Financial Technology: Additional Steps by Regulators Could Better Protect Consumers and Aid Regulatory Oversight
Released: 2018-03-22T00:00:00

Letter

Background

Fintech—originally short for financial technology—refers to the use of technology and innovation to provide financial products and services. For purposes of this report, fintech firms are nontraditional technology- enabled providers, such as start-ups or more established technology firms, such as Apple or Google, that are offering traditional financial products or services to consumers. Fintech products or services are typically provided—sometimes exclusively—through the Internet or via mobile devices, such as smartphones, rather than being provided through face-to-face visits to financial institution branches.

The products and services that fintech firms offer include: payments between individuals, and between individuals and loans to consumers and businesses; advice on wealth management or general financial activities; and distributed ledger technology used to make payments, record and track asset ownership, and other purposes.

Fintech Payments

Various fintech firms offer ways for individuals to make payments and transfer value, including for purchasing goods or services or for transferring money to individuals domestically or internationally. The payments offered by these providers are often conducted using applications (apps) on smartphones or other mobile devices. Often these fintech payments involve the use of accounts linked to existing debit or credit cards and are processed through the existing networks and channels for these types of payments. In some cases, fintech providers may also route their payments through the Automated Clearing House networks, which have traditionally been used to facilitate automatic bill paying to utilities or other merchants or funds transfers between banks. Fintech payments can also be made by charging a consumer’s phone bill. For example, consumers can send charity contributions via text or charge in-app purchases to their mobile phone bill.

One common fintech payment method involves mobile wallets, or electronic versions of consumers’ wallets, which offer consumers the convenience of conducting transactions without having to enter credit or debit card information for each transaction. Using a mobile wallet, consumers can store payment card information and other information on their mobile devices that is often needed to complete a purchase. Generally, mobile wallets replace sensitive information with random values—a process called tokenization—to provide greater security when making a payment, and transmit this information using existing credit and debit card networks. A variety of fintech firms provide mobile wallets, including Apple, Google, and Samsung.

Consumers may use mobile wallets to make payments to other consumers or to businesses; in mobile applications; through mobile browsers; or in-person at a store’s point-of-sale terminal. Some providers, such as Paypal and Venmo, allow individuals to create accounts on mobile devices to make payments funded by debit or credit cards, as well receive and store funds sent to the account owner that can be used to make payments to others or buy goods from merchants. Figure 1 illustrates how a mobile wallet enables the payment information to be transferred by allowing compatible devices to exchange data when placed in very close proximity to each other using various technologies, such as wireless communication.

Regarding the total volume of payments by fintech providers, the association representing state banking supervisors estimated that fintech payment firms were likely used to facilitate payments or currency exchanges of up to $189 billion in the first 2 quarters of 2017. In a 2016 report on consumers’ use of mobile financial services, the Federal Reserve’s survey of more than 2,220 respondents found that over 30 percent of consumers aged 18-44 had made payments using mobile phones sometime during 2015. According to a report by the Smart Payment Association, 200,000 locations accepted Apple Pay when it was launched in September 2014, but by February 2016, this number had reached 2 million. According to Paypal, it had 218 million active customer accounts at the end of the third quarter of 2017 and processed over 6 billion payments valued at more than $354 billion in 2016.

Fintech Lending

Fintech lenders—often referred to as marketplace lenders and which operate almost exclusively online —offer a variety of loan types and may use different sources of funds than traditional lenders. The types of loans offered by fintech providers include consumer and small business loans. While these lenders may use traditional means of assessing borrowers’ creditworthiness, such as credit scores, they also may analyze large amounts of additional or alternative sources of data on other aspects of borrower characteristics, such as information from bank accounts, to determine creditworthiness.

Fintech lenders can follow various models. For example, some conduct person-to-person lending in which loans are financed by individual investors. In other cases, the funds for these loans can come from institutional investors such as hedge funds, financial institutions, or from notes sold to individual investors. In some cases, funding for loans is obtained by securitizing previously-made loans and selling securities backed by the cashflows from the underlying loans. The fintech lenders that use external capital are referred to as direct lenders and include such firms as SoFi and Earnest. Figure 2 below shows the flow of funds for typical direct lenders.

Other fintech lenders include lenders that partner with depository institutions—including banks or credit unions—to originate loans that are then purchased by the lender or by another investor. Examples of lenders partnered with depository institutions include LendingClub Corporation, Prosper, and Upstart. Figure 3 shows the flow of funds for such lenders. Some lenders, such as OnDeck, have now developed hybrid models, selling some whole loans to institutional investors while retaining servicing responsibilities.

One firm that tracks fintech activities reported that the volume of lending by 13 of the most significant lenders had reached about $61 billion as of the end of September 2016, and other market monitors estimate that fintech lending volumes could grow to as much as $90 billion to $122 billion by 2020.

Fintech Wealth Management and Financial Advice

Fintech firms are also offering wealth management or other financial advice, some with minimal or no human interaction. For example, new firms called robo-advisers are offering investors advice using algorithms based on these investors’ data and risk preferences to provide advice on recommended asset holdings and allocations. Fintech firms offering these advice services include Betterment, Personal Capital, and Wealthfront. Figure 4 illustrates a typical case of a consumer using a fintech wealth management adviser.

One research firm estimated in July 2017 that robo-adviser firms would have as much as $1 trillion in assets under management by 2020 and as much as $4 trillion by 2022.

In addition, some fintech firms—referred to as financial account aggregators—allow consumers to aggregate the information from their various financial accounts, including their assets in bank accounts and brokerage accounts, to enable them to better see their financial health and receive advice on alternative ways to save money or manage their finances. Consumers can access this combined information either online or on mobile devices. Account aggregator firms offering this type of advice on savings and other activities include Mint and HelloWallet.

Distributed Ledger Technologies

Distributed ledger technology (DLT) is a secured way of conducting transfers of digital assets in a near real-time basis potentially without the need for a central authority. DLT involves a distributed database maintained over a network of connected computers that allows network participants to share and retain identical cryptographically secured records. Such networks can consist of individuals, financial entities, or other businesses.

Blockchain is one type of DLT. A blockchain is a shared digital ledger that records transactions in a public or private network. Distributed to all members in the network, the ledger permanently records, in a sequential chain of cryptographically secured blocks, the history of transactions that take place among the participants in the network. DLT products can have different types of access control. For example, some may be “unpermissioned” (public) ledgers that are open to everyone to contribute data to the ledger and have no central control, while others may be “permissioned” (private) ledgers that allow only certain participants to add records and verify the contents of the ledger.

The financial services industry has identified various potential uses for DLT. These include tracking international money transfers or tracking the changes of ownership of various financial assets, such as or securities like bonds or stocks or derivatives like swaps contracts. In addition, DLT is being used to track ownership of bitcoin, a virtual currency, specifically using a blockchain.

Some companies are using DLT to raise funds. According to a recent bulletin by U.S. securities regulators, these virtual coins or tokens are being created and then disseminated using DLT as part of offerings known as token sales or initial coin offerings. As part of these token sales, purchasers may use fiat currency (e.g., U.S. dollars) or virtual currencies to buy these virtual coins or tokens. Currently, the capital raised from the sales may be used to fund development of a digital platform, software, or other project; or, the virtual tokens or coins may be used to access the platform, use the software, or otherwise participate in the project. After they are issued, in some cases the virtual coins or tokens may be resold to others in a secondary market on virtual currency exchanges or other platforms.

Various Regulators May Oversee Fintech Activities

A variety of federal and state regulatory bodies may oversee fintech firms or their activities to the extent these firms provide a regulated payment; lending; wealth management; or distributed ledger technology service or activity. Table 1 explains the basic functions of the relevant federal regulators.

In addition to the federal regulators above, various state entities also conduct regulatory activities over fintech firms operating within their jurisdictions. According to the association representing state regulators, state financial services regulators license and supervise activities, such as money transmission, consumer lending, and debt collection, irrespective of technology deployed. Nonbank financial service providers that offer services directly to consumers are likely subject to state oversight. In addition to state financial services regulators, state securities regulators, state entities that oversee corporate activities, and state attorneys general have jurisdiction over certain fintech firms. In general, these entities may have authority to license or register firms, conduct exams, and take enforcement actions for violations of state laws or regulatory requirements.

Fintech Activities Can Provide Benefits and Pose Risks to Consumers and the Broader Financial System

Fintech products in payments; lending; wealth management; and distributed ledger technology can provide consumers and the broader financial system with various benefits but may also pose risks similar to those of traditional products. While existing laws apply to fintech products and services in most cases, some products pose additional risks that may not be sufficiently covered by existing laws.

Fintech Products Can Provide Various Consumer Benefits

According to our prior work, literature we reviewed, and stakeholders we interviewed, consumer benefits of fintech products include greater convenience; lower cost; increased financial inclusion; faster services; and improved security.

Greater convenience: Consumers can use fintech products and services on their mobile device to make payments; transfer money; easily obtain payment for shared expenses; obtain loans; or to receive investment advice without the time and expense of visiting a financial service provider’s physical location. They can also access these services outside of standard business hours. In addition, the ability to see information from all of their financial accounts together in a single dashboard provided by an account aggregator is more convenient than reviewing information from each account on separate statements.

Lower cost: Innovations in payments, including the use of DLT, could reduce the cost of payments for consumers. For example, one fintech firm uses DLT to reduce the operational and liquidity costs traditionally incurred with some international payments. Some fintech providers do not charge fees for payments, so consumers save by avoiding paying for checks or incurring automated teller machine fees. In addition, because fintech providers often do not have overhead costs associated with physical locations and use automation instead of relying on large staffs to provide services, they may be able to pass these cost savings on to consumers. For example, according to a Treasury report, automated loan processing, underwriting, and servicing may allow fintech lenders to offer lower rates or fees on their loans because they have to hire fewer loan officers. Similarly, automation in robo-advising could allow consumers to obtain investment advice at a lower cost than if they obtained services from a firm that relied more heavily upon human advisers.

Increased financial inclusion: Using alternative data may allow fintech lenders to offer loans to consumers whose traditional credit history may have been insufficient for banks to extend them credit. CFPB officials stated that using alternative data—including bill payment history as a proxy for debt repayment—could expand responsible access to credit, particularly to some consumers who are among the estimated 45 million people who lack traditional credit scores. Similarly, a study by FDIC staff noted that fintech accounts may also enable consumers whose traditional accounts are closed due to lack of profitability for the provider or other reasons to continue to have access to financial services. Also, robo-advising services can make investment advice more accessible to consumers who cannot meet account minimums at traditional advisers by offering lower account minimums.

Faster services: Automation may reduce transaction times for services like loan approval or investment advice. Stored payment data in fintech providers’ mobile wallets may reduce transaction time for online purchases because consumers do not need to reenter billing information. Further, such data may reduce transaction time for in- store purchases because transactions using contactless payments are faster than transactions using card readers and cash. Peer-to- peer payments made via mobile wallets may transfer money faster than checks. Also, using DLT may greatly reduce settlement times for currency, derivatives, and securities transactions by improving processes or reducing the number of entities involved in a transaction. For example, one firm is using DLT to reduce settlement for securities from 2 days to the same day.

