeast Asian Nations (ASEAN) economies: Singapore, Malaysia, Thailand, Indonesia, the Philippines and Vietnam. These six economies are selected because they are frequently compared in Southeast Asian open banking analysis. Twimbit’s State of Open Banking in Southeast Asia evaluates these same countries across infrastructure readiness, open finance frameworks, digital payment infrastructure, regulatory sandboxes and digital banking models, indicating that they form a relevant comparison group for assessing regional open finance readiness (Twimbit, 2024).

The ASEAN Open Finance Readiness Index (AOFRI) is developed in this study as a regulatory readiness scoring instrument applied across the six ASEAN economies. The UK is used as a mature open banking benchmark because the Competition and Markets Authority required the nine largest current account providers to establish and fund the Open Banking Implementation Entity and implement standardised open banking arrangements (Competition and Markets Authority, 2021). Brazil is used as a broader open finance benchmark because its framework has been implemented in phases covering institutional data, customer data, payment initiation and loan proposal services (Banco Central do Brasil, n.d.). Together, the UK and Brazil provide reference points for defining higher levels of regulatory readiness within the AOFRI framework.

Three research gaps motivate this study. First, ASEAN-6 economies remain underrepresented in comparative open finance research. The Organisation for Economic Co-operation and Development (OECD) survey on data-sharing frameworks covers 34 jurisdictions and examines issues such as mandatory data sharing, third-party provider authorisation, API obligations and consent frameworks, but it does not include ASEAN economies (OECD, 2023). The Cambridge Centre for Alternative Finance (CCAF) and Asian Development Bank Institute (ADBI) also classify open banking and open finance governance approaches across Asia-Pacific, but they do not develop an indicator-level composite readiness index for ASEAN-6 (CCAF & ADBI, 2025).

Second, the financial inclusion rationale used to justify open finance still requires stronger pre implementation assessment. Open finance is often promoted as a way to improve access to credit and financial services. However, existing evidence shows that the benefits may not be evenly distributed. Babina et al. (2025) find that open banking can support fintech entry and new lending relationships, but some benefits may be larger for consumers and firms that are already able to participate in the financial system. Preziuso, Koefer and Ehrenhard (2023) also argue that research on open banking and financial inclusion remains limited and fragmented. This suggests that financial inclusion should not be assumed as an automatic outcome of open finance. Instead, researchers should first assess whether the regulatory conditions needed to support inclusive outcomes are present.

Third, Malaysia’s proposed regulatory pathway raises a specific readiness concern. In many jurisdictions, open banking frameworks are first established before the scope expands into broader open finance (Eroglu et al., 2026). The UK developed a mandatory open banking framework before moving towards wider financial data-sharing discussions, while Brazil implemented open finance gradually through different phases (Competition and Markets Authority, 2021; Banco Central do Brasil, n.d.). By contrast, Malaysia is proposing open finance implementation without first having a fully mandatory consumer-permissioned open banking regime. This raises an important research question: whether Malaysia’s current de jure regulatory framework provides a strong enough foundation for the proposed implementation timeline.

The study has two main research objectives. The first objective is to assess the completeness of ASEAN-6 open finance regulatory frameworks compared with frontier benchmark jurisdictions. The second objective is to identify Malaysia’s regulatory gaps and provide ranked policy considerations for BNM before the January 2027 implementation timeline. Based on these objectives, three hypotheses are developed.

H1 proposes that ASEAN-6 economies show different levels of regulatory readiness across the five AOFRI dimensions.

H2 proposes that Singapore scores above the ASEAN-6 average, while Malaysia scores below it.

H3 proposes that Malaysia’s AOFRI score falls below the current regulatory profiles of the UK and Brazil, especially in dimensions related to regulatory mandate and implementation governance.

AOFRI is supported by Regulatory Theory and Financial Inclusion Theory. Regulatory Theory explains that effective regulation requires clear standards, monitoring capacity, behaviour modification, enforcement and legitimacy (Baldwin, Cave, & Lodge, 2012). This theory supports the need to assess whether open finance rules are clear, binding and enforceable. Financial Inclusion Theory explains that financial systems should expand access to underserved individuals and firms, especially those excluded by traditional credit assessment methods (Demirgüç-Kunt & Klapper, 2012). This theory supports the study’s focus on whether open finance regulation can create the conditions needed for more inclusive financial access.

Methodologically, AOFRI uses a content analysis approach adapted from Barth, Caprio and Levine’s regulatory scoring method (Barth, Caprio, & Levine, 2013). The unit of analysis is the country-level regulatory framework, using the same ASEAN-6 jurisdictions and benchmark cases form the analytical sample.

The study relies entirely on secondary documentary sources, including central bank publications, financial regulator documents, exposure drafts, open finance and open banking frameworks, API-related policy documents and other official policy materials, as listed in the Appendix. This source selection allows the study to focus on de jure regulatory readiness, namely the extent to which formal rules, policy directions and implementation arrangements have been established in each jurisdiction.

The five AOFRI dimensions are derived from the Alliance for Financial Inclusion (AFI) Policy Development and Implementation Guide for Inclusive Open Finance. These dimensions are Regulatory Authority and Governance; Ecosystem Design and Participants; Policy Provisions; Data, APIs and Security Specifications; and Implementation and Monitoring (AFI, 2025). Each jurisdiction’s documents are reviewed to assess the presence, scope and maturity of open finance-related regulatory provisions. The comparative analysis is then used to identify differences across ASEAN-6 and highlight Malaysia’s key regulatory gaps before its proposed open finance implementation timeline.

This study contributes to open finance research by developing an indicator-level regulatory readiness index for ASEAN-6. It also provides a structured diagnostic of Malaysia’s regulatory foundation before the proposed January 2027 implementation timeline. The findings are expected to help identify whether Malaysia’s open finance framework is sufficiently developed and which regulatory areas require further strengthening before implementation.