Leveraging LTV Technology for Long-Term Electronic Archiving
For electronic archiving, Long-Term Validation (LTV) technology for digital signatures plays an indispensable role. LTV is understood as the process of validating electronic documents to ensure the validity of digital signatures at the time of signing, using Cryptographic Message Syntax (CMS) technology and advanced Public Key Infrastructure (PKI) formats. To use LTV, the system must accurately determine the signing time through an attached Timestamp. LTV is an important component of the advanced digital signature standard for PDF, known as PAdES. PAdES is defined as “a set of rules and additional features for PDF/ISO 32000-1 files designed to support advanced digital signatures.” While PAdES is the standard for applying and validating advanced digital signatures in PDF files, CAdES serves as a guiding standard for the technical specifications of advanced digital signature technology. Advances in digital signature technology for PDF files have become truly useful thanks to the support of new features. Currently, the PAdES digital signature profiles provided by Foxit PDF SDK include: What Is the Purpose of LTV? When signing a paper document by hand, the signatory generally assumes that the signature will remain valid indefinitely. The same assurance is required for electronic documents, even as technology continues to evolve. Without LTV, electronic documents are subject to limitations on how long they can be validated and may become invalid when the CA ceases to provide services. This can result in the costs of revalidating and re-signing electronic documents, as well as re-establishing signed contracts or legal instruments. Using digital signature technology that supports LTV enables users to electronically archive contracts, forms, and PDF documents with full legal validity. Today’s advanced technology allows users to attach multiple Timestamps and validation data to signatures within the same PDF file. This process can be repeated multiple times, extending validation capabilities through a chain of validation records, even after the original digital certificate has expired or been revoked. How Does LTV Benefit Electronic Archiving? Long-Term Validation (LTV) technology ensures the trustworthiness of digital signatures by preserving the signing time and using this information as a reference point for validation. This is far more practical than relying solely on a single CA or a particular clause in a contract or legal document. Documents signed digitally with LTV can be re-signed, and the new digital signatures can be validated without having to repeat the entire contract execution process or create new contracts, thereby reducing associated time and labor costs. Using LTV with the PDF/A Format By combining LTV technology with the PDF/A standard, a PDF format specifically designed for long-term archiving, users can maintain electronic archives of digitally signed documents with long-term validation capability for many years. This is an ideal choice for companies and organizations that use PDF/A to archive large volumes of electronic documents. LTV Compliance For companies and organizations subject to stringent regulations governing electronic records, particularly electronic contracts, LTV technology provides an effective solution. By implementing LTV, organizations and companies can meet Timestamp requirements by establishing a trusted digital signing time and ensuring the integrity of PDF data. In Europe, the eIDAS Regulation specifies the following mandatory requirements for advanced electronic signatures: With LTV, users can meet all these requirements and more! LTV in Security and Information Protection Digital signatures are one of the most effective tools for ensuring the integrity of electronic documents. The technology is standardized for use anytime and anywhere, and is recognized by private organizations, governments, and authorities around the world. LTV technology provides users with an additional layer of security through a historical chain of digital signature verification, supported by Timestamps and associated validation mechanisms. SAVYINT offers a comprehensive suite of solutions that fully supports LTANS/LTV long-term archiving standards, as well as standards for digital signatures and remote digital signing, including eIDAS 2.0 and NIS2, ensuring the ability to archive documents over the long term or permanently. Including the following solutions: Contact us today for expert consultation HERE!
