The Fine Print

An Integrated EU Market For Payments?

2012-02-18T15:35:00.000Z

A Dog's Breakfast

We have until 11 April to weigh in on the European Commission's dream for "an integrated European market for card, internet and mobile payments."

Tedious as the EC's role and processes are, we mustn't forego these opportunities to feed into the EU's 'social dialogue'. If we don't participate we'll get legislation that's more reflective of canine culinary expertise rather than how various markets actually work (like the Payment Services Directive).

Some key issues in the current green paper are:

whether we need more sunlight on how much we pay in interchange fees;

whether it's overkill to make a retailer show on your receipt how much it costs to use your chosen payment method;

whether non-financial service providers should be able to directly access clearing and settlement systems;

whether you should be allowed to permit any service provider you like to show you your bank balance, rather than only your bank; and
whether competition is being inhibited by the process of 'standardisation' and demands for "full interoperability".

My own personal view is that the short answer to all of the above is, "Yes."

The challenge to regulating payments is that service providers and regulators alike tend to view "paying" and "banking" as consumer activities in their own right. Whereas consumers don't actually "pay" - and retailers don't even "accept payment" - as distinct activities. The man from Visa who thinks the brand on my payment card is the most important brand in the context of me buying a gift for a friend on my way to a party is institutionally deluded. Actually paying for the gift is a barely considered sub-process in the course of getting to the party, and I might pay in cash.

Not only must we remember that payment occurs in the context of wider consumer activities, but we must also acknowledge that payment details are a subset of all the personal and transaction data used in retail services that are subject to broader market forces and other regulation. In particular, the impact of the EC's proposal for more comprehensive regulation of personal data processing cannot be underestimated. There seems little point in dealing with access to bank balance information in the context of payments regulation when the wider data protection regime would enable the "right to be forgotten", "data portability", "data protection by design and by default", the logging/reporting of personal data security breaches, personal data processing impact assessments, prior consultation and regulatory consent for potentially risky processing; not to mention enhanced internal controls, enforcement and compliance burdens, including the appointment of a data protection officer.

But let's glance away from the data protection elephant for a moment.

On the question of interchange, it's clear from Annex 2 of the green paper that the EC doesn't understand the lack of a direct contractual/settlement relationship between issuers and acquirers in four-party card schemes like Visa/MasterCard, even where a banking group has both an issuing business and an acquring business. Each acquirer and issuer contracts directly with the card scheme, and the card scheme settles independently with each of them. Besides, the issuing arm's cardholders won't always be making payments to the aquiring arm's merchant customers. Not only does this add an important nuance to the interchange debate, but it also has far wider implications for payment services regulation than there's time to cover here.

As consumers, of course we want retailers to keep a lid on their interchange costs (like any other overhead). That would enable them to improve their services, increase product selection or maybe reduce their prices. But unless the retailer has its own specific surcharge, I don't need the receipt to tell me the cost of using my chosen payment method, any more than I'd need to know what it cost to get the item from the warehouse to the shop. The underlying cost might be fascinating to EC officials and payments geeks, but the all-in price of the item should be enough for me to compare the efficiency of retailers' operational processes. Whether those retailers are competing properly in their own markets is a separate issue to the cost of payments in any event.

I can also see that the cost of payments might be reduced by enabling sophisticated businesses to directly accessing clearing and settlements systems, rather than relying on financial institutions whose systems are geared to servicing the broader market. And such businesses shouldn't need to become regulated financial institutions or to join cosy industry bodies for that privilege. However, I should point out that developing an internal acquiring and settlement capability is very likely to prove an unwelcome distraction for non-financial corporate groups.

Similarly, as a consumer, I should be able to appoint a single service provider to enable access to my various bank, card and other payment accounts, without being in breach of the obligation to keep my account access details confidential. It's not beyond the wit of man to work out which provider is liable for any security breaches that might occur in that data sharing process.

Finally, we need to be really careful about requiring "standardisation" and "full interoperability" rather than merely enabling the market to develop this naturally, free of anti-competitive activity. Entrepreneurs don't have the time or resources to sit around in policy and standards meetings. Nor do they wish to telegraph to incumbents their disruptive plans. Yet there is also little meaningful distinction between "technologicial interoperability" and "commercial interoperability" in a digital world where business models are automated or 'hard coded'. I'm struggling to understand the EC's intention here. On the one hand the EC wants to see competition (which generally means less consolidation and more fragmentation - plenty of new players and competing, disruptive solutions), and on the other hand it wants to "avoid fragmentation of the market". So these aims seem incompatible.

Interoperability and standards may be important to enable efficient, straight-through processing between participants at either end of an overall business process or system. But the more tightly that process is bound together - or the narrower the group of entities involved in the development of standards/interoperation - the harder it is for new entrants to compete by disintermediating or improving any one element of that process. This is a key reason we have been trying to avoid any preoccupation with mandating standards in relation to data release formats in the context of the 'midata' initiative, for example (formerly 'mydata'). This avoids creating an extra hurdle to the release of the data, while opening up a market for the supply of data transformation applications that collect such data in multiple formats and display or transfer it in another format.

Paradoxically, the EC's own concerns on this front are reflected in the green paper questions as to whether card scheme management should be separated from control over card payment processing (Q's 9 and 10), as well as the competition challenge to standards-setting by the European Payments Council:

"Joaquín Almunia Commission, Vice President in charge of Competition Policy, said: "Use of the internet is increasing rapidly making the need for secure and efficient online payment solutions in the whole Single Euro Payments Area all the more pressing. I therefore welcome the work of the European Payments Council to develop standards in this area. In principle, standards promote inter-operability and competition, but we need to ensure that the standardisation process does not unnecessarily restrict opportunities for non-participants."

I rest my case.

Travelling With The ID Pioneers

2012-02-02T11:07:00.000Z

Seeking a New State of Identity

If the penultimate CSFI roundtable on Identity in Financial Services was anything to go by, the final one should be a proper knock-down, drag-out affair worthy of past pioneering epics ;-) In fact, the Innholders should replace it's sign for the day, to read:

The issue that sparked the most heat (again) was whether banks might somehow be suited to be the guardians of the so-called 'hard' element our identities - the proof currently required to move our money, access our government records and so on - rather than 'soft' credentials necessary to access, say, your social media accounts.

Spotted the flaws already?

We shouldn't bother picking on the banks anymore (though it is fun). I mean, I seriously doubt they want to be cast in this role at all. And as Richard Martin pointed out, the banks are each wedded to different identity solutions, chosen for fairly mundane IT procurement reasons rather than any attempt to use ID services as a source of competitive advantage (banks compete?!) in offering secure access to ~~your money~~ their services. At any rate, to the extent that any banks are availing themselves of the latest e-ID tools to more efficiently KYC their customers, they are merely using the credit reference agency databases. So if one were to look only at the development of 'hard' identity services, one should cut through the banking platforms to the credit reference agency roadmaps and how they plan to enable access to those services in ways that are much more useful and empowering for consumers.

And while the Money Laundering Regulations do erect a reasonably heavy barricade to the usability of financial services, it's unduly trusting to pretend they amount to best practice in establishing a person's identity. Real danger lurks in this idea that social media identity is somehow 'soft'. The premise for this seemed to be that Facebook, Google, Amazon, eBay and so on don't offer any services that attract the need for 'bank-standard' ID checks and personal data protection, and couldn't operate to such high standards. Yet, many of them already operate financial institutions. And I suggest that there is more real value to the use of your identity to personalise products and pricing than in simply accessing your bank records. Even the Eurocrats are onto this. It's ironic that the person who was most pressing in his demand to know 'who owns my identity data' in a social network setting also admitted to entering a joke date of birth in a leading social media service. I guess he'd also be the first to complain if that service provider and those in its network were to hold the 'lie' against him...

But, of course, identity verification is developing in ways that mean your joke date of birth in one or more databases - and even your passport, driving licence and energy bill - won't necessarily matter amidst a far wider set of identity factors. As I've explained after the previous roundtable on this topic, what makes us unique is our collection of behaviours and the data they generate. So I'll end this post in a similar way to the last.

There are two key identity problems to be solved. As consumers, we need to be able to simply, conveniently and efficiently prove our identities in the course of any day-to-day activities. And as a community, we need the source of that proof to be less vulnerable to being hacked or guessed, and to contain its cost.

