Competition Law and Data Sharing in Banking Markets

1. Introduction

Data sharing in banking markets refers to the exchange, access, portability, or controlled disclosure of financial information among banks, fintech companies, credit institutions, payment providers, customers, credit bureaus, Account Aggregators, and other financial-sector participants.

Data sharing can have two opposite competition effects.

On one side, appropriate data sharing can increase competition by reducing information asymmetry, helping new lenders assess creditworthiness, lowering switching costs, improving financial inclusion, and enabling fintech innovation.

On the other side, unrestricted sharing of competitively sensitive information between competing banks can facilitate coordination, reduce strategic uncertainty, and weaken competition.

This distinction is now particularly important in India because the RBI's Account Aggregator framework is designed to permit customer-directed financial-data transfer between financial institutions based on explicit consent. As of March 31, 2026, the framework covered 179 Financial Information Providers, 989 Financial Information Users, and more than 2.88 billion enabled financial accounts.

The central competition-law question is therefore:

When does banking data sharing promote competition, and when does it become an instrument for coordination, exclusion, or abuse of market power?

2. Meaning of Data Sharing in Banking Markets

Banking data sharing can occur through several mechanisms.

1. Customer-authorised sharing

A customer permits a bank to transfer financial information to another regulated institution.

2. Credit-information sharing

Banks share information about borrowers':

• credit history;
• outstanding loans;
• defaults;
• repayment behaviour;
• exposure;
• creditworthiness.

3. Open-banking systems

Customers authorise third-party providers to access financial information through standardised interfaces.

4. Account Aggregators

A regulated intermediary transfers financial information between participating financial institutions on the customer's instructions.

5. Industry information exchanges

Banks exchange information collectively through an association or industry infrastructure.

This is where serious competition-law concerns can arise.

6. Regulatory data sharing

Banks provide information to regulators for:

• supervision;
• financial stability;
• anti-money laundering;
• prudential regulation;
• systemic-risk monitoring.

Such legally required disclosure is generally different from voluntary competitor-to-competitor information exchange.

3. The Fundamental Competition-Law Distinction

The most important distinction is:

Pro-competitive data sharing

Customer/regulated institution → authorised recipient

versus

Potentially anti-competitive information exchange

Competitor bank A ↔ Competitor bank B

The first can reduce information asymmetry.

The second can eliminate uncertainty between competitors and facilitate coordination.

The CJEU's 2024 Banco BPN/BIC Português judgment is especially important because it held that a comprehensive exchange of confidential and strategic information between competing credit institutions could constitute a restriction of competition by object.

4. Why Data Is Especially Important in Banking

Banking markets are heavily information-dependent.

A bank deciding whether to lend must evaluate:

• income;
• repayment history;
• existing liabilities;
• credit score;
• transaction behaviour;
• collateral;
• cash flow;
• financial exposure.

Without reliable information, lenders face information asymmetry.

This can produce:

• adverse selection;
• higher interest rates;
• excessive collateral requirements;
• credit rationing;
• higher default risk.

Therefore, properly designed data sharing can make banking markets more competitive and more efficient.

5. The Competition Paradox

Banking data sharing creates a paradox.

More information for lenders

can mean:

better risk assessment → lower lending risk → more competition.

But:

More information about competitors

can mean:

less uncertainty → easier coordination → weaker competition.

Therefore, competition law does not simply ask:

"Was information shared?"

It asks:

"What information was shared, between whom, under what conditions, for what purpose, and with what competitive consequences?"

6. Indian Legal Framework

Competition Act, 2002

Section 3

Prohibits anti-competitive agreements.

An agreement or concerted practice among competing banks involving strategically sensitive information may potentially fall within Section 3.

Section 4

Prohibits abuse of dominant position.

A dominant bank or financial platform could potentially abuse its position through:

• discriminatory data access;
• refusal to provide essential data;
• exclusionary arrangements;
• unfair conditions;
• leveraging;
• discriminatory interoperability.

Section 19

Provides for inquiry into alleged contraventions.

Section 26

Provides the investigation mechanism.

Section 27

Provides remedial powers following establishment of infringement.

