The Financial Regulatory Observer regularly sets spotlights on selected topics driving the regulatory and technological changes in the financial industry.
Valdis Dombrovskis has a full in-tray that includes securing the EU banking and capital markets union as he begins his term at the European Commission.
The latest consultation paper from ESMA raises some important questions about the market abuse regulation (MAR) but lacks detail in some crucial areas.
The European Courts have handed down first judgments on supervisory measures taken by the ECB, highlighting important issues regarding the application of the law.
Since the 2008 financial crisis, a non-US bank seeking to establish or maintain a US presence has been required to comply with a set of stringent regulatory requirements, but a recently adopted rule (Final Rule) limits their application.
Regulatory authorities are increasingly interested in the new products and business models being adopted by market participants.
Digitalization is at the forefront of the challenges facing the banking industry as it undergoes a period of unprecedented upheaval.
Profit margins and returns are being squeezed as traditional banks face a perfect storm of negative interest rates, tight regulatory scrutiny and increased competition from new entrants, which range from small fintech upstarts to the giants of Big Tech.
These new market participants have captured the zeitgeist by catering to tech-savvy consumers who demand seamless online banking, instant information and high-quality services at lower costs. And regulatory authorities are increasingly interested in the new products and business models being adopted by these market participants.
The user experience is being tailored for mobile devices, and product features are adapting to the fast-changing consumer behaviors. Increased competition also comes from BigTech companies with large customer bases and major capabilities in the digital world: Google, Apple and Amazon are all scaling up their financial service capabilities and expanding into markets previously reserved for traditional banks. These companies continue to utilize the network effect to create platforms with plenty of users and the data that comes along with the users. More and more customers are offered various interactions in a single application as shown by the success of so-called "super -apps," such as WeChat offered by Tencent in China.
Payments are becoming increasingly integrated into other services and are less and less visible. The significance of cash is diminishing as well. Bricks-and-mortar branches are being replaced by chatbots programmed by natural language processing based on artificial intelligence (AI).
Market participants and regulators are discussing both the benefits digitalization brings and the challenges it poses. So far, where Big Tech has entered the market, it has sought to collaborate with global financial services firms. This approach has the advantage that tech firms can work with regulated entities. Google and Citigroup have recently announced a partnership for a personal checking account service, while when Apple had launched its credit card, it did so with the help of Goldman Sachs, which is the issuer.
But with the increasing influx of new technology players in banking, regulators are looking to prevent any loopholes in the supervisory scope and address new risks arising from such collaborations, through adequate prudential measures.
US$111.8 bn
Global investment in fintech companies in 2018
Source: KPMG, "The Pulse of Fintech 2018"
Fintech and the scope of regulation and supervision
Collaboration between banks and fintech companies brings clear benefits, such as catering to customer demand for quick solutions, as well as the facilitation of cross-border banking services. But as a result, new systemically important institutions may emerge from these developments that will inevitably use Big Data and artificial intelligence extensively while closely working with the banking sector.
As collaboration with traditional banks becomes more common, it raises the question of whether fintech companies should require a license to engage in banking business, whether directly or indirectly. Forcing fintech players that are partnering with banks within the purview of banking regulation and supervision to acquires a license would be premature as they do not extend financial services per se, but are only competing for small links of the value chain. However, it may be prudent to put a monitoring mechanism in place in order to facilitate quick supervisory adjustments in case of noticeable changes.
With the proliferation of payment services from the likes of Apple and Google, data misuse becomes a big area of concern, as tech companies will have access to the personal data of billions of users that can be sold or used for marketing purposes. This goes hand-in-hand with the risk of a non-transparent credit scoring, which is leading to a so-called "black-box effect." Credit scoring models that are based on artificial intelligence (AI) may use that data without the knowledge of the customer.
As banks look to control costs and grapple with ever-more complex IT solutions, outsourcing is on the rise. But this outsourcing trend raises concerns over risk and market concentration.
The new level of interconnectedness within the banking value chain creates a complex network where any breach may have an impact on the entire value chain and could spark a systemic crisis
3,583
Number of fintech startups in EMEA as of February 2019
Source: Statista
Towards a systemic crisis?
