SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud...

24
INSIDE PAYMENTS EXPLORING Blockchain 3.0 HOW IoT WILL IMPACT Payments and Commerce FIGHTING FRAUD in the Real-Time World SUMMER 2018

Transcript of SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud...

Page 1: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

INSIDE PAYMENTS

EXPLORING Blockchain 3.0

HOW IoT WILL IMPACT

Payments and

Commerce

FIGHTING FRAUD in the Real-Time World

SUMMER 2018

Page 2: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

FROM THE DESK OF

2 INSIDE PAYMENTS

avv

INSIDE PAYMENTSSUMMER 2018

5

10

13

15

20

BLOCKCHAIN 3.0 THE FUTURE OF PAYMENTS?

STRATEGIES FOR FIGHTING FRAUD IN THE REAL-TIME WORLD

DYNAMIC CURRENCY CONVERSION

IoT PAYMENTS AND COMMERCE

SUMMARY: COST AND VALUE IN BANKS – A MODEL FIT FOR THE DIGITAL ERA?

CONTENTS

2 INSIDE PAYMENTS

Page 3: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 3

Page 4: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

FROM THE DESK OF

4 INSIDE PAYMENTS

LET’S GO INSIDE PAYMENTS

Welcome to the second edition of ACI’s Inside Payments magazine. This quarterly publication is intended to share insights from ACI on all aspects of payments innovation, disruption and regulatory change that is fundamentally shifting the way businesses and consumers alike will transfer “value” in the future.

Now that PSD2 and soon GDPR are with us in earnest, it is more important than ever to ensure that the financial sector can continue to grow while regulatory changes are absorbed and put into practice. EU regulators now have their sights set on revising the Capital Requirements Directive (V) and Capital Requirements Regulation (II), which could be an opportunity to reconsider the role of expenses on digital elements in the calculation of capital ratios.

Calls for structural change in the European banking sector come at a time when U.S. counterparts may see an easing of fiscal rules and capital requirements. With the added pressures of regulatory burden brought about by PSD2, Capital Requirements, GDPR, etc., innovation in the EU could slow, as the easy gains have already been made and global competitiveness has been hampered. Competitiveness of EU banks needs to be strengthened with the right incentives provided for developing the most up-to-date services to customers.

In this edition, we focus on the debate around “cost and value of banks” (courtesy of research carried out by the European Credit Research Institute), the role that the Internet of Things will play in enabling payments and commerce of devices, ongoing issues of tackling fraud and how new developments in blockchain will finally start to match the hype surrounding the nascent technology.

As always, we welcome your feedback and comments to help stimulate debate and provide ideas for future topics for the magazine.

ACI Worldwide

“NOW THAT PSD2 AND SOON GDPR ARE WITH US IN EARNEST, IT IS MORE IMPORTANT THAN EVER TO ENSURE THAT THE FINANCIAL SECTOR CAN CONTINUE TO GROW WHILE REGULATORY CHANGES ARE ABSORBED AND PUT INTO PRACTICE.”

Page 5: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 5

Cash may be king for now, but its long reign may be coming to an end,

especially in some Nordic countries which are actively pursuing the utopia of a

cashless society. The millennial generation today is more comfortable reaching

for a contactless card or mobile payments app than a purse. New research from

the Bank for International Settlements (BIS) shows non-cash payments have

roughly doubled in size, as a share of GDP, since the turn of the century. These

trends have sparked a discussion about whether central banks should issue

their own digital currency.

BLOCKCHAIN 3.0 THE FUTURE OF PAYMENTS?

Today, bank notes and coins are the only way consumers

can access central bank money. A bank promises to

exchange that money for cash when a consumer uses

an ATM. But when paying bills online or swiping a debit

card, a consumer is actually using commercial (digital)

bank money. Under the current system, only financial

institutions have direct access to digital central bank

money via accounts at their national central bank.

However, a consumer-oriented Central Bank Digital

Currency (CBDC) would extend that access to everyone.

Although this might not seem like a big step to digitally

savvy consumers, it could have far-reaching ramifications

for the role of money, the financial system and the

economy. For example, a CBDC for all would challenge

the current model of banks taking customer deposits and

using that money to fund the lending that helps drive the

economy. The consequences for bank business models

and financial stability would be seismic in proportions.

That said, existing payment arrangements are already

digital and increasingly convenient, instantaneous and

available 24/7, and despite the growing popularity

of electronic payments, demand of bank notes is still

growing in some countries. CBDCs for consumers and

businesses may not be necessary or even desirable.

However, tokenized forms of digital central bank

money could potentially help streamline many of the

cumbersome clearing and settlement processes that

are currently needed to complete securities and foreign

exchange trades.

ENTER THE BLOCKCHAINEver since Bitcoin was introduced in late 2008, the

blockchain code that underpins it has been a source

of hope, fear and grandiose proclamations. It has been

Bitcoin’s meteoric rise in popularity that gave rise to the

idea of blockchain as a means of building consensus

between financial institutions.

In the context of capital markets, blockchain distributed

ledgers enable open-source, decentralized, replicated,

shared and cryptographically secure operations that are

validated by mass collaboration and can be applied to

many financial instruments. Unlike traditional ledgers

in banks, which use central authorities to manage

Page 6: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

6 INSIDE PAYMENTS

transactions, distributed ledgers built on blockchains

validate transactions through a protocol managed by

the user community via a consensus mechanism. This

decentralized approach changes the power dynamic

within the financial system, shifting power from

institutions to users.

Asset transfers can be facilitated without third-party

intermediaries through the use of “smart contracts”

— programmed code that replicates conventional

commercial agreements by digitizing business

transactions between parties and validating them

through a blockchain. Practically speaking, this means

blockchain-enabled networks have the potential to

increase trading efficiency, improve regulatory control

and eliminate unnecessary intermediaries such as banks,

brokers and complex clearance processes.

In practice, incumbent financial institutions are already

investing in building permissioned blockchains (digitally

distributed ledgers where authorized users can record,

process and verify transactions) to streamline their

own operations and costs. Financial institutions see

an opportunity to tackle their own complexities using

blockchain technology to help reduce the clutter and

cost of numerous complex processes. While broad-based

adoption could still take as long as a decade, exchanges,

custodian and central depositories should see changes

come quicker in the next 12 to 18 months.

The practical applications of the blockchain will take

time, as well as regulatory understanding and long-term

industry adoption. However, clients and investors could

benefit significantly, as would the financial industry itself,

via streamlined and less costly operations, as well as

better products and services for customers.

Much of the development work to date has occurred

through consortiums; banks are now engaged in a broad

range of proofs of concept. As successful ideas emerge,

expect banks and related intermediaries to agree on

common standards, with regulatory support, to share the

expense of building a blockchain, whether it leverages

their existing infrastructure or not. Two such partnerships,

the Hyperledger Project and the R3 Blockchain

Consortium, each have proofs of concept underway,

attracting participation from across tech and financial

institutions.