Improved security: While credit and debit transactions have traditionally transmitted sensitive information that can be hacked and used to make fraudulent transfers, fintech providers’ mobile wallets generally replace this sensitive information with randomly generated numbers that mitigate the risk that transaction information can be used fraudulently (tokenization), according to the Federal Reserve’s Mobile Payments Industry Workgroup. Similarly, while lost or stolen credit and debit cards can be used to make fraudulent payments, a lost or stolen mobile device can have security features that protect a mobile wallet from unauthorized use. For example, according to FTC, mobile device features such as device passwords, fingerprint readers, and face recognition software can help protect consumer accounts from unauthorized access. Additionally, FCC notes in a consumer guide that consumers’ ability to disable their mobile devices remotely can help prevent fraudulent use of a consumer’s fintech provider accounts if their mobile devices have been lost or stolen. Further, mobile device Global Positioning System (GPS) data can help identify suspicious activity in consumer accounts or to ensure that a mobile phone being used at a particular merchant is actually at that location, according to the Federal Reserve’s Mobile Payments Industry Workgroup and others.

Fintech Products Generally Pose Consumer Risks Similar to Those of Traditional Products

The literature we reviewed and stakeholders we interviewed also identified potential risks fintech products pose to consumers, including fraud, discrimination, and unsuitable advice. In general, these risks are similar to those posed by traditional financial products. While laws that apply to traditional products also apply to fintech products in most cases, some fintech products pose additional risks that may not be sufficiently addressed by existing laws. While the legal framework for consumer protection applies to many of the risks associated with fintech products, the extent to which consumers benefit from these protections is a function of the existing regulatory framework and its coverage of fintech activity. We discuss the regulatory framework for fintech products in greater detail later in this report.

Fintech Payments

Consumers face the risk of unauthorized transactions regardless of whether they use a traditional or fintech firm to make payments. CFPB officials we interviewed told us that some fintech products, such as mobile wallets, increase the number of firms involved in a transaction, which may increase the risk of unauthorized transactions. However, when consumers fund their mobile wallets by linking to traditional funding sources—debit or credit cards or bank accounts—consumer protection laws such as the Electronic Fund Transfer Act and the Truth in Lending Act generally apply. These acts and their implementing regulations provide that consumers can dispute charges to these accounts and liability for losses may be limited to $0 if disputes are made within specified time frames.

Consumer protection laws, such as the Electronic Fund Transfer Act, which apply to traditional funding sources, do not yet cover payments funded by mobile wallet balances or mobile carrier billing. To address this gap in protections for mobile wallet funds, CFPB issued a final rule on prepaid accounts that will extend protections for error resolution and liability for unauthorized transfers to prepaid account and mobile wallet balances. This rule had previously been scheduled to become effective in April 2018, but in January 2018, CFPB delayed the effective date of the rule to April 1, 2019. However, fintech firms we interviewed told us that even when certain consumer protections are not required by statute or regulation, they voluntarily provide similar protections and disclose these protections in their terms of service.

Agencies have also issued tips for consumers to safeguard their mobile devices and identify fraudulent payments. Similarly, wireless carriers have taken steps to mitigate fraudulent billing in response to enforcement actions, including offering services that prevent third parties from adding charges to consumer bills without consumers’ knowledge or permission— a practice known as “cramming.” However, FCC has found that fraudulent billing continues to be a problem. FCC’s July 2017 proposed cramming rule seeks to codify the agency’s existing prohibition against fraudulent billing through language explicitly prohibiting wireless carriers from placing third-party charges on consumers’ bills without consumer verification. In addition, FCC and FTC have issued tips for consumers and firms publicizing practices that help avoid cramming.

Consumers also face the risk their funds could be lost due to the failure of their payment provider. Although consumers with funds in a bank account have protection from this risk through federal deposit insurance up to $250,000, consumers with funds in a mobile wallet may not be similarly protected. To address this risk, some fintech firms deposit consumers’ mobile wallet balances into an FDIC-insured bank or savings association, resulting in the funds being insured by FDIC up to the applicable deposit insurance limit in the event of the failure of the bank or savings association. Other fintech firms voluntarily disclose to consumers in their terms and conditions that any mobile wallet balances they hold are not FDIC insured. However, according to the Conference of State Bank Supervisors (CSBS), 49 states have laws that require fintech firms engaged in money transmission or stored value to self-insure through bonding, holding investments against funds held or transmitted, and meeting minimum net worth requirements.

Further, consumers face the risk that their mobile wallet balances will not be accessible in a timely manner. Under the Expedited Funds Availability Act, banks are required to make customers’ deposited funds available to them within prescribed time frames. For example, banks are typically required to make funds a customer receives through an electronic transfer available by the next business day. However, as nonbanks, fintech firms are not subject to this act’s requirements and therefore do not have to make mobile wallet balances available under the same time frames. For example, one fintech firm we interviewed told us that most transfers from mobile wallets to bank accounts make funds available by the next business day, but certain circumstances, such as suspicious account activity, may cause the firm to delay transfers a few days. Another fintech firm we interviewed told us that transfer amounts are limited based on anti-money laundering requirements. However, fintech firms we spoke with voluntarily disclose the availability of funds and any limits on access in the terms and conditions provided to customers when they create their accounts. However, FTC recently settled with a fintech payment provider for delays in fund accessibility experienced by its users. In its complaint, FTC charged that the firm had failed to disclose that these funds could be frozen or removed based on the results of the firm’s review of the underlying transaction. As a result, consumers complained that at times, the firm delayed the withdrawal of funds or reversed the underlying transactions after initially notifying them that the funds were available.

Fintech Lending

Consumers face risks associated with unclear terms and conditions regardless of whether they borrow from a traditional or fintech lender. For example, consumers could have difficulty understanding their repayment obligations or how those terms compare to terms offered by other lenders. However, the Truth in Lending Act requires lenders to provide consumers with standardized, easy-to-understand information about the terms of the loan and enables consumers to make claims against lenders for violating Truth in Lending Act requirements.

Consumers also face risk of discrimination and unfair credit practices regardless of whether they borrow from a traditional or fintech lender. However, these risks may not be fully understood with fintech lenders that use alternative underwriting standards and consumer data—such as information on rent payments and college attended. For example, fintech firms assessing applicants’ creditworthiness with criteria highly correlated with a protected class—such as race or marital status—may lead to a disproportionate negative effect. As with traditional lenders, federal fair lending laws, such as the Equal Credit Opportunity Act, apply to fintech lenders. In addition, some fintech lenders have taken steps that aim to address this risk. For example, one fintech lender said it monitors the effect any changes to their underwriting models may have on fair lending risk.

Consumers face risk of harm due to inaccurate credit assessments, but these risks are also less understood with fintech lenders that use alternative data to underwrite loans. For example, inaccurate data or models used by a fintech lender could classify borrowers as higher credit risks than they actually are. This could result in those borrowers paying unnecessarily high interest rates and increasing their risk of default or could result in creditworthy borrowers being denied credit. Whereas the Fair Credit Reporting Act requires that borrowers have an opportunity to check and correct inaccuracies in credit reports, borrowers could face more challenges in checking and correcting alternative data that some fintech lenders use to make underwriting decisions because alternative data are not typically reflected in credit reports. However, the Equal Credit Opportunity Act requires lenders, including fintech lenders, that deny credit to applicants to disclose the specific reasons for denial. Alternatively, if the fintech lender’s underwriting is too lax, loans could be made to borrowers who lack the ability to repay them. Borrowers who default under these circumstances then face limited access to and higher prices for credit in the future.

Fintech Wealth Management

Consumers face risks of receiving unsuitable investment advice regardless of whether they obtain advice from a traditional or robo- adviser. While a human adviser may be able to mitigate this risk by probing consumers for more information to assess needs, risk tolerance, or other important factors, a robo-adviser’s ability to mitigate this risk may be based on a discrete set of questions to develop a customer profile. In addition, advisers could make inaccurate or inappropriate economic assumptions, perhaps due to a failure to factor in changing economic conditions, which could result in flawed investment recommendations. While human advisers may be able to mitigate this risk to some degree based on their ability to adjust to economic conditions, a robo-adviser’s ability to mitigate this risk is based on whether its algorithm has been updated to reflect the most recent economic conditions. Because, as we discuss below, robo-advisers generally are required to comply with the same requirements as traditional investment advisers, customers of robo- advisers and traditional advisers receive the same protection from these risks.

Consumers who use fintech services that provide an aggregated view of their accounts at other financial institutions could potentially be more exposed to losses due to fraud. If a consumer authorizes an account aggregator to access their financial accounts and grants the aggregator authority to make transfers, the consumer may be liable for fraudulent transfers made. CFPB is studying risks associated with entities that rely on access to consumer financial accounts and account-related information, and has issued a related request for information (we address this issue later in this report).

Distributed Ledger Technology

DLT can be used to issue and distribute digital assets known as tokens to consumers and investors. Virtual currencies—tokens that are digital representations of value that are not government-issued legal tender— could pose some unique risks to consumers. For example, the ability of virtual currency users to recover funds lost due to fraud or errors may be more limited than that of customers using traditional products like payment cards or bank transfers to make payments. Whereas traditional transactions can be reversed to correct fraud or errors, many virtual currency transactions are designed to be irreversible. Also, unlike storing dollars in a bank account, if a consumer stores their virtual currency in a mobile wallet, their wallet provider may disclaim responsibility for replacing virtual currency that is stolen. Further, CFPB’s prepaid accounts rule, which will extend consumer protections to prepaid cards and mobile wallets with stored value, explicitly does not extend consumer protections to virtual currencies. However, firms that transmit, exchange, hold, or otherwise control virtual currency may be subject to state consumer protection law.

In addition to fraud and errors, consumers who use virtual currencies may face other risks of loss. Federal deposit insurance does not apply to virtual currency balances. As a result, according to FDIC staff, consumers could face losses if they store their virtual currencies with a mobile wallet firm that goes out of business unless the firm offers private insurance. Further, if consumers store their virtual currency on their own and misplace or forget their account access information, they may lose access to their funds. Unlike bank accounts for which users can reset passwords or usernames, some wallets do not offer a way to reset such information. To help consumers address these risks, federal agencies and state regulators have issued documents publicizing practices that may help consumers use virtual currency more safely.

Tokens—which may also function similarly to a security—could pose some unique risks to investors, and some investor protections may not be available. Token sales, sometimes known as initial coin offerings or ICOs, are being used by firms to raise capital from investors and may pose investor risks, including fraud and theft. For example, one firm allegedly promised investors it would invest its token sale earnings in real estate, but instead allegedly defrauded investors of their investments. Fraud and theft are risks of other securities offerings, and investors receive protections from these risks under the Securities Act of 1933 and the Securities Exchange Act of 1934 for token sales that meet SEC’s definition of a security. However, these protections do not apply to investors who participate in token sales that do not meet the definition of a security. In December 2017, SEC issued a cease-and-desist order to one firm for failure to register their token sale with SEC. In addition, SEC has reported that an investor’s ability to recover funds may be limited if key parties to token sales are located overseas or operating unlawfully. To help investors address these risks, SEC and FINRA have issued documents publicizing risks of token sale investment.