Given those key problems, the solution cannot possibly comprise a single, static set of data that is 'held' by some institution. Rather, the solution has to involve the capability to generate a unique and momentary proof of identity by reference to a broad array of data generated by a user's own activity, which is then immediately useless and can be safely discarded.

Submission on New Model for Retail Finance

2012-01-31T16:16:00.000Z

Set out below are both the initial summary and my full submission to the Red Tape Challenge and the BIS Taskforce on Non-bank Finance. I'm very grateful to the colleagues who contributed, as mentioned in the longer document.

In its invitation to submit evidence of ‘red tape’ that is inhibiting the development of ‘disruptive business models’, the Cabinet Office notes the example of Zopa, “a company that provides a platform for members of the public to lend to each other, who found that financial regulations simply didn’t know how to deal with a business that didn’t conform to an outdated idea of what a lender is…”

This paper demonstrates that financial regulation similarly fails to deal with a range of non-bank, direct finance platforms (“Platforms”) that share some of the key characteristics of Zopa’s person-to-person lending platform (see Annex 1). Accordingly, financial regulation is failing to enable the cost efficient flow of surplus funds from ordinary people savers and investors to creditworthy people and businesses who need finance. In particular, as further explained in Annex 2, the current regulatory framework:

generates confusion amongst ordinary people as to the basis on which they may lawfully participate on alternative finance Platforms (even though some are licensed by the Office of Fair Trading);

creates legal and regulatory issues that vary greatly depending on the structure of Platform and instrument adopted, particularly where investment is for return, rather than by way of donation (without return) to a good cause. This means that detailed legal advice is needed for any Platform and this is itself a barrier to entry for some schemes which may not pose any significant risk to the public. Platforms may also require a level of regulatory authorisation which may be inappropriate, again considering the low level of risk to the public.

does not make alternative finance products eligible for the usual mechanisms through which ordinary people save and invest (as explained in Annex 2), and the inability to deduct bad debt before tax and the tax on interest charged to cover bad debt exposes individual participants on Platforms to much higher ‘effective tax rates’ than their applicable statutory rates (see Annex 3);

discourages ordinary savers and investors from adequately diversifying their investments;

incentivises ordinary savers and investors to concentrate their money in bank cash deposits, and regulated stocks and shares;

inhibits ordinary savers’ and investors’ from accessing fixed income returns that exceed long term savings rates;

inhibits the development of peer-to-peer funding of other fixed term finance (e.g. mortgages and project/asset finance); and

protects ‘traditional’ regulated financial services providers from competition.

These regulatory failings could be resolved by creating a new regulated activity of “operating a Platform”, for which the best-equipped regulatory authority would be the Financial Services Authority (as replaced by the Financial Conduct Authority). In tandem, or as alternatives, there could be exemptions based on size of investment or risk (e.g. some schemes or platforms may involve minimal investment in what is sometimes a socially useful venture); lesser regulation/authorisation within existing classes of regulated activity (as for small payment services providers or small e-money issuers) ; or the official endorsement of self-regulatory codes (as banks enjoy in relation to the Banking Code, for example). Direct and indirect incentives that selectively favour incumbent banks and investment funds should also be recognised and modified to balance the competitive landscape. Detailed regulatory changes are explained in Annex 4.

Regulation of the platform would be independent of any regulation that may apply to the type of product offered to participants on the platform (e.g. loans, trade invoices, debentures to finance renewable energy and lending for social projects, as noted in Annex 1). However, exemptions from regulations governing financial promotions and offers to the public could be granted for instruments that are offered on Platforms.

Proportionate regulation that obliges Platform operators to address operational risks common to all products would also enable economies of scale and sharing of consistent ‘best practice’, and leave product providers and other competent regulators to focus solely on product-specific issues (e.g. consumer credit, charitable purposes). Similarly, participants on such Platforms do not need to be treated as if they are participating in the course of a ‘business’ if the Platform itself meets all the compliance requirements that a business of that kind would otherwise have to meet.

Given the established nature of the financial regulatory framework and the dominance of incumbent banks in the provision of debt finance to individuals and small businesses in particular, it is unrealistic to assume that new business models will thrive without some alteration to the regulatory framework to enable rapid market entry and to facilitate strong, responsible growth.

Alternative finance briefing paper simon deane-johns 27 01 12

View more documents from Pragmatist.

You Want Eggs With Your Privacy Regulation?

2012-01-26T09:15:00.000Z

Well, the ~~Euro~~Zerozone may be disintegrating, but the European Commission is certainly doing its best to cement over the obvious cracks in the single market fantasy. Now we need more regulation of... privacy.

As with everything else that Brussels churns out, this breakfast had its origins in the primordial soup of the "Social Dialogue" and various talkfests that are helpfully identified by the city in which they were discussed. This time around something seems to have happened in Stockholm in 2009, for example. At any rate, you'll be so impressed by the rich pedigree of the grandly named:

"Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the protection of individuals with regard to the processing of personal data and on
the free movement of such data (General Data Protection Regulation)"

that you'll gratefully submit to the wisdom of our European overlords.

As for me, I just can't wait to roll my sleeves up and get to grips with the detail... the "right to be forgotten", "data portability", "data protection by design and by default", the logging/reporting of personal data security breaches, personal data processing impact assessments, prior consultation and regulatory consent for potentially risky processing; not to mention enhanced internal controls, enforcement and compliance burdens, including the appointment of a data protection officer.

No, really.

Honest.

Just as soon as I've got my head around the idea that "Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller" (Article 7(4)).

How can we really be sure there has been consent to anything?

Should Central Banks Supervise Facebook Credits?

2012-01-21T19:33:00.001Z

This is an interesting question that I've been keeping an eye on for sometime now. Forbes is the latest media outlet to wonder whether Facebook Credits are going to be deemed systemic and somehow in need of regulatory supervision. They cite estimates that Facebook Credits total "$470 million of revenue in 2011, or about 11% of Facebook’s total business."

Financial regulators haven't been terribly interested in Facebook Credits because they merely constitute 'closed loop' stored value, rather than 'open-loop' stored value or 'e-money'. The line of demarcation is somewhat open to conjecture, but as explained below it seems likely that the Facebook Credits programme (as currently configured) will remain outside the scope of regulation. However, Facebook could decide to make things really interesting by 'opening the loop' to become a full-scale e-money issuer...

When you buy Facebook Credits you're really just buying a 'claim code', like you would a music download, and that code is redeemable for purchases of items on the Facebook.com platform. The code is purchased from and redeemed by the same Facebook entity (if you're a resident of or have your principal place of business in the US or Canada, it's Facebook, Inc., otherwise, it's Facebook Ireland Limited). This means the suppliers of items you buy don't actually redeem the Facebook Credits themselves. Instead they rely on Facebook to process that transaction, and the suppliers receive only 70% of the price of the items sold, after Facebook deducts its commission or fees. The terms and conditions also make it clear that the 'credits' aren't able to be re-sold or transferred to anyone outside of Facebook. All of this means Facebook Credits are 'closed loop' stored value.

Typically, the European Commission has been the most aggressive in trying to comprehensively regulate e-money (and everything else!). That's largely arisen from efforts to break open the continental 'banking monopoly', starting with retail payments. As a result, issuing e-money in the European Economic Area (EEA) is a regulated activity under the second 'E-money Directive', and its use in retail payment transactions is covered by the Payment Services Directive. The two directives have been implemented in the UK by The Electronic Money Regulations 2011 and the Payment Services Regulations 2009. Essentially, this creates a framework within non-banks can be authorised to process retail payments.

Key regulatory requirements related directly to E-money include official authorisation/supervision, minimum and ongoing capital requirements and the need to safeguard (insure or segregate) money corresponding to outstanding E-money. “Electronic money” is defined as:

"...electronically (including magnetically) stored monetary value as represented by a claim on the electronic money issuer which—(a) is issued on receipt of funds for the purpose of making payment transactions; (b) is accepted by a person other than the electronic money issuer; and (c) is not excluded by regulation 3;" [my italics].

