Mr. Patrikis discusses the monetary policy and regulatory implications of
banking on the Internet Address by the Vice-President of the Federal Reserve Bank of New
York, Mr. Ernest T. Patrikis, at the Queen Mary & Westfield College University of London &
UNISYS International Management Centre held in Saint Paul de Vence, France from
22-24/1/97.
A. Introduction
I want to share with you today some observations and speculations gathered this
and last year about banking and the Internet. I will be speaking in my capacity as a central
banker -- which includes monetary policy, banking services, bank supervision, and payments
system oversight -- and as a surfer of the 'Net. Let me state, at the outset, that, while the Federal
Reserve Bank of New York does not conduct "Internet banking" as such, we do have a home
page (http://www.ny.frb.org) with much useful information about our institution, with over three
million recorded hits to date. Finally, let me add that some of what I say here today could, very
easily, be obsolete in two months' or even two weeks' time. But I will try to point out those
areas in advance.
The title of this portion of the program gives rise to two issues of definition. The
first is "What is the Internet?" The second is "What is banking?" As I am sure you are well
aware, in the United States we are a litigious sort. We even have a legal definition of the
Internet. According to one recent case, the "Internet" is "an international computer
'supernetwork' of over 15,000 computer networks used by about 30 million individuals,
corporations, organizations, and educational institutions worldwide."1 Another case described
the "Internet" as "a global communications network linked principally by modems which
transmit electronic data over telephone lines [with] approximately 20 million to 30 million
users."2
"Banking" raises a host of issues in the United States. There is commercial
banking and investment banking. The products offered by "banking" firms range from deposit
taking (including payment services), investment advisory and management services, trading in
financial instruments, brokering and underwriting financial instruments, lending, and trust
services. A bank can offer all of these services on the Internet. For the purposes of this
discussion, I will basically confine myself to deposit taking (including payment services) and
lending.
A Central Banker's View
From a United States central bank perspective, the most fundamental question of
banking and the Internet is: What are the monetary-policy implications, especially were we to
assume the enormous, widespread scale that some have been predicting? From this perspective,
the answer appears to be: probably not much. If the Internet is used merely to facilitate existing
banking and payment transactions, such as executing electronic bill payments or transferring
funds from one bank account to another (which more or less describes what electronic bill
payment really is anyway), the combination of banking and the Internet should have few, if any,
implications for the conduct of United States monetary policy, or the measurement of the United
States money supply. "Money," as defined by M1, M2, or M3, would still be held in accounts at
1
Panavision Int'l, L.P. v. Toeppen, 938 F. Supp. 616, 617 (C.D. Cal. 1996).
2
In Systems, Inc. v. Instruction Set, Inc., 937 F. Supp. 161, 164 (D. Conn. 1996). The most comprehensive
judicial description of the Internet can be found in American Civil Liberties Union v. Reno, 929 F. Supp. 824,
830-48 (E.D.P.A. 1996).
banks that would be reported to the Board of Governors of the Federal Reserve System through
the existing mechanisms that such funds are reported today.
If, however, Internet banking evolved to the point where digital "coins,"
account-based cards and PCs, or other private-sector initiatives produced electronic
representations of money that began to be used and circulated like currency, the potential
implications for United States monetary policy are much greater. The key questions here are
related to amount and velocity -- that is, (1) how would digital bills or notes, or digital coins, be
represented on the books of a bank or depository institution; and (2) how many times would this
electronic coin or bill circulate in the general economy without somehow being processed and
recorded by a bank? In this regard, the October 1996 Bank for International Settlements report
"Implications for Central Banks of the Development of Electronic Money" states "E-money
could lead to shifts in the velocity of money which might temporarily reduce the usefulness of
the monetary aggregates, especially narrower ones, for countries that rely on them as targets or
indicators." In a June 1996 speech before a cyber-payments conference, Governor Edward
Kelley of the Board of Governors stated that, with respect to a bank's liabilities incurred through
issuing stored-value cards, such liabilities should be included in the statistical reports that banks
must currently submit to the Board of Governors.3 It is difficult to argue that bank liabilities
resulting from the issuance of electronic "coins" or electronic "bills and notes" should be
reported any differently.