Section 32

Allows the CCI to address certain conduct outside India where it has an appreciable adverse effect on competition in India.

7. RBI and Competition Regulation

Banking markets are unusual because they are subject to both:

sectoral regulation + competition regulation.

The RBI regulates matters such as:

• banking stability;
• prudential requirements;
• payment systems;
• customer protection;
• data security;
• Account Aggregators;
• credit information.

The CCI focuses primarily on:

• competition;
• anti-competitive agreements;
• dominance;
• mergers and combinations.

Therefore, data-sharing arrangements must often be analysed from both perspectives.

8. Account Aggregator Framework

The Indian Account Aggregator model is particularly important.

Under the framework:

Financial Information Provider → Account Aggregator → Financial Information User

The transfer is based on the customer's explicit consent and instruction.

The Department of Financial Services describes Account Aggregators as entities that retrieve or collect financial information and transfer it between financial institutions on the individual's instruction and consent.

This architecture can potentially improve competition because a customer does not need to remain dependent upon the institution that historically holds the customer's information.

9. Data Portability in Banking

Data portability and banking data sharing are closely connected.

For example, a borrower may want to move from:

Bank A → Bank B

If Bank B can securely receive the customer's relevant financial information, the customer may not need to rebuild an entire financial history.

This can reduce:

• switching costs;
• informational disadvantages;
• onboarding costs;
• underwriting costs.

Consequently:

Data portability can convert customer data from a source of incumbent lock-in into a competitive asset controlled by the customer.

10. Credit Information Sharing

Credit information sharing can be strongly pro-competitive.

Suppose Bank A knows that a borrower has:

• five existing loans;
• a strong repayment history;
• low default risk.

Bank B does not possess this information.

Bank B may therefore offer worse terms because it cannot accurately assess the borrower.

A functioning credit-information system reduces this asymmetry.

The CJEU's Asnef-Equifax jurisprudence is particularly important in this respect.

11. Case Law 1 — Asnef-Equifax

Asnef-Equifax v Asociación de Usuarios de Servicios Bancarios

C-238/05, CJEU

This case concerned a credit-information system containing information about borrowers.

The Court considered whether such information exchange was contrary to EU competition law.

The Court recognised that credit-information sharing could improve the functioning of the credit market by reducing information asymmetry between lenders and borrowers.

It could therefore facilitate more accurate assessment of credit risk and improve lending decisions.

The case is important because it demonstrates that:

Information sharing is not inherently anti-competitive.

Its competitive effect depends on the nature and structure of the information system.

The OECD has similarly identified Asnef-Equifax as an important example where credit-information sharing could reduce information asymmetry and facilitate competition.

12. Case Law 2 — Banco BPN/BIC Português

Banco BPN, S.A. v BIC Português, S.A. and Others

C-298/22, CJEU, 29 July 2024

This is arguably the most directly relevant modern banking-information-sharing case.

Fourteen Portuguese banks exchanged information concerning:

• current credit conditions;
• future credit spreads;
• risk variables;
• monthly production volumes;
• home loans;
• consumer credit;
• corporate lending.

The exchange occurred regularly in a highly concentrated banking market with barriers to entry.

The CJEU held that an exchange of confidential and strategic information of this kind could constitute a restriction of competition by object.

Key principle

Competitors are normally expected to determine their competitive strategies independently.

When they exchange information revealing:

"What price will you charge?"

"How much credit will you supply?"

"What strategy will you adopt?"

competitive uncertainty may disappear.

That can facilitate coordination.

Importance for India

This case is highly relevant to Indian banks, fintech firms, NBFCs and financial associations.

A banking association should be extremely cautious about creating databases containing:

• future interest-rate plans;
• future spreads;
• loan volumes;
• customer acquisition plans;
• strategic pricing;
• margins;
• commercially sensitive lending strategies.

13. Case Law 3 — Hungarian Banking Association / BankAdat

Hungarian Competition Authority, BankAdat Case

The Hungarian Banking Association operated the BankAdat database through which participating banks could access sensitive and strategic information.

