Frank Elderson: Payment systems - security, governance and SEPA
Speech by Mr Frank Elderson, Executive Director of the Netherlands Bank, at the "Future of
the Payments System" conference, Amsterdam, 18 June 2013.
* * *
Ladies and gentlemen,
As you all know, DNB's objectives include ensuring secure, reliable and efficient payments.
That means making sure we can rely on having good and effective payment systems.
This is the moment when speakers usually introduce their metaphors. And, in the
Netherlands, these are often metaphors involving water. Water that has to flow, and rivers
that have to be channelled. And then the dikes that have to be built. But I have decided I am
no longer going to do that. Instead, it is now time for conferences on water management to
start comparing themselves to payment systems. In other words, to systems that always
have to work and that have to be secure, reliable and efficient.
Ladies and gentlemen,
There are three things I would like to talk to you about today. These are firstly the security of
the payment system, and I believe there should be an increasing focus on that. Secondly,
what we refer to as "governance". In other words, how we manage the payment system. And
thirdly, which is where I am going to begin today, the near future. In other words, the Single
European Payments Area, or SEPA.
I think I am right in assuming that everyone here today has been very involved in the
introduction of SEPA, and so there is no need for me to explain to you what a complex
project it is.
And, as always happens with complex projects, that there have been all sorts of problems
along the way, and fortunately also some things that have gone well. And that we should
really count our blessings.
Internet banking systems are switching relatively easily to SEPA. Many businesses have
already completed the process, and consumers seem to be accepting IBAN without any
major difficulties. The tax authorities, for example, are now generating huge volumes of
SEPA payments each month, and believe me when I say that even the Emmer Compascuum
volleyball club, which has always been very diligent, has also completed the switch. However
I also know from very reliable sources that others, such as the tennis club around the corner
here in Amstelveen, are first waiting to see how things develop.
On a more serious note, we have seen that introducing the European collections system is
proving quite challenging. Although the system is already working well at many businesses,
others - particularly some of the larger groups - have had to deal with "bugs", either in their
own systems or in their communications with banks, or sometimes even at the banks
themselves. Transactions involving large volumes of collections in particular have not always
gone entirely smoothly.
I firmly believe, however, that we will be able to resolve all these problems. And my belief
has so far been backed up by the facts. What does concern me, however, is that we do not
have much time left before 1 February. To be more exact, there are only 161 working days to
go. Luckily there are still 228 calendar days to go, and I suspect that, for a few of us, there
will not be much difference between a working day and a calendar day over the coming
months. Even if a company has calculated that it still has enough time to complete the
process, there is always a danger of logjams arising. Many companies and even some banks
themselves have experienced delays in their projects, and that means more businesses than
expected will need help over the coming period.
So what are we going to do? There is no need for me to say that SEPA should be a top
priority for you all, and I assume it already is.
But just in case you are here today representing a company that has not yet started its
preparations, I am afraid to say you will probably have to work through most of your
weekends until February next year.
There is one other thing I would like to add today. I know that people in some countries are
slightly less concerned about the deadline of 1 February. That may be because they are
more light-hearted by nature. Personally, however, I think there are two other reasons that
may explain the differing attitudes. Firstly, the biggest challenge for SEPA is setting up the
European collection system, and many countries use collections far less than in the
Netherlands. Secondly, certain other countries are making far more use of conversion
services. These services mean businesses can make far more modest adjustments to their
systems and then use a conversion service so that the payments they send to their banks
are SEPA-compliant.
These conversion services have never been able to count on much support in the
Netherlands as, ultimately, they mean you are not making genuine SEPA payments.
However, they are an interim solution that will certainly help some parties to meet the
1 February deadline.
Please do not understand me wrongly. I am certainly not suggesting using conversion
services as an alternative to switching over to SEPA. All I am saying is that you should
consider whether you need to use these services to meet the deadline. And make sure you
do this in time because conversion services also involve more than just pressing a button
and suddenly, all at once, you are SEPA-compliant. You also need some preparation time,
particularly for collections.
I hope, therefore, that conversion services will be included in banks' discussions with clients
who are at risk of missing the deadline. Whether they see these services as a temporary
bridging facility, as an emergency sticking plaster or as a solution. That is entirely up to them.
There is just one final comment I would like to make on conversion services. What exactly
are they? If I enter a payment into my payments engine in the old-style format, is that a
conversion service? The answer to that question is "no".
A conversion service is a separate service that is independent of the bank's payments
engine. It is a service you can arrange for separately, either at a bank or from another
provider.
You might expect to have to pay a fee for the service. Indeed, it was previously said that
conversion services would have to be provided by separate legal entities. But there is no
need for you to worry. That is not necessary, and this is something I am saying in my
capacity as "overseer" of SEPA.