Tokens traded on a platform may also be considered commodities and may pose investor risks including fraud and theft. Platforms that facilitate leveraged, margined, or financed trading of tokens may be subject to a requirement to register with the CFTC. To help investors understand tokens, CFTC has issued a report publicizing potential risks of virtual currencies and clarifying cases in which investors may be at risk because CFTC does not have oversight authority. For example, virtual currency and token exchanges that conduct certain spot or cash market transactions but do not use leverage, margin, or financing are not required to follow all of the rules that regulated exchanges are required to follow.

DLT applications may pose other unknown risks compared to the technologies and processes they replace, given that the technology is in the early stages of development. For example, CFTC and the Federal Reserve have identified cybersecurity and operational risks as potential risks of DLT. FDIC officials said that finality of a transaction under a DLT settlement may potentially raise legal challenges. Also, applications of DLT that depend on consensus for validating transactions are vulnerable to a “51 percent attack,” which could defraud consumers by revising their transactions or sending fraudulent payments. However, according to market observers, such an attack is unlikely and has not been carried out.

Fintech Products Can Pose Other Risks to Consumers; Risks to the Broader Financial System Are Unclear

Consumers face the risk of financial loss due to data breaches regardless of whether they use a traditional or fintech firm, and these breaches could undermine the financial system by eroding consumer trust in financial institutions. Similar to traditional products and services that collect sensitive consumer information and are connected to the Internet, fintech products and services may be vulnerable to cyberattack and can pose data security risks. In addition, one market observer we interviewed told us that hackers may target these new fintech firms before their security systems are mature.

However, according to literature we reviewed and fintech firms and market observers we interviewed, some fintech firms have adopted technologies or practices designed to mitigate security risks. For example, new fintech firms can use the latest information technology systems to secure their products instead of having to update older systems. Additionally, as discussed above, some fintech firms use new techniques and leverage mobile device features to enhance data security, and one fintech firm said that it also uses technology that contacts clients if a data breach issue arises. Like traditional financial institutions, rules and guidelines implementing the Gramm-Leach-Bliley Act (GLBA) generally require fintech firms to secure customer information. In addition, some regulators have issued guidance to consumers publicizing practices that help avoid security problems when using fintech products. Regulators have also issued guidance to businesses including fintech firms that recommends that they adopt policies and procedures that address the prevention and detection of, and response to, cybersecurity threats. For example, the New York State Department of Financial Services requires regulated entities to meet cybersecurity requirements outlined in regulation.

Some fintech firms may also pose privacy concerns because they may collect more consumer data than traditional firms. For example, fintech lenders that use alternative data in underwriting may have sensitive information about consumers’ educational background, mobile phone payments, or other data. One fintech firm we spoke with requires consumers to provide additional data, such as what a payment is for, in order to make peer-to-peer payments. Some data aggregators may hold consumer data without disclosing what rights consumers have to delete the data or prevent the data from being shared with other parties. A leak of these or other data held by fintech firms may expose characteristics that people view as sensitive. GLBA generally requires fintech firms and traditional financial institutions to safeguard nonpublic personal information about customers. According to literature we reviewed and fintech firms and market observers we interviewed, as with data security, some fintech firms use new technologies or mobile device features to mitigate data privacy risks. In addition, some regulators have issued guidance to consumers publicizing practices that help maintain privacy when using online products and services, including those provided by fintech firms. Regulators have also issued GLBA guidance to businesses including fintech firms recommending that they adopt policies and procedures to prevent, detect, and address privacy threats.

Similar to traditional products and services, fintech products may be used to facilitate illicit activities, including money laundering, terrorist financing, and evading sanctions program requirements. For example, in 2015, the Financial Action Task Force (FATF) reported that new payment methods pose an emerging terrorist finance vulnerability because users can access these methods from anywhere in the world and it is difficult for enforcement agencies to identify the beneficiary. However, FATF found that the extent to which terrorist groups actually exploit these technologies is unclear and said that enforcement agencies should monitor these risks for developments. Further, FATF has stated that fintech innovations provide an opportunity to bring anti-money laundering efforts into the 21st century by reducing dependency on cash and informal systems and making it easier for authorities to detect and follow illicit financial flows. Relevant laws that prohibit financial crimes apply to fintech products. For example, the Bank Secrecy Act (which established reporting, recordkeeping, and other anti-money laundering requirements) and economic sanctions programs (which create economic penalties in support of U.S. policy priorities) apply to all financial firms that transmit money regardless of whether they use traditional or fintech products.

Finally, market observers have questioned whether fintech activities could create risks to overall financial stability, but many have said such risks are relatively minimal due to fintech firms’ small market presence. While direct or indirect linkages between large financial institutions could lead financial problems at one firm to create similar problems for other firms that can undermine financial stability, studies by regulators in various countries and international organizations found that fintech firms have not generally reached a level of interconnectedness where their financial distress would threaten the stability of other financial system participants. For example, the Bank for International Settlements and the Financial Stability Board reported that in 2015 fintech accounted for 2 percent of new credit in the United States. Additionally, after assessing virtual currencies, the European Central Bank concluded in a November 2017 report that virtual currencies were not a threat to financial stability due to their limited connection with the real economy, their low volume traded, and the lack of wide user acceptance.

However, the Financial Stability Board and other market observers have noted that fintech firms could potentially affect financial stability in both positive and negative ways as the activities and firms evolve. For example, fintech firms could help decentralize and diversify the financial services market, and they could diversify exposure to risk by increasing access to financial services for consumers and small businesses. On the other hand, providers could potentially also increase risks to financial stability. For example, robo-advisers could amplify swings in asset prices if their risk models rely on similar algorithms, making the portfolio allocation methods of robo-advisers more highly correlated than those of traditional advisers, although according to the Financial Stability Oversight Council, this risk could also arise if traditional advisers follow similar allocation strategies. Similarly, according to the Financial Stability Board, fintech lenders could potentially amplify swings in credit availability if the investors that fund many marketplace lending products are more willing to fund loans during market upturns or less willing to fund loans during market downturns. To help balance these potential benefits and risks, the Financial Stability Board recommended that international bodies and national authorities continue to monitor the issues and consider the effects of fintech in their risk assessments and regulatory frameworks.

Fintech Firms’ Compliance with Applicable Laws Is Subject to Varied Federal Oversight

The extent to which fintech firms are subject to federal oversight of their compliance with applicable consumer or other laws varied. Fintech firms that offer investment advice typically register with and are subject to examinations by federal securities regulators. Some fintech firms providing payments or loans that have partnered with federally regulated banks or credit unions may receive indirect oversight from federal financial regulators as part of their efforts to ensure that their regulated entities are adequately managing the risks of these arrangements. Nonpartnered fintech firms would not typically be subject to routine examinations by a federal financial regulator but would instead be subject to state regulatory oversight and enforcement. While fintech firms and financial institutions are subject to different degrees of routine federal oversight, we found that indications of fintech firms causing widespread harm were limited as they were subject to fewer complaints than large financial institutions.

Fintech Firms Providing Investment Advice Are Subject to the Same Oversight as Traditional Financial Institutions

Fintech robo-advisers offering wealth management advice would generally be subject to the same federal and state oversight as traditional investment advisers. Under the Investment Advisers Act of 1940 and state securities laws, any entity or individual that offers investment advice for compensation generally must register as an investment adviser—with SEC or states—and adhere to various reporting and conduct requirements. When providing advice, investment advisers—traditional or fintech—are considered fiduciaries to their clients, which means they owe a duty of care and loyalty to their clients, and they must disclose all actual or potential conflicts of interest, and act in their clients’ best interest. To review for compliance with this standard and other applicable requirements, staff from SEC and state securities regulators conduct examinations of registered investment advisers. Specifically, state regulators are responsible for conducting examinations of investment advisers that operate in fewer than 15 states and hold client assets under management of less than $100 million. However, according to staff from the North American Securities Administrators Association—a membership organization for state, provincial, and territorial securities administrators in the United States, Canada, and Mexico—no robo-adviser firms were solely regulated by the states as of October 2017.

Fintech Firms That Partner with Financial Institutions May Be Subject to Indirect Federal Financial Regulator Oversight

Some fintech firms may be subject to indirect federal oversight as part of relationships they have entered into with regulated financial institutions. If fintech firms partner with federally-regulated financial institutions, such as a bank or credit union, federal financial regulators may conduct examinations of the regulated financial intuition that could include some review of the extent to which the fintech firm may affect the partner financial institution’s adherence to relevant regulations through the services provided to the financial institution. Regulators conduct these examinations in order to assess the risk to the regulated institution because the failure of the fintech firm to follow such laws could expose the bank or credit union to financial or other risks.

As part of the indirect oversight of fintech firms, the financial institution would be expected by its regulators, under various third-party guidance issuances by these regulators, to ensure that any risks to the institution resulting from the relationship with the fintech firm are assessed and mitigated. Among other things, banks and credit unions should conduct due diligence on potential third-party partners, including having a process within the institution for managing the risks posed to their institution by the third party. For example, OCC third-party guidance states that banks should adopt risk management processes that are commensurate with the level of risk and complexity of the third-party relationship. These processes include establishing risk-mitigating controls, retaining appropriate documentation of the bank’s efforts to obtain information on third parties, and ensuring that contracts meet the bank’s compliance needs.

Although fintech firms partnering with federally regulated institutions would be expected to follow the practices in this guidance, the extent to which they would be overseen by a federal financial regulator was limited. For example, FDIC and OCC staff told us that they had examined a fintech firm that provides financial account aggregation services to regulated institutions. This review focused on the fintech firm’s data security rather than its activities with consumers. FDIC staff also said they conducted exploratory discussions with some fintech lenders, but these firms were not part of their technology service provider examination program. However, as of November 2017, FDIC and OCC staff noted that they had not completed examinations of fintech firms within our scope. NCUA staff noted that NCUA does not have authority to examine services provided to credit unions by third-party service providers. In order to examine any services provided to credit unions, NCUA must rely on credit unions voluntarily providing information on the third-party service provider. However, NCUA’s staff noted some of their examiners had accompanied state regulators in an examination that involved a credit union’s partnership with a fintech payments firm.

Other Fintech Firms Are Not Routinely Overseen by Federal Financial Regulators, but Are Subject to State Oversight

Fintech firms not providing investment advice or partnered with federally- regulated financial institutions would be subject to routine oversight by a federal regulator only under certain circumstances. For example, CFPB could examine some fintech firms as a result of its examination authorities. Specifically, it has supervisory authority over certain nondepository institutions, including mortgage lenders and servicers, payday and student loan providers, and “larger participants” in consumer financial product and service markets, which could include fintech providers. CFPB has conducted or plans to conduct examinations of fintech firms that meet the agency’s definition of ‘“larger participants” in sectors for which they have designated such participants. For example, according to CFPB staff, it has conducted a stand-alone examination of a fintech payments company that provides international remittances, and it has scheduled an examination of a fintech lender that provides student loans. As of October 2017, it had not defined other “larger participants” specifically for other markets in which fintech firms may be active, but it is considering a proposed rule to supervise larger participants in the personal loan markets, which might include larger fintech lenders. CFPB may also conduct examinations of individual companies that it determines pose risks to consumers, as identified in public orders. Furthermore, CFPB’s supervisory authority also extends to third-party service providers of nondepository institutions overseen by the agency.

