快速支付系统背景下的开源技术（英）

FEBRUARY 2025 FINANCE, COMPETITIVENESS & INNOVATION GLOBAL PRACTICEPayment Systems Development Group © 2025 International Bank for Reconstruction and Development / The World Bank1818 H Street NWWashington DC 20433Telephone: 202-473-1000 This volume is a product of the staff of the World Bank. The findings, interpretations, and conclusions expressed in this The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations,and other information shown on any map in this work do not imply any judgment on the part of the World Bank RIGHTS AND PERMISSIONSThe material in this publication is subject to copyright. Because the World Bank encourages dissemination of their CONTENTS 1.EXECUTIVE SUMMARY 2.INTRODUCTION4Components of FPS5What Is Open-Source Technology, and How Does It Differ from Proprietary Technology? 3.OPEN SOURCE IN THE CONTEXT OF FPSComponents of FPS5What Is Open-Source Technology, and How Does It Differ from Proprietary Technology? 4.A TAXONOMY OF OPEN-SOURCE TECHNOLOGY FOR FPSGround-Up Open Source8 5.RISKS AND BENEFITS OF OPEN-SOURCE TECHNOLOGIES Design and Conceptualization11Implementation13Operation14Cost Implications across the Life Cycle of an FPSMaturity of an Organization to Leverage Open Source 6.LESSONS LEARNED Open source in payments is still a growing space.19Consider the following key factors before leveraging open source for FPS.19Choosing open-source technologies requires embracing a long-term vision and clearly 7.CONCLUSIONS 8.ACKNOWLEDGMENTS APPENDIX A: SPECIFIC COMPONENTS OF AN FPSAPPENDIX B: COMPONENTS OF AN OPEN-SOURCE SOLUTION AND ECOSYSTEMAPPENDIX C: SECURE DESIGN PRINCIPLES Open-source software has gained significant popularity due to its zero ini-tial cost and widespread adoption across industries. Recent studies show thatopen-source software appears in nearly 97 percent of codebases across differentsectors. A Harvard University study estimates that re-creating widely used open- In the context of a fast payment system (FPS), the use of open-source softwarefor core components is still at an early stage. Our research identified only onelive FPS using open-source software for core functionalities. Despite the limitedadoption of open-source software in FPS, interest is growing among paymentsystem operators, particularly in initiatives such as Mojaloop. Moreover, some FPSoperators may choose to use open-source software for non-core components,making it crucial for both operators and regulators to be aware of the poten-tial impacts that open-source software may have, both positive and negative,on the overall efficiency and resilience of FPS. This note, given rising interest inopen-source software for FPS, examines its use as well as relevant implementa- 2|Open-Source Technologies in the Context of Fast Payment Systems Moreover, adopting open-source software for FPS intro-duces specific risks, particularly around cybersecurity andintegration with existing systems. Vulnerabilities in open-source components can expose systems to a broader rangeof threats. While the open nature of open-source softwarecan enhance transparency, it can also expose vulnerabil- Implementation –Adaptability:Open-source solutions offer customi-zation but require significant expertise for them to betailored to institutional needs, which can introduce –Capacity:Institutions need strong internal technicalcapabilities or external support to implement open-source FPS effectively. This includes building a dedi- Therefore, operators and regulators must be proactive inassessing these risks, ensuring that robust security measuresare in place and continuously monitoring for updates andvulnerabilities. While open-source software offers potential –Customization versus vendor lock-in:Open-sourcesolutions reduce vendor lock-in, but a lack of ven- –Secure integration:Operators should treat opensource with the same rigor as proprietary code byselecting pre-vetted components, conducting initialand ongoing vulnerability assessments using soft- •Open source in payments is still a growing space. There is increasing interest from operators in the benefitsthat open source can bring to payments, including FPS.Mojaloop is one example that operators have just begun Operation –Security:While open-source solutions allow for codereview and collective security checks, vulnerabilitiescan still remain undetected for years. Regular vulner- •Consider the following key factors across the life cycle Design and conceptualization –Maintenance and support:Institutions must ensurethat they have the internal capacity to maintain andtroubleshoot open-source solutions, as they do not –Requirement alignment:Ensuring that open-sourcesolutions meet the functional, business, and securityneeds of the FPS is crucial. Operators must confirmthat these solutions align with current and future re- –Strength and expertise of the open-source commu-nity:A highly active and skil