Understanding Long-Term Validation (LTV) in Digital Signatures
To standardize formats and ensure verifiability, the European Telecommunications Standards Institute (ETSI) has issued a series of foundational standards for digital signature formats. One of the most important is TS 102 778, which provides guidelines for applying the ISO 32000-1 standard to PDF files. This standard is also known as PDF Advanced Electronic Signatures (PAdES). The PAdES standard was developed to ensure that digitally signed electronic documents can be stored, retrieved, and used for decades. At any point in the future, even as technology advances dramatically, users must still be able to validate electronic documents – particularly the validity of digital signatures at the time of signing. This requirement laid the foundation for the development of Long-Term Validation (LTV) technology. The introduction of the PAdES signature standard marked the standardization of advanced digital signature formats for PDF files, enabling long-term storage and validation. With Long-Term Validation (LTV) technology, the digital signing timestamp is recorded and stored directly within the electronic document. The LTV-enabled status is displayed in the digital signature parameters. Validation evidence is embedded directly in the electronic document, allowing the validity of the electronic record to be verified in the future without depending on the validity or revocation status of the digital certificate after signing. Since this evidence is stored within the digitally signed document, it is also authenticated and protected by the document’s digital signature, significantly minimizing the risk of errors or forgery. LTV technology is a valuable option for individuals, organizations, and businesses seeking to reduce their dependence on third-party systems and minimize future uncertainty regarding expired or revoked digital certificates. Applying LTV to Digital Signature Solutions Today, certain industries require the validity of a signature to be verifiable at the time of signing, making the adoption of advanced standards such as PAdES necessary. When Acrobat Reader or any other PDF software that supports digital signature validation opens a PDF document, it can readily validate the digital certificate used in the document-signing process without requiring separate digital signing applications provided by service providers. With LTV technology, signing-time data is stored directly in the document, allowing PDF software to validate the digital signature at the time of signing using the embedded timestamp information. As a result, PDF software can still verify the validity of the digital certificate at the time of signing, even if the original certificate has since expired or been revoked. For electronic documents that have not been digitally signed using LTV technology, PDF software such as Acrobat Reader may encounter difficulties validating the digital certificate associated with the digital signature. If the certificate has expired, Acrobat Reader will display a yellow warning to the user stating, “At least one signature has problems.” This warning means that Acrobat Reader cannot determine whether the digital certificate was valid at the time of signing. Savyint is one of the trusted providers of LTV digital signature solutions that fully comply with European and international standards. Contact us today for consultation HERE!
Comparing Digital Signatures With and Without Trusted Timestamps
Digital signatures on electronic documents help identify and authenticate signatories, ensure document integrity, and provide non-repudiation. So, what additional value does a digital signature offer when combined with a trusted Timestamp and Long-Term Validation (LTV) technology, and in which cases should this solution be used? Digital Signatures Ensure Signer Identification, Authentication, Document Integrity, and Non-Repudiation Paper-based documents bearing handwritten signatures and red seals are gradually becoming outdated in the face of new societal demands and challenges. Paper documents are inefficient because they depend on and are constrained by numerous factors, including printing and scanning speeds, printers, ink, and document delivery times. The same person’s handwritten signature may vary across documents and can be easily forged or used for fraudulent purposes, making verification and notarization difficult. Furthermore, paper documents are susceptible to tearing, alteration, and erasure, making their integrity difficult to guarantee. Therefore, adopting digital signature systems for individuals, organizations, and enterprises is a fundamental prerequisite and the first step toward comprehensive digital transformation. In legal terms, digital signatures have the same legal validity as handwritten signatures and seals. Electronic documents digitally signed in accordance with applicable regulations enable accurate identification and authentication of the signatory, ensure document integrity, and provide non-repudiation. A digital signature is intentionally created by its owner and is designed to prevent forgery or accidental creation through technical mechanisms provided by trust service providers and digital signature solutions. Digital signatures provide a trusted foundation for document digitization and the creation of electronic documents. Digital Signatures With and Without Trusted Timestamps and LTV With digital signatures that do not include a trusted timestamp, the displayed signing time is based on the clock of the signing device or server. This time can be easily altered using simple tools, potentially exposing time-sensitive documents and records—such as financial, banking, and securities transactions; purchase and sale contracts; electronic medical records; and certificates of intellectual property ownership or copyright—to forgery and fraud. In the event of a dispute, it may therefore be difficult to establish the exact time at which a document was signed and whether the digital signature was valid at that time. In particular, when a digital certificate has expired, verifying the signing time and document integrity may become difficult or impossible if the necessary validation data has not been preserved. As a result, the document may lose its evidentiary value if its authenticity and the validity of the signature at the time of signing cannot be established. This poses a risk to organizations that rely solely on digital signatures without trusted timestamps, especially when handling sensitive documents for which the signing time and the validity of the digital signature at that time must be proven. Digital signatures combined with trusted Timestamping and Long-Term Validation (LTV) provide enhanced integrity protection for your electronic documents, helping preserve the evidence needed for long-term validation. These include: Documents for which the legal validity of a digital signature at the time of signing is particularly important and for which trusted timestamping may be necessary, include: Explore Savyint Qualified Timestamp – a trusted timestamping service for electronic documents, HERE!