For FinTech, the two most promising short-term use

cases remain payments and trade finance. Larger banks,

including correspondent banks, will increasingly be

interested in the blockchain payment systems because

they are tempted by the advantages blockchain may

bring in terms of real-time processing, lower-risk profiles,

lower costs and transparency. Also, the insurance sector

is expected to emerge as a “hot” area for blockchain

technology. Claims processing and complex multi-party

processes like subrogation (the transfer of any associated

rights and duties in the event of an insurance claim) will

show the business value of blockchain-based automation.

DESPITE THE PROMISE OF BLOCKCHAIN, CHALLENGES TO ADOPTION PERSIST Plenty of hurdles stand between financial institutions and

widespread blockchain adoption:

Cost/benefit: Blockchains could speed financial

transactions, but faster isn’t always more profitable.

Given the high cost of building a blockchain system,

any proposed use must have a positive return on

invested capital. The question is, can incumbents achieve

increased security, speed, transparency and efficiency

using enhancements, blockchain or otherwise, to existing

infrastructure.

Cost mutualization: If a shared blockchain were to work

like an interoperable industry utility, banks would need

to share the cost of building the infrastructure. Making

this equitable could be challenging, given banks’ wide

variation in size and need for customization.

SWIFT’s Global Payments Innovation (gpi) initiative

(a proof of concept based on Hyperledger Fabric

technology) has been able to show that blockchain

provides real-time visibility to both the account owner

and its service provider on the available and forecasted

liquidity on the Nostro accounts, and supports payments

reconciliation and investigations by providing an enriched

data model based on ISO 20022. However, the need to

develop unique value propositions in response to the

different levels of sophistication, automation and past

investments of banks adds significant complexities. In

Page 7: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 7

particular, integration with legacy back-office applications

and co-existence with existing processes.

Likewise, finding a one-size-fits-all application that can be

applied equally across all SWIFT member banks will be

no easy task. For banks that have already invested heavily

in automating back-office reconciliations, the appetite for

disruptive investment that pulls along the herd may be

lacking.

Evolving standards: The lack of business standards as

well as formats for shared data, business processes,

roles and responsibilities to address complex financial

transactions will hinder adoption in the near term.

Blockchain is not only a technology play, it is also a

change of business process and business logic, which

involves multiple parties.

Scalability: Any blockchain must scale effectively from

proof of concept to succeed, a key reason why most

new blockchain proposals are looking at a range of

rules, including ones that restrict users or centralize

all, or part, of the blockchain. Consensus mechanisms

based on “proof-of-work” concepts (like the Bitcoin

blockchain) are energy wasting and environmentally

unsustainable; alternative consensus mechanisms (e.g.,

“proof-of-state (PoS)” or “proof-of-authority”) are less

energy-demanding and more desirable. Without these,

higher energy costs could eliminate the benefits from

lower personnel costs.

Governance: A shared blockchain would need a

governing body to decide who gets access to the

blockchain and manages its maintenance.

Regulation: The familiar challenges of regulating digital

identities and cross-border standards would have to be

addressed during the build-out. Banks will also need to

wait for regulatory approval for collecting, storing and

sharing customer data. Cross-border trades will prove

particularly challenging, as they will require approval

between regulators from different countries, few of

which are aligned on blockchain technology.

Legal risks: Users on a financial services blockchain

must be identifiable entities and regulators would still

need to enforce “know your customer” and anti-money

laundering rules, regardless of the software protocol.

How legal authorities treat automated contracts

and digital assets transferred through blockchain

technology is still an evolving area.

Simplicity: To deliver better efficiency and interface

with other parts of the tech food chain seamlessly,

an industry blockchain would have to be built simply

and elegantly so that all parties can leverage and

understand it.

These roadblocks, while not insurmountable, show

why blockchain technology most likely won’t disrupt

the financial industry as quickly or as completely as

some expect. While financial institutions are investing

in research now, adoption will be iterative, asset-class

by asset-class over the next five to 10 years. Even as

the industry begins to adopt blockchain technology,

institutions are likely to incorporate the new technology

into existing systems with workarounds, instead of

completely scrapping their current infrastructures for a

brave new blockchain world.

EVER SINCE BITCOIN

WAS INTRODUCED

IN LATE 2008, THE

BLOCKCHAIN CODE

THAT UNDERPINS IT

HAS BEEN A SOURCE

OF HOPE, FEAR

AND GRANDIOSE

PROCLAMATIONS.

Page 8: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

8 INSIDE PAYMENTS

A HOLISTIC VIEW OF BLOCKCHAIN SECURITYBlockchain brings together a combination of features,

not only traditional endpoint protection, but a holistic

approach that includes user identity security, transaction

and communication infrastructure security, business

security through transparency and audit, and security

from malicious insiders, compromised nodes or server

failure. These are all addressable issues within blockchains

because security and privacy are central to the protocol,

and not an external consideration. Where individuals,

businesses and governments are constantly locked

in a battle against bugs, fraud and malicious actors,

blockchains propose an alternative. The paradigm shift

blockchains represent can offer true data integrity,

advanced digital identity systems and a new way for

business to offer transparency for audit alongside access

for third parties.

Because blockchain allows the incorporation of smart

contracts into everyday transactions, adding speedy

and secure automatic verification and processing of

pre-defined agreements, we can expect new ecosystems

will develop as integration platforms between existing

industries. There are seemingly infinite use cases where

blockchain-based smart contracts can be applied by

creating blockchain networks to manage identities, keep

records and secure digital relationships.

NEW APPROACHES ON SCALABILITY AND PERFORMANCE ISSUESOne of the key challenges of existing blockchain

technology is scale and performance. Current blockchain

frameworks are still lagging behind when compared

to transaction speeds offered by traditional payment

networks. In its current state, there is no such thing as a

scalable public blockchain. Private chains, on the other

hand, seem to achieve great success in this regard.

Right now, the state of all blockchain protocols

involves every node storing all states and processing all

transactions. While this provides a high level of security, it

also severely limits scalability. Over the years, there have

been many repeated attempts to scale this mechanism

so that only a small subset of nodes would be required

to verify each transaction. To be a success, there must be

enough nodes to verify each transaction so that security

is not compromised, but few enough so that the system

can process many transactions in parallel.

The Lightning Network is one of the proposed solutions

to Bitcoin’s scalability problem and comes with the

promise of allowing instant payments while being able

to process millions of transactions per second. By

transacting and settling off-blockchain, the Lightning

Network will allow for exceptionally low fees, which

could enable emerging use cases such as instant

micropayments.

Ethereum, the second largest cryptocurrency by market

cap, has its own scaling option and many other alt-coins

claim to be faster with lower transaction fees than

Bitcoin. There is no silver bullet to solving this scalability

issue, and it is likely that a combination of approaches

will be used to match, or surpass, what is possible today

through traditional payment channels.

If Lightning is successful, it could be the biggest change

to the world of finance we have witnessed this decade.

