"Integrating IT into the Banking Business Model"

27th November 2003, Nairobi

Master Class – Case Study

Finland?

Finnish Market in Brief

Governing Authorities Ministry of Transport and CommunicationsFinnish Communications Regulatory Agency (FiCora)

Mobile Penetration rate 75% (3.9 mil subscribers) 95% in the age group of 18-

45

GPRS services started in 2000 (practical speed upto 50 kbps) 3G (UMTS) services to start in Q2 of 2003Non-Voice Revenue per User is about 11%, expected to grow to 25% in 2004Major Fixed line NO : Sonera, Elisa Communication, FinnetMajor Mobile NO and SO: Sonera, Radiolinja

GSM Operators in Finland

Network Operators Service Operators SubscribersSonera Sonera 2,360,776Sonera Jippii 47,310Sonera RSL Com Finland 7,000Radiolinja Radiolinja 1,177,711ÅMT ÅMT 9,174Telia Mobile Telia Mobile 167,000Suomen 2G DNA/FL 90,000Elisa Elisa 19,000Total 3,877,971Source: Ministry of Transportation and Communications Finland

(as of July 2001)

(62%)

(30%)

(4%)

E-Commerce in Finland (2001)

Over 44% of Finns shop online1/10 of Finnish households pay their bills electronically65% of Finnish population uses the internet and online servicesOnline banking:- 42.3% of Finns use online banking. - The largest bank, Nordea (former Merita Bank), has over 1 mil internet accounts, making it the largest in Europe and the 3rd largest in the world. - Services : daily transactions, loan applications, insurance purchases, stock trading, investment funding- 50 % of Nordea’s stock transactions are done over the internet

Sweden 68.1%

Finland 65.0%

Netherlands 63.1%

Ireland 60.2%

Denmark 59.7%

UK 56.1%

France 54.8%

Use of Internet & Online Services by % of Population

Finland 42.3%

Sweden 42.0%

Netherlands 35.6%

Denmark 32.1%

France 27.7%

Use of Online Banking

History of Mobile Payment in Finland

Sonera has developed services relating to mobile payment since 1997. In 1997, Sonera launched the 1st application for buying soft drinks by mobile phone from vending machines. In 2000, Sonera tested the sale of lift tickets at ski slopes that combined SMS and contact less card technology. In 2000, Sonera launched the operator-independent mobile payment services, allowing users to pay for parking fees, restaurant bills, order chocolate and movie tickets.

Vending Machines

There are some 800 vending machines that operate by SMS. However, this is more of a test project, not a significant business.

Parking : ‘Parkit’ Service

• Mobile payment service for parking with mobile phone (SMS) launched in January 2002.

• Service is offered by Payway Oy, a Sonera’s subsidiary and available at 18,000 parking places in 6 major cities in Finland and Sweden.

•Billing in the phone bill (Sonera customers) or by credit card (Visa, Eurocard, Mastercard) or as a separate bill

Sonera ‘Shopper’

A pilot mobile payment service for Sonera customers

31 shops participate in this project in the cities of the Greater Helsinki area. The shops include travel agencies, book, donut, ticket, video rental and record shops, and restaurants.

Customers register for the service either by SMS or at Sonera IN (store)

When shopping, customers order a payment identifier by SMS which is valid for a half hour.

Show the payment identifier message at thecashier on check out.

The bill is charged to credit cards (Visa and Eurocard) or Shopper account on which money is deposited beforehand

Other mCommerce Applications in Finland

Car washes at 25 Shell gas stations by SMS

Electronic mobile tickets to music, sports & other happenings

SMS based premium taxi orderMail Catalogue orders by SMSHelsinki City Transport tickets

NameAddressPhone

Current Situation

Growth rate of the mobile phone penetration has slowed down. Operators need to find more attractive services to be able to continue to grow revenueSMS has turned out to be an unexpected killer app and it’s widely used for personal communication and also for commercial servicesWAP services have mostly been a disappointment- far better usability than SMS, but often too

complicated to install settings and too slow to use

- few services open for all operators customers

Current Situation

Majority of the non-voice revenue comes from SMS. Most of the SMS and WAP-services are enter-tainment services, very few offer real added value Chat-services combined to tv-shows are popularRingtones, logos and news alert services generate revenueGPRS, when more broadly in use, will ease up some of the problems