A more problematic question arises when considering the matter of nonbank
issuance of electronic coins or bills. Currently, the largest nonbank issuers of travelers checks
are not required, but do volunteer to the Fed, the outstanding balances of their travelers checks,
so that this information can be statistically recorded and reported in United States monetary
aggregates by the Fed. If the issuance of private electronic money grows to a significant level in
the real economy, and if much of that growth is provided by nonbank issuers of electronic
money, there could be a similar request for nonbank issuers to provide information about the
volume of their issuance and their outstanding electronic money liabilities, to the extent these
liabilities are not recorded on the books of a bank every time they are circulated in the general
economy.
A Bank Supervisor's View
From this perspective, combining banking and the Internet offers both great
opportunity and great potential risk. First, the good news -- it is primarily cost-related. It has
been reported by several banking studies that the cost of a typical transaction at a bank branch is
now over $1.00; the cost of an ATM transaction is approximately $0.25. The cost of an Internet
transaction, however, has been estimated at about a penny. I do not vouch for this statistic, but
the difference is substantial. Such figures make a compelling argument for banks to get on the
Internet sooner rather than later, and to move as many of their customers on to electronic or
Internet banking as soon as they possibly can. Indeed, some banks offer low-fee accounts where
the customer is not expected to enter an office physically -- mail, phone, and ATM are
sufficient.
As stated by Board of Governors Chairman Alan Greenspan: "it is useful...to
begin by reminding ourselves just why there is bank supervision and regulation. At bottom, of
course, is the historical experience of the effects on the real economy of financial market
disruptions and bank failures, especially when the disruptions and failures spread beyond the
initial impetus."4
A bank supervisor should have concerns other than cost, and these comprise the
bad news -- the "risk" aspect of banking on the Internet. In the simplest terms, while we strive to
ensure that banks remain efficient and cost-effective, we also have to ensure that banks know
what they are getting into, and that they are capable of handling the risks that accompany
banking on the Internet. The tension between the two is very constant and real, particularly
because the technology today seems to be moving so much faster than bankers or bank
supervisors can fully absorb.
At the Federal Reserve Bank of New York, we are being proactive in this area.
We currently conduct on-site, information systems examinations of State member banks in our
district -- in addition to commercial, trust, trading, and compliance examinations -- in which we
try to review and constructively criticize the examined bank's entire MIS infrastructure. There is
no separate, independent electronic or Internet bank exam as such. However, a part of the
information systems examination reviews the bank's electronic and Internet activities and plans,
and all examiners ask general questions that we feel that any bank offering on-line banking
services should be able to answer responsively.
In addition, we have convened a special task force at the Federal Reserve Bank of
New York to review security issues involving on-line and Internet banking. The goal of this task
force is two-fold: (1) to gather, review, and benchmark current and future on-line security
procedures and policies of State member banks in our district; and (2) to then somehow
disseminate, without unduly disadvantaging any specific depository institution that provided us
with its information, the best of these policies and procedures into a kind of "sound practices"
security guide for banks to use for their electronic and Internet banking services. The task force
should issue its first report in the summer of 1997.
In a similar vein, I believe that the United States Federal bank supervisors, while
mindful of the risks, have tried to be as supportive of electronic and Internet banking as possible.