The database operated for many years and enabled banks to exchange information relating to:

• quantities;
• costs;
• demand;
• profits;
• market processes;
• business policies;
• strategies.

The Hungarian Competition Authority concluded that this constituted horizontal information exchange capable of restricting competition and imposed a substantial fine.

Importance

BankAdat demonstrates that a database itself can become a competition problem.

The legal question is not:

"Is a database efficient?"

but:

"Does the database give competitors commercially sensitive knowledge that reduces competitive uncertainty?"

14. Case Law 4 — Groupement des Cartes Bancaires

Groupement des Cartes Bancaires (CB) v European Commission

C-67/13 P

This case concerned restrictions within the French bank-card payment system.

The CJEU clarified the important distinction between:

• restrictions that can be classified as restrictions by object, and
• conduct whose effects must be demonstrated.

Relevance to Banking Data

The case provides an important analytical safeguard.

Not every banking-sector arrangement that potentially affects competition should automatically be treated as a cartel.

Authorities must examine:

• the content of the arrangement;
• its objectives;
• economic and legal context;
• whether it is sufficiently harmful by its nature.

This is particularly important for data-sharing arrangements because some information exchanges may be beneficial, while others may facilitate coordination.

15. Case Law 5 — MasterCard Inc. v Commission

Case C-382/12 P

The MasterCard litigation concerned multilateral interchange fees in card-payment systems.

Although it was not principally a data-sharing case, it is important for understanding competition in payment markets, where banks and payment networks operate through interconnected platforms.

The EU competition framework examined:

• network effects;
• relationships between acquiring and issuing banks;
• payment infrastructure;
• merchant costs;
• competitive effects.

The case demonstrates that banking and payment competition frequently involves multi-sided markets, rather than simple buyer-seller relationships.

Relevance to Data

Modern payment systems generate enormous amounts of transaction information.

Consequently, control over:

• payment infrastructure;
• transaction data;
• customer relationships;
• merchant relationships

can reinforce platform power.

16. Case Law 6 — MCX Stock Exchange v National Stock Exchange

CCI, Case No. 13/2009

This Indian competition case concerned competition in financial-market infrastructure.

The CCI found NSE's conduct involving pricing and interoperability in the exchange market to raise concerns under competition law.

Although this case was not a banking-data-sharing case, it is important by analogy because it demonstrates the CCI's willingness to examine competitive conditions in highly networked financial infrastructure.

Relevance

Financial data systems frequently exhibit:

• network effects;
• economies of scale;
• switching costs;
• interoperability issues.

These are also characteristics of modern banking-data ecosystems.

Therefore, the case is useful for understanding how competition law can approach infrastructure-based financial markets.

17. Case Law 7 — HSBC Holdings v Commission

HSBC Holdings plc and Others v European Commission

C-883/19 P

This case concerned information exchanges in financial markets and is important for the principle that strategically sensitive information can facilitate coordination.

The CJEU's jurisprudence emphasizes that information concerning future commercial behaviour can be particularly problematic because it reduces uncertainty between competitors.

The principle is directly relevant to banking because future:

• interest-rate strategy;
• lending terms;
• credit spreads;
• production;
• market positioning

can constitute strategically sensitive information.

18. Case-Law Summary

19. Types of Banking Data and Competition Risk

20. The "Sensitive Banking Data" Test

Competition regulators should examine five characteristics.

1. Is the information commercially sensitive?

Examples:

• pricing;
• margins;
• future strategy.

2. Is it confidential?

Information already publicly available generally creates less risk.

3. Is it individualised?

Data identifying the conduct of a particular competitor creates greater risk.

4. Is it current or future-oriented?

Future strategic information is particularly dangerous.

5. Is the market concentrated?

Information exchange creates greater coordination risks where only a few large banks dominate.

The CJEU's Banco BPN judgment specifically emphasised confidentiality, strategic character, market concentration, barriers to entry and the capacity of the exchange to reduce uncertainty.

21. Data Aggregation as a Competition Safeguard

One possible solution is aggregation.

Instead of:

Bank A's exact monthly lending volume

provide:

Total banking-sector lending volume.

This makes it more difficult to identify individual competitors' strategies.