The update would completely transform Bitcoin’s

blockchain, making it possible to compete with currently

established payment processors, such as Visa and

PayPal. It could even reintroduce Bitcoin as a usable daily

currency that puts it on track to replace fiat in the future.

WHAT IF WE GOT RID OF THE BLOCKS? BLOCKCHAIN 3.0Bitcoin’s rise in popularity resulted in it being categorized

as Blockchain 1.0. As Ethereum and other alt-coins

emerged as decentralized platforms for applications, they

were loosely labeled as Blockchain 2.0. The next evolution

of blockchain may see the ditching of blocks in favor of

“side chains” or the removal of blocks altogether.

Bitcoin has always been inefficient due to the

proof-of-work (PoW) system. Blocks can’t be created

simultaneously. The linked storage structure allows for

only one chain on the whole network. All the transactions

occurring around the same time are kept in the same

block. Miners then compete for the block validation. One

single block is created about every 10 minutes.

Direct Acyclic Graph, or DAG, is one possible alternative.

DAG is a well-known data structure in computer

science and is often applied to problems related to

data processing, scheduling, finding the best route

in navigation and data compression. The DAG model

works differently than a blockchain. Whereas a common

blockchain requires miners to maintain blocks, a DAG

wouldn’t need either PoW or blocks. Instead, DAG

transactions are linked from one to another, meaning

one transaction confirms the next and so on. The whole

process is much faster than those of blockchains based

on PoW or PoS, as there is no need for miners on a DAG

network. For users, this means that transactions go

through almost instantly.

Although DAG is an improvement on existing blockchain

technology, its development is still in its infancy and there

are still technical hurdles that need to be overcome to

offer the tech commercially.

CONCLUSIONIt is almost guaranteed that blockchain or one of its

derivatives will become a vital underlying technology

for the payments industry in the near future. As

regulatory understanding matures and the tech moves

beyond the pilot phase, we should expect to see it

power micropayments for the Internet of Things (IoT),

and disrupt other systems that rely on intermediaries,

including property, contracts and identity management.

Page 9: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 9

BLOCKCHAIN 3.0

Cost/benefit — is it more profitable

Maturing regulations

Business standards still evolving

IoT micropayments

Governance, regulation, legal risks

Contracts

Legal

Identity management

Scalability

Removal of intermediaries

INSURANCE ADOPTION• Claims processing• Subrogation• Automation

DAG

CENTRAL BANK DIGITAL CURRENCY

DIGITAL COIN

LIGHTNING NETWORK

RETAIL BANK

BLOCKCHAIN• Faster• Secure• Smart contact• Micropayments

ADOPTION CONSTANTS

WHY BLOCKCHAIN WILL SUCCEED

SCALABILITY NEW APPROACHES

BANK• Lower operational costs• Faster payments• Reduce fraud

Page 10: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

10 INSIDE PAYMENTS

STRATEGIES FOR FIGHTING FRAUD IN THE REAL-TIME WORLD

As a form of cybercrime, card payments fraud is one of

the priority crime areas of the European law enforcement

agency Europol. According to the organization, in 2012

the total value of transactions made by debit and credit

cards issued within the Single Euro Payments Area (SEPA)

amounted to ¤3.5 trillion. In the same period, criminals

acquired ¤1.33 billion [2013: 1.44 billion] from payments

card fraud. This represents 38 cents lost to fraud for

every ¤1,000 worth of transactions. Credit and debit card

payment and online fraud are highly profitable criminal

activities that are increasingly dominated by card-not-

present (CNP) transactions (such as online purchases).

The total value of fraudulent transactions conducted

using cards issued within SEPA and acquired worldwide

amounted to ¤1.44 billion in 2013, which represented

an increase of 8% from 2012 according to the European

Central Bank’s Fourth Report on Card Fraud. As a share

of the total value of transactions, fraud rose by 0.001

percentage point to 0.039% in 2013, up from 0.038% in

2012. However, as a share of total transactions, fraud is

still below the level observed in 2009. In 2013, 66% of the

value of fraud resulted from CNP payments, 20% from

transactions at point-of-sale terminals and 14% from

transactions at automated teller machines (ATMs).

The European Payments Council’s (EPC’s) December

2017 Payment Threats and Fraud Trends Report stated

that the organization and sophistication of recent

cyber attacks demonstrate greater professionalism

of cybercriminals. The number of DDOS attacks were

continuing and frequently attacking the financial sector.

“Social engineering attacks and phishing attempts are

still increasing, and they remain instrumental often in

combination with malware, with a shift from customers,

retailers, SMEs to company executives, employees

(through ‘CEO fraud’), financial institutions and payment

infrastructures,” cites the report.

THE IMPACT OF THE PAYMENT SERVICES DIRECTIVE: OPENING PANDORA’S BOX? The revised Payments Services Directive (PSD2),

which came into effect on January 13, 2018, will have a

significant impact on Europe’s payments market. It ushers

in a new era of competition, and with it, new sources of

fraud as the payments value chain is opened. The rules

of the security game are changing fundamentally with

PSD2, the General Data Protection Regulation and EU

Network and Information Security Directive. The aim

of these regulatory initiatives is to create standards for

security. In the past, banks’ fraud prevention systems

tended to rely on the fact that customers interacted

with them directly; a bank possessed all the information

needed to establish whether a transaction was

fraudulent. Online purchases were usually processed

via an intermediary, such as PayPal, which obtained the

funds from the consumer’s bank account or nominated

credit card.

In its regulatory technical standards (RTS) for secure

customer authentication (SCA) in PSD2, which were

issued in November 2017, the European Commission

(EC) stated that electronic payment services offered

should be carried out in a secure manner, “adopting

technologies able to guarantee the safe authentication of

the user and to reduce, to the maximum extent possible,

Page 11: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 11

the risk of fraud”. The authentication procedure should

include, in general, transaction monitoring mechanisms

to detect attempts to use a payments service user’s

personalized security credentials that were lost, stolen

or misappropriated, and should also ensure that the

payments service user is the legitimate user and

therefore is giving consent for the transfer of funds and

access to its account information through a normal use

of the personalized security credentials. Throughout all

the phases of an authentication, PSPs are required to

ensure the confidentiality, authenticity and integrity of

the amount of the transaction and the payee, and the

information displayed to the payer.

Another issue the EC addressed in the RTS was the

changing nature of fraud methods. It suggests that SCA

requirements should allow for “innovation in the technical

solutions addressing the emergence of new threats to

the security of electronic payments”. To ensure that the

requirements to be laid down are effectively implemented

on a continuous basis, it is also appropriate to require

that the security measures are documented, periodically

tested, evaluated and audited by auditors with expertise

in IT security and payments, and be operationally

independent.

Against this background, providing a secure

infrastructure to third-party providers (TPPs) will be a

challenge for banks. To prevent fraud in real time, most

banks use packaged software whose fraud scoring

models are trained over a period of 18 to 24 months.