Fintech firms may also be subject to examinations related to their compliance with anti-money laundering laws and related requirements. FinCEN, which is responsible for administering federal anti-money laundering laws, has authority to examine any fintech firms conducting money transmission, according to Treasury officials. These firms would be required to comply with the applicable anti-money laundering and counter-terrorist financing requirements, including registering with FinCEN, establishing anti-money laundering programs, and reporting suspicious activities to FinCEN. However, FinCEN delegates routine anti- money laundering examinations of federally-chartered or registered financial institutions to the federal financial institution regulators. In other cases, firms subject to anti-money laundering requirements, including fintech payments or lending firms, could be examined by state regulators and the Internal Revenue Service.

Fintech firms not subject to routine federal supervisory oversight would instead generally be subject to state oversight. As of October 2017, 49 states, as well as the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, required entities that provide money transfer services—which may include some fintech payments firms—to obtain licenses to conduct such activities in their jurisdictions according to documents from state regulator associations and CSBS staff. In addition, all states and the District of Columbia required lending licenses for consumer lenders operating in their states, according to CSBS staff.

Furthermore, some states have created or provided guidance on licensing statutes in order to include virtual currencies. For example, in 2015 New York finalized a new license for virtual currency businesses under New York’s financial services law.

State regulators in these jurisdictions conduct examinations of the firms that hold licenses to assess their compliance with safety and soundness and various other requirements. In addition, CSBS staff stated that as of February 2018, approximately 37 states authorize state regulators to examine banks’ third-party service providers—which could include fintech companies.

According to state regulators we interviewed in Illinois, New York, and California, their agencies use the same approach to regulate and examine fintech firms and traditional financial institutions providing similar services. Furthermore, according to state regulatory associations and some state regulatory agencies, fintech firms such as money transmitters undergo regular supervision through on-site examinations to monitor compliance with federal and state capital, liquidity, and consumer protection requirements. For example, Money Transmitters Regulators Association staff said that state regulators examine MSBs at least every 3 years depending on risk assessment and previous examination record, and that state examinations cover federal and state laws, including data security and anti-money laundering requirements. Similarly, staff from one state regulator noted that they conduct consumer protection examinations of direct lenders and take enforcement action if they identify potential violations. CSBS staff noted that state requirements do not differ for fintech firms because the requirements and examinations are activity- based. For example, most states have anti-money laundering requirements within their money transmitter license laws. Due to state anti-money laundering examination cycles, CSBS staff stated that MSBs licensed in 40 or more total states experience an examination at least once every 14 months.

Fintech Firms Can Be Subject to Enforcement Actions by Federal and State Regulators

Outside of examinations, fintech firms that violate federal and state regulations can be subject to enforcement actions by federal and state agencies with such authorities. The OCC, Federal Reserve, and FDIC may have enforcement jurisdiction over fintech firms when the fintech firm is an “institution affiliated party” under the Federal Deposit Insurance Act or a service provider under the Bank Service Company Act. In addition, CFPB can take enforcement action against institutions under its jurisdiction for noncompliance with federal consumer protection laws. For example, in 2016, CFPB used its unfair, deceptive, or abusive acts or practices authorities to investigate and issue a consent order against a fintech firm operating an online payment system, which CFPB determined had made deceptive data security claims to customers. FTC can also take enforcement actions against fintech firms not registered or chartered as a bank for violations of any federal consumer laws FTC enforces, including the FTC Act’s prohibition against unfair or deceptive acts or practices. For example, in 2015, FTC took action against the providers of a smartphone application, alleging that they deceived consumers and installed hidden malicious software code to generate virtual currencies for the providers without consumer permission. It can also bring enforcement action against non-bank service providers that maintain or process customer information under its GLBA authority.

Other federal entities can pursue enforcement action against fintech firms. The Department of the Treasury’s Office of Foreign Assets Control can take action against fintech firms that violate U.S. sanctions regulations. In addition, FinCEN can also pursue enforcement measures against fintech firms that transmit funds—such as certain fintech payment and lending firms—due to its authority to enforce compliance with the Bank Secrecy Act’s anti-money laundering and prevention of terrorist financing provisions. For example, FinCEN took enforcement action in May 2015 against the fintech firm Ripple—a company that allows users to make peer-to-peer transfers in any currency using a DLT-enabled process—for violating anti-money laundering requirements through its sale of virtual currency. In 2016, CFTC brought an enforcement action against a Hong Kong-based fintech firm for offering illegal off-exchange financed retail commodity transactions in bitcoin and other cryptocurrencies, and for failing to register as a futures commission merchant.

Finally, state regulators can also take enforcement action against financial institutions and fintech firms that violate state data security or consumer protection laws. In addition, state attorneys general may bring actions against fintech companies through consumer protection and deceptive trade practice acts, according to the National Association of Attorneys General.

In Some Cases, Fintech Firms May Not Be Subject to Financial Regulator Oversight

Some fintech companies may not be subject to any federal or state financial oversight if they do not meet federal or state definitions of a money service or other regulated business. For example, some fintech payments firms—such as certain mobile wallet providers—might not be subject to state or federal money service business requirements because their role in the payment process does not specifically involve transmitting money, according to state and federal regulators. One mobile wallet provider claimed that it is not subject to federal financial regulatory oversight because it does not transfer funds or authorize transactions, but instead facilitates the transfer of customer data as part of the credit card or debit card networks; it also does not retain any of its consumers’ personal data, including data on purchase content, location, or dollar amount.

Indications of Fintech Activities Creating Widespread Consumer Harm Appear Limited Compared to Traditional Providers

Available regulatory data show that the number of consumer complaints against fintech activities appears modest compared to traditional providers. For example, although our analysis of the CFPB’s consumer complaint database has limitations in assessing risk, the number of published complaints submitted against several prominent fintech firms from April 2012 through September 2017 included in this database was generally low, when compared to select large financial institutions. Our analysis showed that for 13 large firms offering fintech payments, lending, investment advice, financial account aggregation, or virtual currencies, only 5 of the firms had complaints in the CFPB database, with 4 having received fewer than 400 complaints. The largest number of published complaints had been submitted against a large fintech payment provider with over 3,500 published complaints. Further, the number of published complaints submitted against the fintech payment provider was relatively small compared to the number of published complaints submitted against other, often larger financial institutions. For example, our analysis showed that 10 large financial institutions each received between approximately 14,300 and 67,300 total complaints April 2012 through September 2017.

In addition, various federal regulators, including CFPB and FTC, can address the risk of consumer harm by taking actions against fintech firms for deceptive or unfair acts or practices when warranted. For example, in 2016, FTC reached a settlement with a firm that sold machinery designed to create virtual currencies—a process known as mining—and allegedly had been deceiving its customers about the availability and profitability of the machinery. As noted earlier, FTC also settled with a fintech payment provider in February 2018 over complaints by thousands of consumers the company had received regarding confusion over its funds availability practices. Additionally, in 2016 CFPB assessed a $100,000 civil penalty against a fintech payments firm for deceiving consumers about its data security practices and the safety of its online payment system.

The U.S. Regulatory Environment Poses Various Challenges to Fintech Firms

Fintech firms can find that the complexity of the U.S. financial regulatory system creates challenges in identifying the laws and regulations that apply to their activities, and that complying with state licensing and reporting requirements can be expensive and time-consuming for mobile payment providers and fintech lenders. Also, federal agencies could improve collaboration and clarify issues related to financial account aggregation by making sure that interagency efforts dedicated to fintech include all relevant participants and incorporate other leading practices. In addition, because banks are liable for risks posed by third parties, fintech firms may face delays in entering into partnerships with banks.

Challenges with Complexity of Financial Regulatory Structure

The complex U.S. financial regulatory structure can complicate fintech firms’ ability to identify the laws with which they must comply and clarify the regulatory status of their activities. As noted in our past reports, regulatory oversight is fragmented across multiple regulators at the federal level, and also involves regulatory bodies in the 50 states and other U.S. jurisdictions. Fintech firms and other stakeholders we interviewed told us that it was difficult for fintech firms to navigate this structure. In particular, understanding the laws and regulations that may apply to fintech firms was not easy because existing regulations were sometimes developed before the type of product or service they are now offering existed. In addition, the cost of researching applicable laws and regulations can be particularly significant for fintech firms that begin as technology start-ups with small staffs and limited venture capital funding. Fintech payments and DLT firms and other market participants told us that navigating this regulatory complexity can result in some firms delaying the launch of innovative products and services—or not launching them in the United States—because the fintech firms are worried about regulatory interpretation. For example, staff from one U.S. firm that developed a DLT payments technology told us that they and their peers only work with foreign customers due to the fragmented U.S. financial regulatory structure and lack of unified positions across agencies on related topics.

However, several U.S. regulators have issued rules and guidance to help fintech firms understand where their products and services may fit within the complex financial regulatory structure, as shown in the following examples.

In December 2017, the Federal Reserve’s Consumer Compliance Outlook newsletter included an article that offered financial institutions and fintech firms general guideposts for evaluating unfair and deceptive practices and fair lending risk related to fintech, with a focus on alternative data. Also, in 2016, a special edition of Consumer Compliance Outlook focused on fintech, including summarizing relevant federal laws, regulations, and guidance that may apply to mobile payments, fintech lending, and digital wealth management. For example, the newsletter listed laws and regulations related to credit, privacy, and data security; anti-money laundering requirements; and consumer and investor protection.

In 2016, CFPB issued a final rule that will extend wide-ranging protections to consumers holding prepaid accounts, including peer-to- peer payments and mobile wallets that can store funds. Also, in 2015, CFPB issued a set of nonbinding consumer protection principles for new faster payment systems, which outline CFPB expectations for payment services providers.

In February 2017, SEC issued updated guidance on robo-advisers that addresses the substance and presentation of disclosures provided to clients on the robo-adviser and the investment advisory services it offers, the obligation to obtain information from clients to ensure that recommended investments are suitable, and the need to implement effective compliance programs reasonably designed to address the unique nature of providing automated advice. Similarly, in March 2016, FINRA issued a report on effective practices related to digital investment advice and reminded FINRA-registered broker- dealers of their obligations under FINRA rules.

In 2013, FinCEN issued guidance that clarified the applicability of anti- money laundering and related regulations to participants in certain virtual currency systems, and in 2014 FinCEN issued administrative rulings that further clarified the types of market participants to which the 2013 guidance applies.

In October 2017, CFTC issued a report on virtual currencies that explains that it considers virtual currencies to be commodities, outlines related examples of permissible and prohibited activities, and cautions investors and users on the potential risks of virtual currencies.

In July 2017, SEC issued a report on DLT token sales, which cautions market participants that sales with certain characteristics may be subject to the requirements of federal securities laws. In general, the report uses one company’s token sale as an example to illustrate how SEC could consider a token sale to be a securities offering, and why companies offering such products would have to register the offering with SEC or qualify for an exemption. In August 2017, FINRA also issued an investor alert on DLT token sales, which includes questions for investors to ask before participating in such sales.

