However, most BSPs do not realize the gravity or scope of the internal control risks that will emerge from this whole transaction fabric. Any auditor can, within an afternoons' work, identify dozens and perhaps hundreds, of separate points in this architecture, where a bewildering variety of players could potentially steal money. Link the separate applications together and the scale of the control problem is multiplied. When a webledger provider provides banking services, in effect there will not be any difference between books and bank. This is categorically different from the internal control systems of the past.
Accountants have no experience other than segregation of duties within the company.
Even the decades of system experience by banking regulators leaves them unprepared for a situation where customers would be literally helpless to detect balance fraud because the subscribers' general ledger is automatically kept equal to the bank. There is an intrinsic, inverse relationship between greater integration and internal control. Every point of excess labor, duplication or separation that is removed from a business process usually removes certain components of internal control, but it less often removes the associated risk. Any webledger that doesn't have payments-grade security should not be in business. Full, payments-grade security is a baseline requirement for a general ledger, because any thief who can get into your general ledger, AR, AP or inventory accounts, can convert some of it to cash.