However, aggregation must be genuine.

A supposedly aggregated dataset can remain competitively sensitive if the market is so concentrated that participants can reconstruct each competitor's information.

22. Anonymisation

Another mechanism is anonymisation.

For example:

Unsafe

Bank A issued 1,000 home loans at 8.2%.

Safer

Average sector-wide home-loan lending increased by 6.4%.

However, anonymisation must prevent re-identification.

Simply removing names may not be sufficient.

23. Historical Data

Age is relevant.

Generally:

Old information → lower strategic value

while:

Current/future information → greater strategic risk.

But historical information can remain competitively sensitive where:

• the market changes slowly;
• prices remain stable;
• competitors can infer current strategies from historical patterns.

Therefore, there is no universal rule that "old data is safe."

24. Public vs Private Data

Competition law generally treats information differently depending upon whether it is publicly available.

Public information

For example:

• published interest rates;
• publicly advertised products;
• statutory disclosures.

Private information

For example:

• confidential future pricing;
• internal margins;
• strategic lending targets.

An exchange among banks of information that each bank was already legally required to publish is fundamentally different from the private exchange of unpublished future strategy.

The Banco BPN judgment specifically considered the distinction between information already required to be publicly disclosed and information exchanged beyond those obligations.

25. Data Sharing Through Banking Associations

Banking associations can perform legitimate functions such as:

• standard setting;
• industry research;
• regulatory consultation;
• cybersecurity coordination;
• fraud prevention;
• technical interoperability.

But they must avoid becoming mechanisms for competitor coordination.

A banking association should therefore establish:

• competition-law protocols;
• clean teams;
• restricted access;
• data aggregation;
• anonymisation;
• legal review;
• access logs.

The BankAdat case demonstrates the danger when an industry database permits competitors to obtain confidential strategic information.

26. Clean Teams

A clean team is a restricted group of individuals who may access competitively sensitive information without passing it to commercial decision-makers.

This can be useful during:

• mergers;
• due diligence;
• joint ventures;
• industry studies;
• regulatory projects.

The principle is:

Information necessary for legitimate cooperation should not automatically reach employees responsible for competitive decisions.

27. Data Sharing and Merger Control

Bank mergers create special risks.

Suppose:

Bank A + Bank B

creates a combined institution possessing:

• customer data;
• credit history;
• transaction data;
• merchant information;
• payment data.

The regulator must ask:

1. Will the merger reduce consumer choice?
2. Will it create excessive data concentration?
3. Will competitors lose access to important information?
4. Will customers face greater switching costs?
5. Can the merged institution use data across markets?
6. Will fintech competitors be disadvantaged?

Thus, data should increasingly be considered a competitive asset in banking mergers.

28. Data Sharing and Fintech Competition

Fintech companies often face an important problem:

They may have innovative products but lack historical financial information.

Banks, by contrast, possess extensive customer data.

This creates an imbalance.

If banks refuse legitimate customer-authorised data portability, fintech competition can be weakened.

Account Aggregators attempt to address this problem by allowing customers to direct data transfers between participating financial institutions.

29. Banking Data and Financial Inclusion

Data sharing can improve access to credit.

A person with:

• limited traditional credit history;
• irregular income;
• small-business transactions;
• digital payment records

may nevertheless possess substantial alternative financial information.

With appropriate consent and safeguards, data sharing can enable lenders to assess such customers more accurately.

This can promote:

• financial inclusion;
• MSME lending;
• agricultural finance;
• consumer credit;
• fintech competition.

30. Risks of Excessive Data Sharing

Data sharing is not automatically beneficial.

Potential risks include:

Privacy risk

Unauthorised disclosure of financial information.

Cybersecurity risk

Large databases become attractive targets.

Discrimination

Algorithms may use financial data to discriminate against particular consumers.

Exclusion

A poor credit profile can follow an individual across institutions.

Surveillance

Extensive transaction data can reveal highly sensitive personal behaviour.

Competition risk

Banks may use shared information to coordinate rather than compete.

31. Data Sharing and Dominant Banks

A dominant bank may have a particularly important duty.