In January 2017, FINRA issued a report on DLT uses more broadly, which outlines key regulatory considerations for firms that want to use DLT in equity, debt, and derivatives markets. For example, the report outlines securities-related regulatory considerations for DLT applications that could alter securities clearing arrangements, be used for recordkeeping by broker-dealers, or change the equity or debt trading process, among other things.

Challenges Complying with Numerous State Regulatory Requirements

As mentioned previously, although federal oversight applies to some fintech firms, fintech payments and lending firms not subject to routine federal oversight must typically obtain state licenses based on their activities. Banks can choose to be chartered at the state level or as a national bank, which generally exempts them from state licensing requirements and examination. In contrast, fintech payment providers operating as MSBs—including those using DLT—and fintech firms offering consumer loans must typically hold licenses in each state in which they operate. Similarly, as mentioned above, small robo-advisers would generally have to be licensed in states in which they wish to operate.

State regulators and other market observers we interviewed told us that they believe state regulation of fintech firms provides benefits. Several market participants and observers said that states understand the needs of their local economies, consumers, and market participants and can use their authorities to craft tailored policy and regulation. For example, New York regulators created a special license for virtual currency firms. New York regulators told us that they did so because of New York’s status as a financial and innovation hub, as well as activities and concerns of virtual currency firms operating within their jurisdiction. In addition, state regulators may complement the federal oversight structure by dedicating additional resources to helping educate fintech firms on regulatory requirements and making sure that firms follow these requirements. For example, two state regulators told us that they work closely with many fintech start-ups to help educate them on regulatory requirements before they apply for licenses or begin operations, and a state regulatory association told us that fintech firms and state regulators often meet to discuss regulatory concerns. Representatives of a state regulatory association told us that federal agencies also rely increasingly on state examinations to ensure compliance with anti-money laundering requirements.

Similarly, an industry association and state regulators told us that they believe states are very responsive to consumer complaints. For example, one state regulator told us that they investigate hundreds of consumer complaints per month and believed they often resolved consumer complaints more quickly than their federal consumer protection counterparts, although CFPB staff told us that CFPB handles thousands of complaints per month. California regulators also told us they have initiated their own investigations into the extent to which fintech lenders comply with state lending and securities laws, and risks that fintech lenders may pose to consumers and to markets.

However, complying with fragmented state licensing and reporting requirements can be expensive and time-consuming for mobile payment providers and fintech lenders. For example, stakeholders we interviewed said that obtaining all state licenses generally costs fintech payments firms and lenders $1 million to $30 million, including legal fees, state bonds, and direct regulatory costs. Also, market participants and observers told us that fintech firms may spend a lot of time on state examinations because state exam requirements vary and numerous states may examine a fintech firm in 1 year. For example, staff from a state regulatory association said that states may examine fintech firms subject to coordinated multistate exams 2 or 3 times per year, and as many as 30 different state regulators per year may examine firms that are subject to state-by-state exams.

Although these challenges are not unique to fintech firms, they may be more significant for fintech firms than for other MSBs and lenders. For example, some MSBs and lenders operate in a limited geographic area that can require them to be licensed by one state only. Other firms operate in multiple states or nationwide, but may have started with a license in one state and then obtained additional licenses and spread these compliance costs as they grew over time. In contrast, fintech firms are generally online-only businesses that likely seek to operate nationwide from their inception, which immediately requires licenses in all states and generates higher up-front compliance costs that may strain limited venture capital funding. For example, one firm we interviewed that funds fintech start-ups told us that one of their fintech firms spent half of the venture capital funds it had raised obtaining state licenses. As a result, some firms may choose not to operate in the United States. For example, one DLT provider we interviewed told us that although they are based in the United States, they operate abroad exclusively because state licensing costs are prohibitively expensive.

Bank partnerships and specialized operating charters offered by federal and state banking regulators may help fintech firms more easily operate nationwide by generally preempting state licensing requirements. For example, some fintech payments firms and fintech lenders have chosen to partner with nationally chartered and state-chartered banks, which allows them to operate nationwide without having to obtain individual state licenses. Also, two fintech lenders have applied for an Industrial Loan Corporation (ILC) charter, an FDIC-supervised state banking charter, which commercial firms other than regulated financial institutions can obtain in certain states to operate nationally. Such ILCs would also be overseen by FDIC if they obtain FDIC deposit insurance.

In addition, in December 2016, OCC announced its intent to consider applications for special-purpose national bank charters from fintech firms such as lenders, which would allow such firms to operate nationally under a single national bank charter if finalized. However, OCC officials we interviewed told us that this special-purpose national bank charter is on hold because they are still reviewing whether to go forward with the proposal, and CSBS has filed a lawsuit against OCC challenging the fintech charter. Some fintech lending firms and an industry association representing payments firms have expressed interest in applying for this special charter, but other stakeholders we interviewed told us that the proposed fintech charter may not be a good option for small fintech firms if the capital requirements are the same as those for banks.

In addition, state regulators are taking steps to make it easier for fintech firms seeking to operate across multiple states. For example, CSBS staff we interviewed told us that states leverage the Nationwide Multistate Licensing System—which enables firms to submit one application with information that fulfills most of the licensing requirements of each state that participates in this system. Staff from CSBS, some fintech firms, and an industry observer we interviewed said that although the multistate licensing system has reduced administrative requirements somewhat, firms still have to make additional filings to address certain requirements unique to some states. In February 2018, seven state regulators also agreed to standardize key elements of the MSB licensing process and mutually accept licensing findings. Additionally, in 2013, state regulators established the Multi-State MSB Examination Taskforce, which coordinates and facilitates multistate supervision of MSBs. CSBS staff told us that multistate exams have made the state MSB exam process more efficient for state regulators and MSBs.

In May 2017, the CSBS also announced they would be expanding efforts to modernize state regulation of fintech firms. For example, under this initiative, officials we interviewed told us they plan to redesign their multistate licensing system to provide a more streamlined licensing process for new applicants and shift state resources to higher-risk cases by 2018; plan to harmonize multistate supervision by establishing model approaches to key aspects of nonbank supervision, making examinations more uniform, identifying and reporting violations at the national level, and creating a common technology platform for examinations by 2019; and have formed a fintech industry advisory panel—with sub-groups on payments, lending, and banking—to identify licensing and regulatory challenges.

Challenges with Interagency Collaboration

Although a few fintech market participants and observers we interviewed told us that they thought regulatory collaboration on fintech was sufficient, the majority of market participants and observers we interviewed who commented on interagency collaboration said that it could generally be improved. Some also cited additional areas in which better interagency collaboration could facilitate innovation:

Use of alternative data and modeling in fintech lending. Fintech lenders may face challenges because agencies with authorities related to consumer protection and fair lending have not issued guidance on the use of alternative data and modeling. For example, one fintech lender we interviewed told us that they discussed using alternative data to assess creditworthiness with FDIC and FTC, but they do not understand what each agency might consider to be an unfair, deceptive, or abusive practice because the agencies have not coordinated positions. Staff we interviewed from two consulting firms that advise on fintech told us that lack of clarity or coordination on fair lending and use of alternative data and modeling creates uncertainty for fintech lenders. This has led some fintech lenders to forgo use of alternative data for underwriting purposes since they do not know if it will produce outcomes that violate fair lending laws and regulations. However, FDIC staff told us that FDIC applies the same standards as FTC in determining whether an act or practice is unfair or deceptive and that existing guidance on fair lending applies broadly to traditional and nontraditional modeling techniques and data sources.

OCC special-purpose national bank charter. A few market participants and observers we interviewed told us that fintech payment providers and lenders may face challenges because OCC has not sufficiently coordinated with the Federal Reserve and FDIC on OCC’s special-purpose national bank charter. Despite OCC discussion with the Federal Reserve, the charter proposal does not specify whether recipients could access the Federal Reserve payments system. Federal Reserve officials have said that the Federal Reserve will likely not take any policy positions or make any legal interpretations about the proposed charter until OCC finalizes the charter’s terms and a firm applies for a charter. Officials have said that this is their position because the potential policy and legal interpretation issues that could arise related to membership and access to Federal Reserve services will require a case-by-case, fact- specific inquiry unique to any firm that moves forward with an application. One fintech lender we interviewed told us that obtaining consistent and complete information from OCC and the Federal Reserve on the specific rights this charter would grant a fintech lender had been challenging, and that this lack of consistency and clarity could discourage fintech firms from applying for the charter. However, OCC staff we interviewed told us that the charter is not yet final and that they facilitate communication between fintech firms that are interested in the special charter and the Federal Reserve. Also, OCC staff said that they briefed FDIC staff on the special charter, but will coordinate further if appropriate.

Differing regulatory interpretation of consumer protection requirements. As discussed above, fintech firms may be subject to CFPB oversight and limited federal financial regulatory oversight if they also partner with financial institutions. In addition, FTC and CFPB can also take enforcement actions against fintech firms not registered or chartered as a bank for violations of any federal consumer protection laws they enforce. Fintech firms we spoke with said that this can cause challenges because firms are concerned that regulators may have different interpretations of what conduct might merit consumer protection enforcement actions, and a research and consulting firm we interviewed that works with fintech start-ups told us that this is one of the industry’s biggest challenges. Similarly, the potential for differing regulatory interpretation may limit the effectiveness of agency efforts to innovate. For example, fintech firms can apply for a CFPB No Action Letter, which is intended to reduce regulatory uncertainty for financial products or services that promise substantial consumer benefit but face uncertainty regarding consumer protection requirements. However, some entities we spoke with said that few firms have applied, in part because a letter provided by CFPB may not preclude prudential regulators or FTC from taking enforcement actions in cases where they have jurisdiction.

Although stakeholders indicated that agencies could improve interagency collaboration on other fintech issues, federal agencies said that they already collaborate through a variety of informal and formal channels at the domestic and international levels. Domestically, in addition to informal discussions and participation in fintech events hosted by other agencies, some agencies have coordinated examinations of third-party service providers and enforcement actions. For example, in 2014 and 2015, CFPB, FCC, FTC, and state regulators coordinated on enforcement actions related to unauthorized mobile carrier billing charges. Also, U.S. agencies have had informal discussions regarding fintech with their foreign counterparts. For example, Treasury staff have discussed regulations designed to counter money laundering and terrorist financing with officials from countries such as France and the United Kingdom. In addition, federal agencies have begun to collaborate on fintech regulatory issues through formal interagency working groups that are primarily concerned with other financial regulatory issues. For example, at the domestic level, U.S. prudential regulators have discussed issues related to potential risks of fintech lending and DLT through the Financial Stability Oversight Council. At the international level, the Federal Reserve represents the United States at the Bank for International Settlements, which has published papers on fintech topics including payments, fintech lending, and DLT. For more information on these efforts and others, see appendix II.