Mobile Payment in Europe

Mobey Forum

Financial industry-driven forum founded in May, 2000

Founding members:

- ABN AMRO, BNP Paribas, Deutsche Bank, HSBC, Nokia, Nordea, Santander Central Hispano, Siemens, USB

Goal:

- to encourage the use of mobile technology in financial services such as payment, remote banking and brokerage

- Supports dual-chip technology

Mobile Electronic Transactions (MeT)

Founding members:- Ericsson, Motorola, Nokia

Goals:- to establish a framework for secure mobile

transactions, the ability to buy goods and services using a mobile device

- to ensure that interoperable mobile transaction solutions are developed around the world - enabling consumers to access goods and services seamlessly wherever they may be

Global Open Platform

In 1999, organizations interested in issuing multiple application smart cards founded a global alliance under the leadership of Visa.GOP adopted the Open Platform card specifications and terminal framework. Goal:to promote global smart card use and to

assure interoperability of smart card.Interoperability issues have not been completed yet. Some core parts are still left up to vendor’s individual interpretation and left optional.

Mobile Payment Forum

Founding members:Amex, JCB, MasterCard, Visa

Goal:- to develop methods for standardized,

secure and authenticated mobile payments, using payment card accounts

- Supports dual chip technology

SIM

Smart Card in Mobile Payment

Trends

SIM Card as the VAS-enabler after WAP’s disappointment

SIM Toolkit and SIM browser are adopted by operators as a means to increase data revenue.

Higher security required : PKI SIM

Java Card

Bigger memory

Working hard on interoperability

OTA Application Management System

Development of UICC as a way to solve interoperability between 2G GSM and 3G

Development of smart card, terminal, and handsets that are interoperable

The SIM

29% of Network Operators use 8K EEPROM SIM

44% of Network Operators use 16K EEPROM SIM

27% of Network Operators use 32K EEPROM SIM

63% of Network Operators have launched SIM

Application Toolkit as of 10.2000

More than 80% of Operators have multiple SIM

vendors

Source: Telecom Italia Mobile, 2001

SIM Application Toolkit (STK)

1. Normal STK

- Some of the memory in the SIM card is used for STK to store applications such as electronic banking, betting, gaming, location-based services, etc.

- Bank Menu (Inquiry, Transfer, Pay Bill, etc) can be created in the SIM card. When customers select Inquiry, the sub menu option will be displayed "Checking", "Saving", "Credit Card", etc. If the customer selects "Checking", the "Get Input" function from STK will prompt the customer to key-in the Account Number.

- Once the customer key-in the account number and press ENTER/OK key, SIM will process the customer information and rearrange to the proper format which can be understood by bank. Then, the correct message will be sent via SMS to SMSC ,after that to the bank. Once the transaction finished, bank will then sent the confirmed message back to the customer via SMS.

SIM Application Toolkit (STK)

2. SIM Toolkit with SIM browser

- SIM browser is a STK application that is similar to a conventional Internet browser. The browser is stored as an executable application on the SIM card. - A URL is used by the browser application to access to the server to retrieve information, which is converted to an executable script such as menu, sub-menu and information. - Applications are stored in the servers of both Operator and content provider. As a result, the menu, sub-menu, and any information can be modified easily. - As Browser STK can interact to the content provider, it can use encryption/decryption security, suitable for mobile banking service. The transaction message will be encrypted by the key within SIM and transfer via mobile banking server directly to bank. Finally the same bank key in the bank side will decrypt that transaction message and process the rest at bank back end. - This solution is the most preferable to the bank because bank can control all the security and key management.