Savyint and SAVIS Advance Digital Trust for the Media Industry in Vietnam
On October 9, at the exhibition “VTV – From Traditional Television to a Digital Media Organization: Audience-Centric, Data-Driven and AI-Powered,” organized by Vietnam Television (VTV), Savyint and its partner in Vietnam, SAVIS, showcased a modern suite of AI-powered solutions built on Zero Trust architecture and designed to be post-quantum cryptography-ready for VTV’s digital platforms. As one of the key activities marking Vietnam’s National Digital Transformation Day 2026, the exhibition brought together leading technology companies showcasing solutions for the television and media industries. In his opening remarks, Mr. Đinh Đắc Vĩnh, Deputy Director General of Vietnam Television, stated that the exhibition is one of VTV’s practical annual initiatives, contributing to the effective implementation of Politburo Resolution No. 57-NQ/TW on breakthroughs in science and technology development, innovation and national digital transformation, as well as VTV’s own digital transformation program. In recent years, advanced technologies such as AI and cloud computing have had a significant impact on the television industry, creating numerous opportunities to automate business processes, improve production efficiency, analyze data and personalize viewer experiences. The exhibition’s theme also addresses a key challenge facing broadcasters today: how to make emerging technologies more accessible and apply them more effectively. Supporting the digital transformation of the television industry, SAVIS introduced an ecosystem of solutions combining AI and Zero Trust architecture with post-quantum cryptography readiness. The ecosystem aims to achieve three key objectives: optimizing content production and distribution, maximizing the value of data resources, and building a secure and trusted digital environment, ultimately strengthening national digital sovereignty. AI and data are driving innovation, but a digital media ecosystem can operate sustainably only when all participating entities are authenticated, data is protected, and access rights are appropriately controlled. Together with SAVIS, a leading provider of Digital Trust solutions, Savyint introduced an ecosystem of platforms designed to ensure cybersecurity and information security for press and television organizations: All these platforms incorporate post-quantum cryptography (PQC) algorithms, including ML-KEM, ML-DSA and SLH-DSA, enabling flexible cryptographic transitions while supporting compliance with stringent data security and privacy requirements in Vietnam and internationally, including GDPR, PCI DSS, eIDAS 2.0 and PSD3. With an ecosystem combining AI, Digital Trust, Zero Trust and post-quantum cryptography, Savyint and SAVIS aim to support Vietnam Television and other television and media organizations in Vietnam and across the region in modernizing operations, maximizing the value of data, protecting intellectual property and strengthening cybersecurity capabilities. Some snapshots from the event:
Vietnam: Personal Data Security When Integrating with VNeID – What Should Businesses Do?
In Vietnam, connecting to and verifying information through the VNeID application has officially become a core form of digital identification, serving as the “digital identity” of each citizen in the electronic environment. However, as identity data is shared and utilized in the digital environment, businesses and organizations must also ensure that user data is properly managed and used. 1. Personal data protection: From “recommendation” to “mandatory requirement” Effective from January 1, 2026, the Personal Data Protection Law No. 91/2025/QH15 establishes a new legal framework for the collection, processing, and protection of personal data. Subsequently, Decree No. 320/2026/ND-CP, effective from September 28, 2026, further requires the connection and use of electronic identification and authentication across multiple sectors. Specifically: However, authentication through VNeID does not mean that organizations have the right to use all citizens’ data for every purpose. Under Vietnam’s Personal Data Protection Law, users have the right to know and request transparency regarding: The measures used to protect data against unauthorized access, use, or disclosure. Therefore, businesses and organizations also need to implement the necessary platforms and systems to safeguard users’ rights regarding the sharing of personal data, while supporting record-keeping and reporting when required. 2. Legal compliance needs to be translated into technical controls Personal data protection cannot stop at internal procedures or written policies. Vietnam’s personal data protection regulations have established clearer requirements regarding organizational responsibilities in cases involving personal data breaches and cybersecurity incidents. Specifically, the 2025 Personal Data Protection Law together with Decree No. 330/2026/ND-CP provides for administrative penalties in the areas of cybersecurity and personal data protection. Depending on the nature and severity of the violation, organizations and individuals may face: The collection, storage, use, provision, or sharing of data for improper purposes, without an appropriate legal basis, or without adequate data protection measures may also expose organizations to unnecessary legal risks. 