And this then brings me to my second topic today: governance of the payment system. I am
going to dwell for just a while longer on the subject of SEPA as the Ministry of Finance has
given DNB two hats to wear in this respect: that of overseer and that of catalyst.
As far as DNB as overseer is concerned, this is when I put my strict hat on as it is the
overseer's task to make sure the banking sector complies with the law. That means staying
on top of things, and we will be tightening the reins even more over the coming months. That
will sometimes mean difficult discussions with some parties. And sanctions will follow if
things are not satisfactory. Even, however, if we do decide to apply sanctions, we cannot do
that before 1 February next year. That may sound a bit strange because, by then, it will in
any event be too late. That is why we will also be looking at how parties are operating now
when we consider whether to apply sanctions next year.
I am sometimes asked "Exactly how strict is DNB going to be next year?" My answer to that
is quite simple: "Strict". The next question then is "But are you going to be thorough?" My
answer to that question, too, is simple: "Of course we are".
If I then put on my other hat - that of the catalyst - it means looking at the issue from the
typical Dutch polder perspective and switching to my role as chairman of the NFS National
Forum on SEPA migration.
That role means working with everyone to make sure we take account of all the interests at
stake and arrive at optimal solutions for us all. Here, too, we regularly have to be strict. The
overseer's hat then comes in handy as there are times when we also have to take decisions.
And not every decision is equally welcomed by everyone.
The NFS is the SEPA variant of what we are doing on a broader scale in the National Forum
on the Payment System (or MOB, as it is known in Dutch). I often have to explain to
colleagues from abroad that this Forum works on the basis of equal participation by
representatives of providers and users of payment systems.
And, if you'll forgive me this reference to water after what I said earlier: before we start work
on, say, a project to build water defences, we first put up a coffee hut at the site. Setting up
the coffee hut is not our main task, but we would not want to be without it as that is where we
agree who is going to do what during the project. This is also a model that could prove useful
in a European context. As you may know, there is a SEPA Council at a European level, and I
have attended its meetings on various occasions. But the SEPA Council still has too few
powers to make a real impact. However, and despite all the good aspects of the polder
model, we also have to admit, in the current climate, that not everything can be done in an
atmosphere of cooperation and consultation. Not everything can be voluntary. With the
exception of our new SEPA task, DNB's oversight task is still based on a voluntary
agreement, and that is no longer appropriate for the times we live in.
The payment system has become far too crucial for society to allow oversight of the relevant
players to remain entirely voluntary. We really need legislation in this respect, and indeed
some of this legislation is on its way.
The Settlement Organisations (Financial Supervision) Act [Wet Financieel Toezicht voor
Afwikkelondernemingen] will come into force next year.
Although this will certainly provide a legal basis for our oversight activities, it will not plug all
the gaps. We are still not allowed to impose measures on organisations such as iDeal, for
example, and there is no need for me to tell you how tolerant society is about iDeal
disruptions.
To ensure secure, reliable and efficient payment systems in a broad sense, DNB needs
legislation covering every aspect involved in these systems. That is something we are
currently discussing with the Ministry of Finance, and I certainly hope we succeed as the
payment system is simply too important for us to be satisfied with the current patchwork of
laws. We need a single consistent framework so that we can supervise all the links in the
horizontal chain of the payment system. We still do not have that single framework, and that
is something that today's world demands.
And now I am coming to my third and final point: the security of the payment system. In April
this year various Dutch banks in the Netherlands were hit by a series of DDOS attacks, and
this is a matter of great concern to DNB.
Fighting cybercrime and dealing with the digital disruption it causes are high priorities for us.
Last month I attended discussions at the Dutch House of Representatives to explain my
views on these subjects.
Society has become less tolerant about disruptions to the payment system as more and
more people are using on-line payment products, and consumers increasingly expect
payment systems always to work. Those are facts we have to accept. We also have to
accept, however, that 100% availability is an illusion. That is just impossible.
So what can we do? There are three things we have to work on:
1. Prevention
2. Damage limitation if and when things go wrong, and
3. Communications.
In the case of prevention, I believe that we as a sector are going to have to focus more on
security and availability. And yes, that may mean we have to accept that systems will
sometimes be less efficient than otherwise. By harmonising systems and technologies we
can certainly boost efficiency. But this also creates SPOFs, or single points of failure, and
these make us vulnerable and, therefore, a more attractive target for cybercriminals. And
although I always sleep extremely well at night, cybercrime does sometimes mean I go to
bed later. A lot of parties are working extremely hard to avoid becoming victims of
cybercrime. But we can never rest on our laurels. It is a race, and the enemy never sleeps.