Further, federal agencies said that they have recently organized the following interagency collaborative groups dedicated to fintech, as detailed in appendix II: In March 2017, the Federal Reserve convened the Interagency Fintech Discussion Forum, an informal group which meets approximately every 4 to 6 weeks and aims to facilitate information sharing among consumer compliance staff from the federal banking regulators on fintech consumer protection issues and supervisory outcomes. Discussion topics have included account aggregation, alternative data and modeling techniques, and third-party oversight.

In 2016, Treasury created the Interagency Working Group on Marketplace Lending, which was active over the course of fiscal year 2016, meeting 3 times. This group shared information among industry participants and public interest groups, and discussed issues from a Treasury report on benefits and risks associated with online marketplace lending.

In 2010, the Federal Reserve Banks of Atlanta and Boston created the Mobile Payments Industry Workgroup to facilitate discussions among industry stakeholders about how a successful mobile payments system could evolve in the United States. This group also functions as an interagency collaboration mechanism through biennial meetings between industry stakeholders and relevant regulators that update industry on regulatory concerns, identify potential regulatory gaps, and educate regulators on mobile payment technologies.

However, we found that these groups do not include all relevant participants. For example, NCUA was not included in the Interagency Fintech Discussion Forum or the Interagency Working Group on Marketplace Lending, and FCC has not participated in the biennial regulator meetings of the Mobile Payments Industry Workgroup since 2012. Federal Reserve staff said that they did not include NCUA in the Interagency Fintech Discussion Forum because NCUA is not a bank regulator. Treasury staff noted that staff who could explain why NCUA had not been invited to participate in the Interagency Working Group on Marketplace Lending were no longer with the agency. Similarly, FCC staff could not recall why they had not participated in recent biennial regulator meetings of the Mobile Payments Industry Workgroup.

However, NCUA has experiences and perspectives that would make it a relevant participant in the Interagency Fintech Discussion Forum, and NCUA officials said that they would participate in these interagency efforts if invited. NCUA would be a relevant participant because, although it does not oversee banks, it oversees credit unions that have entered into partnerships with fintech lenders and virtual currency exchanges, and could enter into partnerships with other fintech firms. Similar to fintech partnerships with banks, these partnerships could create risks related to safety and soundness and consumer protection. Further, NCUA’s 2018– 2022 draft strategic plan includes fintech as a key risk to the credit union system because fintech could provide a competitive challenge to credit unions or take advantage of differences in how credit unions and fintech firms are regulated, among other things.

Likewise, as Federal Reserve staff have acknowledged, FCC could be a relevant participant in biennial regulators meetings of the Mobile Payments Industry Workgroup because FCC could share valuable insight on regulatory concerns related to mobile device security with other regulators and industry participants. Specifically, FCC has facilitated and encouraged industry efforts to improve security of mobile devices, on which consumers make fintech payments, and has conducted related consumer education efforts. FCC staff said they would consider participating in future biennial regulator meetings of the Mobile Payments Industry Workgroup if the topics discussed aligned with FCC’s work on mobile device security.

Our past work has identified key practices relating to collaborative mechanisms among agencies that increase their effectiveness, such as including participants with the appropriate knowledge, skills, and abilities. In addition, these key practices also state that an interagency group should continue to reach out to potential participants who may have a shared interest in order to ensure that opportunities for achieving outcomes are not missed.

However, we found that interagency collaborative efforts dedicated to fintech issues were not fully leveraging relevant agency expertise. Lack of NCUA participation in the Interagency Fintech Discussion Forum may preclude NCUA and the other participating agencies from sharing information that could be useful in efforts to oversee the risks that fintech poses to their regulated institutions. Similarly, lack of FCC participation in the biennial regulators meetings of the Mobile Payments Industry Workgroup could preclude industry participants from receiving updates on FCC regulatory concerns related to mobile device security and could preclude FCC from learning about new risks that fintech payments products pose to mobile device security.

Furthermore, OCC and international bodies have identified fintech as an area where collaboration among agencies can be helpful. For example, OCC has stated that collaboration among supervisors can promote a common understanding and consistent application of laws, regulations, and guidance through steps such as establishing regular channels of communication. At the international level, the Bank for International Settlements has recommended that bank supervisors in jurisdictions where responsibilities related to fintech are fragmented among a number of regulators with overlapping authorities should collaborate with other relevant agencies to develop standards and regulatory oversight for fintech, as appropriate. Similarly, the Financial Stability Board has suggested that responsible agencies further open lines of communication to address cross-cutting fintech issues.

Industry Disagreements on Aggregation of Consumer Financial Account Information Create the Need for Stronger Collaboration

Among other consumer protection issues related to financial account aggregation, market participants do not agree about whether consumers using account aggregators will be reimbursed if they experience fraudulent losses in their financial accounts. While some account aggregators negotiate contracts with the financial institutions that hold the consumer accounts that are being aggregated, other account aggregators have no relationship with the financial institutions holding the consumer accounts that they access on behalf of those consumers. Officials from at least one large bank have made public statements that they may not reimburse losses from consumer accounts if the consumer provided his or her account credentials to an account aggregator and fraudulent activity subsequently occurs in the consumer’s account. In contrast, some account aggregators and consumer protection groups have argued that consumer protection law establishes that banks retain the obligation to reimburse losses due to transactions not authorized by the consumers.

To date, CFPB and the Federal Reserve have taken varying public positions on this disagreement among market participants, and some regulators told us that they have held related discussions with market participants and observers. In October 2017, CFPB issued principles for consumer-authorized financial data sharing and aggregation that stated that consumers should have reasonable and practical means to dispute and resolve instances of unauthorized transactions. However, CFPB’s principles are not binding and federal financial regulators have not issued guidance or rules to clarify this issue. As previously mentioned, CFPB also issued a request for information studying these topics to various industry members, observers, and consumers in November 2016. A member of the Board of Governors of the Federal Reserve System has publicly stated that industry stakeholders will need to come to agreement on which party bears responsibility for unauthorized transactions. Also, Federal Reserve staff told us that some financial institutions and account aggregators are negotiating contractual arrangements that could address this issue on a case-by-case basis. In addition, staff from FDIC, the Federal Reserve, and OCC said that they have discussed related issues with market participants and observers.

The financial regulators have recently begun to hold collaborative information sharing discussions on consumer compliance issues surrounding financial account aggregation, but this collaboration has not resulted in any coordinated public outcomes on the issues. In May 2017, the federal financial regulators—CFPB, the Federal Reserve, FDIC, NCUA, and OCC—and representatives of state financial regulators began to share information on account aggregation and related consumer compliance issues through the Federal Financial Institutions Examination Council (FFIEC) Task Force on Supervision and the FFIEC Task Force on Consumer Compliance. The regulators are collaborating through FFIEC because they acknowledge that account aggregation issues cross agency jurisdictions. According to participating agency officials, FFIEC discussions have covered responsibilities for consumer reimbursement due to fraudulent charges and access to consumer data, generated an internal paper on consumer compliance issues, and previewed CFPB’s principles for consumer-authorized financial data sharing and aggregation prior to publication. However, as of November 2017, these efforts have not generated public outcomes to guide market participants.

The federal financial regulators’ missions include ensuring that consumers are protected. CFPB’s primary mission is to protect consumers in the financial marketplace, including ensuring that markets for consumer financial products and services operate transparently and efficiently to facilitate access and innovation. Similarly, according to their mission and vision statements, the banking and credit union regulators help protect consumer rights by supervising financial institutions to help ensure compliance with consumer protections.

However, some of the regulators told us that they have not taken more steps to resolve the disagreements surrounding financial account aggregation because they are concerned over acting too quickly. For example, Federal Reserve staff we interviewed told us that premature regulatory action could be detrimental to the negotiations between individual financial institutions and financial account aggregators. Similarly, OCC staff we interviewed told us that OCC staff does not recommend publishing guidance or rules while the account aggregation industry is evolving because regulation should not constantly change. Nonetheless, the financial regulators could take additional steps to address these issues without prematurely issuing rules or regulations. Further, the FFIEC IT Examination Handbook on e-Banking’s appendix on aggregation services, which the financial regulators use in their examinations of banks, indicates that the financial regulators have been aware since at least 2003 that regulatory requirements related to consumer protection responsibilities of financial account aggregators are not clear.

Incorporating leading practices on collaboration could strengthen the efforts that regulators are making to address financial account aggregation issues. As discussed previously, our prior work has developed interagency collaboration principles that make efforts among agencies more likely to be effective. These principles find that collaborative efforts should define the short-term and long-term outcomes that the collaboration is seeking to achieve and clarify the roles and responsibilities of the participating agencies, among other things. Although banking regulators and CFPB have discussed issues related to account aggregation within FFIEC, these discussions have not yet defined outcomes or produced any public outcomes to help guide fintech firms and traditional financial institutions which could help lead to market- based solutions, or defined agency roles and responsibilities. In addition, market participants, CSBS staff, and a member of the Board of Governors of the Federal Reserve System have said that additional collaboration on financial account aggregation issues—including reimbursement for unauthorized transactions—would be beneficial. Similarly, in its 2017 annual report, the Financial Stability Oversight Council encouraged financial regulators to monitor how fintech products affect consumers and regulated entities and to coordinate regulatory approaches, as appropriate.

Acting collaboratively to help address consumer compliance issues related to financial account aggregation could help financial regulators better meet their consumer protection missions. Improved collaboration could help regulators and market participants resolve disagreements over account aggregation and related consumer compliance issues more quickly and in a manner that balances the competing interests involved. Taking steps now, while the discussion on financial account aggregation is in its relatively early stages, could help federal regulators better address these needs over the long term. Until regulators coordinate and assist the industry in clarifying and balancing the valid interests on both sides, consumers could have to choose between facing potential losses or not using what they may find to be an otherwise valuable financial service, and fintech firms providing useful services to consumers will face barriers to providing their offerings more broadly.

Challenges Involving Fintech Partnerships with Banks

Partnerships between fintech firms and financial institutions are increasingly common because such partnerships offer benefits to both parties involved. According to literature we reviewed and market participants and observers we interviewed, the benefits to banks can include the ability to meet consumer demand by providing their customers with access to innovative products that provide good user experiences without having to dedicate extensive internal time or resources. Market observers and Federal Reserve staff we interviewed told us that this benefit may be particularly important for small banks and credit unions, which have fewer staff and fewer financial resources for research and development. Similarly, the benefits to fintech firms can include access to banking services and networks, customer acquisition, and assistance with regulatory compliance. Some fintech firms enter contractual agreements to partner with banks through white-labeling, a type of partnership where the bank markets the fintech firm’s product as its own when soliciting customers. Other fintech firms enter contractual partnerships with banks as stand-alone third-party relationships. For example, some fintech lenders make loans to customers and partner with a bank that originates or purchases loans sourced through the fintech lender.