3. What should businesses and organizations do to ensure user data security when integrating with VNeID? When data generated through electronic identification and authentication is incorporated into business processes, the responsibility for protecting that data does not stop at the point of connection with VNeID. Companies and organizations need to establish end-to-end data control mechanisms covering data collection, transmission, processing, storage, sharing, and the destruction or deletion of data in accordance with applicable regulations. Businesses should: Proactively protecting users’ personal data is not only a legal requirement but also an opportunity for businesses to strengthen risk management, prevent fraud, and protect their long-term reputation. To meet the requirements for personal data protection, strong authentication, and traceability when integrating with VNeID, businesses need a security architecture capable of maintaining control throughout the entire data lifecycle. With more than 22 years of experience in cybersecurity and digital trust, SAVYINT provides a comprehensive Digital Trust & Cybersecurity ecosystem with solutions such as Multi-Factor Authentication (MFA), Strong Customer Authentication (SCA), FIDO2 Identity, Post Quantum Identity & Authentication, Transaction Signing, data encryption, Tokenization, and API Security. These solutions help businesses strengthen access control, protect sensitive data, and enhance their ability to meet requirements for data security, traceability, and regulatory compliance in Vietnam. Contact with SAVYINT experts HERE.
Vietnam Seeks to Elevate Electronic Identification and Authentication Regulations into Law
For many years, electronic identification in Vietnam has largely been viewed as a tool to support the delivery of administrative procedures in the digital environment. For most citizens, electronic identification has been closely associated with the VNeID application, digital driving licences, or access to online public services without the need to present physical documents. However, the proposals put forward by the Ministry of Public Security as part of the development dossier for the Law on Electronic Identification and Authentication indicate that the scope and ambition of this policy extend far beyond that. If approved by the National Assembly of Vietnam, the legislation would not merely govern electronic identification accounts or the VNeID application. More broadly, the draft law seeks to establish a national digital identity infrastructure in which not only individuals but also organizations, goods, assets, data, software, locations, transactions, and other entities within the digital economy can be identified, authenticated, and traced in the electronic environment. This represents an important shift in national governance — from traditional administrative management toward data-driven governance in the digital age. Electronic Identification Is Becoming Essential National Infrastructure Globally, electronic identification and authentication are increasingly regarded as core infrastructure for the digital economy. The European Union is implementing the European Digital Identity Framework (eIDAS 2.0) alongside the European Digital Identity Wallet, enabling citizens to use a unified digital identity when conducting transactions across member states. Estonia has long served as a model for digital government, with almost all public services operating on the basis of its electronic identification system. Singapore has developed the Singpass ecosystem to serve both the public and private sectors, spanning banking, insurance, real estate, and other services. Meanwhile, India operates Aadhaar with more than 1.4 billion digital identities, widely regarded as the world’s largest electronic identification system. The common thread across these models is that electronic identification is no longer viewed as a standalone technological utility. Instead, it has become an operational foundation for digital government, the digital economy, and digital society. Current international trends are moving even further beyond human identification. The European Union is implementing the Digital Product Passport, under which each product is assigned a unique electronic identifier to support traceability and lifecycle management. New international standards are also expanding the scope of identification to goods, assets, data, devices, applications, and many other types of entities in the digital environment. It is against this backdrop that the Ministry of Public Security considers it necessary for Vietnam to establish a legal framework with greater legal authority, enabling the country to keep pace with global developments and meet the requirements of national digital transformation. Regulations Are No Longer Sufficient for the Next Stage of Development After more than three years of implementing Decree No. 59/2022/ND-CP and Decree No. 69/2024/ND-CP, Vietnam’s national electronic identification system has achieved notable results. However, according to the Ministry of Public Security, Vietnam has now moved beyond the initial stage of electronic identification. Previously, the primary focus was on establishing digital