Eight application programmable interface (API), data and security compliance companies launched a new open finance data security standards body today.

API platform and data network provider Plaid joined open finance API provider MX, employment and income verifier Truework and financial data platform Flinks to announce a new standards body of the Open Finance Data Security (OFDSS) standard; the proposed framework of requirements addresses security risks encountered by emerging fintechs that handle consumer financial information.

The new standard is designed to “instill even greater confidence in data holders, including financial institutions, that the fintech ecosystem has robust protections in place for consumer data,” wrote Shano Fonseka, Plaid head of risk, in a blog post announcing the group.

Security compliance companies Drata, Laika, Secureframe and Vanta also joined the group as founding supporters.

The standards will be a work in progress, but the draft establishes 63 individual security requirements across 12 control domains, such as access controls, cryptography, data minimization, auditing and alerting, incident management, independent testing and vendor management.

The new group addresses a pain point in existing data security standards, such as SSAE18 TSC for security, which is published by the American Institute of Certified Public Accountants, and CSF, the National Institute of Standards and Technology (NIST) standard cybersecurity standard, Daniel Kahn, open finance lead at Plaid, told Bank Automation News. It does not compete with Financial Data Exchange (FDX) standards, Kahn added. Plaid sits on the board of FDX, where MX is a sustaining member, and Flinks is a member.

“The OFDSS does fit into the world of existing data security standards, however, existing standards were not designed specifically for modern, cloud-native delivery models or the resource constraints of early-stage companies,” Kahn told BAN.

Fonseka noted that OFDSS creates a “strong, auditable data security guidelines that maintains alignment with common and relevant criteria found in other security frameworks, such as SSAE18 TSC for Security and NIST CSF.”

Security — particularly around APIs — has been a growing concern as attackers have learned to exploit API security weakness. The issues aren’t likely to diminish as API connections between banks and fintech apps continue to grow.

However, Kahn said the standards body is not a response to API security risks, but rather that the new “standard helps build on that foundation of security to level up security within the ecosystem.”

The goal is ultimately to protect consumers, wrote Fonseka.

“It provides a strong framework that helps fintechs improve security while enabling innovation, gives banks a level of confidence about the companies connecting to their APIs, and, most importantly, helps protect consumers,” Fonseka noted.

Plaid handles integration between mobile apps and banks for companies such as $423.4 billion Capital One and $558.9 billion U.S. Bancorp.