However, after PSD2 enables new transactions through

TPPs, it will take around two years for the banks to

generate scores reflecting the transaction risk. In the

interim, banks’ fraud analytics departments must perform

proactive transaction monitoring and develop their own

rules to prevent fraudulent transactions. Under PSD2,

banks can block third-party access to accounts if they

have the evidence that the activity is unauthorized or

fraudulent. This is a capability they may well need to

exercise in the PSD2 environment.

KYC AND AML OBLIGATIONSIn addition to a PSP’s obligation to prevent fraudulent

transactions, a growing requirement is to ensure

transactions are not connected with money laundering,

terrorist financing or those subject to sanctions. This is

a serious concern, as the fines for violating anti-money

laundering (AML), know your customer (KYC) or

sanctions rules are very high and during the past few

years have totaled billions of dollars. For example, in late

December 2017, U.S. bank Citi was fined $70 million by

the U.S. Office of the Comptroller of the Currency for

shortcomings in its AML policies.

The European Union’s fourth AML Directive, which

came into effect in mid-2017, requires ongoing KYC

due diligence together with continuous transaction

monitoring. The Directive applies to a range of

Page 12: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

12 INSIDE PAYMENTS

businesses including banks, credit institutions, other

financial institutions and businesses that make or

receive cash payments for goods worth at least

¤10,000 — irrespective of whether payment is made in

a single or series of transactions. The Directive covers

risk assessment and the corresponding risk approach,

creation of national central registers of beneficial owners

and waivers on customer due diligence for certain

eMoney products.

Accurate customer identification and authentication

is crucial in a regulatory environment where violations

of sanctions and AML and KYC rules can attract

multi-million-pound fines and damage reputations.

Financial institutions are typically responsible for

performing initial KYC screening whenever individuals,

legal entities or correspondent banks open accounts

or execute high-risk transactions. KYC is a broad term

and includes the identification of the client profile and

an understanding of their business. As sanctions are

increasingly imposed, financial institutions must not only

know their customer but also know their customer’s

customers.

THE ROLE OF TECHNOLOGY IN TACKLING PAYMENTS FRAUDIn tackling payments fraud, PSPs are increasingly turning

to technology. Artificial intelligence and big data analytics

to monitor and respond to fraud events without human

intervention are emerging as an important weapon in

the fight against fraud. Successful fraud prevention

is all about decision-making — accepting the good

transactions and denying the fraudulent ones — with

the best available real-time information. A winning fraud

prevention solution allows revenues to grow and costs to

shrink, ideally giving PSPs the ability to focus upon what

they do best.

Westpac New Zealand believes real-time fraud detection

will become a competitive differentiator in the future.

The bank uses AI and machine learning to pattern

match transactions. Long term, it hopes its customer will

become “part of the intelligence” to identify transactions

that have been flagged as fraudulent, says Dawie Olivier,

Chief Information Officer at the bank1. Olivier says with

real-time payments, the opportunity for fraud will be

more frequent while the chances of recovering funds

will be lower, given that real-time payments will also be

settled in real time.

Another approach is risk-based authentication (RBA) to

detect the risk profile of transaction banks and retailers.

Using the RBA and analytics processes, banks can create

a threat matrix of fraud profiles to triangulate the threat

instances to their origin and proactively block fraudulent

traffic. Behavioral analytics, AI, machine learning and a

comprehensive threat matrix can help to continuously

monitor the payments network and provide threat

intelligence. Banks can undertake various activities such

as continuously checking all systems for possible threats,

observing markets, scenario simulation, examination of

previous attacks, monitoring activities and applications,

and establishing a payments control center to

permanently monitor payments and identify exceptional

situations.

Financial institutions have also realized that tackling such

huge responsibilities as KYC, AML and fighting payments

fraud on their own doesn’t make sense. Moreover,

fraud prevention requires more than technology alone.

An important aspect to mitigate the risks related

to payments is the sharing of fraud intelligence and

information on incidents among PSPs.

There are obstacles to such an approach elsewhere in

Europe, Olivier pointed out. For example, legislation can

prove a hindrance to information sharing, particularly

those related to privacy issues. Additionally, many

European countries view anti-cartel legislation as a

barrier to the sharing of information or to improved

collaboration.

The tougher regulatory environment and the increasing

sophistication of fraudsters mean PSPs face a

considerable challenge in fighting payments fraud. But

the technologies and techniques exist to create effective

fraud prevention systems that are far more advanced

than the legacy practices of the past.

For more on what Westpac New Zealand has done with real-time fraud detection, visit:

1

https://www.aciworldwide.com/insights/ videos/2017/october/westpac-new-zealand- uses-artificial-intelligence-machine-learning-- pattern-matching-features-of-acis

Page 13: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 13

However, since 2006, dynamic currency conversion

(DCC) has allowed consumers to pay in their own

currency with the conversion rate shown on the terminal

at the time of the transaction. DCC typically costs

between 4% and 6% of the charged amount, and has

proved popular with merchants because it enables

them to profit from the foreign exchange conversion

that occurs during the payments process for a foreign

denominated credit card. Credit card acquirers and

payment gateways will also take a profit on the foreign

exchange conversion that occurs during the payments

process for foreign denominated credit cards when

DCC is used. DCC revenue also allows for the offset of

increasing international interchange fees.

Currency conversion fees may still be charged, but

rather than having to estimate how much money they

are paying, consumers can see the exact amount in

their local currency, consequently reducing the amount

of chargeback disputes experienced by the merchant.

Customer satisfaction is also generally higher when

customers can see prices in their own currency without

having to mentally convert the amount for themselves.

According to the latest UNWTO World Tourism Barometer, international tourist arrivals grew by 7%

in 2017 to reach a total of 1,322 million1. This strong

momentum is expected to continue in 2018 at a rate

of 4% to 5%. Proponents of DCC point out that it benefits acquiring financial institutions, merchants and

cardholders alike. For merchants this can be a noticeably

reduced number of potential disputes brought by

consumers. For financial institutions, the benefits of

incorporating DCC revolve around improving merchant

and treasury services. For consumers, DCC can provide

increased convenience and confidence with each

transaction outside of their home country.

However, DCC has it detractors and some would argue

that the conversion rates used and additional fees still

amount to an unacceptable surcharge that consumers

must bear. The actual size of the foreign exchange margin

added using DCC varies depending on the DCC operator,

card acquirer or payments gateway and merchant.

This margin is in addition to any charges levied by the

customer’s bank or credit card company for a foreign

purchase. In most cases, customers are charged more

DYNAMIC CURRENCY CONVERSION

In the not too distant past, traveling to a foreign country for work or for

pleasure was always fraught with the uncertainty that the actual cost of the

credit card purchases would only be determined when the monthly statement

arrived through the post. Furthermore, the actual currency conversion rate

applied and any associated fees could only be discerned after the transaction

had cleared and settlement completed.

using DCC than they would have been if they had simply

paid in the foreign currency.