Suppose a bank controls an important banking-data infrastructure.

It might:

• refuse access;
• impose discriminatory conditions;
• delay API access;
• provide inferior data formats;
• restrict interoperability;
• tie access to other services.

Such conduct may raise Section 4 concerns where dominance and competitive harm are established.

The question is not whether the bank owns the data system.

The question is:

Does control over the data infrastructure give the bank the ability and incentive to exclude competitors?

32. Essential-Facility Theory

In exceptional circumstances, banking data infrastructure could raise an essential-facility-type question.

The analysis would consider:

1. Is the data indispensable?
2. Can competitors reasonably reproduce it?
3. Is access technically feasible?
4. Would refusal eliminate effective competition?
5. Is there a legitimate justification for refusal?
6. Can access be provided while protecting privacy and security?

The threshold should remain high.

Otherwise, competition law could discourage investment in financial-data infrastructure.

33. Pro-Competitive Data-Sharing Model

An ideal system can be represented as:

Customer

↓

Explicit Consent

↓

Account Aggregator / Secure API

↓

Bank / Fintech / NBFC

↓

Credit Assessment

↓

Competitive Financial Product

↓

Customer Choice

This model uses data to increase competition.

34. Anti-Competitive Data-Sharing Model

The dangerous model is:

Bank A ↔ Bank B ↔ Bank C

↓

Future Prices

↓

Future Lending Volumes

↓

Strategic Plans

↓

Reduced Uncertainty

↓

Tacit/Explicit Coordination

↓

Higher Prices / Reduced Competition

The Banco BPN and BankAdat authorities are particularly important illustrations of this risk.

35. Regulatory Enforcement Mechanisms

A. Ex-Ante Regulation

Authorities can prescribe rules before harm occurs.

Examples:

• standardised APIs;
• data-sharing standards;
• consent requirements;
• interoperability requirements;
• data portability.

B. Ex-Post Competition Enforcement

CCI can investigate:

• anti-competitive information exchange;
• discriminatory access;
• refusal to deal;
• exclusionary arrangements;
• abuse of dominance.

C. Regulatory Sandboxes

Fintech firms can test innovative data-sharing models under controlled regulatory conditions.

D. Technical Standards

Regulators can establish:

• data formats;
• API standards;
• cybersecurity requirements;
• authentication mechanisms.

E. Auditing

Financial-data systems can be subject to:

• independent audits;
• access logs;
• security testing;
• competition compliance audits.

36. Competition Compliance for Banks

Banks participating in data-sharing arrangements should adopt a formal compliance framework.

Before sharing information, ask:

1. Is sharing legally required?
2. Is customer consent required?
3. Is the recipient a competitor?
4. Is the information commercially sensitive?
5. Is it current or future-oriented?
6. Is it aggregated?
7. Can individual banks be identified?
8. Is there a legitimate pro-competitive objective?
9. Is the exchange necessary?
10. Can the same objective be achieved with less sensitive information?

37. Special Problem of Artificial Intelligence

AI makes banking data-sharing even more significant.

Banks increasingly use data to develop:

• credit-scoring models;
• fraud-detection systems;
• customer segmentation;
• risk models;
• automated underwriting.

A dominant bank possessing substantially more data could develop superior AI models, which may further reinforce its market position.

This creates a feedback loop:

More customers → more data → better AI → better credit decisions → more customers → more data.

Competition authorities may therefore need to examine both:

data concentration + computational/algorithmic advantage.

38. Data Sharing and Open Banking

Open banking attempts to shift control from:

institution-centred data

toward:

customer-directed data portability.

The competition rationale is strong:

Customers should not become permanently tied to a financial institution merely because that institution possesses their historical financial information.

India's Account Aggregator system is a particularly important example of this approach. The framework expressly requires customer consent and permits transfer based on the individual's instruction.

39. Critical Analysis

The law must avoid two extremes.

Extreme 1 — Excessive secrecy

If banks cannot share any data, competition may suffer because:

• lenders cannot assess creditworthiness;
• fintechs cannot innovate;
• customers cannot switch easily;
• new entrants face information disadvantages.