Each of the various bank supervisory agencies, i.e., the Board of Governors, the Office of Thrift
Supervision ("OTS"), the Federal Deposit Insurance Corporation ("FDIC"), and the Office of
the Comptroller of the Currency ("OCC"), has dealt in some immediate way with the issues
posed by electronic and Internet banking. Both the OTS and the Board of Governors have dealt
directly with Internet banking through the bank applications approval process. In May of 1995,
the OTS approved the application of a new thrift, the Security First Network Bank ("SFNB"),
that sought explicitly to provide the majority of its electronic banking services over the
Internet.5 In May of 1996, the Board of Governors approved the application of SFNB's parent, a
bank holding company, for SFNB to acquire a data-processing firm specializing in data
processing activities that would provide nationwide banking and financial services over the
Internet.6 In December of 1996, the Board of Governors approved the application of a
Minnesota bank holding company and two foreign banks to join a consortium of 15 North
American banks and IBM to form Integrion Financial Network, LLC.7 Integrion itself has
announced that it will not provide electronic or home banking services, but will instead design
and operate a secure electronic gateway or interface system linking bank customers to their
depository institutions, including links via the Internet.8 Finally, the Federal Reserve Bank of
New York and the Board of Governors are currently processing an application from a foreign
bank, with a United States securities brokerage subsidiary, to acquire a software firm planning to
design software for customers of brokerage firms to place securities buy-and-sell orders over the
Internet.9 The OCC, meanwhile, confirmed in correspondence in August of 1996 that, in
addition to providing home banking services to its customers through the Internet, a national
bank subsidiary could also provide Internet access to customers and nonbank customers in the
bank's service area.10
In the midst of all this supervisory "support," however, I should also mention
some of the as-yet unsettled issues dealing with the unique regulatory burdens facing depository
institutions offering financial services over the Internet. Among the most difficult will be the
proper application of the Community Reinvestment Act ("CRA"), a United States statute that
requires depository institutions to meet the credit needs of the communities where they accept
deposits. What exactly is a deposit community in cyberspace? Nobody really knows. This has
not yet become a significant issue because most depository institutions offering on-line services
still have brick-and-mortar branches, on to which current definitions of a CRA community are
based. Still, for exclusively on-line depository institutions, the CRA issue will become
increasingly important as their market share grows. Some early discussions with the relevant
compliance supervisors may be in order. I also note that this also raises interesting questions on
the definition of the relevant geographic market in the analysis of bank mergers.
Furthermore, considering the CRA issue brings forth another, broader issue: what
is the role of nonbanks in the realm of Internet financial services, particularly payment services,
which are still largely the province of banks and other regulated depository institutions? Because
banks have been so intricately involved in the United States payments system, banks today face
unique regulatory burdens: CRA, reserve requirements, deposit insurance premiums, and the
costs of good supervision and good supervisors. If nonbanks begin to take significant market
share away from banks because of an inherently lower cost structure, that raises real questions
about a level playing field and whether or not banks can ever fairly compete. If nonbanks begin
offering through the Internet many of the payment services, or alternatives to the payment
services now offered exclusively by banks, that raises real concerns about the ultimate value of a
bank charter, and what it really means to be a "bank." Or is this "banking"? Another issue that
may be relevant here is the implication of a firm that has a balance sheet that looks like that of a
bank but does not have direct access to the lender-of-last resort.
Finally, and especially in light of the issues just raised, I think it is important for
me to emphasize that the bank supervisors have expressed a clear willingness to listen to what
the banking community has had to say on the issues involving electronic and Internet banking.
Regulation E, promulgated by the Board of Governors, implements the Electronic Funds
Transfer Act of 1978, and establishes primarily for consumer protection purposes the basic
rights, liabilities, and responsibilities of consumers who use, and financial institutions who offer,
retail electronic funds transfer services.11 Among the protections provided are required
disclosures, error resolution procedures, and loss protection. In 1996, when the Board of
Governors issued its proposed regulations concerning the applicability of Regulation E to
stored-value cards, the Board of Governors explicitly requested that commenters to the proposed
revisions indicate whether the commenters believed that part or all of Regulation E should apply
to electronic "money" or "value" residing on a computer system or a personal-computer hard
drive.12
Similarly, the FDIC, while holding public hearings on its General Counsel
Opinion No. 8 on stored-value cards and Federal deposit insurance coverage,13 specifically
requested additional commentary on Federal deposit insurance coverage and electronic value
represented on computer systems or personal computers. I believe the message is clear: as bank
supervisors, we are open to what the banking community has to say on this rapidly evolving
market. New ideas and reasoned arguments are welcome. We must try not to restrain important
new services developed by the banking industry but should remain vigilant as banking-type
services are offered by nonbank institutions.