Parking the various issues with the real meaning and scope of "payment transactions", it's clear from the relevant terms and conditions that Facebook Credits are not accepted by anyone other than the relevant Facebook entity. Technologically speaking, it also seems likely that none of the suppliers of items purchased with Facebook Credits would be able to recognise and redeem the unique claim codes. Furthermore, both of the regulation 3 exemptions are relevant in the context of Facebook Credits:

"3. (a) monetary value stored on instruments that can be used to acquire goods or services only—
(i) in or on the electronic money issuer’s premises; or
(ii) under a commercial agreement with the electronic money issuer, either within a limited network of service providers or for a limited range of goods or services;"

which is generally referred to as the 'limited network' exemption; and a 'digital goods' exemption (which also applies to services) for:

"...(b) monetary value that is used to make payment transactions executed by means of any telecommunication, digital or IT device, where the goods or services purchased are delivered to and are to be used through a telecommunication, digital or IT device, provided that the telecommunication, digital or IT operator does not act only as an intermediary between the payment service user and the supplier of the goods and services."

The digital goods exemption is pretty clear cut, and probably applies to most of what Facebook Credits are used for. But being able to pay for a trip to the movies, as Forbes reports occurred in the US last summer, would likely fall outside the EU digital goods/services exemption if it occurred in the European Economic Area. So that puts pressure on the extent to which Facebook can claim to be a "limited network" of service providers or only providing access to "a limited range of goods or services". And if that exemption fell away, we'd be back to whether a participating merchant could be deemed to be 'accepting' Facebook Credits.

The meaning of "limited" is left undefined in the legislation, probably to give the authorities a broad enough discretion to act where they think it's necessary or appropriate. However, the ordinary dictionary meaning does not equate to 'small', 'narrow' or 'few', so the size of the programme of itself shouldn't be a problem.

Nevertheless, it seems that the scope, scale and growth of the Facebook Credit programme is continuing to provoke policy discussion about its regulatory status, particularly as to whether there are systemic grounds on which Facebook should be segregating customer funds related to oustanding stored value and whether it has some kind of unfair cost advantage over authorised E-money institutions.

I discussed the policy issues related to operational risk, safeguarding and competition concerns in the context of other limited network offerings during the UK consultation on the introduction of the 2011 regulations. Incredible as it may seem, I think these will recede as the eventual scale of 'proper' E-money issuance will gradually grow to vastly exceed the quantity of Facebook Credits in issue - unless Facebook decides to enter the E-money market itself and go 'open-loop'. Now that would be interesting.

Red Tape Challenge Submission - Summary

2012-01-12T08:23:00.000Z

In its invitation to submit evidence of ‘red tape’ that is inhibiting the developmentof ‘disruptive business models’, the Cabinet Office notes the example of Zopa,“a company that provides a platform for members of the public to lend to eachother, who found that financial regulations simply didn’t know how to deal witha business that didn’t conform to an outdated idea of what a lender is…”

Financial regulation similarly fails to deal with a range ofnon-bank finance platforms that share some of the key characteristics of Zopa’sperson-to-person lending platform. Accordingly, financial regulation is failingto enable the cost efficient flow of surplus funds from ordinary people saversand investors to creditworthy people and businesses who need finance. Inparticular, the current framework:

generates confusion amongst ordinary people as to the basis on which they may lawfully participate on alternative financeplatforms (even though some are licensed by the Office of Fair Trading);
does not make alternative finance products eligible for the usual mechanisms through which ordinary people save and invest,exposing lenders to higher ‘effective tax rates’;
discourages ordinary savers and investors from adequately diversifying their investments;
incentivises ordinary savers and investors to concentrate their money in bank cash deposits, and regulated stocks and shares;
inhibits ordinary savers’ and investors’ from accessing fixed income returns that exceed long term savings rates;
inhibits the development of peer-to-peer funding of other fixed term finance (e.g.mortgages and project/asset finance, and even short term funding of invoices); and
protects ‘traditional’ regulated financial services providers from competition.

Theseregulatory failings could be resolved by creating a new regulated activity ofoperating a direct finance platform, for which the best-equipped regulatory authoritywould be the Financial Services Authority (as replaced by the Financial ConductAuthority). Regulation of the platform would be independent of any regulationthat may apply to the type of product offered to participants on the platform(e.g. loans, trade invoices, debentures to finance renewable energy and lendingfor social projects). Proportionate regulation thatobliges platform operators to address operational risks common to all productswould also enableeconomies of scale and sharing of consistent best practice, and leave productproviders and other competent regulators to focus solely on product-specificissues (e.g. consumer credit, charitable purposes).

Similarly,there is no reason why products distributed via these platforms should not alsobe eligible for the usual mechanisms through which ordinary people save andinvest, such as ISAs, pensions and enterprise investment schemes.

I'm off to Number 10 today to discuss these issues, and will be submitting a more detailed paper in the coming weeks, both to the Red Tape Challenge and the BIS Taskforce on alternative business finance. I'm interested in any comments you may have.

The Nature of Scepticism

2011-12-20T16:38:00.002Z

Readers of Pragmatist will know that I've expressed my bemusement before that auditors have to be taught how to be sceptical. That was back in March. In November, the European Commission confirmed that the Financial Reporting Council wasn't joking:

"Article15

Professionalscepticism

Whencarrying out the statutory audit of a public-interest entity, the statutoryauditor or audit firmshall maintain professional scepticism throughout the audit, recognizing thepossibility thata material misstatement due to facts or behaviour indicating irregularities,including fraud orerror could exist, notwithstanding the auditor's or firm's past experience ofthe honesty andintegrityof the audited entity's management and of the persons charged with itsgovernance.

Thestatutory auditor or the audit firm shall maintain professional scepticism inparticular whenreviewing management estimates relating to fair values and the impairment ofgoodwill andother intangible and future cash flow relevant to the consideration of thegoing concern.

Forthe purposes of this Article, 'professional scepticism' means an attitude thatincludes a questioningmind, being alert to conditions which may indicate possible misstatement due to erroror fraud and a critical assessment of audit evidence."

Proposal for a regulation on specific requirements regarding statutory audit of public-interest entities.

Next: a European Regulation governing the exercise of scepticism in the course of police interviews...

Hat-tip to Mark from last night's London New Finance Meet-up. Image from The Philosopher's Magazine.

Alternatives To Traditional Business Funding

2011-11-25T11:32:00.001Z

Huge thanks to MarketInvoice for the kind invitation to their event at the Cass Business School yesterday. The event really highlighted the gravity of the SME funding situation and the giant leap in understanding that is required of politicians and policy-makers in this area.

Chuka Umunna MP, Shadow Secretary for BIS, gave the keynote, and the panel included Andrew Cave, the Head of Policy at the Federation of Small Businesses, Emmanouil Schizas of ACCA Global, as well as Anil Stocker of MarketInvoice and Andy Ralph, director of a company that has raised significant amounts of invoice finance in the past quarter.

Chuka gave some useful context:

All the recent banking industry figures point to a significant contraction in lending to SMEs in the past quarter. Worse, SME Finance Monitor says over half of SMEs applying for overdrafts this year for the first time have been refused, and more than 400,000 SMEs who wanted to apply for an overdraft in the third quarter didn’t do so – a third because they were discouraged by their bank.
A recent BACS report also suggests that "half of all the UK’s small and medium sized enterprises are awaiting late payments. On average, each firm is owed £39,000 in late payments, with the total amount owed to SMEs having reached a staggering record figure of £33.6bn."

Less helpful, however, were Labour's proposed solutions to this mess. In summary, notwithstanding his glowing endorsement of MarketInvoice's as a useful private sector alternative to bank finance and the acknowledged need for more non-bank competition, Chuka said that Labour wants:

Banks to improve local relationship management;
The government to be more active and directly involved in improving payment and supply chain management;
To create a new agency along the lines of the US Small Business Administration and Small Business Investment Company programme, whereby SBICs use their own capital plus funds borrowed with an SBA guarantee to make investments in qualifying small businesses - a phenomenal soure of moral hazhard and downright fraud that's been well documented by David Einhorn in his US Senate Committee testimony and the book "Fooling Some of the People All of the Time"; and
To use government procurement to help SMEs (notwithstanding Labour's notorious reputation for waste in that area).