identities for citizens and organizations. Today, the scope of governance requirements is considerably broader. In the digital environment, identifying people alone is no longer sufficient. The State needs the ability to identify vehicles, goods, locations, data, software, digital assets, and many other types of objects to support governance, transactions, and the development of the digital economy. Meanwhile, regulations relating to identification are currently scattered across multiple laws and subordinate legal instruments, including the Law on Identification, the Law on Electronic Transactions, the Law on Data, the Law on Digital Technology Industry, and various sector-specific regulations. This fragmentation creates significant challenges. For state management agencies, the absence of a unified legal framework limits the ability to ensure data interoperability across ministries, sectors, and local authorities. For businesses, compliance with multiple authentication mechanisms increases both compliance costs and transaction costs. For citizens, repeatedly providing and verifying information — even when the data already exists within government systems — reduces the efficiency of the digital transformation process. The development of a unified law is therefore expected to establish a common “language” for Vietnam’s entire digital identity and data ecosystem. Legal Recognition of Digital Identity and Reduced Reliance on Physical Documents Another important driver behind the development of the law is the need to strengthen the legal foundation for the use of electronic documents. In recent years, VNeID has integrated various types of documents, including identity cards, driving licences, vehicle registration certificates, health insurance information, and other documents. However, the number of documents integrated into the system remains limited compared with practical needs. Many agencies and organizations still require citizens to present physical documents even when the relevant information has already been authenticated through electronic systems. This situation reflects a fundamental issue: current legislation does not yet provide sufficiently comprehensive legal recognition of digital identities and electronic documents. In the absence of a sufficiently strong legal basis, many agencies continue to adopt the safer approach of requiring paper – based documentation rather than relying entirely on electronic data. Accordingly, one of the key objectives of the draft law is to establish clear legal status for digital identities, electronic documents, and electronic authentication results. If implemented effectively, this could provide the foundation for significantly reducing administrative paperwork, lowering compliance costs, and shortening the time required to process procedures for citizens and businesses. Electronic Identification Is Not Limited to Public Services A notable aspect of the draft legislation is that electronic identification is designed not only to support government operations but also to facilitate transactions within the private sector. In finance and banking, a unified electronic identification system could significantly reduce customer verification costs, improve the efficiency of eKYC processes, and help mitigate fraud. In e-commerce and logistics, the identification of goods and products could support traceability, combat counterfeit products, and enhance supply-chain trust. For data and digital assets, establishing electronic identities for data and intangible assets could provide a foundation for new data-driven business models. In other words, the draft law would not only affect public administration but
From Open Banking to Open Finance and Open Data
The Open Banking ecosystem is expanding rapidly, bringing significant and positive changes to the global financial landscape. The world is now ready to witness the next chapters in the evolution of Open Finance and Open Data. In fact, Open Banking emerged somewhat unexpectedly. In the UK, as Fintech companies began entering the retail payments market, there were initially no specific regulations governing how these parties should collaborate or operate within the ecosystem. A study conducted by the UK Competition and Markets Authority (CMA) found that the UK retail banking sector was highly concentrated, with limited competition. These findings provided a major impetus for the introduction of Open Banking regulations and similar initiatives worldwide, aimed at enhancing competition and driving economic growth. This led to the emergence of Open Banking, with its principles and requirements formally established under the European Parliament’s PSD2 Directive and, more recently, the proposed PSD3 framework. Key roles were also clearly defined, including Account Information Service Providers (AISPs), which aggregate users’ financial data from multiple accounts, and Payment Initiation Service Providers (PISPs), which enable payment services across accounts. The emergence of Open Banking has encouraged banks to invest in API technology and establish partnerships with Fintech organizations across Europe. Nordic banks were among the earliest and most enthusiastic adopters of this model. Digital Identity as an Enabler of Open Finance and Open Data The Nordic countries provide a