Extreme 2 — Excessive information exchange

If competing banks freely exchange:

• prices;
• margins;
• future strategies;
• lending targets;
• customer acquisition plans,

competition may be weakened.

Therefore:

The goal is not maximum data sharing or minimum data sharing. The goal is competitively appropriate data sharing.

40. Recommended Indian Regulatory Model

A strong Indian framework could adopt the following principles:

1. Customer-controlled data portability

Customers should be able to authorise legitimate transfers.

2. Standardised technical infrastructure

APIs should be interoperable.

3. Competition-sensitive information rules

Competitors should not freely exchange strategic information.

4. Aggregation

Industry statistics should generally be sufficiently aggregated.

5. Anonymisation

Individual institutions should not be identifiable where unnecessary.

6. Clean teams

Sensitive data should be restricted to authorised personnel.

7. Competition-law review

Industry-wide data-sharing projects should receive competition compliance review.

8. Privacy-by-design

Data sharing must incorporate strong privacy safeguards.

9. Cybersecurity

Financial-data transfer requires strong authentication and security.

10. Regulatory coordination

CCI, RBI and relevant data-protection authorities should coordinate where competition and data-governance issues overlap.

41. Key Legal Principles

The following principles emerge from the cases:

Principle 1

Information sharing is not inherently anti-competitive.

Asnef-Equifax demonstrates that credit-information sharing can improve market functioning.

Principle 2

Strategic information exchange among competitors can be highly dangerous.

Banco BPN demonstrates this clearly.

Principle 3

Future-oriented information is particularly sensitive.

Future prices and strategic intentions can remove competitive uncertainty.

Principle 4

Market structure matters.

Information exchange is more dangerous in concentrated markets with significant entry barriers.

Principle 5

Purpose and effects both matter.

Authorities must distinguish beneficial information systems from coordination mechanisms.

Principle 6

Customer-authorised portability can promote competition.

Account Aggregators demonstrate how data mobility can reduce informational barriers.

Principle 7

Data regulation and competition law must interact.

Modern banking markets require coordination between sectoral regulation and competition enforcement.

42. Research Questions

For a dissertation or advanced research project, useful questions include:

1. Can refusal by a dominant bank to provide customer-authorised data constitute abuse of dominance?
2. How should the CCI distinguish legitimate credit-information sharing from cartelistic information exchange?
3. Can Account Aggregators reduce concentration in Indian banking markets?
4. Should banks be required to provide real-time financial-data portability?
5. How should competition law regulate banking associations' databases?
6. What constitutes strategically sensitive banking information?
7. Can AI-generated credit scores be considered competitively significant data assets?
8. How should customer privacy be reconciled with competition-based data access?
9. Can banking data constitute an essential facility?
10. Should banking mergers be evaluated partly on the basis of data concentration?
11. How can fintech entrants obtain sufficient data without receiving competitors' strategic information?
12. What role should the CCI play alongside the RBI in regulating banking data ecosystems?

43. Conclusion

Competition Law and Data Sharing in Banking Markets involves a fundamental balancing exercise.

On one side:

Data sharing can promote competition.

It can reduce information asymmetry, improve credit assessment, facilitate fintech entry, reduce switching costs and strengthen customer choice.

On the other:

Competitor-to-competitor information sharing can suppress competition.

The Asnef-Equifax approach demonstrates the potential pro-competitive value of credit-information sharing, while BankAdat and Banco BPN/BIC Português demonstrate the danger of allowing competing banks to exchange confidential and strategic information. The latter is particularly significant because the CJEU's 2024 ruling confirmed that certain standalone exchanges of strategic banking information can amount to a restriction of competition by object.

For India, the Account Aggregator framework offers an important pro-competitive model because financial information moves between institutions on the customer's instruction and with explicit consent.

The appropriate regulatory philosophy can therefore be expressed as:

Customer-directed data mobility should generally be facilitated; competitor-directed strategic information exchange should generally be controlled.

The future of banking competition will consequently depend not merely upon who has the most data, but upon who can lawfully access it, who controls it, whether customers can move it, and whether information sharing promotes competition or eliminates competitive uncertainty.