Perhaps it's beyond his shadow brief, but it was notable that Chuka made no mention of the discussion of alternative regulatory solutions here and in the US, nor the Cabinet Office focus on red tape that inhibits disruptive business models that specifically identifies alternative finance platforms. There was no reaction to the suggestion that alternative payment providers should enjoy the same tax subsidies that banks and other regulated institutions enjoy through ISA/pension allowances and individuals' ability to off-set losses against income. And no thought appeared to have been given to the idea of a clearly defined 'safe harbour' for the likes of MarketInvoice and peer-to-peer platforms from the rules on collective investment schemes and/or arranging deals in investments, to enable them to start up more confidently, quickly and efficiently.

In fact, Chuka's pitch rather underscored his party's role in helping to create our desperate need for alternatives to traditional business funding. Let's hope we see some decent ideas from the opposition in future.

In the meantime, it's down to the participants on MarketInvoice, Funding Circle and CrowdCube and the many angel networks to carry the alternative funding hopes of SMEs.

A New Regulatory Model For Retail Finance - Update 1

2011-11-16T19:12:00.001Z

"It's time for reflection..." FT.com

The fact that the US has taken the first step towards a 'Crowdfunding Act' requires an update of my earlier post on a new regulatory model for retail finance...

Non-bank retail finance models have been gaining momentum worldwide over the past six years, in spite of our creaking financial regulatory framework. Finally, it seems that framework is about to become more directly supportive.

Since 2005 we have seen the launch of various innovative person-to-person, or peer-to-peer (P2P) finance platforms in the UK, US, Germany and elsewhere, which have been tracked here. These were launched by teams that spent considerable time and expense trying to accommodate existing regulation that favoured incumbents, with little or no regulatory assistance. Their goal was to enable those with surplus cash to connect directly with people who needed finance in a way that minimises costs and delay, and leaves most of the 'margin' with lenders and borrowers, rather than the middleman.

Meanwhile, we have all discovered that the existing financial regulatory framework, ironically designed to protect consumers, actually guaranteed the worst excesses amongst 'traditional' banks and failed to contain the risks posed by the "shadow banking" system. And although taxpayers have had to step in and effectively democratise the financial markets, we are still unable to extract badly needed funding from retail banks.

Against that background, it is perverse that the regulatory framework does not already directly facilitate simple, low cost, alternative financial services. And let's not forget that banks and other retail investment institutions continue to enjoy indirect tax subsidies through individuals' ability to off-set losses, as well as ISA and pension allowances for which unregulated alternative investments do not qualify.

While substantial innovation in consumer and small business lending has been possible, UK rules against marketing investments like bonds, shares and unregulated collective investment schemes, have made it much harder to offer direct, alternative funding for SME start-ups, trade finance and even social projects. Given a more proportionate investment regime, the likes of Crowdcube, MarketInvoice, Buzzbnk, Social Impact Bonds and the Green Investment Bank, for example, might operate rather differently. No doubt existing and new P2P platforms would take the opportunity to distribute multiple financial instruments, creating a far more substantial alternative to banks and other fee-hungry investment institutions.

Oddly, given its reputation for fast-paced innovation, the US has been (until recently) even less supportive of alternative retail financial models. Zopa, for example, which led the growth of P2P platforms with its launch of person-to-person lending in the UK, was unable to launch that model in the US despite lengthy consultations with securities regulators. And life has been unnecessarily complicated for the likes of Prosper and Lending Club ever since.

To help remedy the regulatory imbalance, as mentioned in August, three of the leading UK commercial P2P lending facilitators launched the Peer-to-Peer Finance Association (P2PFA) for platforms on which the majority of lenders and borrowers are consumers or small businesses (rather than, say, ‘investment clubs’ or networks of sophisticated investors). The P2PFA has adopted a set of self-regulatory measures that are based on similar FSArequirements for payment services platforms (which have a similar, low risk profile).In particular, the P2PFA Operating Principles require:

Senior management systems and controls;
Minimum amounts of capital;
Segregation of participants’ funds;
Clear rules governing use of the platform, consistent with the Operating Principles;
Marketing and customer communications that are clear, fair and not misleading;
Secure and reliable IT systems;
Fair complaints handling; and
The orderly administration of contracts in theevent a platform ceases to operate
Appropriate credit assessment and anti-fraud measures

Earlier this month, the US House of Representative has passed a Bill HR 2930 (still subject to Senate and Presidential approval) which would enable the issuer of securitiesto raise small amounts of money from many people (crowdfunding) on thebasis summarised below. Please note that I've used the helpful summary from VentureBeat, but replaced "company" with "issuer", as I see no reason on my reading of the bill and the definition of "issuer" in the Securities Act 1933 why this would not enable person-to-person lending, rather than merely raising capital for corporations (please seek your own independent legal advice):

"The [issuer] may only raise a maximum of $1 million, or $2 million if the [issuer] provides potential investors with audited financial statements.

Each investor is limited to investing an amount equal to the lesser of (i) $10,000 or (ii) 10% of his or her annual income.

The issuer or the intermediary, if applicable, must take a number of steps to limit the risk to investors, including (i) warning them of the speculative nature of the investment and the limitations on resale, (ii) requiring them to answer questions demonstrating their understanding of the risks, and (iii) providing notice to the SEC of the offering, including certain prescribed information.”

Will this work in practice?

Absolutely. The challenge (and benefit) associated with such 'safe harbours' is that there is very little room for fee income. This in turn favours 'thin intermediaries', like the new electronic finance platforms, as a means of broad, open distribution. Proportionately regulating platforms to address horizontalissues like those covered by the P2PFA Operating Principles leverages economiesof scale, leaving product providers to focus only on vertical product-specificrequirements. Specifically, the platforms can control operational risk (including anti-money laundering); deliver transparency through adequate productdisclosure and ‘my account’ functionality; and centralise customer service andcomplaints handling, with ultimate referral to financial ombudsmen or othercomplaints handling bodies. In addition, because the platforms provide areliable audit trail, tax rules should permit losses to be off-set against gainsand income derived via platform-related activity. Similarly, there is no reasonwhy instruments distributed via these platforms should not also qualify forconsumers’ tax-free ISA and pension allowances.

Further, the 'horizontal' form of credit intermediation adopted by P2P platforms solves the problems identified by the NY Federal Reserve in the 'vertical' model adopted by the 'shadow banking' system. Since each borrower's loan amount is drawn from many lenders at the outset, there’s no need to engage split a single loan into many pieces by securitising later. Lenders also achieve diversification across many borrowers at the start, so there is no need for a series of bonds, CDOs and so on to ‘transform’ interest rates, maturity or borrower type. The facilitator is not a party to the loanagreements made on its platform and segregates lenders’ funds, so it has no creditrisk (or ‘balance sheet risk’), and therefore no need or temptation to engagein regulatory/tax arbitrage that banks and shadow banks attempt. The one-to-one legal relationship betweenborrower and loan owner is maintained for the life of each loan via thesame technology platform (with a back-up available), so all the loan data is readily available to participants and it's easy to assess theperformance of the loan against its grade. Risk remains visible, rather than being rendered opaque through fragmentation, re-packagingand re-grading of the underlying loans, guarding against moral hazard.

Finally, by enabling the efficient use of technology to facilitate consumers’ desire forgreater control over their personal circumstances, governments will be helping to build a decent,sustainable financial services industry.

Consumers and small businesses should expect further developments in this space throughout 2012.

US Crowdfunding Bill

2011-11-15T21:30:00.001Z

"It's time for reflection..." FT.com

Further to my recent post on a new regulatory model for retail finance, the US House of Representative has passed a Bill HR 2930 (still subject to Senate and Presidential approval) which would enable the issuer of securitiesto raise small amounts of money from many people (crowdfunding) on thebasis summarised below. Please note that I've used the helpful summary from VentureBeat, but replaced "company" with "issuer", as I see no reason on my reading of the bill and the definition of "issuer" in the Securities Act 1933 why this would not enable person-to-person lending, rather than merely raising capital for corporations. However, I'm not a US securities lawyer, and you should seek your own independent legal advice ;-)

"The [issuer] may only raise a maximum of $1 million, or $2 million if the [issuer] provides potential investors with audited financial statements.

Each investor is limited to investing an amount equal to the lesser of (i) $10,000 or (ii) 10% of his or her annual income.

The issuer or the intermediary, if applicable, must take a number of steps to limit the risk to investors, including (i) warning them of the speculative nature of the investment and the limitations on resale, (ii) requiring them to answer questions demonstrating their understanding of the risks, and (iii) providing notice to the SEC of the offering, including certain prescribed information.”

As mentioned previously, it would be great to see this sort of support for alternative finance from the UK authorities.

FSA, OFT Seek To Avert Another PPI Scandal

2011-11-01T23:50:00.001Z

Having covered the Great PPI Robbery - and the Redux - via Pragmatist for some years now, it's encouraging to see the FSA and the OFT remaining vigilant against another heist. Listen for any mention of a "debt freeze" or "debt suspension"; or a "debt waiver" or "debt cancellation" during your next discussion about a loan or mortgage - and assume a fee or higher interest rate or the need to make some kind of payment. You should also assume that activating the freeze or waiver will be harder than it looks.

If you think you need the insurance, you probably shouldn't be borrowing at all.

The FSA/OFT consultation on the guidance is open until 13 January 2012.

A New Regulatory Model For Retail Finance

2011-10-23T15:06:00.003+01:00

"It's time for reflection..." FT.com

Non-bank retail finance models have been gaining momentum worldwide over the past six years, in spite of our creaking financial regulatory framework. Finally, it seems that framework is about to become more directly supportive.

The mid-noughties saw the launch of various innovative person-to-person finance platforms in the UK, US, Germany and elsewhere, which have been tracked here. These were launched by teams that spent considerable time and expense trying to accommodate existing regulation that favoured incumbents, with little or no regulatory assistance. Meanwhile, the regulatory authorities discovered that their framework, ironically designed to protect consumers, actually guaranteed the worst banking excesses and failed to contain the downside to complex "shadow banking" system in which the incumbent institutions were also involved. And although taxpayers have had to step in and effectively democratise the financial markets, we are still unable to extract badly needed funding from retail banks.

While substantial innovation in consumer and small business lending has been possible, UK rules against marketing investments like bonds, shares and unregulated collective investment schemes, have made it much harder to offer alternative funding for SME start-ups, trade finance and even social projects. Given a more proportionate investment regime, the likes of Crowdcube, MarketInvoice, Buzzbnk, Social Impact Bonds and the Green Investment Bank, for example, might operate rather differently. They would no doubt also be joined by existing and new P2P platforms as a substantial alternative to banks and other fee-hungry investment institutions.

Oddly, given its reputation for fast-paced innovation, the US is even less supportive of alternative retail financial models. Zopa, for example, which led the growth of P2P platforms with its launch in the UK, was unable to launch its P2P model in the US despite lengthy consultation with securities regulators. And life has been unnecessarily complicated for the likes of Prosper and Lending Club ever since.

To help remedy the regulatory imbalance, as mentioned in August, three of the leading UK commercial P2P platforms launched the Peer-to-Peer Finance Association and an accompanying set of self-regulatory measures. Their focus is platforms on which the majority of lenders and borrowers are consumers or small businesses, rather than, say, ‘investment clubs’ or networks of sophisticated investors.

And in September the New York Times reported that there are three proposals in the US to allow peer-to-peer financing without securities registration and disclosure requirements:

"One petition, prepared in 2010 by the Sustainable Economies Law Center and, fittingly, paid for by a grass-roots crowdfunding effort, asks the S.E.C. to permit entrepreneurs to raise up to $100 per individual and an aggregate of up to $100,000 without requiring expensive registration and disclosure.

President Obama, as part of his jobs act, advocates an exemption for sums totaling up to $1 million. Representative Patrick McHenry, a Republican from North Carolina, has drafted legislation that would allow companies to obtain up to $5 million from individuals through crowdfunded ventures, with a cap of $10,000 per investor, or 10 percent of their annual incomes, whichever is smaller."

How would this work in practice?

The challenge (and benefit) associated with such 'safe harbours' is that there is very little room for fee income. This in turn favours 'thin intermediaries', like the new electronic finance platforms, as a means of broad, open distribution. Proportionately regulated, these platforms can delivergreater efficiency, transparency and cost savings that benefit providersand consumers alike.

Specifically, these platforms can be the focus of regulation designed to control operational risk; deliver transparency (through adequate product disclosure and ‘my account’ functionality); and centralisecustomer service and complaints handling, with ultimate referral to financial ombudsmen. Focusing those regulatory burdens on the platforms would shift significant compliance costs away from the productproviders who rely on the platforms as a means of distribution. This would also mean specialist product regulators could focus their resources on 'vertical' issues related to specific products and their providers rather than 'horizontal' issues that are common to all. Such is the primary intent behind the P2PFA's Operating Principles, for example, which cover lending to both consumers and small businesses.

In addition, since social investments and P2P financeofferings both involve some credit risk and therefore the potential for losses, tax rules should allow off-setting against gains and income derived via these platforms. And there is no reason why instruments so distributed should not also qualify for ISA and pension allowances.

Consumers and small businesses should expect further developments in this space throughout 2012.

Excessive Mortagage Arrears Fees?

2011-10-04T17:16:00.003+01:00

Following my recent post on excessive arrangement fees, it's worth noting that the FSA recently meted out a £630,000 fine for excessive arrears charges to Swift 1st Limited - the fifth such lender since a review in 2010. Swift will also have to pay about £2.35 million to redress the problems.

The FSA found that "Swift applied certain charges to its customers’ accounts... which ... did not reflect a reasonable estimate of the cost of administering an account in arrears."

The list of adverse practices is quite long, and worth comparing against your own mortgage statement or that of any client who has suffered arrears. However, you'll need to go back over all the old statements - the Swift practices dated back from June 2007 to July 2009...

The fees "were:

Arrears management fee: a monthly management fee applied to a customer in arrears;
Default notice fee: a default fee applied when a customer’s account fell into arrears;
Unpaid mortgage payment fee: applied when a cheque, direct debit or standing order was not honoured by a customer’s bank; and
Litigation fees: fees applied to customers’ accounts when Swift started legal proceedings."

"In addition:

Swift applied excessive early repayment charges to the redemption figures of customers who were, or had been, in arrears;
Swift failed to send all its customers in arrears certain prescribed documents, providing information on the options available to them;
Swift focussed on the collection of arrears without always proactively engaging with customers to establish an appropriate “Arrangement To Pay” based on their individual circumstances; and
Swift also failed to have adequate systems and controls in place to deal with early redemptions which resulted in some customers who redeemed their mortgages overpaying."

Identity Is Dynamic, Not Static. Proof: Momentary.

2011-09-28T22:56:00.000+01:00

On Tuesday we had a very revealing discussion on whether "banks and/or mobile operators should provide the identity infrastructure" at the CSFI's Sixth roundtable in the series on Identity and Financial Services.

Of course we began by discussing what identity actually is - not something that can be isolated or assumed, as was also apparent from the Fifth roundtable.

In this discussion, it was very clear that a bank or telco views identity as a static collection of data about an individual that can be stored or held, with varying degrees of subject access and control. In this entrenched view of the world, institutions - like banks and telcos - can compete for the privilege of 'holding' your identity and enabling you to prove who you are. In essence, those institutions are in control of your identity.

So what's stopping them providing an all-purpose identity infrastructure today?

The fact that identity is not a static concept. It's dynamic, contextual, and defined more by your various sets of activities or behaviours - "routes and routines", as Tony Fish put it - than by a picture, address and date of birth. That collection of behaviours and the data they generate are what makes us unique. Further, Dean Bubley made the point that we over-estimate the degree to which telcos (and banks), actually 'know' their customers in the sense of understanding their customers' end-to-end activities. And we over-estimate these institutions' technological ability to enable their customers to prove their identity at all, let alone conveniently in scenario's of their choosing.

A Finnish delegate also made the point that Finnish banks offer identity services, based on a government database, but make very little money out of them. Which suggests the services are not very useful or compelling.

In any event, static data repositories are vulnerable to attack; and the services that rely on them are apt to be 'gamed' by simply replicating the data held - as in the case of skimming card data or fabricating identity documents to gain control of a bank account. The fact that the individual consumer is ultimately compensated and therefore not 'harmed' in a direct financial sense is beside the point. We all pay for such inefficiencies in the form of higher interest rates, fees and retail prices.

So there are two key problems to be solved. As consumers, we need to be able to simply, conveniently and efficiently prove our identities in the course of any day-to-day activities. And as a community, we need the source of that proof to be less vulnerable to being hacked or guessed, and to contain its cost.

Given those key problems, the solution cannot possibly comprise an "identity infrastructure" or 'service' that relies on a single, static set of data that is 'held' by some institution. Rather, the solution has to involve the capability to generate a unique and momentary proof of identity by reference to a broad array of data generated by our own activity, on the fly, which is then useless and can be safely discarded.

Image from Young Lee.

Old Newzbinned

2011-09-22T10:45:00.003+01:00

I see that Lexology carries a note on the decision in Motion Picture Association v BT [2011] EWHC 1981 (Ch) in July, ordering BT to block access to a revived "Newzbin2" web site that was enabling a large scale copyright infringement in films after an earlier site had been successfully restrained.

The problem with services that post material on a delayed basis is that time-pressured senior lawyers can get over-excited about the 'latest' case, and miss all the discussion that occurred when it first hit the traditional and social media, none of which is summarised in the note. That's especially problematic in this particular context, given the vast lobbying effort by the 'majors' to gloss over some critical issues associated with alleged mass copyright infringement.

Specifically, the injunction was granted under section 97A of the Copyright, Designs and Patents Act 1988, which enacts the Information Society Directive (2001/29/EC) giving the High Court "power to grant an injunction against a service provider, where that service provider has actual knowledge of another person using their service to infringe copyright."

The case shows that rightsholders have long had adequate protection for mass infringement, and underscores the waste and futility involved in passing the Digital Economy Act during the infamous Parliamentary 'wash-up' of 2010. The core provisions and site-blocking generally have been found by Ofcom to be unworkable; and the Liberal Democrats have joined the calls for the DEA to be largely repealed.

More productive efforts are focused on modernising our intellectual property rights, and it would be good to see more articles on that.

Are 'Soaring' Mortgage Arrangement Fees Excessive?

2011-09-04T16:03:00.000+01:00

Moneyfacts July 2007 warning

In a re-run of 2007, this time amidst persistent low interest rates, MoneySavingExpert has reported huge increases in mortgage arrangement fees. In 2007, the suggestion was that the high fees masked artificial reductions in headline interest rates. This year, the suggestion is that higher arrangement fees are being used to make up for low interest income:

"Typical mortgage rates are at a record low, and while this undoubtedly means reduced costs for consumers, lenders are partly offsetting that fall with a rise in costs to secure that deal."

Of course, that may be hard for lenders to justify in relation to regulated mortgages, on the basis of treating customers fairly, disclosure obligations or under the excessive fee provisions in the FSA's Mortgage Conduct of Business sourcebook (MCOB).

In particular:

"When determining whether a charge is excessive, a firm should consider:

(1) the amount of its charges for the services or products in question compared with charges for similar products or services on the market;

(2) the degree to which the charges are an abuse of the trust that the customer has placed in the firm; and

(3) the nature and extent of the disclosure of the charges to the customer."

But I'm sure each of the lenders has prepared some kind of explanation in case the FSA or the competition authorities inquire...

Regulating P2P Finance

2011-08-30T19:32:00.000+01:00

From a standing start in March 2005, this year peer-to-peer finance will account for more than £100 million of loans to individuals and small businesses in the UK. The timing is perfect, given that our banks are lending less and paying lower savings rates, and new capital rules will drive further need for alternative funding.

Yet, as I noted last year, while these platforms deliver very real social and economic benefits by enabling people rather than banks to share most of the margin between savings rates and funding costs, the financial regulatory and tax framework does not directly accommodate them. So, ironically, new entrants whose business models are founded on openness, fairness, transparency and individual consumer control must spend a huge amount of time and start-up capital figuring out a regulatory path through a regime that is not only designed to force recalcitrant 'traditional' financial institutions to treat customers fairly but also subsidises their marketing efforts with favourable tax allowances.

While the various P2P providers were also considering the merits of forming a self-regulatory body to act as a focal point for more helpful enabling regulation, a further catalyst was the BIS consultation on moving responsibility for consumer credit from the OFT to the Financial Conduct Authority (the FSA's replacement). Having helped frame Zopa's positive response to that consultation, I was happy to help apply the same regulatory approach we'd suggested to a set of operating principles that could form the basis of an interim self-regulatory framework. Collaboration with both Ratesetter and Funding Circle ultimately led to the formation of the "Peer to Peer Finance Association" in July, with invitations extended to others.

The intention of the P2PFA is to enable the development of platforms that facilitate open consumer and small business participation, rather than merely 'investment clubs' or networks reserved for sophisticated investors. As a result, the term “Peer to Peer Finance” is broadly defined in the Rules to mean "any funding arrangement that comprises direct, one-to-one contracts between a single recipient and multiple providers of funds, where the majority of providers and borrowers are consumers or small businesses." The desire for scalable, open or 'mass' access is underlined by the definition of “Platform” as "an electronic system that facilitates Peer to Peer Finance." Generally, funding is likely to be in the form of simple one-to-one loans, but other instruments may evolve over time.

As stated on the Association's web site:

"The Association’s Rules and Operating Principles set out the key requirements for the transparent, fair, robust and orderly operation of peer-to-peer finance platforms and cover:

1. Senior management systems and controls;
2. Minimum capital requirements;
3. Segregation of participants’ funds;
4. Clear rules governing use of the platform, consistent with these Operating Principles;
5. Marketing and customer communications that are clear, fair and not misleading;
6. Secure and reliable IT systems;
7. Fair complaints handling; and
8. The orderly administration of contracts in the event a platform ceases to operate.

The Peer-to-Peer Finance Association is run by a Management Committee, made up of one representative from each member, with one member acting as Chairman for one year on a rotating basis. Giles Andrews, CEO of Zopa, will act as the Committee’s initial Chairman. As new members join the Association, their representative will join the Management Committee.

Membership of the Peer-to-Peer Association is subject to the Rules of the Association and members must comply with the Association’s Operating Principles."

The Rules, Bye-laws and Operating Principles are set out here.

Wither the Digital Economy Act?

2011-08-04T18:05:00.002+01:00

Well wasn't this a shoddy little piece of Parliamentary washing-up?

A year later we're still fussing over the damn thing and, surprise, surprise: site-blocking has been abandoned as unworkable and ISPs won't have to subsidise the costs of protecting outmoded entertainment industry business models.

BUT! I cannot fathom a decision to charge on individual citizens £20 for appealing "every notification letter received from their ISP, and against every instance of infringement identified" by a copyright owner. It's all very well to say that this will discourage vexatious appeals and that the individual can recover the £20 if their appeal is successful. But where is the constraint on the mistaken, vexatious or groundless issue of infringement notices? Will it cost £20 per notice to complain about that? Can they all be heard together? These things could arrive like confetti, effectively reversing the burden of proof and obliging the indivdual to underwrite a multiplicity of appeals.

My sense is that there will be not be a significant number of appeals. But, on the flip-side (as it were), rights owners who avail themselves of this process will find their material shunned altogether, for the reasons discussed in Henry Jenkins' "Convergence Culture". Rights owners who don't understand that are doomed.

I can't imagine what Kafkaesque process Ofcom is being forced to envisage in order to bring this monster to life, but I understand we'll find out "shortly".

Image from LoveMarks.

How Not To Deal With A Regulator

2011-07-30T01:06:00.000+01:00

The 'Big Six' energy providers are actually threatening to steal the regulatory limelight from UK retail banks - which is no mean feat. Ofgem says it has levied a total of £12.5m in fines this year already. In the past few weeks alone, SSE and Scottish Power have found themselves under scrutiny from MPs. And British Gas has complained publicly that it's recent fine of £2.5m for complaints mishandling is "totally disproportionate", seeming to suggest they should've been given credit for having to spend £4m fixing the problem.

But you'd expect a little more humility from a company that is raising consumer gas and electricity prices at an average of 18% and 16% respectively, and contributed £270m of its parent's £1.3bn profit for the first half of this year.

Ofgem explains that its complaint handling regulations include the following requirements ("the breaches Ofgem found against British Gas in this case are in bold):

a common definition of a complaint between (sic) energy suppliers;
a requirement for suppliers to record complaints upon receipt and follow up contact with the customer after the initial complaint;
a requirement for suppliers to have a complaints handling procedure and be able to explain to customers how they can make a complaint;
a requirement to signpost customers to the Energy Ombudsman if the complaint is not resolved;
a requirement to deal with consumer complaints in an efficient and timely manner, and allocate sufficient resources to do this;
a requirement to publish information on complaints."

Here's an explanation of Ofgem's industry governance arrangements.

And here's where to complain if you are a consumer or small business (once you've given the provider a chance to resolve the dispute).

Meanwhile, Ofgem says that it's:

"currently investigating Npower and EDF Energy for complaint handling; Scottish Power, Scottish and Southern Energy, EDF Energy and Npower for misselling; and is undertaking two investigations into Scottish Power for potentially misleading marketing and the difference between its Standard Credit and Direct Debit Tariffs."

I'm sure the suspects are bound to accept any adverse findings with good grace...

Private Sheriffs in Cyberspace and Counter-regulation

2011-07-16T16:10:00.000+01:00

Zittrain's Rule-making quadrant

What better task for a rainy Saturday than extracting the 'blawg' posts from Pragmatist and placing a link to them on a dedicated Blawg where they belong?

Here's my response to a Zittrain lecture in May 2009, that appears to have stood the test of time.

Counter-Regulation And Consumer Empowerment

2011-06-12T16:28:00.002+01:00

In 2006, I speculated in an article for the Society for Computers and Law, entitled "Counter-regulation", that the government would one day require offline businesses to implement the benefits of successful online business models. They would do this, I suggested, because successful online businesses "will have demonstrated to most consumers the inadequacies in the business models of their offline counterparts" whose customers will realise they're at a disadvantage compared to consumers dealing online.

That day certainly arrived in April, if not before, when the UK government announced its "Consumer Empowerment Strategy". The policy "aims to put consumers in charge so that they are better able to get the best deals for themselves, individually and collectively." As part of the strategy, "the Government wants to work with [service providers and retailers] to come up with a solution that allows consumers to access [purchasing] information, analyse it according to their own preferences and make better choices."

However, in Better Choices: Better Deals, the Government makes it refreshingly clear (at p.5) that a new legislative programme is not the best way to achieve consumer empowerment. Instead, it is relying on "a wide range of new programmes that have been developed in partnership with businesses, consumer groups and regulators" against a background of normal regulatory enforcement.

It is also refreshing to see that the Government has gone to considerable lengths to try to understand the overall context before announcing policy. As a result, Better Choices: Better Deals is a treasure trove of statistics, behavioural insights, and research - and an inspiring read, rather than an irritating one. There are numerous proposals (see pp.6-7 and Annex A of Better Choices: Better Deals), some of which are the product of thematic regulatory work and some of which go beyond the way many online businesses operate today. Indeed, the semantic web is central to the Government's vision. Of course, the list is not exhaustive - the document is step one in in an attempt to foster collaborative effort across the community, not a creaking regulatory panacea of the kind favoured by the European Commission. These proposals include:

the 'mydata' [since renamed 'midata'] project to enable consumers to access information about their purchases, analyse it according to their own preferences and use that information to make better purchasing decisions;

e-statements for credit cards, to provide the last 12 months of transaction data in a portable electronic format;

clear information about the lowest energy tariff on energy bills;

changes to Energy Performance Certificates and how they are presented;

improving the provision of product information about cars and other products from a health and environmental standpoint;

encouraging local collective purchasing deals;

making available more complaints and performance data about businesses, regulators, government departments and public service providers;

figuring out how in-store shoppers can access consumer feedback normally only available online;

a new resolution scheme for e-commerce disputes;

a review on how to empower very vulnerable consumers.

Of course, our day-to-day consumer activities tend to require combinations of data held by both public and private sector organisations. So it's encouraging that great progress is also being made on the Open Government data initiative.

Image from 1Million1Shot.

An EU Contract Law? Too Tough To Digest

2011-05-26T19:26:00.000+01:00

A hat-tip to Mayer Brown for the heads-up on the latest in the saga of a proposed European Contract Law. We have until 1 July to send feedback on 189 individual articles included in a 'feasibility study'. The Commission will then consider that feedback, together with the results of an earlier consultation.

As I have posted previously in another place, I'm not terribly supportive of a new European Contract Law. It doesn't fix any real problem, and it won't catalyse a single, cross-border market - notwithstanding the rationale advanced by the European Commission. The example used is:

"An Irish consumer buys an MP3 player online from a French retailer. In this case, Irish contract law would apply if the French retailer has designed his website for Irish consumers."

This is a strange scenario, littered with odd assumptions. Besides, there are notable instances of successful cross-border retailing in the EU that rely on the law of a single Member State as the law of the contract. And choice of law is the least of the barriers to setting up such an operation, as the European Commission itself discovered in the context of the reform of laws related to consumer rights and consumer credit. In particular, a May 2007 study by Civic Consulting revealed that:

“the main [non-regulatory] barriers hindering selling of consumer credit products in other EU Member States are different language and culture; consumers’ preference for national lenders; credit risk for lenders – no access to creditworthiness information; problems related to tax, employment practices etc.; difficulties to penetrate local market; different consumer demand in different Member States; lack of consumer confidence in a brand; differing stages of development of consumer credit; and lack of adequate marketing strategies.”

Furthermore, the law should follow, not lead commerce (though I realise that is a common law, rather than a civil law view). Otherwise, it acts as a hurdle to innovation and market development, and only those who are 'good at regulation' (incumbent players) will cope.

A pan-European contract law also conflicts with the principle already enshrined in various financial and other regulatory frameworks that, in general, the law in a corporation's home Member State should govern that corporation's cross-border EU activities. In fact, given the preponderance of any EU-based cross-border retailer's trade is with the citizens of its home state (with the exception of retailers based in Luxembourg) this proposal would seem to envisage retailers either imposing European Contract Law on their local customers, or creating separate set of terms for cross-border customers. I don't see how either is helpful, other than to generate work for the likes of... well, me.

But I'm not in the business of creating more hurdles for cross-border trade. So, while I will of course personally attempt to digest yet another European dog's breakfast, I propose to focus my drafting energies on an exclusion clause that will mean my clients and their customers won't have to.

Apply within ;-)

Would You Like A Cookie?

2011-05-17T09:56:00.001+01:00

The law that applies to ‘cookies’ is changing with effect from 26 May 2011. Within a year from that date, not only must the user be given clear and comprehensive information about the purposes of cookies and use of the data they collect; but cookies can also only be placed on the user’s device after the user has given his or her consent. There is an exception where such storage or access is strictly necessary for the provision of a service that has been requested by the user (as well as where the cookie is for the sole purpose of carrying out the transmission of a communication over an electronic communications network). The UK Information Commissioner has issued guidance on how to comply.

How best to obtain consent?

This is likely to vary according to the type of cookie being set and the use to which the information is put. Cookies may be either "Session” cookies, which are temporary and deleted as soon as the user closes his or her browser; or "Persistent” cookies, which are stored on the user’s device hard drive until they expire or are removed. Where a persistent cookie is set, the consent only needs to be obtained prior to it being set the first time.

Of course, users can configure their browser to warn them whenever a new cookie is about to be stored; clear the cookies that have previously been set; and/or block specific cookies in advance. Or they can choose not to visit a website or use a service whose cookies they don’t want to receive. However, the Information Commissioner has found that most browser settings are not sophisticated enough to allow the service provider to assume the user has given his or her consent to allow your website to set a cookie. So, the Commissioner has advised that consent must be obtained in some other way.

If you are changing your terms for the use of your web site or web-based service, you have to make users aware of the changes and specifically that the changes refer to your use of cookies. You then need to gain a positive indication that users understand and agree to the changes. This is most commonly obtained by asking the user to tick a box to indicate that they consent to the new terms. Where a third party sets its own cookies or similar technologies onto “your” users’ devices, you will need to ensure your users’ consent is obtained either by you or the third party.

For sites with subscribers who must log-in to gain access, you could prompt the user to agree amendments to your privacy policy to cover the use of cookies at time of next log-in. More challenging is how to obtain consent to cookies from users who don't log-in or necessarily interact with your site in a way that would enable you to display terms of consent that could be agreed. The Information Commissioner has suggested that web site owners “place some text in the footer or header of the web page which is highlighted or which turns into a scrolling piece of text when you want to set a cookie on the user’s device. This could prompt the user to read further information (perhaps served via the privacy pages of the site) and make any appropriate choices that are available to them.”

Whichever way you decide to meet the challenge, you'll need a psychiatrist on standby for your digital design team ;-)

Image from Jefferson Park.

What Is Identity, Anyway?

2011-05-10T23:00:00.000+01:00

I was a pleasure to join a CSFI round-table discussion on identity today. It was the latest in a series of discussions to elucidate the problems with the current approach to identifying customers (and providers) in the financial services context. Subsequent discussions will focus on potential improvements and alternative solutions.

It was a broad-ranging discussion, as you'd expect, and tough to do justice to everyone's remarks, but worth a quick summary. Dr Ian Brown of the Oxford Internet Institute set the context in terms of the various meanings of 'identity' and how other disciplines view it. However, he doesn't believe it's helpful to think in terms of 'identity' itself, as opposed to 'reputation', for example. And it's not actually necessary in many cases for someone to be identified (e.g. a tube journey). People's attitudes to privacy vary with context: students have been shown to disclose more in their responses to an informal student survey than to official university research questionnaires. Ian also explained how the technological landscape is evolving - and ought to be encouraged to evolve - including the work of David Chaum and others on how to ensure 'unconditional anonymity' or that transactions you undertake are not shown as related. He suggested that approach could be promoted via initiatives like Project Stork (a project to enable interoperability of EU member state ID cards).

Marc Dautlich of Olswang pointed out that "identity" itself is not legally prescribed, but explained the relevant provisions of the Data Protection Act and the offences created by the Identity Documents Act 2010 relating to the possession of false documentation with improper intent. However, he believes the law does not adequately address the fact that the consequences of misuse of identity or personal data vary greatly according to the context. His sense is that it would be more helpful in the future to regulate for appropriate outcomes rather than regulate identity or personal data itself.

My role was to say something about alternative legal approaches to identity.

From the outset, given the pan-European approach to regulating data protection and money laundering, it's important to consider the difference between common law and civil law attitudes to regulation. In common law jurisdictions the law tends to follow commerce, whereas in civil law jurisdictions there's an expectation that the law should stipulate what can and cannot be done. That means UK players can't sit back and leave market forces to reveal any need for new regulations to support a shift to a new identity model. The EC will be under pressure to regulate how the new paradigm should work, and to influence such regulation we would need to participate in the EU 'social dialogue'.

At any rate, 'identity' is not a constant, but flexible in terms of the data used to distinguish the subject from everyone else, the sources of that data, who controls it and the source of any requirement to identify the subject. Identity is contextual, as Ian mentioned. Some personal data we volunteer happily in a social media situation (or on reality TV), but less so in a formal or institutional situation. Often we have no control over the process. Money laundering regulation, for instance, casts an obligation on product providers to identify their customers by reference to official data.

An organisation's attitude to identity data also tends to be governed by whether the organisation is a 'facilitator' (which exists to solve its customers' problems) or an 'institution' (which primarilty exists to solve its own problems). Facilitators try much harder than institutions to ensure that their collection and use of personal data, and treatment of identity, is transparent and proportionate to the customer activity being facilitated, and 'friction' in the customer experience is kept to a minimum.

However, some institutional identity requirements may be disproportionate partly because the government views the institutions concerned as useful 'choke points' for imposing requirements for public policy purposes, like anti-terrorism or serious crime prevention.

In future, I suggested that we determine identity requirements from the consumer/customer standpoint, and ensure they are facilitative and proportionate (rather than simply a hurdle to be cleared). That may also mean solving public policy identification requirements in different ways. The semantic web represents an ideal opportunity to minimise identity issues. For instance, I've long been a proponent of the idea that you should have an applet on your computer that holds your personal profile and can interrogate product provider's semantic datafeeds to find, say, an insurance product that's right for you without requiring you to disclose your personal data.

I look forward to seeing the output of this round table process in due course.

Image from Brainstorm Services.

Do Other EU Countries' Data Protection Laws Apply To You?

2011-05-05T11:33:00.000+01:00

A hat-tip to Claire Walker and Shona Kerr for their SCL article on the above question: "Location, Location … Guidance on Applicable Law in International Data Processing Scenarios" (cheap annual subscription applies).

The "guidance" referred to is the Opinion of the EU's Article 29 Data Protection Working Party of national data protection regulators. And, naturally, the answer to the above question is that "it depends".

In essence, the factors for businesses to consider are whether you are the data controller or processor, and whether you have an "establishment" in a given EU Member State and/or are sufficiently involved in processing personal data through "equipment" or some means of processing located in that country. There are helpful detailed examples in the Opinion, but ultimately it's a question of fact and degree that will benefit from discussion with the operational or IT staff who know what's actually going on. Guidance is also given on supervision and enforcement.

This sort of analysis is not exclusive to the law on personal data protection - many local laws and regulations may apply to your cross-border activities in another country, even if you don't operate a physical point of sale there (direct and indirect taxes being critical examples). But it's a useful illustration of the type of issues facing anyone operating on a cross-border basis.

Week One: Build A Decent Framework

2011-05-03T09:34:00.001+01:00

The first week in any new in-house role or project has many defining moments. Are you friendly and approachable, or nervous and shy? Do you listen respectfully before suggesting improvements, or arrogantly impose your own experience and expertise from the outset? Do you have a plan for how you'll approach your new role, or will you simply react to demands on your time?

One advantage to having worked in nearly a dozen businesses over the past twenty years or so is having the opportunity to experience many 'fresh starts'. Here are three steps I've learned to take each time:

1. Research the business and its products: You should've done this at interview stage (along with understanding the overall market context), but you probably didn't get the whole picture from company filings, web sites and other publicly available material. Depending on seniority, you may not get much more. Play the 'newbie' card while you can. Try to meet the lead business people and ask plenty of questions about their successes and key challenges. Ask each product manager to explain how his or her product works. Make a note of anything that surprises you - good or bad. Understand the business problem-solving methodology (if any), project planning framework (if any) and the end-to-end business processes that comprise or support the products - how customers are signed up, complaints are handled, how distribution works, the supply chains, how contractual rights are enforced. Due diligence reports, regulatory filings, major contracts, sales presentations and process maps all make great source material.

2. Figure out the top ten challenges for the business: This can be a hair-raising experience, especially in a young business or one that's poorly run. Try to be discreet, patient and under-react until you've figured out the list and considered how to align yourself with each challenge. A well-managed business will identify and prioritise its most significant challenges annually. In that case, figuring these out will involve a fairly easy discussion with the boss about the business planning cycle, the current plan and where you fit in. In other cases, there may be no clarity at all, and no process for achieving it - great opportunities for anyone with an analytical mind and a positive attitude. Clearly the annual revenue target, major product launches, acquisitions and any substantial new regulation will be likely to feature in the top ten. Addressing the organisation's substantial strengths, weaknesses, opportunities and threats should round out the list.

3. Figure out the top ten legal challenges: What the lawyers need to do should have become pretty clear by now. Of course you have to factor in your own major initiatives, like getting a handle on significant contracts, contested litigation, training and competence, ensuring appropriate records retention and so on. But some of that will be business as usual. The major challenges should involve cross-functional co-operation - including public affairs and PR.

I'm interested in your thoughts.

Image from De Madera Constructions.

Bio

2011-05-01T13:07:00.001+01:00

I'm a consulting solicitor specialising in retail financial services, e-commerce and IT. I work through Keystone Law, based in London, both as an in-house lawyer and as an external adviser. Current clients include an online retailer, payment service provider and peer-to-peer finance platforms.

In the past I've also worked both in-house and in private practice. On the in-house side, I've consulted full-time at Amazon.com and Reuters, and was the Legal & Compliance Director for a mortgage business in GE. I've also helped start two e-businesses: Zopa, the world's first online marketplace where people lend directly to each other (I was General Counsel & Company Secretary) and Earthport plc, the online payment services provider (I was a Director and General Counsel).

I started out as a barrister in Sydney (1990-'94) and later initiated and co-ordinated e-commerce strategy for DLA in London from 1997-'99. I was admitted as a solicitor in England in 1996 and qualified as an Attorney in New York State in 1997. I'm a member of the media board of The Society for Computers and Law.