A Payments Systems Overseer's View
From the perspective of a payments system overseer, I see much activity, but thus
far, few genuinely revolutionary innovations with respect to banking and the Internet in the
United States. Mainly, I see the application of faster, cheaper electronic processing of older,
more established paper-based methods of transferring payments between parties. Credit card
payments on the Internet are one example. Instead of using a telephone, a normal card reader,
and a customer's signature, one leading Internet payments company has devised a secure method
of allowing a bank customer to shop on-line with a credit card, by never releasing "in the clear"
the customer's credit card number on the Internet itself. Instead, the company only releases the
credit card number and a merchant's request for payment to the customer's issuing bank, away
from the Internet, after verifying on-line with the customer that the purchase was authentically
made. The bank processes the transaction as it would any other credit card purchase; the value
added by the company is that the customer's credit card number is never on-line, a benefit
indeed in today's security-poor Internet.
It is not hard to imagine that another step in this direction is for a third-party
organization (perhaps even a bank subsidiary) to issue secure, encrypted electronic checks on the
Internet on behalf of bank customers, or even unaffiliated parties, wishing to make purchases
on-line. Much legal uncertainty remains in the United States about establishing such a process,
however. Basic questions remain unanswered. What, exactly, would be an authorized signature
on an electronic check? Put another way, what types of entities would be authorized to act as
certification authorities on the Internet for such commercial conveniences as electronic purchase
orders, electronic negotiable instruments, or their bases, digital signatures? Would these
certification authorities be entirely private sector derived? Or would they be established and
operated by the government, by the individual states, some of whom already have enacted digital
signature statutes? What is the role of banks in this process? In particular, what are the risks to
the bank, in allowing a nonaffiliated third party to act as a certifying authority for electronic
checks drawn from the accounts of bank customers?
I could ask some even more basic commercial law questions about banking in
cyberspace. When is an Internet payment final? More specifically, when a payment over the
Internet is made, has the maker of the payment made a provisional payment, as with writing a
check, or a final payment, as with giving a certified check or making a wire transfer? Articles 3,
4 and 4A of the Uniform Commercial Code ("UCC") govern the above circumstances, but have
nothing to say on Internet payments. Currently, private contract law governs; agreements
between each of the parties in an on-line transaction should be very carefully drafted and
reviewed. Still, if Internet banking and commercial transactions were to grow in volume and
complexity, it is quite possible that private contract law could evolve into a specialized
commercial law of cyberspace, and eventually be codified into parts of the UCC.
On a less theoretical note, I should mention that a multi-national Task Force on
the Security of Electronic Money, established by the Committee on Payment and Settlement
Systems and the Group of Computer Experts of the Group of Ten Central Bank Governors, and
chaired by Israel Sendrovic of the Federal Reserve Bank of New York, issued a report on its
findings entitled "Security of Electronic Money" in August 1996. This Task Force examined
primarily consumer-oriented stored-value payment products by, among other activities,
surveying the leading global suppliers of both card-based and software-based stored-value
systems, and concluded that the technical security measures of these systems are being designed
to achieve an adequate level of security relative to other forms of common retail payment,
assuming they are implemented appropriately. I recommend the report to anyone interested in a
general discussion about security issues and stored-value systems, Internet-based or not.