The European Consumer Organization (BEUC)2, a strong

critic of DCC, has called for an outright ban and has

recommended that the issue be tackled in the upcoming

revision of Regulation 924/2009 on Cross-Border

Payment Fees, which is due early 2018.

Although best practices exist, they haven’t always been

followed and there are many examples of travelers

being exploited when paying for goods and services.

MasterCard and VISA have introduced rules to ensure

that the currency conversion process is transparent,

and to avoid cardholder confusion/dissatisfaction at

Page 14: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

14 INSIDE PAYMENTS

the checkout or upon receipt of their statement. The

main problem is that merchants may not fully explain

the extra costs to customers, who often may be better

off paying in the local currency and letting their card

companies work out the exchange rate. Details about the

exchange rate and fees must be disclosed on the receipt.

Unfortunately, consumers don’t tend to see the receipt

until after the transaction has been completed.

MasterCard introduced the Enhanced European DCC

Compliance Program in October 20123 to provide a more

consistent and structured DCC compliance approach,

while still supporting the ability of acquirers, merchants

and ATM providers to expand their business. The program

aims to improve the acquirer’s implementation of DCC,

ensuring that the applicable legislation and MasterCard

rules are respected at all times, and to improve the

cardholder’s experiences with DCC transactions.

Its principal activities are to:

• Enforce the DCC registration mandate

• Help to ensure DCC transactions are correctly

populated in the clearing message

• Help to ensure DCC services are properly deployed

and that they comply with the MasterCard rules and

standards

MasterCard has also introduced a Performance Rewards

Program in the SEPA region which is designed to

encourage and reward acquirers that are in compliance

with MasterCard DCC standards. VISA has similar best

practices that it issues to merchants.

DCC has been regulated since 2007 through the Payment

Service Directive 1 (PSD 1, article 49) and article 59 in

PSD 2, with an extension of the scope to include ATMs.

The basic principle of this legislation is that the consumer

should be informed about all charges, as well as the

exchange rate to be used. It is not defined how this

information must be provided, therefore the merchant

may just give this information orally.

It is important to understand the behavior of the

consumer when confronted with DCC for the first time.

Most consumers do not have the ability or the inclination

to look up the most favorable exchange rate when

standing in a queue waiting to pay for an item.

However, there are innovative ways that frequent

travelers can significantly reduce, if not entirely eliminate,

fees. Pre-paid cards and digital wallets in particular allow

consumers to load numerous currencies at inter-bank

exchange rates with very low or zero fees. Providers such

as Revolut, Paysera and TransferWise are early pioneers

in this space and other digital wallet providers and

challenger banks are expected to launch similar services

in the near future. Revolut has also provided a handy

guide to help explain and avoid fees in situations where

DCC is offered especially at ATMs4.

It is also important to note that some of the biggest

banking partnerships in December 2016 took place

between Ant Financial and four major European banks:

BNP Paribas in France, SIX Group in Switzerland, Barclays

in the U.K. and UniCredit in Italy. The deal allows Alipay

to be used within the banks’ merchant networks. Tencent

(owner of WeChat Pay) and UnionPay (provider of bank

card services and scheme owner in mainland China) have

reached similar arrangements globally.

These agreements are all centered around enabling as

many merchants as possible to accept China UnionPay

cards, WeChat Pay and Alipay digital wallets abroad,

so Chinese tourists can always depend on their favored

payments method no matter where they are. Part of

these efforts is undoubtedly to carve out a slice of the

massive amount of Chinese tourist spending every year,

estimated at $261.1 billion in 2016. However, arguably

just as important is ensuring that users never have to

abandon either their Chinese card or mobile payments

platform.

The 1% to 2% currency conversion fee is exempted

when using UnionPay cards abroad for purchasing or

withdrawing cash via the UnionPay network. UnionPay

will also convert the amount of local currency withdrawn

into that of RMB based on the market exchange rate,

and the issuing bank will deduct that amount from the

cardholder’s RMB account accordingly. Low commission

fees will be charged for ATM cash withdrawal with debit

card. Almost all bankcards with the UnionPay logo

commonly used in mainland China can now be accepted

in the U.S. without the need to apply for a new card.

It is also not beyond the realm of possibility that in

the next 15 to 20 years, a global cryptocurrency could

surpass traditional fiat payment methods and end the

debate around the validity of DCC once and for all.

Just as card surcharge fees were capped and then

completely removed by PSD2, the same could be

proposed for DCC. However, while customer satisfaction

with DCC remains high and digital alternatives exist,

regulators may want to wait to see how the market

responds over the short term to more DCC provisions

and post-PSD2 innovation from FinTechs to facilitate new

payment options.

Sources

1 UNWTO: http://media.unwto.org/press-release/2018-01-15/2017-international-tourism-results-highest-seven-years

2 Beuc - Dynamic Currency conversion – When paying aboard costs you more than it should

3 Mastercard Dynamic Currency Conversion Compliance Guide https://www.mastercard.com/elearning/dcc/docs/DCC%20Guide%2020.02.17%20EN.pdf

4 Revolut Blog: What you didn’t know about using ATMs abroad - https://blog.revolut.com/what-you-didnt-know-about-using-atms-abroad/

Page 15: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 15

Banks and financial services institutions can leverage the

IoT ecosystem to connect and act as trusted advisors

using information from the networks built around

the life of the customer — from cars, kitchen, coffee

maker, washing machine, refrigerator, medical records,

healthcare providers, doctors, retailers, weather, traffic

signals, web, social and so on. To do this, banks will need

to constantly re-design customer experiences to reflect

the lifestyle trends of customers and to stay ahead of

niche players offering innovative services. We have seen

a transformation in the way customers interact with a

bank, which include touch points ranging from telephone,

web and mobile to the now popular apps and wallets. IoT

is further set to accelerate this proliferation of customer

touch points requiring banks to take a fresh look at how

they maintain their customer connection.

IoT PAYMENTS AND COMMERCE Recent market analysis from Boston

Consulting Group1 predicts that by

2020, ¤250B ($267B) will be spent

on IoT technologies, products and

services. The greatest two sources of

revenue growth in the IoT market will

be from services and IoT applications

investment. Consequently, business

leaders are asking how IoT can help

their companies increase customer

satisfaction, improve quality, support

new business models (such as data-

driven services) and reduce costs.

Although industrial, manufacturing and logistics

applications of IoT are likely to be deployed first and in

greatest numbers, it is the advent of internet-enabled

cars that are likely to be the boon for IoT-based

commerce. Through new types of sensors, wireless

connectivity and on-board processing units, vehicles are

increasingly becoming connected, and many consumers

already expect this type of functionality in new vehicles.

Connected cars offer enhanced navigation, better

safety features and various creature comforts, including

advanced music and entertainment options, and features

are expected to mature over the next five to 10 years.

But, consider a scenario where a car acting as a wallet

can make payments on the go. A biometric identification

on the car’s ignition start button can help a fuel dispenser

instantly authenticate the driver and authorize the car for

refueling. Or when driving into a parking lot, the facility

can anticipate the car’s arrival, direct it to a vacant spot

and deduct payment as it leaves, all without the driver

having to stop or leave the car. What if the insurance

company can gain insight about the car’s health and the

driver behavior?