SIM Browser : WIB

WIB complements WAPWIB, easy and cost-efficient implementation of mobile services. USAT Interpreter, standardized across all mobile technologies (3GPP, 3GPP2, GAIT, etc.) - Infotainment services- Secure financial services- Location based services- Secure corporate services- Controlled and secured by the operator- Roaming in and between private and public networks, e.g.,

GSM and WLAN- Authentication of user e.g. for wireless access to VPN

SmartTrust WIB - de facto global standard 90% of market for advanced SIM clients ( 25 million SIM cards on the market)

Operators are turning into SIM toolkits (STKs) that do not rely on the handsetSTK supports the development of smart card applications for GSM networks based on SMS as the bearer service.

SIM : GSM 11.11 STK : GSM 11.14 Java Card 2.1 API : GSM 03.19 SIM OTA Management : GSM 03.48

In Nov.1999, ETSI adopted Java Card technology for inclusion in SIM Toolkit

Java Card Technology & SIM Application Toolkit

Interoperability Issue

International use of e-purse is not possible, and international debit and credit transactions still reply on magnetic-stripe

=> inconvenience to customers in EU where Euro is the common currency

EMV Integrated Circuit Card Specifications for Payment Systems define smart card-based debit and credit transactions. But, topic of e-purse is not considered in this working group. A group of organizations led by Europay, Visa, and German Zentraler Kreditausschup has therefore published the Common Electronic Purse Specifications (CEPS).

Existence of standardization working groups and a standard do not always ensure the interoperability of products of different vendors, because not every implementation detail is covered in the standard.

SIM Alliance has been making efforts on smart cards interoperability for a few years without much success.

Java Card Technology : Visa Open Platform

Supported by financial institutions, service providers, mobile operators, and hardware manufacturers to develop standardized solutions for secure mobile electronic commerce and an Open Platform chip that will allow financial institutions to dynamically download Visa payment applications to a mobile phone on the basis of Java Card technology.

Goals of Visa Open Platform

- Interoperability of cards, terminals, OS, SW products

and bank office support systems from different vendors

- Secure support of multiple applications coexisting on

the card in such as way that each application provider is

assigned a separate security domain

- Strongest commercially feasible security, which will be

evaluated using the Common Criteria

- Support of existing standards such as EMV and ISO

7816 so that the card can be used in the existing

ISO/EMV-compliant terminals.

Java Card Technology : Visa Open Platform

Technology in Mobile Payment : Dual Slot

Usage : “Payment CB sur mobile”

- Since 12.2000. France Telecom, SFR and Bouygues Telecom offer the service. This is a bank-centric payment scheme which is an ‘inter-operator’ system.

- Virtual POS and mail order with debit/credit card payment

1. Buyer orders goods from CB’s partner merchants by entering mobile phone number (typing it on the e-merchant web site in the card of internet or saying it over the mobile phone to the catalog sales merchant

2. Buyer receives SMS with purchase details

3. Buyers insert payment card and type the card’s PIN code

4. When the transaction is authorized by the bank, a confirmation message is sent by the bank via SMS to the customer’s mobile phone

5. The merchant receives payment confirmation.

- As of 2001, 500,000 dual slot phones were sold and 80 merchants signed up - Average 80,000 transactions per month - Use SIM Toolkit Card of 32K

Problems :1. Bigger handset due to a separate card reader in the handset2. Slot is easily damaged 3. Low service usage due to security concerns of customers and little merchants. Transactions occur at only 10 merchants out of the 80.

Technology in Mobile Payment : Dual Slot

Technology in Mobile Payment :Dual Chip

Mobey Forum, GMCIG, Mobile Payment Forum, MoSign

SIM and additional IC chip with WIM module for payment applications

SIM – Operator’s domain (issuer)IC chip with WIM – Bank’s domain (issuer)

=>Favored by Banks. MoSign (www.mosign.org) works on standardization of mobile signature on a separate IC chip for payment applications.

Mobile Payment in Finland (EMPS)

Nokia, Nordea Bank and Visa International started a mobile e-commerce pilot project in Helsinki in 10.2001 that tested and developed the use of mobile phones in everyday e-commerce.