However, because banks are liable for risks posed by third parties as discussed above, fintech firms may face delays in entering into partnerships with banks. Financial regulators have issued guidance on risk management for financial institutions’ relationships with third parties. Among other things, this guidance explains that financial institutions are expected to conduct proper due diligence in selecting partners and to monitor the activities conducted by third parties for compliance with relevant laws, rules, and regulations, considering areas such as consumer protection, anti-money laundering/counter-terrorist financing, and security and privacy requirements. Banks, fintech firms, and market observers we interviewed told us that banks may interpret this guidance conservatively. Large banks may also spend significant time conducting due diligence on the practices and controls in place at the fintech firms seeking to partner with them in order to prevent unnecessary compliance or operational risks, while a banking association told us that small banks with fewer resources to dedicate to due diligence may be unwilling to risk partnering with fintech firms. Banks, fintech firms, and market observers we interviewed told us that bank due diligence can also lead to lengthy delays in establishing partnerships, which can put fintech firms at risk of going out of business if they do not have sufficient funding and are not able to access new customers through a bank partner. For example, officials we interviewed from one bank told us that it takes about 18 months to launch a partnership with a fintech firm, and acknowledged that this is too slow to align with venture capital funding cycles that many fintech providers rely upon.

Consideration of Regulatory Approaches Abroad Could Benefit Fintech Regulation and Innovation

Regulators abroad have addressed the emergence of financial innovation through various means, including establishing innovation offices; establishing mechanisms for allowing fintech firms to conduct trial operations; holding innovation competitions; providing funding for firms through business accelerators; and using various methods to coordinate with other regulators domestically and internationally. While certain U.S. regulators have adopted similar efforts, further adoption of these approaches by U.S. regulators could facilitate interactions between regulators and fintech firms and improve regulators’ knowledge of fintech products. However, some initiatives may not be appropriate for the U.S. regulatory structure. For example, adopting certain initiatives could raise concerns about U.S. agencies picking winners, in which firms that participate in these programs may be better positioned to succeed than other firms. Further, particular initiatives may not align with agencies’ legal authorities or missions.

Regulators in the U.S. and Abroad Have Developed Approaches to Improve Interaction with Firms and Help Them Identify Applicable Regulatory Requirements

Citing the complexity of the U.S. financial regulatory system, fintech firms and industry observers noted having difficulty identifying which regulations they were subject to or which regulators would oversee their activities. Further, one fintech firm noted that when they were able to identify their regulators, they had difficulty finding a point of contact at the regulators. Officials from three regulators that we interviewed also noted that they had been contacted by fintech firms that were confused about their regulatory status and did not fall under the agency’s regulatory authority, but were subject to oversight by other regulators.

Regulators in the U.S. and abroad have taken steps to better facilitate interactions with fintech firms, including by establishing innovation offices with dedicated staff to serve as a front door for start-up firms or innovators to find information on regulation and to contact the agency. These innovation offices generally maintain a webpage hosted on the agencies’ websites, a dedicated e-mail address, or dedicated staff. Through these innovation offices, some agencies offer services including office hours during which regulatory staff are available to meet and provide informal guidance. For example, CFPB officials said that, as of August 2017, they had met with approximately 115 companies in four such events in New York and San Francisco, under the agency’s Project Catalyst. Similarly, OCC officials noted that through their Office of Innovation, they have been able to answer regulatory questions for fintech firms and connect firms to relevant OCC offices. Since the launch of LabCFTC, CFTC’s innovation office, in May 2017, CFTC officials have met with more than 100 entities through office hour sessions in New York, Chicago, and Washington, D.C.

In addition to office hours, several regulators have held fintech events through their innovation offices. For example, FTC has held three fintech forum events comprising panel discussions with industry experts, covering topics such as marketplace lending and distributed ledger technology. Several regulators have also issued publications on various fintech topics, which are posted to the dedicated webpages for those agencies with innovation offices.

Some regulators from other jurisdictions also facilitated regular interaction with firms through their innovation offices. For example, through its Innovation Hub, the United Kingdom’s (UK) Financial Conduct Authority offers informal regulatory guidance to individual firms directly and through posted publications; operates its regulatory sandbox, described below; and engages with industry participants through various events. Similarly, through a program called Looking Glass, the Monetary Authority of Singapore offers fintech firms training and consultation on regulation and provides a space for fintech firms to give product demonstrations to regulators and banks. Regulators and fintech firms we interviewed abroad said that these innovation offices have helped firms better understand their regulatory obligations and help regulators identify and address risks early. For example, representatives of a robo-adviser firm we interviewed in Hong Kong said that their interactions with the Hong Kong Securities and Futures Commission’s innovation office—known as the Fintech Contact Point—made identifying and obtaining guidance from the appropriate regulatory officials easier, which helped the firm more efficiently develop a product compliant with applicable regulations.

Some fintech firms and industry observers stated that U.S. regulators’ innovation offices have helped fintech firms by offering a point of contact for new entrants in the industry. Additionally, in a 2009 report, we created a framework that identified characteristics of an effective financial regulatory system. One of the characteristics was that regulators should oversee new products as they come onto the market to take action as needed to protect consumers and investors, without unnecessarily hindering innovation. Figure 5 summarizes efforts that we reviewed by regulators in the U.S. and abroad to implement initiatives to improve interactions with fintech firms.

However, FDIC and NCUA have not established innovation offices for various reasons. For example, FDIC staff said that, although the agency has not formally evaluated establishing an innovation office, they have met with fintech firms to discuss deposit insurance applications. Associated with the deposit application process, the agency has established central points of contact for all interested parties, not only fintech firms. NCUA said that its lack of legal authority over third-party service providers limited the usefulness of an innovation office, since fintech providers are often third-party service providers. However, by not dedicating specific staff, as occurs with the establishment of an innovation office, these regulators could be less able to interact with fintech firms in their sectors and fintech firms that partner with their regulated entities. Other regulators who, similar to FDIC and NCUA, generally do not directly oversee third-party providers, though they may have such authority, have noted benefits from establishing innovation offices. For example, OCC, which has a similar mission to these two regulators, has formed such an office and OCC staff said that the agency has benefited by learning about industry trends involving fintech and by improving interactions with fintech firms and banks. Similarly, Federal Reserve officials we interviewed said that efforts through its innovation office have helped staff better understand fintech issues and have particularly helped its examiners better understand banks that partner with fintech companies. Consideration of establishing innovation offices, as many U.S. regulators have recently done, could help FDIC and NCUA better enable new firms to become familiar with regulatory requirements and could better facilitate interaction between the agencies and fintech service providers.

Regulators Abroad Use Various Approaches to Learn about and Enable Development of New Fintech Products, and U.S. Regulators Could Consider Taking Similar Steps

Internationally, some regulators have taken various approaches that help educate their staff on emerging products and help innovators develop products in limited-risk environments (see fig. 6). Based on interviews with regulators and firms abroad and a literature review, initiatives that we studied include regulatory sandboxes, proofs-of-concepts, innovation competitions or awards, and agency-led accelerators. Regulatory sandboxes that we studied were agency-led programs that allow firms to test innovative products; services; business models; or delivery mechanisms in a live environment, subject to agreed-upon testing parameters. The proofs of concept that we reviewed were similar to sandboxes, but for these programs regulators issued a request for proposals to industry to develop a product that is conceptual; that is, an idea for a product that is not yet on the market. In the fintech competitions that we studied, regulators invited firms to develop solutions to problem statements drafted by agencies or financial institutions. Accelerators that we reviewed provided funding; access to regulators and mentors; connections to outside funding sources; potential clients; and working space to fintech firms and start-ups.

One approach regulators abroad were using to learn about fintech activities was regulatory sandboxes. While a few U.S. regulators have undertaken efforts that are similar to regulatory sandboxes, most have not. Two regulators that we interviewed stated that tools already exist, such as the comment process, to fulfill the role of a sandbox by helping them better understand innovation and assist in the development of rules and guidance. However, other U.S. regulators said that creating regulatory sandboxes by using tools such as No Action Letters could benefit regulators and firms. Based on our analysis of selected jurisdictions’ efforts, regulatory sandbox programs generally may include the following elements: firms apply to participate; firms and regulators agree on the parameters of how products or services will be tested, such as the number of consumers or transactions included in the test, the required product disclosures, or the time frame of the test; firms secure the appropriate licenses, if applicable; and firms and regulators interact regularly.

In some cases, the sandbox may include limited regulatory relief. For example, UK regulators we interviewed noted that they can waive or modify a rule, issue a “no enforcement action” letter, or provide a restricted license for a firm participating in the sandbox. However, these tools are used on a case-by-case basis for the duration of the sandbox test, are not used for every participating firm, and would not limit any consumer protections. Further, UK regulators we interviewed said that while waiving or modifying rules is possible, they are only used on an exceptional basis. Similarly, Singapore regulators said that they can relax specific legal and regulatory requirements, such as capital requirements, on a case-by-case basis for firms while they are participating in the sandbox. Also, Hong Kong regulators allow firms to operate without full regulatory compliance for the limited product offerings within the sandbox. Similar to UK and Singapore regulators, Hong Kong regulators we interviewed said that they have put safeguards in place to protect consumers from and manage the risk of the regulatory relief. For a more detailed description of the Hong Kong, Singapore, and UK sandboxes, see appendix III.

Regulators and market participants we interviewed abroad said that these fintech sandboxes have helped regulators better understand products and more effectively determine appropriate regulatory approaches while limiting the risk that the failure of a fintech firm could pose to consumers. Some participating firms we interviewed told us they benefited by being able to test products with customers, make changes to their business model, and understand how their products would be regulated. Moreover, two participating firms and a regulator we interviewed said that firms are able to introduce their products to the market more quickly because they are able to test their products in the market while becoming compliant with laws and regulations. One fintech firm that participated in the UK sandbox pointed out that the UK regulators better understood their firm’s technology and business model because of interactions in the sandbox. For example, although the company and regulatory officials had previously disagreed on whether the firm’s product needed to be regulated, after gaining a better understanding of the company’s business model through interactions in the sandbox, the regulatory officials agreed that the product did not require regulatory oversight. Similarly, Singapore regulators we interviewed noted that their sandbox provides them a hands-on approach to learning about new technologies and how the technologies align with regulatory requirements.

Some U.S. regulators have programs that share some characteristics with sandboxes. As shown in figure 6, CFPB, SEC, and CFTC have issued No Action Letters in which agency staff state that they do not intend to recommend certain regulatory action against the firms if they offer the products in the way described in a request letter to the regulator. The issuance of such letters could assist fintech firms in cases in which the applicability of existing regulations to their product is unclear. However, similar to sandboxes abroad, CFPB officials stated that No Action Letters do not provide safe harbor for companies taking actions that are clearly not allowed under U.S. consumer regulations. As of March 6, 2018, CFPB had issued one No Action Letter to Upstart Network, a company that uses alternative data to assess creditworthiness and underwrite loans. As a condition of the No Action Letter, Upstart will regularly report lending and compliance information to CFPB to mitigate risk to consumers and inform CFPB about the impact of alternative data on lending decisions.

In addition, CFPB officials we interviewed said that they can use a similar tool known as trial disclosure waivers, which allow industry participants to seek CFPB approval to test an innovative disclosure or way of delivering a disclosure to consumers that includes a safe harbor provision during which the industry participant may be exempted from statutory or regulatory requirements. As of March 6, 2018, CFPB had not issued any trial disclosure waivers.

