Hokkoku Bank adopts Authlete for BaaS platform with advanced API security standard “FAPI”

Hokkoku Bank, a subsidiary of Hokkoku Financial Holdings, has adopted “Authlete” to implement the international advanced API security standard “FAPI” for their Banking as a Service (BaaS) business.

Background

Hokkoku Bank launched a project in January 2023 to build a next-generation regional digital platform with full cloud financial services on a multi-cloud environment to improve financial services and bank management efficiency. As part of this initiative, they announced the launch of a BaaS business in July 2024 that will provide banking functions via API to corporate-operated services, with plans to sequentially release account opening, transfer, inquiry, and authentication functions. This will enable fintech companies and other non-bank entities to offer services with embedded banking functions to users.

Challenges

Hokkoku Bank is promoting system modernization and internal development and operation of systems by adopting agile development methods to provide convenient services quickly. They actively collaborate with external specialist partners to supplement their internal expertise, aiming to achieve early product release and improve their in-house development and operations team capabilities.

Given that implementing FAPI requires significant specialized knowledge and time — particularly in high-security industries like finance and healthcare — Hokkoku Bank chose Authlete, which has implementation experience in major digital banks domestically and internationally.

Atsushi Shintani, Executive Officer and Head of Systems Department at Hokkoku Bank, commented: “FAPI, the standard specification for API authorization, is widely prevalent globally, with more service providers in Japan becoming FAPI-compliant. We considered it essential to incorporate this specification as a standard function in our BaaS platform to facilitate various businesses, including fintech companies, and promote collaboration with advanced domestic and international enterprises.

For FAPI implementation, we decided early in the project to adopt Authlete, which is already FAPI-certified, has extensive implementation experience, and offers high flexibility for easy integration into our BaaS platform. The significant achievement is that implementing Authlete simplified our implementation and enabled an early release of our BaaS platform.”

Authlete Product Features

Authlete is a backend service that provides the core functions of OAuth 2.0 and OpenID Connect, the international API security standards, via Web API. It maximizes development flexibility and shortens development periods by enabling integration with existing applications and user authentication using any development language or framework. Version 3.0 allows detailed FAPI compliance level settings, including FAPI 2.0 Message Signing for non-repudiation.

About Authlete

Authlete provides API security components that accelerate and simplify the implementation of authorization servers based on OAuth 2.0 and OpenID Connect. Developed by international standard experts, Authlete has obtained certification for advanced security specifications FAPI 1.0 and FAPI 2.0, and complies with globally recognized open banking and open finance regulatory frameworks, including Australian Consumer Data Right, KSA Open Banking, Open Finance Brazil, and UK Open Banking.

Please follow us to read more about Finance & FinTech in Japan, like hundreds of readers do every day. We invite you to also register for our short weekly digest, the “Japan FinTech Observer”, on Medium, on LinkedIn, or on Substack.

We also provide a daily short-form Japan FinTech Observer news podcast, available via its Podcast Page. Our global Finance & FinTech Podcast, “eXponential Finance” is available through its own LinkedIn newsletter, or via its Podcast Page.

Should you live in Tokyo, or just pass through, please also join our meetup. In any case, our YouTube channel and LinkedIn page are there for you as well.