150 consumers from the Helsinki metropolitan region were supplied with 150 specially manufactured mobile phones with which they can make payments in two Helsinki businesses, the Kinopalatsi movie theatre and the ruoka.net electronic grocery store.

The pilot uses new dual chip technology, which means that the mobile phone includes both a SIM card and a separate chip card issued by Nordea. The latter contains a Wireless Identity Module (WIM) function enabling mobile Visa Electron payments.

The test results handed over to current forums on the development of European and global standards for e-commerce, including the Mobey Forum and the MET consortium.

Not supported by mobile operators

Mobile Payment in Finland (EMPS)

Technology in Mobile Payment : One-chip

SIM + IC chip for payment applications in One-chip - Favored by mobile operators if the chip is issued by mobile operators - Debate over who should be the issuer Supported by mobile operators. mSing (www.msign.org) works on standardization of mobile signature on the SIM card Usage : Mobilix Open Mobile (Denmark) - Since 2H of 2001 by Orange and PBS (a financial institution)- SIM Toolkit-based SIM card using 3DES- Reload pre-paid airtime over the air- More of mobile wallet or e-purse on the mobile

Usage : Radiolinja (Finland) - Launched in March, 2002 - SIM + WIM module, owned by the mobile operator. Raiolinja acts also as CA. - WAP service (over WAP 1.2.1. browser)Two encrypted keys; - 1 : for logging on to the service - 2 : for electronic signature- Both keys include specific PIN codes to log on the service and sign the payment transaction - Mobile phone is equipped with mobile wallet - Currently available commercial service.- Visa (Luottokunta, a Finnish credit institution) participates

Technology in Mobile Payment : One-chip

Technology in Mobile Payment : Non Smart Card-based

Phone Bill : Sonera – ticketing, parking, vending machine, sky lift Vodafone – m-pay Mobile Wallet Germany – Paybox, OnPay, Street Cash, Genion M-PaymentSpain – MovilPay

Vodafone m-pay bill

Micro Payment Up to 5 pounds

Vodafone m-pay bill

Other Mobile Payments in Europe

Movilpago (Spain)

- Telefonica, BBVA joint-venture

- Real and virtual POS. Purchases are billed on credit/debit cards or prepaid phone account

- Cardholder verification and authentication through the SIM card.

Telia Payit (Sweden)

- Telia, EHPT

- Virtual POS. Digital goods are billed either on phonebill or a pre-paid account. Targets mainly micro payment.

Other Mobile Payments in Europe

Paybox (Germany)

- Deutsche Bank

- Real and virtual POS. Direct debit payments.

- Card holder authentication through the SIM card.

Omnipay-Visa Mobile (Italy)

- A trial in progress by partnership between Omnitel-Vodafone and Deutsche Bank in Italy

- Subscribers can pay for account top-ups and other services using their mobile handset and a ‘telecode’

- Visa cardholders verify the transaction using their mobile phone by entering a ‘telecode’ in order to confirm the transaction.

- Telecode is similar to a PIN but designed for use with mobile transactions only.

Other Mobile Payments in Europe

Visa Movil (Spain)

- A pilot that links a cardholder’s mobile telephone number and Visa card number so that the phone becomes a personal authentication device.

- Partnership between Visa and 8 financial institutions

- 1. Cardholder registers for the service

- 2. Cardholder is given a personal telecode number, which can be used instead of a signature or PIN in remote and face-to-face transactions.

- 3. Cardholder simply give the phone number to the merchant instead of the Visa card number.

Other Mobile Payments in Europe

KPN Mobile’s pilot project (Netherlands) - Participants :

KPN Mobile / Nokia / Interpay, financial transaction processor in NL / SWIM vendors / Merchants /

Customers (120) - Used technology

* PKI-enabled SWIM (Secure Wireless Identity Module) * SET (Secure Electronic Transaction), international bank standard for electronic transactions* WAP 1.2

- Pilot period : 05.2002 – 07.2002 - Feedback : The use of service is too complicated and too

many steps, especially signing process- Conclusion : Climate not good for introduction as

technology push

Mobile Banking in Europe

Mobile banking data services have been in commercial existence since 1997. At the end of 1999 there were already more than 30 mobile banking (SMS and WAP) services in place world-wide.