compelling example of how digital identity can be adopted in banking for commercial purposes. As digital identity solutions become widely used across the region, they help accelerate customer authentication and streamline digital financial services. This has enabled Fintech companies not only to compete with traditional banks, but also to challenge credit and debit card providers, whose services have traditionally faced limitations in online customer information management. Beyond authentication, digital identity provides a trusted foundation for Open Finance and Open Data. By enabling secure identification, reliable authentication and consent-based data sharing, digital identity solutions can help users access financial services across multiple providers while maintaining control over their personal information. Integrated with secure APIs and consent management platforms, digital identity can support trusted data exchange among banks, Fintech companies and other authorized third parties, paving the way for more connected, interoperable and user-centric financial ecosystems. Open Data Enables Competition and Drives Innovation Following its implementation and widespread adoption, Open Banking has developed more rapidly than initially anticipated. Today, users can authorize banks to share their transaction histories, identification images and other relevant information with other banks or third-party providers of their choice. They can also switch accounts, apply for loans or obtain credit cards from new providers with greater ease. In addition, users can manage their financial histories through a single platform, eliminating the need to switch between multiple applications. This transformation is gaining momentum as new players enter the ecosystem. In the future, organizations outside the financial sector will also leverage Open Data to deliver highly personalized products and services, while allowing users to retain control over their own data. These new market participants will make it easier for users to discover and access services that meet their specific needs. Ultimately, services that significantly reduce time and costs will be well positioned to attract and retain users. Open Data – An Opportunity for Early Movers From the perspectives of regulators and users alike, the transition to Open Banking and Open Finance is not something that can be achieved overnight. It requires a continuous, long-term process. Greater attention will also be needed as new technological initiatives around Open Data emerge. For Open Data to drive meaningful and positive change, clear regulatory frameworks and legal standards are essential. This requires concerted efforts from regulatory authorities, as well as closer international cooperation to establish common standards and requirements for secure, compliant data exchange across borders. In conclusion, the world is witnessing the continued growth of Open Banking and the benefits it brings. It is now time to set the next goals for the era of Open Finance and Open Data. While this transformation will take time, it will serve as a powerful catalyst for global economic and technological development. SAVYINT – Comprehensive Open Banking Solutions SAVYINT provides a comprehensive Open Banking solution ecosystem, encompassing data management, Digital Identity and trusted digital services. Backed by more than 20 years of experience in the Banking and Financial Services sector, SAVYINT has successfully deployed solutions for leading banks and major organizations across Vietnam and Southeast Asia (SEA). The solution portfolio includes: Contact us today to consult with our leading Open Banking experts HERE!
The Growing Threat of SIM Swap Fraud
As cybercrime and fraud have escalated into a global crisis, one type of scheme is seeing particularly rapid growth: SIM swap fraud. The growing prevalence of SIM swap attacks highlights vulnerabilities in telecom authentication processes and underscores the need for stronger regulatory measures to protect customers. SIM swap fraud is increasingly plaguing the telecommunications industry and its customers. It was recently ranked second, behind synthetic identity fraud, among the most damaging fraud schemes affecting the telecom industry. 1. What is SIM swap fraud? SIM swap fraud is a cybercrime in which criminals gain control of a victim’s mobile phone number by fraudulently obtaining a replacement SIM card. Criminals may first collect personal information through phishing, social engineering, data leaks, or malware, and then use that information to impersonate the legitimate customer. Once the victim’s mobile number is transferred to the criminal’s SIM card, SMS messages including banking OTPs and transaction alerts can be received by the fraudster. SIM swapping requires no advanced technical expertise. Instead, it relies on the fraudster’s ability to manipulate telecom carrier employees into transferring a victim’s phone number to a SIM card under the fraudster’s control. Using basic personal information obtained from public sources or data leaks, fraudsters can carry out attacks with little more than a phone call or a visit to a retail store, without requiring coding or hacking skills. The only tools needed may be inexpensive prepaid SIM cards or burner phones. In a SIM swap