With IoT, the opportunities for multi-device banking will

continue to rise and bring in several new customer touch

point applications, increasing the need for more real-time

data integration and reconciliation within a bank’s

application landscape. Banks may be required to expose

many parts of banking functions as API services to these

customer touch point applications. This emphasizes

the significance for a common customer data hub and

service-oriented architecture. Banks will need these two

elements to form a strong foundation that can house and

Page 16: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

16 INSIDE PAYMENTS

serve a constantly evolving application landscape. While

these are key ingredients, getting the right design and

level of granularity will determine success.

It also drives home the point that banks will have

to gain a deep understanding of their customers to

derive maximum benefit from the new and emerging

opportunities. However, gaining insights that enable

real-time contextual customer engagement requires

dealing with a large amount of external unstructured

data and structured data from within the bank’s

application landscape. Early adopters who are ready with

infrastructure and intelligent strategies will be better

poised to gain a competitive advantage and win new

customers, especially the millennials.

IoT AND PAYMENTSIoT is already posing many interesting questions for the

payments industry. If a consumer can simply walk into a

shop, order what they want and pay on their connected

device, could this lead to the end of the checkout?

Using innovations such as BLE sensors and beacons,

stores will gain access to certain shopper information

upon a consumer’s entrance into a shop and to any

previously stored payments information, making it easy

for customers to simply walk in, select an item and walk

out with it.

There are some examples of how IoT is changing

consumer behavior already. In the U.S., several

restaurants offer self checkout at the table using tablets,

while in the U.K., supermarket chain Tesco is rolling out

self-scanning technology and “smart trollies” which add

up purchases as items are placed in the trolley. At the end

of the shopping process, the consumer simply uses an

automated self-checkout payments terminal. These early

examples show how the IoT is already making payments

even more seamless than they are now.

Another use case for IoT devices is the data it provides

for targeting advertisements and consumer offers. A card

issuer or merchant who only has data from a consumer’s

mobile device might leverage its location data to send a

coupon to the closest restaurant. But if the provider also

had data from social media plus access to information

from a connected car, it would know that the consumer

is driving to another town to celebrate a birthday. The

provider could then send offers based on the consumer’s

destination instead of the consumer’s current location.

The future provides almost boundless opportunities for

payments, which will often be triggered automatically

and underpinned by technologies like 5G, Bluetooth,

Mesh and NFC. Dramatic shifts in consumer expectation

and behavior (for example, the huge growth of

contactless payments in the last two years) underlines

that the worlds of payment and mobile are well along

IN THE U.S., SEVERAL

RESTAURANTS OFFER

SELF-CHECKOUT AT THE

TABLE USING TABLETS,

WHILE IN THE U.K.,

SUPERMARKET CHAIN

TESCO IS ROLLING

OUT SELF-SCANNING

TECHNOLOGY AND

“SMART TROLLIES”

WHICH ADD UP

PURCHASES AS ITEMS

ARE PLACED IN THE

TROLLEY.

Page 17: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 17

the path to convergence. Ultimately, that will allow us to

unlock new digital services that offer consumers even

more innovative, convenient and flexible ways to pay and

to manage their money.

Of course, anything dependent on software and

connectivity will be susceptible to fraud and cyber

crime, as we have learned from recent high-profile

data breaches. With every IoT device connected to the

internet, there is also the threat of enrollment into a

botnet, as occurred in October 2016 with a distributed

denial-of-service (DDoS) attack on Dyn (the domain

name system operator) which left services like Twitter

and PayPal inaccessible for many users around the world.

Issues of data encryption and device authentication will

be key, but there is no clear consensus as to how the IoT

will be secured and standardized. Also, the mounting

number of data breaches has cast doubt on retailers’

ability to secure consumer data and sustain consumer

confidence in sharing data, creating a barrier to the

adoption of IoT technologies.

Data capacity will also be a key consideration. IoT will

transmit and generate huge amounts of data, which will

in turn boost usage of cloud services. But, with a relative

lack of regulation over the IoT thus far, it remains to be

seen what this will mean in terms of liability along the IoT

supply chain.

IMPACT ON BANKS While the IoT is fundamentally about gathering,

processing and creating value from information about

tangible physical objects, many financial transactions

are based on information from intangible sources that

may ultimately have roots in the physical world but that

are one level removed from it. For example, no tech

start-up has yet figured out how to strap a sensor to a

company’s profit-to-earnings ratio.

By harnessing the power of the IoT, banks will be able

to change their role in the life of their customers and

evolve into a service provider. Accessing the data

captured by smart devices of all kinds will enable

banks to provide customers with a holistic view of

their personal finances, updated in real time. Banks can

use their data-driven insights to anticipate customer

needs and offer advice, products and solutions to

assist customers in making smart and financially sound

decisions. In this way banks becomes an ever-watchful

advisor and facilitator, building customer loyalty and

increasing the likelihood of additional business.

The successful business banks of the future will also

be those that help their customers achieve superior

commercial results. By accessing data from across

their business customers’ value chain, from suppliers to

distributors to retailers, banks will be able to develop

much deeper customer insights. This will allow banks

to provide financial analysis, products and services that

enable their business customers to gain a competitive

edge in a highly connected, hyper-competitive market.

Analytics will be one of the most valued product

offerings for business customers. Banks will, for

example, combine their demographic and market

segment data with their business customers’ own

data-led insights (e.g., insights into consumer

preferences, regional market differences or demand

fluctuations) to help those business customers refine

pricing models.

Trust and a reputation for strong data protection are

valuable assets in the context of identity management,

and though it is no small matter to tackle allocating and

managing identity to billions of devices, this is certainly

a viable route for banks to consider to ensure their

role in the world of PSD2, IoT and whatever the next

disruptive innovation turns out to be.

FUNDAMENTALS OF IoT ADOPTIONIt is clear that a number of gaps need to be filled before

the IoT can fulfill its potential, and it’s also clear that

banks have natural attributes that could fit them well to

help fill some of those gaps. The successful enablement

of trillions of micropayments at a manageable cost, for

example, seems a prerequisite for the IoT to work, and

underpinning payments is the banks’ sweet spot.

Banks and payment market infrastructures worldwide

are already focused on reinventing payment rails

Page 18: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

18 INSIDE PAYMENTS

to cope with more and faster payments in response

to competition from new entrants and demand

from customers. At the same time, they are looking

to streamline their own internal process to ensure

payments can be processed as speedily — and cheaply

— as possible. As they do this, they need to work to

accommodate not just the volumes that human beings

armed with smartphones can generate, but also the kinds

of volumes billions of additional devices could produce.

There is a very real possibility that over time the value of

transactions could fall below the cost of processing them,

and to be successful in payment processing in such an

environment requires scale, which banks can bring. In the

new world, banks may not get paid for making payments,

but they may do so for enabling the commercial

operation of the IoT.

