In 2012 Brazilian entrepreneur Thiago Alvarez and his American co-founder Ben Gleason created Guiabolso. The idea was bold and innovative for the time: banks were starting to create online portals and apps where users could login and access their bank account, so they allowed users to share the data from these accounts by giving Guiabolso their usernames and passwords. With this data, Guiabolso would be able to give the user a neat PFM (Personal Financial Management) tool to monitor their savings and expenses across all the bank accounts they wanted to connect. Besides the PFM tool, users would also be able to access a marketplace for curated credit products based on the data they had shared. The incentive for the end user to share their banking information was very clear: use your data to give better information and get access to tailored products.
Guiabolso went on to raise USD $66m from investors like Kaszek and QED. The most important part of the story, however, came in 2016 when Bradesco, one of the largest banks in Brazil, sued Guiabolso. Bradesco argued that the access to the customers’ credentials violated the contract entered by the customer and the bank; in other words, the data belonged to Bradesco and not the customer. The Ministry of Finance joined the court proceedings as an interested party, issuing an opinion saying that the bank account information belongs to the customer and not to the bank, and required the Administrative Council for Economic Defense (CADE in portuguese) to open an investigation for abuse of dominant power. At the end, both parties came to an agreement which set a few rules:
- Bradesco had to develop secure API’s so Guiabolso could access the information of customers who gave their consent.
- Users had to give an explicit consent when sharing their data that allowed Bradesco to give Guiabolso access to the user’s information.
- The consent had a validity of 12 months (last week the Central Bank changed it to forever), but the user could always revoke the consent.
Does this seem familiar? It should. Guiabolso was ultimately acquired by PicPay in 2021, but they set the precedent for what today we all know as Open Finance. The most important idea being that the account information belongs to the user and not the institution.
Where are we now:
The Guiabolso vs Bradesco case laid the groundwork for the regulation the Brazilian Central Bank set for Open Finance (which in turn is the regulation the Mexican Central Bank attempted to copy). As of this writing, the Brazilian Central Bank is in the process of implementing the fourth of four phases for it’s rollout of Open Finance, here is a very brief overview of each phase:
- Phase 1:Participating financial institutions (banks) facilitated the transfer of data amongst themselves. This means banks created the API’s so they can share their data to other banks and they can get the data from the others.
- Phase 2:Users can share their data from any bank they want to with other banks, this is exactly what Guiabolso was doing, only a regulated and “official” version. You can see how it works in PicPay, which is the company that acquired Guiabolso, it is likely that they used the Guiabolso app to build this. First Users connect their accounts, then they can get a PFM with the aggregated data from all their accounts:
