An Integrated EU Market For Payments?

A Dog's Breakfast

We have until 11 April to weigh in on the European Commission's dream for "an integrated European market for card, internet and mobile payments."

Tedious as the EC's role and processes are, we mustn't forego these opportunities to feed into the EU's 'social dialogue'. If we don't participate we'll get legislation that's more reflective of canine culinary expertise rather than how various markets actually work (like the Payment Services Directive).

Some key issues in the current green paper are:

• whether we need more sunlight on how much we pay in interchange fees;

• whether it's overkill to make a retailer show on your receipt how much it costs to use your chosen payment method;

• whether non-financial service providers should be able to directly access clearing and settlement systems;

• whether you should be allowed to permit any service provider you like to show you your bank balance, rather than only your bank; and

• whether competition is being inhibited by the process of 'standardisation' and demands for "full interoperability".

My own personal view is that the short answer to all of the above is, "Yes."

The challenge to regulating payments is that service providers and regulators alike tend to view "paying" and "banking" as consumer activities in their own right. Whereas consumers don't actually "pay" - and retailers don't even "accept payment" - as distinct activities. The man from Visa who thinks the brand on my payment card is the most important brand in the context of me buying a gift for a friend on my way to a party is institutionally deluded. Actually paying for the gift is a barely considered sub-process in the course of getting to the party, and I might pay in cash.

Not only must we remember that payment occurs in the context of wider consumer activities, but we must also acknowledge that payment details are a subset of all the personal and transaction data used in retail services that are subject to broader market forces and other regulation. In particular, the impact of the EC's proposal for more comprehensive regulation of personal data processing cannot be underestimated. There seems little point in dealing with access to bank balance information in the context of payments regulation when the wider data protection regime would enable the "right to be forgotten", "data portability", "data protection by design and by default", the logging/reporting of personal data security breaches, personal data processing impact assessments, prior consultation and regulatory consent for potentially risky processing; not to mention enhanced internal controls, enforcement and compliance burdens, including the appointment of a data protection officer.

But let's glance away from the data protection elephant for a moment.

On the question of interchange, it's clear from Annex 2 of the green paper that the EC doesn't understand the lack of a direct contractual/settlement relationship between issuers and acquirers in four-party card schemes like Visa/MasterCard, even where a banking group has both an issuing business and an acquring business. Each acquirer and issuer contracts directly with the card scheme, and the card scheme settles independently with each of them. Besides, the issuing arm's cardholders won't always be making payments to the aquiring arm's merchant customers. Not only does this add an important nuance to the interchange debate, but it also has far wider implications for payment services regulation than there's time to cover here.

As consumers, of course we want retailers to keep a lid on their interchange costs (like any other overhead). That would enable them to improve their services, increase product selection or maybe reduce their prices. But unless the retailer has its own specific surcharge, I don't need the receipt to tell me the cost of using my chosen payment method, any more than I'd need to know what it cost to get the item from the warehouse to the shop. The underlying cost might be fascinating to EC officials and payments geeks, but the all-in price of the item should be enough for me to compare the efficiency of retailers' operational processes. Whether those retailers are competing properly in their own markets is a separate issue to the cost of payments in any event.  

I can also see that the cost of payments might be reduced by enabling sophisticated businesses to directly accessing clearing and settlements systems, rather than relying on financial institutions whose systems are geared to servicing the broader market. And such businesses shouldn't need to become regulated financial institutions or to join cosy industry bodies for that privilege. However, I should point out that developing an internal acquiring and settlement capability is very likely to prove an unwelcome distraction for non-financial corporate groups.

Similarly, as a consumer, I should be able to appoint a single service provider to enable access to my various bank, card and other payment accounts, without being in breach of the obligation to keep my account access details confidential. It's not beyond the wit of man to work out which provider is liable for any security breaches that might occur in that data sharing process.

Finally, we need to be really careful about requiring "standardisation" and "full interoperability" rather than merely enabling the market to develop this naturally, free of anti-competitive activity. Entrepreneurs don't have the time or resources to sit around in policy and standards meetings. Nor do they wish to telegraph to incumbents their disruptive plans. Yet there is also little meaningful distinction between "technologicial interoperability" and "commercial interoperability" in a digital world where business models are automated or 'hard coded'. I'm struggling to understand the EC's intention here. On the one hand the EC wants to see competition (which generally means less consolidation and more fragmentation - plenty of new players and competing, disruptive solutions), and on the other hand it wants to "avoid fragmentation of the market". So these aims seem incompatible. 

Interoperability and standards may be important to enable efficient, straight-through processing between participants at either end of an overall business process or system. But the more tightly that process is bound together - or the narrower the group of entities involved in the development of standards/interoperation - the harder it is for new entrants to compete by disintermediating or improving any one element of that process. This is a key reason we have been trying to avoid any preoccupation with mandating standards in relation to data release formats in the context of the 'midata' initiative, for example (formerly 'mydata'). This avoids creating an extra hurdle to the release of the data, while opening up a market for the supply of data transformation applications that collect such data in multiple formats and display or transfer it in another format. 

Paradoxically, the EC's own concerns on this front are reflected in the green paper questions as to whether card scheme management should be separated from control over card payment processing (Q's 9 and 10), as well as the competition challenge to standards-setting by the European Payments Council:

"Joaquín Almunia Commission, Vice President in charge of Competition Policy, said: "Use of the internet is increasing rapidly making the need for secure and efficient online payment solutions in the whole Single Euro Payments Area all the more pressing. I therefore welcome the work of the European Payments Council to develop standards in this area. In principle, standards promote inter-operability and competition, but we need to ensure that the standardisation process does not unnecessarily restrict opportunities for non-participants."

I rest my case.

Travelling With The ID Pioneers

Seeking a New State of Identity

If the penultimate CSFI roundtable on Identity in Financial Services was anything to go by, the final one should be a proper knock-down, drag-out affair worthy of past pioneering epics ;-) In fact, the Innholders should replace it's sign for the day, to read:

The issue that sparked the most heat (again) was whether banks might somehow be suited to be the guardians of the so-called 'hard' element our identities - the proof currently required to move our money, access our government records and so on - rather than 'soft' credentials necessary to access, say, your social media accounts. 

Spotted the flaws already? 

We shouldn't bother picking on the banks anymore (though it is fun). I mean, I seriously doubt they want to be cast in this role at all. And as Richard Martin pointed out, the banks are each wedded to different identity solutions, chosen for fairly mundane IT procurement reasons rather than any attempt to use ID services as a source of competitive advantage (banks compete?!) in offering secure access to your money their services. At any rate, to the extent that any banks are availing themselves of the latest e-ID tools to more efficiently KYC their customers, they are merely using the credit reference agency databases. So if one were to look only at the development of 'hard' identity services, one should cut through the banking platforms to the credit reference agency roadmaps and how they plan to enable access to those services in ways that are much more useful and empowering for consumers.

And while the Money Laundering Regulations do erect a reasonably heavy barricade to the usability of financial services, it's unduly trusting to pretend they amount to best practice in establishing a person's identity. Real danger lurks in this idea that social media identity is somehow 'soft'. The premise for this seemed to be that Facebook, Google, Amazon, eBay and so on don't offer any services that attract the need for 'bank-standard' ID checks and personal data protection, and couldn't operate to such high standards. Yet, many of them already operate financial institutions. And I suggest that there is more real value to the use of your identity to personalise products and pricing than in simply accessing your bank records. Even the Eurocrats are onto this. It's ironic that the person who was most pressing in his demand to know 'who owns my identity data' in a social network setting also admitted to entering a joke date of birth in a leading social media service. I guess he'd also be the first to complain if that service provider and those in its network were to hold the 'lie' against him...

But, of course, identity verification is developing in ways that mean your joke date of birth in one or more databases - and even your passport, driving licence and energy bill - won't necessarily matter amidst a far wider set of identity factors. As I've explained after the previous roundtable on this topic, what makes us unique is our collection of behaviours and the data they generate. So I'll end this post in a similar way to the last.

There are two key identity problems to be solved. As consumers, we need to be able to simply, conveniently and efficiently prove our identities in the course of any day-to-day activities.  And as a community, we need the source of that proof to be less vulnerable to being hacked or guessed, and to contain its cost.

Given those key problems, the solution cannot possibly comprise a single, static set of data that is 'held' by some institution. Rather, the solution has to involve the capability to generate a unique and momentary proof of identity by reference to a broad array of data generated by a user's own activity,  which is then immediately useless and can be safely discarded.

Submission on New Model for Retail Finance

Set out below are both the initial summary and my full submission to the Red Tape Challenge and the BIS Taskforce on Non-bank Finance. I'm very grateful to the colleagues who contributed, as mentioned in the longer document.

In its invitation to submit evidence of ‘red tape’ that is inhibiting the development of ‘disruptive business models’, the Cabinet Office notes the example of Zopa, “a company that provides a platform for members of the public to lend to each other, who found that financial regulations simply didn’t know how to deal with a business that didn’t conform to an outdated idea of what a lender is…” 

This paper demonstrates that financial regulation similarly fails to deal with a range of non-bank, direct finance platforms (“Platforms”) that share some of the key characteristics of Zopa’s person-to-person lending platform (see Annex 1). Accordingly, financial regulation is failing to enable the cost efficient flow of surplus funds from ordinary people savers and investors to creditworthy people and businesses who need finance. In particular, as further explained in Annex 2, the current regulatory framework:

• generates confusion amongst ordinary people as to the basis on which they may lawfully participate on alternative finance Platforms (even though some are licensed by the Office of Fair Trading);

• creates legal and regulatory issues that vary greatly depending on the structure of Platform and instrument adopted, particularly where investment is for return, rather than by way of donation (without return) to a good cause. This means that detailed legal advice is needed for any Platform and this is itself a barrier to entry for some schemes which may not pose any significant risk to the public. Platforms may also require a level of regulatory authorisation which may be inappropriate, again considering the low level of risk to the public.

• does not make alternative finance products eligible for the usual mechanisms through which ordinary people save and invest (as explained in Annex 2), and the inability to deduct bad debt before tax and the tax on interest charged to cover bad debt exposes individual participants on Platforms to much higher ‘effective tax rates’ than their applicable statutory rates (see Annex 3);

• discourages ordinary savers and investors from adequately diversifying their investments;

• incentivises ordinary savers and investors to concentrate their money in bank cash deposits, and regulated stocks and shares;

• inhibits ordinary savers’ and investors’ from accessing fixed income returns that exceed long term savings rates;

• inhibits the development of peer-to-peer funding of other fixed term finance (e.g. mortgages and project/asset finance); and

• protects ‘traditional’ regulated financial services providers from competition.

These regulatory failings could be resolved by creating a new regulated activity of “operating a Platform”, for which the best-equipped regulatory authority would be the Financial Services Authority (as replaced by the Financial Conduct Authority). In tandem, or as alternatives, there could be exemptions based on size of investment or risk (e.g. some schemes or platforms may involve minimal investment in what is sometimes a socially useful venture); lesser regulation/authorisation within existing classes of regulated activity (as for small payment services providers or small e-money issuers) ; or the official endorsement of self-regulatory codes (as banks enjoy in relation to the Banking Code, for example). Direct and indirect incentives that selectively favour incumbent banks and investment funds should also be recognised and modified to balance the competitive landscape. Detailed regulatory changes are explained in Annex 4. 

Regulation of the platform would be independent of any regulation that may apply to the type of product offered to participants on the platform (e.g. loans, trade invoices, debentures to finance renewable energy and lending for social projects, as noted in Annex 1). However, exemptions from regulations governing financial promotions and offers to the public could be granted for instruments that are offered on Platforms. 

Proportionate regulation that obliges Platform operators to address operational risks common to all products would also enable economies of scale and sharing of consistent ‘best practice’, and leave product providers and other competent regulators to focus solely on product-specific issues (e.g. consumer credit, charitable purposes). Similarly, participants on such Platforms do not need to be treated as if they are participating in the course of a ‘business’ if the Platform itself meets all the compliance requirements that a business of that kind would otherwise have to meet. 

Given the established nature of the financial regulatory framework and the dominance of incumbent banks in the provision of debt finance to individuals and small businesses in particular, it is unrealistic to assume that new business models will thrive without some alteration to the regulatory framework to enable rapid market entry and to facilitate strong, responsible growth.

Alternative finance briefing paper simon deane-johns 27 01 12

View more documents from Pragmatist.

You Want Eggs With Your Privacy Regulation?

Well, the EuroZerozone may be disintegrating, but the European Commission is certainly doing its best to cement over the obvious cracks in the single market fantasy. Now we need more regulation of... privacy.

As with everything else that Brussels churns out, this breakfast had its origins in the primordial soup of the "Social Dialogue" and various talkfests that are helpfully identified by the city in which they were discussed. This time around something seems to have happened in Stockholm in 2009, for example. At any rate, you'll be so impressed by the rich pedigree of the grandly named:

"Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the protection of individuals with regard to the processing of personal data and on
the free movement of such data (General Data Protection Regulation)"

that you'll gratefully submit to the wisdom of our European overlords.

As for me, I just can't wait to roll my sleeves up and get to grips with the detail... the "right to be forgotten", "data portability", "data protection by design and by default", the logging/reporting of personal data security breaches, personal data processing impact assessments, prior consultation and regulatory consent for potentially risky processing; not to mention enhanced internal controls, enforcement and compliance burdens, including the appointment of a data protection officer.

No, really.

Honest.

Just as soon as I've got my head around the idea that "Consent shall not provide a legal basis for the processing, where there is a significant imbalance between the position of the data subject and the controller" (Article 7(4)).

How can we really be sure there has been consent to anything?

Should Central Banks Supervise Facebook Credits?

This is an interesting question that I've been keeping an eye on for sometime now. Forbes is the latest media outlet to wonder whether Facebook Credits are going to be deemed systemic and somehow in need of regulatory supervision. They cite estimates that Facebook Credits total "$470 million of revenue in 2011, or about 11% of Facebook’s total business."

Financial regulators haven't been terribly interested in Facebook Credits because they merely constitute 'closed loop' stored value, rather than 'open-loop' stored value or 'e-money'. The line of demarcation is somewhat open to conjecture, but as explained below it seems likely that the Facebook Credits programme (as currently configured) will remain outside the scope of regulation. However, Facebook could decide to make things really interesting by 'opening the loop'  to become a full-scale e-money issuer...

When you buy Facebook Credits you're really just buying a 'claim code', like you would a music download, and that code is redeemable for purchases of items on the Facebook.com platform. The code is purchased from and redeemed by the same Facebook entity (if you're a resident of or have your principal place of business in the US or Canada, it's Facebook, Inc., otherwise, it's Facebook Ireland Limited). This means the suppliers of items you buy don't actually redeem the Facebook Credits themselves. Instead they rely on Facebook to process that transaction, and the suppliers receive only 70% of the price of the items sold, after Facebook deducts its commission or fees. The terms and conditions also make it clear that the 'credits' aren't able to be re-sold or transferred to anyone outside of Facebook. All of this means Facebook Credits are 'closed loop' stored value.

Typically, the European Commission has been the most aggressive in trying to comprehensively regulate e-money (and everything else!). That's largely arisen from efforts to break open the continental 'banking monopoly', starting with retail payments. As a result, issuing e-money in the European Economic Area (EEA) is a regulated activity under the second 'E-money Directive', and its use in retail payment transactions is covered by the Payment Services Directive. The two directives have been implemented in the UK by The Electronic Money Regulations 2011 and the Payment Services Regulations 2009. Essentially, this creates a framework within non-banks can be authorised to process retail payments.

Key regulatory requirements related directly to E-money include official authorisation/supervision, minimum and ongoing capital requirements and the need to safeguard (insure or segregate) money corresponding to outstanding E-money. “Electronic money” is defined as:

"...electronically (including magnetically) stored monetary value as represented by a claim on the electronic money issuer which—(a) is issued on receipt of funds for the purpose of making payment transactions; (b) is accepted by a person other than the electronic money issuer; and (c) is not excluded by regulation 3;" [my italics].

Parking the various issues with the real meaning and scope of "payment transactions", it's clear from the relevant terms and conditions that Facebook Credits are not accepted by anyone other than the relevant Facebook entity. Technologically speaking, it also seems likely that none of the suppliers of items purchased with Facebook Credits would be able to recognise and redeem the unique claim codes. Furthermore, both of the regulation 3 exemptions are relevant in the context of Facebook Credits:

"3. (a) monetary value stored on instruments that can be used to acquire goods or services only—

(i) in or on the electronic money issuer’s premises; or
(ii) under a commercial agreement with the electronic money issuer, either within a limited network of service providers or for a limited range of goods or services;"

which is generally referred to as the 'limited network' exemption; and a 'digital goods' exemption (which also applies to services) for:

"...(b) monetary value that is used to make payment transactions executed by means of any telecommunication, digital or IT device, where the goods or services purchased are delivered to and are to be used through a telecommunication, digital or IT device, provided that the telecommunication, digital or IT operator does not act only as an intermediary between the payment service user and the supplier of the goods and services."

The digital goods exemption is pretty clear cut, and probably applies to most of what Facebook Credits are used for. But being able to pay for a trip to the movies, as Forbes reports occurred in the US last summer, would likely fall outside the EU digital goods/services exemption if it occurred in the European Economic Area. So that puts pressure on the extent to which Facebook can claim to be a "limited network" of service providers or only providing access to "a limited range of goods or services". And if that exemption fell away, we'd be back to whether a participating merchant could be deemed to be 'accepting' Facebook Credits. 

The meaning of "limited" is left undefined in the legislation, probably to give the authorities a broad enough discretion to act where they think it's necessary or appropriate. However, the ordinary dictionary meaning does not equate to 'small', 'narrow' or 'few', so the size of the programme of itself shouldn't be a problem.

Nevertheless, it seems that the scope, scale and growth of the Facebook Credit programme is continuing to provoke policy discussion about its regulatory status, particularly as to whether there are systemic grounds on which Facebook should be segregating customer funds related to oustanding stored value and whether it has some kind of unfair cost advantage over authorised E-money institutions.

I discussed the policy issues related to operational risk, safeguarding and competition concerns in the context of other limited network offerings during the UK consultation on the introduction of the 2011 regulations. Incredible as it may seem, I think these will recede as the eventual scale of 'proper' E-money issuance will gradually grow to vastly exceed the quantity of Facebook Credits in issue - unless Facebook decides to enter the E-money market itself and go 'open-loop'. Now that would be interesting.

Red Tape Challenge Submission - Summary

In its invitation to submit evidence of ‘red tape’ that is inhibiting the developmentof ‘disruptive business models’, the Cabinet Office notes the example of Zopa, “a company that provides a platform for members of the public to lend to each other, who found that financial regulations simply didn’t know how to deal with a business that didn’t conform to an outdated idea of what a lender is…” 

Financial regulation similarly fails to deal with a range of non-bank finance platforms that share some of the key characteristics of Zopa’s person-to-person lending platform. Accordingly, financial regulation is failing to enable the cost efficient flow of surplus funds from ordinary people savers and investors to creditworthy people and businesses who need finance. In particular, the current framework: 

1. generates confusion amongst ordinary people as to the basis on which they may lawfully participate on alternative finance platforms (even though some are licensed by the Office of Fair Trading); 
2. does not make alternative finance products eligible for the usual mechanisms through which ordinary people save and invest, exposing lenders to higher ‘effective tax rates’; 
3. discourages ordinary savers and investors from adequately diversifying their investments; 
4. incentivises ordinary savers and investors to concentrate their money in bank cash deposits, and regulated stocks and shares; 
5. inhibits ordinary savers’ and investors’ from accessing fixed income returns that exceed long term savings rates; 
6. inhibits the development of peer-to-peer funding of other fixed term finance (e.g.mortgages and project/asset finance, and even short term funding of invoices); and
7. protects ‘traditional’ regulated financial services providers from competition. 

These regulatory failings could be resolved by creating a new regulated activity of operating a direct finance platform, for which the best-equipped regulatory authority would be the Financial Services Authority (as replaced by the Financial Conduct Authority). Regulation of the platform would be independent of any regulation that may apply to the type of product offered to participants on the platform (e.g. loans, trade invoices, debentures to finance renewable energy and lending for social projects). Proportionate regulation that obliges platform operators to address operational risks common to all products would also enable economies of scale and sharing of consistent best practice, and leave product providers and other competent regulators to focus solely on product-specific issues (e.g. consumer credit, charitable purposes). 

Similarly, there is no reason why products distributed via these platforms should not also be eligible for the usual mechanisms through which ordinary people save and invest, such as ISAs, pensions and enterprise investment schemes.

I'm off to Number 10 today to discuss these issues, and will be submitting a more detailed paper in the coming weeks, both to the Red Tape Challenge and the BIS Taskforce on alternative business finance. I'm interested in any comments you may have.

The Nature of Scepticism

Readers of Pragmatist will know that I've expressed my bemusement before that auditors have to be taught how to be sceptical. That was back in March. In November, the European Commission confirmed that the Financial Reporting Council wasn't joking:

"Article 15

Professional scepticism

When carrying out the statutory audit of a public-interest entity, the statutory auditor or audit firm shall maintain professional scepticism throughout the audit, recognizing the possibility that a material misstatement due to facts or behaviour indicating irregularities, including fraud or error could exist, notwithstanding the auditor's or firm's past experience of the honesty andintegrity of the audited entity's management and of the persons charged with its governance.

The statutory auditor or the audit firm shall maintain professional scepticism in particular when reviewing management estimates relating to fair values and the impairment of goodwill and other intangible and future cash flow relevant to the consideration of the going concern.

For the purposes of this Article, 'professional scepticism' means an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud and a critical assessment of audit evidence."

Proposal for a regulation on specific requirements regarding statutory audit of public-interest entities.

Next: a European Regulation governing the exercise of scepticism in the course of police interviews...  


Hat-tip to Mark from last night's London New Finance Meet-up. Image from The Philosopher's Magazine.