attack, the attacker takes control of a legitimate subscriber’s mobile phone number by persuading the mobile telecom provider to link that number to a SIM card controlled by the attacker. SIM swapping is a legitimate procedure that serves a number of purposes, such as replacing a lost or damaged SIM card. It is also used to connect mobile phones to embedded SIMs (eSIMs), which are becoming increasingly common. In a fraudulent SIM swap, however, the attacker uses social engineering techniques to convince the telecom provider to transfer the number, impersonating the legitimate customer and claiming, for example, that the original SIM card has been lost or damaged. When the attack is successful, the legitimate subscriber’s phone loses its connection to the mobile network, preventing them from making or receiving phone calls. 2. 80% of SIM Swap Fraud Attempts Succeed Due to Weak Authentication A study by Princeton University found that 80% of first attempts at SIM swap fraud were successful. One of the main reasons for this high success rate is the use of weak authentication methods by telecom operators, which can be easily bypassed by fraudsters. While each carrier has its own vulnerabilities in the SIM replacement process, none required direct identity verification or implemented strong multi-factor authentication, allowing fraudsters to carry out remote attacks with relative ease. Telecom operators have often prioritized convenience over security, opting for simpler authentication methods to streamline customer service. In doing so, they may inadvertently create opportunities for fraudsters to exploit vulnerabilities. Lowering security standards to reduce friction for customers can ultimately weaken carriers’ defenses against SIM swap fraud. The risks become even more serious when mobile banking applications rely heavily on phone numbers and SMS-based OTPs for identity verification. If a newly registered device can be activated primarily using customer credentials and an OTP, a successful SIM swap attack may give an attacker access to the victim’s bank account. Weak device-binding mechanisms, insecure account recovery processes, inadequate session controls, and insufficient verification when registering a new device can further increase this risk. 3. SIM Swap Fraud Is Not Just a Consumer Problem SIM swap attacks are often viewed primarily as a threat to individual consumers, but they can have direct consequences for organizations as well. When an employee’s phone number is compromised, attackers can intercept one-time passwords (OTPs) sent via SMS and potentially gain access to corporate systems. This puts not only personal accounts at risk but also sensitive corporate data, financial assets, and customer records. One of the most significant concerns is account compromise through SMS-based authentication. Many organizations still rely on mobile phone numbers for password resets or two-factor authentication. If an attacker gains control of an employee’s phone number, they may be able to change login credentials for email accounts, cloud services, or financial systems often without raising suspicion until it is too late. The legal and reputational risks can be equally serious. Under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, organizations have obligations to protect personal and customer data. If attackers exploit weak authentication through a SIM swap attack, regulators may consider the incident in the context of data protection requirements. Beyond regulatory compliance, such incidents can also seriously undermine customer trust. 4. Measures to Prevent SIM Swap Fraud For these reasons, security experts recommend that organizations and telecom operators move away from SMS-based authentication and adopt stronger identity authentication methods, such as Identity and Access Management (IAM), authenticator applications, or hardware security keys. Banks can mitigate SIM swap fraud through measures such as strong device binding, risk-based authentication, transaction-level verification, controls over new-device registration, cooling-off periods for high-risk activities, real-time alerts, and server-side authentication and authorization controls. Customers, meanwhile, should avoid sharing OTPs, PINs, or login credentials and should never install banking-related APK files from untrusted or unknown sources. Ultimately, SIM swap fraud demonstrates why mobile banking security cannot rely on a single authentication factor. Instead, phone numbers, devices, customer identity, authentication processes, and transaction behavior should be treated as independent layers of security. SIM swap attacks clearly demonstrate why organizations need protective measures that go beyond the security standards typically applied to individual consumers. 5. Building Digital Trust Beyond SMS-Based Authentication SIM swap fraud highlights a broader challenge: digital security cannot depend on a single authentication factor – especially one tied to a mobile phone number. As digital services become increasingly interconnected, organizations need a more comprehensive approach that can establish trust across the entire digital journey—from identity verification and authentication to device security, transaction protection,
From Open Banking to Banking-as-a-Service: What Comes Next?