In a similar vein, when they are planning their strategies

for open banking and PSD2, banks should think about

identity management, strong authentication and open,

real-time APIs, not just in the context of customers and

third-party payment providers, but in the context of

devices as well. The IoT can be viewed as taking the

changes introduced by PSD2 further still, and as a result

of the work banks do to prepare for PSD2 they will have

a meta-framework on which to build. In the IoT world,

there is a role to orchestrate and secure the interactions

and data sharing that customers will need to ensure

purchases are made and business is done, and the banks

have an opportunity now to embed themselves in that

orchestration at this early stage of the IoT’s evolution.

MERCHANT PERSPECTIVEWith regard to the transactional capabilities of IoT

commerce, the underlying transaction model is similar

to that of a traditional one involving four key players: a

consumer, a merchant, an issuer and an acquirer. After a

consumer begins a transaction, the issuer authorizes the

transaction and the flow of payment continues through

to the acquirer and merchant. Three key issues arise:

Payment processing: Although this area may be familiar,

there are several layers that will require updating for

IoT commerce. IoT commerce can and often will involve

many devices that are all connected, making it essential

to have a payments transaction model that can flex

to the use case. Whether it’s ordering a delivery off a

home central hub or ordering a morning coffee through

the car, players in the ecosystem are required to think

through and comprehensively account for the context

of the transaction and data exchange for facilitating the

commerce transaction.

Risk management: Determining what sort of data and

credentials are passed across which devices and players

will dictate how information is handled and aligned in

the ecosystem, especially as new entrants like OEMs

and integrators enter the marketplace. As incremental

information is passed across multiple devices by multiple

parties, this new data will have to be permissioned for the

device/ecosystem partners, and these components must

evolve to match the advancement of IoT commerce.

Data protection and fraud: Clear ownership of liability,

education of data privacy standards and the continual

deployment of fraud detection to the broader IoT space

is mandatory. It will also be important to define, align

and enforce new standards of regulatory governance.

As more AI is introduced into the IoT world (in areas

like auto-replenishment, sensors, data and analytics),

IoT commerce should convey the same standards of

assurance as a secure transaction using traditional

methods.

BLOCKCHAIN AS AN IoT ENABLERThe earliest and the most practical application of a

blockchain was to create the cryptocurrency Bitcoin.

Today, it has gone beyond finance with a host of other

applications, including IoT, being worked on. It is even

possible that blockchain and IoT convergence will

become a necessity at some point. If the current IoT

paradigm (millions of devices connected via a centralized

cloud storage and processing service) continues, then

systems are likely to become increasingly bloated as data

volumes, as well as the number of connected devices,

continue to increase.

These cloud services are likely to become bottlenecks

as the amount of data pumped through them increases.

Blockchains can remedy this thanks to their distributed

nature. Rather than an expensive, centralized data

center, a blockchain data storage network is duplicated

across the hundreds or thousands of computers and

devices that make up the network. This huge amount

of redundancy means data will always be close at hand

when it’s needed, cutting down transfer times and

meaning one server failure will be of no consequence to

business activity. The blockchain design provides strong

protections to make sure that data is not compromized

or tampered with, enabling it to provide better security

than existing systems.

There are several clear advantages to the idea of building

a network of smart devices able to communicate

and operate via blockchain. First, there is the issue of

oversight. With data transactions taking place between

multiple networks, a permanent, immutable record means

ownership can be tracked as data (or physical goods)

passes between points in the supply chain. Blockchain

records are by their very nature transparent — activity

can be tracked and analyzed by anyone authorized to

connect to the network. Without the private keys giving

write access to the blockchain (which in this case would

be held by machines), no human will be able to overwrite

the record with inaccurate information.

Smart contract facilities provided by some blockchain

networks, such as Ethereum, allow the creation of

agreements which will be executed when conditions are

met. This is likely to be very important when it comes

to authorizing a system to make a payment, when

conditions indicate that delivery of a service has been

provided.

Page 19: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 19

Finally, blockchain offers the potential of greatly

improving the overall security of the IoT environment.

Much of the data generated by IoT is highly personal. For

example, smart home devices have access to intimate

details about our lives and daily routines. Allowing

access to data from IoT devices to be managed through

blockchains would mean an additional layer of security

that would be secured by the most robust encryption

standards available. The very nature of a blockchain

provides strong protections to make sure that data is not

compromised or tampered with, enabling it to provide

better security than existing systems.

AS MORE AI IS INTRODUCED

INTO THE IoT WORLD

(IN AREAS LIKE AUTO-

REPLENISHMENT, SENSORS,

DATA AND ANALYTICS), IoT

COMMERCE SHOULD CONVEY

THE SAME STANDARDS OF

ASSURANCE AS A SECURE

TRANSACTION USING

TRADITIONAL METHODS.

Source

1 Winning In IoT, It’s All About The Business Processes, Boston Consulting Group

Page 20: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

20 INSIDE PAYMENTS

SUMMARY: COST AND VALUE IN BANKS — A MODEL FIT FOR THE DIGITAL ERA?

Identifying, measuring and allocating costs have become much more complex

for banks. The emergence of hybrid models combining online and offline

channels indicates that new cost drivers need to be developed and that these

costs are adequately allocated to cost pools and cost objects. Legacy issues

also add to the complexity of developing efficient cost systems. Most banks

still use different methodologies within the group, multiple and conflicting

taxonomies, product hierarchies and accounting processes, varying definitions

for many of the same terms and disparate cost allocation systems. Also, owing

to continual revisions, many cost indicators cannot be compared over time.

Due to the lack of methodological consistency, many banks still have major

difficulties in identifying the right cost levers to improve margins. At present,

the use of analytics to empower cost reduction efforts concern only a part of

these banks.

Page 21: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 21

An adequate management of compliance costs is

increasingly perceived as having a crucial role to

play in the mitigation of reputational risks. Most

of the compliance costs have stemmed from the

implementation of new pieces of legislation. New rules

enacted at both the national and EU levels have aimed

at addressing risks as diverse as those pertaining to

data privacy, cybersecurity, exploitation of information

asymmetries, anti-money laundering, competition and

financial stability. Given the multiplicity of compliance

cost origins and drivers, the development of an efficient

approach to the management of cost compliance

remains challenging.

Owing to heightened regulatory pressures and the need

to improve reputation, the compliance costs of banks

have increased significantly into the future. Nevertheless,

the level of compliance costs is likely to vary across

financial organizations, depending

on their strategy and size. Costs

should be lower for firms that

compete on the quality of their

products and processes, as their

business strategy implies that they

comply more easily. Scale might

also matter. Smaller banks are likely

to face higher costs than larger

banks do in pursuit of the same

performance standards. Often,

those smaller banks have greater

difficulties in fully automating

compliance processes, thereby

resulting in higher recurring costs.