Moving away from consumer banking and the Internet, and looking perhaps
not-so-distantly into the future, I have also had occasion to question what the repercussions are
for large-value payments transfer systems, such as Fedwire, with the emergence of a different,
much more secure Internet. Generally speaking, the Internet today is a "somewhat" secure
environment in which to conduct banking and financial service activity. The current level of
security is not adequate for large-value payments. Some Internet-based payment products are
becoming more secure, but only after the creators of these products have spent a great deal of
time, effort and resources making their products secure. Consistent fast transmission and
processing are also essential for large-value payments. The Internet today has no authorized,
universal means of prioritizing specific electronic messages from other messages. Faster and
better hardware helps, certainly, but offers no guarantee.
One of my responsibilities is to serve as the Product Director of the Wholesale
Payments Product Office of the twelve Federal Reserve Banks. This includes the Fedwire
transfer of funds, transfers of securities against payment, and net settlement. In providing these
payment services, the Reserve Banks must charge a fee designed to cover their costs, plus what
we refer to as a "private sector adjustment factor," a proxy for the capital, taxes, and other costs
incurred by private-sector service providers. Thus, I am keenly interested in the next stage of the
Internet.
If messages sent across the Internet could be made timely, become much more
secure at reasonable cost, and, if a widely-accepted prioritization scheme for electronic messages
could be implemented so that large-value payment messages could move instantaneously, it is
not inconceivable that the effect on existing large-value payments transfer systems could be
substantial. Within a five-to-ten year time frame, I could see at least a portion of Fedwire
large-volume transfers of funds and securities -- with real-time gross-settlement -- handled over
the Internet. Please do not ask me exactly when this will come about. On the other hand, with
potentially enormous, secure, bilateral netting arrangements occurring between clearing banks in
real time over the Internet, volume on existing large-value transfer systems could decrease
dramatically. The clearing banks could, conceivably, save themselves some real money.
Jurisdictional Issues
Any discussion of banking or any form of commerce over the Internet today
would not be complete without at least a few words on the legal jurisdictional issues that the
Internet presents. This is arguably the area of law most in flux, the most subject to change on a
monthly or even daily basis, depending on the specific jurisdiction and long-arm statute under
discussion. In the United States, cases have already been decided regarding court jurisdiction
and the Internet over alleged trademark violations,14 contract disputes,15 and advertising
disputes.16 Although I am as yet unaware of any banking organizations that have become
embroiled in litigation over jurisdictional issues from being on the Internet, I cannot promise
you that such a suit will never occur. If a State banking agency or a State attorney general
decided one day that a Web-site or an Internet-based transaction conferred sufficient minimum
contacts with a state resident so that the state's long-arm statute applied to the bank, a suit could
easily be filed. Minnesota Attorney General Hubert Humphrey III filed six lawsuits in 1995
against six companies accusing them of engaging in illegal business practices or running outright
pyramid schemes over the Internet, although none of the six companies was based in Minnesota,
and no Minnesota citizen ever came forward to complain about the companies. The fact that a
Minnesota resident could have accessed the scams run by the companies, claimed Attorney
General Humphrey, was sufficient to confer jurisdiction of his lawsuits in the Minnesota courts.
Lest this argument sound wildly and improbably expansive, it should be noted
that the "Internet access = jurisdiction" idea has already been accepted by some of the Federal
district courts that have decided such cases, although it must also be noted that these courts'
decisions have been inconsistent, have all had slightly different facts, and have taken great pains
to distinguish themselves from one another. New case law on the issue of jurisdiction conferred
by Internet access is undoubtedly being made as we speak. At a minimum, then, banks offering
services through the Internet should have signed contracts with electronic and Internet banking
customers that specify to the courts where claims or disputes may be brought. Web-sites
designed merely to advertise a bank's financial services should be designed to be as
controversy-free as possible, although that may be difficult without making the sites content-free
as well. Banks should err on the side of caution until the jurisdictional issues have had more time
to sort themselves out.