Over the past decade, financial innovation has evolved from open banking, which focuses on consumer-authorized data sharing, to banking-as-a-service (BaaS), which uses application programming interfaces (APIs) to make core banking functions more modular and accessible. Open banking & Open Finance The term “Open Banking” emerged around 2016 as a policy initiative aimed at increasing competition in the retail payments sector. The United Kingdom was the first country to explore this approach as a regulatory tool for promoting greater competition in digital payments through the Open Banking Implementation Entity. The idea behind these initiatives was straightforward: by making it easier for third-party providers (TPPs) to access data, regulators could lower barriers to entry, encourage competition, and create more opportunities for innovation in digital payments. A similar approach was taken by the European Union through the Second Payment Services Directive (PSD2), which came into effect in 2018. PSD2 required banks to provide registered third-party providers with access to customer account data through standardized application programming interfaces (APIs). Open Finance takes this concept a step further. While Open Banking mainly focuses on banking and payment data, Open Finance covers a much broader range of financial products and services, including credit, investments, pensions, and insurance. Under an Open Finance model, consumers can give third parties access to a broader set of financial data, potentially providing a more complete picture of their financial lives. While the potential benefits of Open Finance have not yet been fully demonstrated in practice and evidence of its impact remains limited, the concept could give consumers and businesses greater control over their financial data. By making more financial data available, Open Finance could help reduce information gaps, encourage competition, and create opportunities for more personalized financial products. These products could better reflect an individual’s financial profile, spending habits, and long-term goals. Open Finance can also make it easier for consumers to bring together and compare information from multiple providers, helping reduce complexity and make financial decisions easier. Concept of Everything-as-a-Service (XaaS) Against this backdrop, Open Banking is often seen as one of the starting points for the rise of Banking-as-a-Service (BaaS) – a new approach to financial services that brings data-driven capabilities into the way banking services are delivered. BaaS is built around the broader concept of Everything-as-a-Service (XaaS), also known as Anything-as-a-Service. XaaS refers to a wide range of cloud-based and remotely delivered services that companies can access through the Web or similar networks. The idea started with Software-as-a-Service (SaaS), where cloud providers made individual software applications available to customers. Over time, the model expanded into other services such as Infrastructure-as-a-Service (IaaS) and Communications-as-a-Service (CaaS). Eventually, the concept developed into the broader XaaS model, where businesses can access the specific services they need and pay for them on demand. In simple terms, instead of buying a software license and installing the application on individual computers, a business can subscribe to a cloud-hosted application provided by the software company. This approach gives businesses greater flexibility to switch providers while also making software maintenance easier. APIs play a key role in making this possible. They allow different applications and software systems to communicate and work with each other. As XaaS continues to grow, opportunities are also expanding for developers to build third-party applications that connect with existing platforms. The growth of SaaS, for example, has created entire businesses around developers and companies using SaaS platforms. However, APIs and SaaS are not the same thing. APIs do not require SaaS, and they have existed long before the Internet. They can also be used in offline environments. LinkedIn is an example of the SaaS model because it delivers its platform through cloud computing and generates revenue through recurring subscription fees. Facebook, on the other hand, does not operate as a SaaS company. Although it provides data through APIs, its primary source of revenue is advertising, much like Google’s core business model. Unlike SaaS providers, these platforms do not rely on subscription fees for their core services. Bank as a Service What banks can now build with APIs follows a similar XaaS approach. Banking-as-a-Service enables banks to deliver digital banking capabilities through APIs. In other words, banking services can move beyond traditional branches and become part of mobile and web-based experiences. Banks can make their data, functions, and infrastructure available through APIs, allowing other digital platforms and businesses to integrate banking capabilities into their own services. From the customer’s perspective, this can lead to very different types of digital experiences. A bank may continue to interact directly with customers, or it may operate behind the scenes as a white-label service provider. In either case, customers no longer have to interact with their bank in the traditional way. Instead, APIs allow consumers to interact with companies that may not be banks themselves, while still being seamlessly connected to regulated financial institutions through digital interfaces. While Open Banking has opened the door to greater data sharing, its role as a data-sharing mechanism can still have limitations. BaaS, meanwhile, can act as a catalyst for creating more seamless and integrated financial services in the digital economy. This model allows banks to move toward more customer-centric, platform-based business models. For traditional banks, this may also mean rethinking and restructuring how they operate. In many ways, the future of financial institutions could increasingly resemble the broader XaaS model. Making this transition possible requires a connected and collaborative ecosystem, where integration is at the core and APIs become a key enabler. Savyint provides a comprehensive Open Banking and BaaS ecosystem, backed by more than 20 years of experience in the Banking and Financial Services sector, with successful deployments for leading banks and major organizations across Vietnam and Southeast Asia (SEA). Contact us to start your banking digital transformation journey today HERE! Source: From open banking to banking-as-a-service – Nydia Remolin