If outsourcing leads to a situation where activities such as cloud computing end up being offered by just a handful of players, there could be severe operational risk implications for the whole banking sector. "If any of these players were to get into trouble, a huge number of banks might be affected, possibly unleashing a systemic crisis," said Andrea Enria, Chair of the Supervisory Board of the ECB in a speech in March 2019.
Cybercrime is another obvious risk, particularly given the new level of interconnectedness achieved by the "sliced and diced" banking value chain supported by various players including banks and fintech companies. This creates a complex network where any breach may have an impact on the entire value chain and could spark a systemic crisis.
The more business models become digital, the more important IT will be and the more complex technology will become as a result. Components of such complexity, such as AI, are prone to failures that are not easy to detect if small, or to more nuanced cyberattacks planned by entities that thoroughly understand the financial system. The risks embedded in these complexities are not restricted to technical disturbance of operational processes. It may manifest into substantive aspects of supervision, for example, the black-box effect mentioned earlier. Such challenges are tougher to deal with given the accelerating pace of digitalization, thereby requiring adaptations and market assessments that are more frequent.
Regulators and supervisors are actively and openly engaging in the deliberations around digitalization. "We are neutral on technology. But one thing we are not neutral on is risk," said Enria.
Supervisors recognize the challenge in dealing with innovation but ultimately wish to adhere to the core principal of "same risk, same rules, same supervision." This means that banks should be supervised proportionate to their individual risk regardless of whether they use innovative or traditional methods.
Different authorities have offered varied approaches to keep pace with technological advancements in the banking and finance industry. The UK's Financial Conduct Authority (FCA) in its early initiatives came up with the FCA "sandbox," which provided a space for fintech startups and even larger established financial services firms to prove that their business models work and are compatible with the regulatory framework. This has enjoyed considerable success with some fintech players who have benefited from the FCA's approach calling for a global sandbox network.
Meanwhile, the European Banking Authority has emphasized the increasing importance of new fintech providers in its new guidelines for outsourcing arrangements. While discussing the use of fintech solutions by traditional banks to achieve operational and cost efficiency, the EBA noted that "outsourcing is a way to get relatively easy access to new technologies and to achieve economies of scale."
Supervisors have stressed the need to ensure a high level of prudential safety as banks navigate various phases of technological change. Therefore, regulators and supervisors need to stay ahead of any new, emerging risks. A challenging aspect of dealing with the risks imposed by digitalization for banks is to ensure that they build up expertise and knowledge while establishing adequate governance structures and proper risk management practices. This also mandates simple measures such as regular training of employees and raising awareness of the problems with eliminating or attempting to diminish evident risks.
With the increasing influx of new technology players, regulators are looking to prevent any loopholes in the supervisory scope and address new risks arising from such collaborations, through adequate prudential measures
Harnessing technology for supervision
Supervisors have not just reflected on the challenges of digitalization and possible ways of dealing with it, but have embraced ways of using technology and innovation to support supervision and increase efficiency.
Supervisory technology— suptech—the use of innovative technology by supervisory agencies to support supervision, are evolving in areas such as data collection and data analytics.
As new digital business models lead to an ever-increasing amount of high-frequency data, AI and machine learning can help to manage and mine this data. Supervisors can use machine learning to identify patterns that may help to predict systemic risks, analyze credit risk taken by banks, and even play a role in detecting money laundering. Repetitive and periodic tasks can be digitized and therefore free up the workforce to engage in new supervisory challenges.
Digitalization can also make the supervisory process more efficient and less bureaucratic. However, supervisors emphasize that they should approach AI with caution due to potential risks and the need to make comprehensible decisions even when using suptech.
Another area where technology might alter supervision is the way data is shared between banks and supervisors. One option to address the uprising challenges of digitalization for regulatory authorities could be to establish "direct reporting" processes. Direct reporting models can increase efficiency and ease the burden of data collecting. Big Data and AI may thus help to overcome information asymmetries. Suptech represents a refreshing development in the approach to supervising digitalization in the financial sector.
What's next?
While supervisory agencies gear up for newer challenges offered by digitalization, market participants must also get ready for an oversight regime that strives to strike a balance between evolving consumer choices, technological innovation and the scope of banking regulation and supervision.