I would like to present a hypothetical fact situation to you which I think
demonstrates some of the thorny legal and supervisory issues that could be raised by the
existence of offshore banking entities doing business over the Internet with individuals in our
jurisdictions. I travel to the island of Atlantis, where I obtain a Class Z banking charter. I am
permitted under this charter to engage in the business of banking every place in the world,
except with residents of Atlantis. As you have probably suspected, Atlantis is founded on the
principle of free and open markets, unfettered by supervision and regulation of banks with Class
Z charters. Atlantis also provides for strict adherence of the principles of banking secrecy. My
bank is named The Internet International Bank ("IIB"). The IIB offers a full spectrum of
banking services to Atlantis nonresidents. Being a modern bank, it conducts business principally
on the Internet. IIB has a series of quite attractive Internet pages where its products are offered.
These pages spell out the products, deposit terms and interest rates, and loan terms and interest
rates. All agreements are governed by the law of Atlantis. All deposits are deemed received over
IIB's "counters" in Atlantis, and all loans are paid out of Atlantis. Atlantis has an enjoyable
ambiance even exceeding that of Nice and Saint Paul de Vence; therefore, I see no need to leave
the island. I do receive and entertain customers when they visit Atlantis. I do place telephone
calls to customers who have responded to my Internet page, but I do not make cold calls to
customers. Communications with customers over the Internet are state-of-the-art secure.
Customers receive account statements over the Internet, issue payment instruments to IIB over
the Internet, and request loans over the Internet. All payments to and from accounts are made by
wire transfer to IIB's correspondent account maintained on the books of Atlantis Bank, the only
bank chartered under Atlantis law authorized to engage in banking transactions with Atlantis
residents. Customers may instruct IIB to make payments for their account. These too are
consummated by means of payments out of IIB's account at Atlantis Bank. Loans are disbursed
and paid the same way.
The question presented is whether IIB is violating the law of the countries in
which its customers are located. While I have my own views as to the application of United
States banking and securities laws to this fact situation, I prefer not to spell those out in my
prepared remarks. Instead, we all might prosper by sharing our views as to the proper
application of our home country's laws to individuals in our countries who might do business
with IIB. I should note that this fact situation is a pure figment of my imagination. The
cooperative efforts of bank supervisors over the world should be designed to ensure precisely
against this sort of bank. In other words, like Atlantis, IIB should never surface above water.
Our discussion should include responses to the following questions: (1) is IIB
engaged in an impermissible activity in your home country; (2) if it is impermissible, what
authority has responsibility for enforcing that law; (3) if impermissible, is that a civil or criminal
violation; (4) if impermissible, is there any way for IIB to qualify to do business in your home
country; and finally, (5) does your home-country court have jurisdiction to hear cases brought by
a customer against IIB?
Conclusion
To conclude, I simply wish to commend the banking and legal communities for
learning as much about electronic and Internet banking as they can, now, and for trying to stay
ahead of the curve of ever evolving and improving technology. I fully agree with the philosophy
of letting the markets decide what will work and what will not. We, as supervisor and central
banker, will try to stay out of the way as much as possible, unless because of criminal activities
or systemic risk concerns we have to jump in. The private sector seems to have done fairly well
so far. To this end, I point out a recent creation of the Banker's Roundtable, an organization
composed of some of the largest United States banks, in organizing the Banking Industry
Technology Secretariat ("BITS").
BITS, as I understand it, is in the process of designing and implementing common
technological standards for the inter-operability of systems linking banks and their customers,
and is also hoping to act as a certification authority for its member banks for third-party system
and software providers, to ensure that when an electronic or Internet banking transaction takes
place, the bank's name is the only name the customer ever sees. Similarly, a certified software or
systems provider would agree that the customer's payment information would stay with the bank
and not the provider.
I mention this not as an endorsement of BITS, but as an example of the type of
innovation and cooperative or collaborative effort that can occur when the banking community
realizes the enormous challenge and opportunity it has in the next few years. Central banks and
bank supervisors must also be equal to these challenges. In order for us to fulfill our
responsibilities, it will be necessary for the private sector financial institutions to keep educating
and challenging us. It is those dynamics that will help ensure good public policy in banking
supervision and regulation of banking transactions over the Internet.