There is one other aspect I would specifically like to draw your attention to, and that is the
need for diversity. In other words, the need for alternatives. If we cannot use iDEAL, but
another easy-to-use alternative is available, that is fine. But that means that the alternative
must not be reliant on the same technology as iDEAL. Diversity in technology is important.
Also when you make PIN payments in a shop. If the PIN terminal does not work, you need to
be able to pay in another way, and using a method that is not dependent on that PIN
technology. We are now thinking about these alternatives, and maybe a more mobile society
will help us in this respect. What I mean here is that technology has become more mobile.
Mobile internet banking, for example, is becoming increasingly popular, and mobile
payments are on the way. In other words, the distinction between point-of-sale and remote
payments is becoming blurred, and maybe it will ultimately disappear altogether.
If the various technologies become equally fast, it will soon no longer make any difference
whether you use your phone to make a mobile payment (a PIN payment, for example) or an
internet banking payment (in other words, a transfer).
If I put my security hat back on, I would say that is fine, but we do need to make sure we use
two different technologies. Otherwise, a single cause could result in both payment options
being unavailable at the same time.
Some of these changes are still in the future. But the issue also applies to the old tried and
trusted alternative of cash. If the PIN system does not work, you need to be sure you can still
get cash out of the cash machine.
And luckily that is not usually a problem because you withdraw cash from your own bank's
cash machine system, which is separate from the PIN system. So there, too, technological
diversity is important.
And so, to go back to what I mentioned before, our resilience to cybercrime relies on our
having good preventive measures in place and also on our having good mitigating measures,
just in case things go wrong.
Communications, however, are also important, which is why this topic was discussed at the
extra meeting held by the National Forum on the Payment System on 15 April. We reached
various useful agreements during this meeting, and these require us to be able to
communicate very quickly. And in this case "very quickly" means that communications may
often first have to be limited to process-related information.
We also reached agreements on the need to communicate better. In other words, on who will
communicate what in which circumstances. In the first instance, the bank that has been
affected will communicate. If, however, the problem is more widespread, the Netherlands
Bankers' Association (NVB) will communicate on behalf of the sector.
DNB will communicate only if the payment system as a whole is at risk. Or, to put it more
accurately, the Tripartite Crisis Organisation (TCO) will communicate. DNB chairs the TCO,
while the AFM and the Ministry of Finance are the other two members. DNB, or rather the
TCO, will act as "communicator of last resort". That is a role we are suited to. Will it mean we
can avoid any form of disruption in the future? No. No-one can give any guarantee of that as
there is simply no such thing as a risk-free society.
Lastly I would like to look ahead to the future. We should not see SEPA as being finished by
1 February 2014. That date is really just the start. We are going to be seeing other
developments, including electronic mandates, and probably more and more mobile
payments.
Time and experience will refine and change our payment products. And DNB is looking with
interest at our neighbours to the east and the shorter transfer times they are achieving on
SEPA Direct Debits. SEPA's arrival will also change the playing field for payment service
providers and banks, and innovative parties will grasp their opportunities. One of these
innovations will involve parties wanting access to payment accounts so that they can offer
new services.
The Dutch payment sector has issued a position paper on this subject and has sent this to
Europe. There is one issue in that paper, however, where our view may not get accepted,
and that is the "dual consent" approach. Just to remind you what that is, it covers situations
when a third party wants access to a person's payment account, either to make a payment or
to check the balance. That involves certain risks. In my view, those risks are acceptable only
if both the consumer and the bank agree to the role of the third party. One good way of
arranging this is for both parties to have to agree to grant access. In other words, dual
consent.
Our European colleagues are worried that, in practice, banks will not grant access to those
third parties, and that this will hold back innovation. That is why there is currently insufficient
support for the principle of "dual consent". The Dutch market, however, is in favour of it, and
so that is the challenge I am issuing to any payment service providers and banks here today.
Show that it can be done. There is nothing to stop us from operating a "dual consent"
approach in the Netherlands. And I for one would welcome it.
"Dual control" is also secure, and I am sure no-one will blame me for saying that security is
my top priority. And I think that you and the rest of society will probably all agree. Innovation
is good, and even very good. But if your bank balance suddenly and innovatively disappears,
you would wish that security had been the number one priority. People have to be able to
trust that their payments will arrive in the right place and at the right time. The routes that
monetary flows take need to be predictable and known.
Ladies and gentlemen,
It is now time for some rhetoric. If you have read Quintillianus, you will know that this is when
I should return to my metaphor. In other words, to the metaphor that I threw overboard at the
start of my speech. The metaphor of SEPA as a wonderful new waterway, with neatly
finished retaining walls and an efficient system of locks. But I am not going to do that today.
Instead I am going to tell you that there is a conference on water management being held
tomorrow in Rotterdam and that you might find it interesting.
Thank you for listening.