Due to security concerns and technological limitations, many mobile banking services are still limited to providing account info via SMS or WAP.

Digital signatures can be implemented by using a smart card (SIM or a separate card) as the cryptographic token.

Mobile Banking : Case

Nordea Bank’s WAP-based service in Finland.

- All customers of the bank can get bank account balance info, pay bills, buy and sell stocks and other financial investments, and shop with their mobile phones.

- Nordea Bank has its own WAP gateway and the users dial-up directly to the bank=> access to the mobile banking service is operator-independent.

Mobile Banking : Case

MTN (South Africa)’s mobile banking service

- Available over both WAP and SAT+2 handsets- Cooperation with ABSA, First National Bank, and Standard

Bank.- Balance inquiry, transaction history, inter-account transfer,

payment to 3rd parties.- A new SIM card pre-loaded with SmartTrust’s WIB is

required, after which users are able to activate a new banking menu-option. The update and user account can then be carried out automatically over-the-air by SmartTrust’s OTA platform. When the bank decides to add new services, customers are notified the next time they use a banking service and can request updates for their banking menus.

- SSL and 3DES encryption are used.

Mobile Banking : Case

O2 (Netherlands)

- Partners : Postbank (ING), Genie (WAP, WEB portal), O2 - 32K Java SWIM card- Private key (stored on WIM) (generated via a secret key)

(acts as a“finger print” for the SIM). Secret key owned by bank! Public key distributed to other parties

- Launch in summer 2001 with 500,000 customer base- Result :

Impressive usage of m-banking41% use Mobile BankingOver 2,100,000 account balance requests madeOver 100,000 Mobile Payments made

Mobile Banking : Case

Sonofon (Denmark)

- Uses SIM browser (SmartTrust WIB) as the basis for a mobile banking application. The banking application uses the WIB to connect Sonofon’s sytem with Sydbank, a bank computer center for 20 banks in Denmark.

- Customers can visit Sonofon’s website and download OTA new services onto the SIM.

- Sonofon’s database looks up the type of SIM that an individual user has and checks with Sonofo’s billing system to validate what services are available for the customer. Then, the mobile portal displays the current configuration of services that are available to that user.

Components of Sonofon’s Mobile Banking

Customer

SIM

GSMSonofon

with WIB

SMS

SMSC

TCP/IP

SmartTrust Wireless Internet Gateway

Internet

TCP/IP

Internet Server

Customer’s Bank

GSM SMS Security

Transport Security (GSM 03.48)

End-to-end Security (3DES)

Source: Mobile Application Development with SMS and the SIM Toolkit, S.Guthery & M.Cronin, 2002

Bank vs. Mobile Operators?

Arm-Twisting over the service, security and customers who may have different operators’ mobile subscription

Good example of cooperation : Barclay card and mmO2 service in the UK

Example of Bank-control : Bank holds control of the access to their own services : Nordea Bank

Example of Operator-control : Smaller banks may find it useful to be placed on an operator’s portal or even co-brand services with the mobile operator, and let the operator handle the hosting of the mobile data access and security solutions, thus being able to concentrate on their own core business : Sonofon in Denmark and Danish banks

Pending Issues in Mobile Payment

PKI-enabled SIM cards yet to be distributed widely

Burden of distributing new SIM cards

Interoperability of SIM, Java Card, and OTA platform

• deploy any applet to any card OTA

• update any applet on any card OTA

• source cards from multiple suppliers

• develop applets with different sources

Power struggle between Banks and Operators

Define the operators’ role; CA/RA? To produce own certificate or buy it?

Clear business model

Non-existence of proven Smart Card Applications Management System on the mobile netowrk. SCMS is new even to the financial industry and never tested on the mobile network

Thank You

Presentation By:-Deepak Pareek