The sector of banking and financial

services is one of the largest

spenders on IT. This IT spending has

even increased in recent years and

should continue to rise in the coming

years. Measuring and allocating IT

costs remains demanding, especially when they result

from phenomena such as shadow banking. Although

banks’ IT spending for the purpose of maintenance

is much higher than for the purpose of investment, a

surge has recently been recorded in the latter among EU

banks. Overall, the efficient management of IT spending

is proving to be a powerful driver behind the decrease in

total costs.

Policy makers should develop tools aimed at facilitating

a balanced digital transformation of the banking sector.

The competitiveness of EU banks should be strengthened

and the right incentives should be provided for

developing the most up-to-date services to customers.

The first priority for achieving these objectives is to

ensure that regulators and implementing authorities

integrate and better anticipate the cost of IT changes

needed for implementing new rules. This could be

done systematically as part of any impact assessment

conducted.

Second, as regulators are working on a revised Capital

Requirements Directive (V) and Capital Requirements

Regulation (II), this could be an opportunity to reconsider

the role of expenses on digital elements in the calculation

of capital ratios. The exclusion of software expenses

for certain priority areas could be a powerful means for

national supervisors to orient digital expenses where

these are most needed. Priority areas could be defined

at the discretion of national supervisors and could be

justified, for example, by better proportionality (small

banks versus large counterparts), better access to finance

by SMEs (with a focus on corporate finance rather than

retail) and the need for faster transaction processes for

NFCs (digitalizing KYC and authentication processes

for NFCs, notably in trade finance). The definition of the

right parameters to distinguish the types of software

expenses would require close cooperation between

accounting standard setters and supervisory authorities

in developing the final set of rules and in implementing it.

DRIVERS BEHIND DIGITALIZATION OF RETAIL AND CORPORATE FINANCEFour main drivers behind

digitalization initiatives of banks

were identified by the research.

These consisted of the greater need

for regtech, the increase in digital

service adoption of customers,

eroding lending margins and new

entrants. Noticeable differences

could be observed between retail

finance and corporate finance, and

could explain why for most banks

digitalization in retail finance has

so far been more advanced than in

corporate finance.

For consumer finance, it appears

that the rapid digitalization of consumers has for the

most part been the cause of the digitalization of financial

providers. In that sense, consumers have taken the lead.

The digitalization of companies’ processes has been

slower as a result of greater complexity. Companies are

increasingly considering the digitalization of corporate

finance as a powerful driver of their own digital

transformation. Against the backdrop of decreasing

lending margins, it is often assumed that financial

organizations would use digitalization to cut costs in

order to maintain similar patterns of profitability.

Despite all the hype and speculation about what could

happen, no dramatic change has so far taken place on

the supply side of financial services. In the EU market,

the vast majority of financial services offered, whatever

the area, continues to be provided by banks, even in

segments where alternative providers are most active,

such as unsecured consumer loans, small SME loans,

corporate foreign exchange and payment services. That

notwithstanding, the fear of being overwhelmed by new

OWING TO

HEIGHTENED

REGULATORY

PRESSURES AND THE

NEED TO IMPROVE

REPUTATION, THE

COMPLIANCE

COSTS OF BANKS

HAVE INCREASED

SIGNIFICANTLY INTO

THE FUTURE.

Page 22: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

22 INSIDE PAYMENTS

The gradual digital transformation of retail and

corporate finance brings both opportunities

and risks. Regulators should enhance these

opportunities, while addressing the risks by

promoting specific practices for both banks and

regulatory/supervisory bodies. The generalization

of such practices should ensure a balanced digital

transformation and even improve the overall quality

of the banking system.

competitors in the coming years, notably by tech

giants, persists and constitutes a powerful incentive

for banks to innovate by digitalizing their processes

and services, on a sole basis or in cooperation with

alternative providers.

DIGITALIZATION AND THE RESHAPING OF COSTS AND VALUES AT THE DIFFERENT STAGES OF PRODUCTSAlthough it is still too early to assess the full impact

of the recent digital investment made by large banks

on the costs and values of retail and corporate

finance, specific trends can already be detected. The

objective is to analyze how and to what extent the

different stages of products in retail and corporate

finance are being reshaped by banks in a digital

context: marketing, distribution, advice, scoring,

contracting/authentication/KYC and recovery.

In the big data environment, the use of predictive

analytics for the purpose of better segmentation has

become more popular. These tools are used mostly

for consumers and SMEs, as each large corporation

often represents a segment in and of itself for which

banking solutions are specifically designed.

Robo-advisers tend to be used in the context

of a hybrid model, where automated and

human processes are combined. The benefits of

automated advice in terms of costs and values

remain ambiguous. However, a greater number of

banks are trying to provide useful online financial

information to consumers. The production of

financial information to support banking customers

in their decisions and strategies might be even more

valuable for companies, especially for SMEs, which

often expect banks to play the role of a consultant.

Still, companies often have a very poor appreciation

of the forecasting services of banks.

Furthermore, an opinion shared by numerous large

corporations is that standards among banks remain

way too fragmented, KYC processes are often not

streamlined and data is not sufficiently integrated

across banks. These issues are notably due to

divergent interpretations of rules by banks and

cause significant difficulties for large corporations

that interact with multiple banks. Almost all the

stakeholders approached considered that trade

finance is the segment for which the need for

improvement in terms of converging standards

and KYC processes is the greatest. In the big data

era, regulators should encourage the development

of advisory tools such as financial dashboards for

consumers.

Click here to read the full paper.

Page 23: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

SUMMER 2018 23

Page 24: SUMMER 2018 INSIDE PAYMENTS - ACI Worldwide...commerce of devices, ongoing issues of tackling fraud ... Cash may be king for now, but its long reign may be coming to an end, especially

ACI Worldwide®, the Universal Payments® (UP®)

company, powers electronic payments for more than

5,100 organizations around the world. More than 1,000

of the largest financial institutions and intermediaries,

as well as thousands of global merchants, rely on ACI to

execute $14 trillion each day in payments and securities.

In addition, myriad organizations utilize our electronic

bill presentment and payment services. Through our

comprehensive suite of software solutions delivered

on customers’ premises or through ACI’s private cloud,

we provide real-time, immediate payments capabilities

and enable the industry’s most complete omni-channel

payments experience.

Americas +1 402 390 7600 Asia Pacific +65 6334 4843 Europe, Middle East, Africa +44 (0) 1923 816393

© Copyright ACI Worldwide, Inc. 2018 ACI, ACI Worldwide, ACI Payment Systems, the ACI logo, ACI Universal Payments, UP, the UP logo, ReD, PAY.ON and all ACI product names are trademarks or registered trademarks of ACI Worldwide, Inc., or one of its subsidiaries, in the United States, other countries or both. Other parties’ trademarks referenced are the property of their respective owners.

WWW.ACIWORLDWIDE.COM

@ACI_WORLDWIDE

[email protected]

WWW

LEARN MORE

ANY PAYMENT,EVERY POSSIBILITY™.