Through its Project Catalyst, CFPB has also established a research pilot program where it collaborates with firms that are testing innovative products to understand consumer use and policy implications of innovative products. CFPB officials said that research pilots have similar elements to sandboxes, including participant application, agreement of testing parameters, and regular meetings between CFPB and the participating firm. Four firms have concluded research pilots with CFPB and three other firms are currently participating in pilots. Similarly, OCC officials said that they are considering developing a pilot program, which will allow banks or fintech firms partnering with banks to test innovative products with the involvement and interaction of OCC staff. OCC officials said that they have not set a date for determining whether to go forward or implement the program.

Proofs of Concept

Another approach regulators abroad were using to learn about fintech activities was establishing proofs of concept. The proofs of concept that we studied are similar to sandboxes in that the regulator has regular interaction with the company to better understand the product or technology, but the product is not introduced into the market during the proof of concept period. For example, the Bank of England, through its Accelerator program, uses proofs of concept to have firms develop technology that can help the agency improve its operations, according to agency officials. The Hong Kong Monetary Authority, which, among other things, regulates banks in its jurisdiction, uses proofs of concept to allow industry participants to develop products that are conceptual and not ready for market implementation. A firm we interviewed that participated in a proof of concept with Hong Kong Monetary Authority said that it offered the regulator the opportunity to gain a working understanding of the technology, while providing a test environment for the company to tailor the technology to adhere to regulatory requirements.

CFTC officials noted that they are exploring the ability to conduct proofs of concept through LabCFTC. CFTC officials noted that the agency would be well positioned to conduct proofs of concept because they already collect large amounts of market data that could potentially be leveraged for such projects. However, CFTC officials expressed concerns that receiving services as part of proofs of concept may violate gift or procurement laws. The Federal Reserve Bank of Boston participates in a collaborative effort called Hyperledger, which serves a similar purpose as a proof of concept for the Federal Reserve Bank. Hyperledger is a collaborative effort involving public and private entities created to advance the use of blockchain technologies across various sectors. As observers in the Hyperledger, Federal Reserve Bank staff have gained hands-on experience with blockchain technology by experimenting with uses of the technology. None of the other regulators with whom we spoke said that they planned to conduct proofs of concept.

Innovation Competitions or Awards

Another approach used by regulators abroad for learning about fintech activities was establishing fintech competitions or awards to encourage financial innovation. Winning firms receive recognition, contracts, or cash prizes. For example, the Monetary Authority of Singapore operated an international competition called Hackcelerator to crowdsource innovative solutions to problems that Singaporean financial institutions identified, including insurance, customer identification, and data analytics, according to officials. Singapore regulators have also established FinTech Awards, which provide ex-post recognition to FinTech solutions that have been implemented. CFTC officials said that they are seeking public input to establish prize competitions and intend to launch such competitions in 2018. FTC officials said that in 2017, the agency challenged participants to create a technical solution, or tools, that consumers could use to guard against security vulnerabilities in software found on the Internet of Things devices in their homes. FINRA staff noted that the agency holds internal innovation competitions, called CREATEathons, in which FINRA staff compete to develop solutions to various problems identified internally by staff. While external parties do not participate in these competitions, teams can consult with firms. Some U.S. regulators pointed out that while some regulators abroad are mandated to promote competition, no such mandate exists among most U.S. financial regulators.

Agency-led Incubator or Accelerator

Two governments we studied abroad were also learning about fintech by establishing incubators or accelerators to encourage the development of a country’s fintech industry and talent pool. The accelerators provide funding, access to regulators and mentors, connections to outside funding sources, potential clients, and working space to fintech firms and start- ups. For example, officials we interviewed from SG Innovate, Singapore’s government led accelerator, said that the agency helps Singaporean businesses expand overseas, bring companies to Singapore, and connect start-ups to regulators and funding, among other things. None of the U.S. regulators we interviewed said that they planned to establish such accelerator programs. Regulators from the U.S. and abroad pointed out that the U.S. fintech industry is more developed than those of other jurisdictions with many fintech firms, large talent pools, and significant amounts of private funding or privately run accelerators.

Regulators and market participants we interviewed abroad said that these knowledge-building initiatives have helped regulators learn about new products and business models and have allowed firms to test products. Although CFTC and SEC can issue No Action Letters, those agencies have not adopted other approaches similar to these knowledge-building initiatives described above. Further, FDIC, the Federal Reserve, and NCUA have not adopted any of these approaches. U.S. regulators said that these initiatives could raise concerns about favoring certain competitors over others and also noted that they may not have the authority to initiate these programs. However, despite similar potential constraints with regard to competition and authority limitations, CFPB and OCC have formally evaluated undertaking relevant knowledge-building initiatives, through conversations with regulators abroad, general research, and documentation of their efforts; and they have begun developing similar approaches, according to agency officials.

A characteristic of an effective financial regulatory system we identified in our 2009 framework was that a regulatory system should be flexible and forward looking, which would allow regulators to readily adapt to market innovations and changes. Consideration by U.S. regulators of adopting approaches taken by regulators abroad, where appropriate, could result in the implementation of initiatives that help improve their overall ability to oversee fintech and how it affects the entities they currently regulate. While constraints may limit the ability or willingness of regulators to fully adopt these practices, opportunities exist to assess ways to tailor them to the U.S context.

Regulators in the U.S. and Abroad Have Adopted Approaches to Facilitate Coordination on Financial Innovation

Regulatory coordination is less of an issue for regulators abroad because most jurisdictions have fewer financial regulators. For example, the UK has 3 agencies involved in financial regulation, Singapore has 1 financial regulator, and Hong Kong has 4 financial regulators, compared to the 10 federal agencies involved in the regulation of fintech in some capacity in the United States. However, regulators abroad have undertaken efforts to bolster coordination among domestic regulators—as applicable—as well as regulators abroad and industry representatives (see fig. 7). These collaborative efforts include advisory councils and steering committees dedicated to fintech issues; and fintech-specific cooperation agreements.

In the jurisdictions we examined, two agencies have established fintech advisory councils or steering committees of industry participants and government officials. Fintech advisory councils and steering committees may provide a valuable connection to industry, through which U.S. regulators could gain insight into industry developments. For example, the Hong Kong securities regulator has established an advisory council comprised of members with knowledge and experience of various parts of Hong Kong’s fintech industry. Officials of this agency told us that the advisory council provides valuable market data, a forum that offers firms a preliminary check for interpretation of their rules and updates on emerging issues. Advisory council members said that the council gives this regulator a cross-functional perspective from industry experts and enables the agency to learn about emerging issues and related regulatory challenges early in their development.

Selected U.S. regulators have established formal advisory committees dedicated to fintech issues, as shown in figure 7.

FINRA has established a Fintech Industry Committee through which FINRA member and nonmember firms are provided a platform for ongoing dialogue and analysis of fintech developments related to FINRA’s purview. FINRA officials said that the agency has also established the FinTech Advisory Group, a forum to identify and prioritize FinTech topics and coordinate appropriate regulatory approaches with key stakeholders.

CFTC staff noted that the agency restarted its Technology Advisory Committee in late 2017 to explore a range of fintech topics and augment the work of LabCFTC.

FDIC officials noted that the agency has a Fintech Steering Committee, which aims to help FDIC understand fintech developments by identifying, discussing, and monitoring fintech trends through reports from the staff working groups that the steering committee has established. The Fintech Steering Committee had not made any formal recommendations as of March 13, 2018.

As previously mentioned, U.S regulators we interviewed said that they have coordinated with other regulators and industry through various mechanisms, as the following examples illustrate. (For additional information on interagency collaborative efforts, see app. II).

The Federal Reserve has coordinated with relevant industry participants and other regulators including CFPB, FDIC, FTC, NCUA, OCC, Treasury, and CSBS through its Mobile Payments Industry Working Group and its Faster Payments Task Force.

FTC solicits insight from industry participants, observers, and regulators through its fintech forums.

Regulators have also coordinated with each other through domestic and international interagency financial regulatory bodies, as well as a recently organized interagency collaborative group dedicated to fintech, the prudential regulators’ Interagency Fintech Discussion Forum.

Cooperation Agreements

Some regulators abroad have cooperation agreements with other regulators abroad to share information and to help fintech firms begin operations in other jurisdictions. For example, Singapore regulatory staff told us that the regulator has 16 such agreements with entities from 15 regions that typically consist of (1) referrals to regulatory counterparts for firms attempting to operate in a new country, (2) guidance to firms on regulation in the firm’s new country of operation, and (3) information exchange among regulators and between regulators and fintech firms. UK regulators said that these agreements outline how the agencies in each country pledge to assist each other’s fintech firms seeking to operate in their country with business-to-business contacts, office space, and other assistance. For example, regulators can discuss trends related to their authorities and share information on fintech firms seeking to expand operations in the other country. A fintech firm we interviewed said that because much financial innovation is international in scope, sharing information across borders with cooperation agreements is important for regulators to understand the new technologies and to be responsive to risks. On February 19, 2018, CFTC and UK Financial Conduct Authority signed a cooperation agreement, which, according to CFTC officials, will focus on information sharing and facilitate referrals of fintech companies interested in entering the other regulator’s market. None of the other U.S. regulators that we interviewed had fintech-specific cooperation agreements with regulators abroad. Most of them said that existing memoranda of understanding were sufficient to facilitate information sharing. One regulator we interviewed abroad noted that establishing fintech-specific cooperation agreements with U.S. regulators is difficult because no direct regulatory counterpart exists since the U.S. financial regulatory structure is significantly different from those of other jurisdictions.

Conclusions

The emergence of various fintech products has produced benefits to consumers and others. Fintech products often pose risks to those of traditional financial products, although in some cases fintech products pose additional risks. While existing consumer protection and other laws apply to some fintech products and services, in some cases fintech transactions may not be covered by such protections. The extent to which the activities of fintech providers are subject to routine federal oversight varies, but fintech firms not overseen by a federal body generally are subject to oversight by state regulators. While limited evidence of widespread problems has surfaced to date, as the prevalence of fintech products grows, risks posed by segments of the industry that regulators do not routinely examine could correspondingly grow. Therefore, efforts regulators by regulators to monitor developments and risks posed by these firms and their financial innovations remains a sound approach.

With fintech products spanning across financial sectors and jurisdictions of the numerous U.S. regulatory bodies, many parties have called for improved regulatory coordination. While regulators have taken steps to collaborate, opportunities remain to improve collaboration in line with GAO’s leading practices. For example, the Interagency Fintech Discussion Forum and the biennial meetings of the Federal Reserve Mobile Payments Industry Workgroup do not include NCUA and FCC, respectively, agencies that could add valuable perspectives. Without these agencies, these efforts are not fully leveraging relevant agency expertise, and NCUA and FCC may be precluded from learning about risks that are relevant to their authorities.

Among other consumer protection issues related to financial account aggregation, market participants do not agree about whether consumers using account aggregators will be reimbursed if they experience fraudulent losses in their financial accounts. Until regulators coordinate and assist the industry in clarifying and balancing the valid interests of consumers, financial account aggregators, and financial institutions, consumers could have to choose between facing potential losses or not using what they may find to be an otherwise valuable financial service. Although regulators have been reluctant to act too quickly in light of related industry efforts, they could increase collaboration to address key issues such as consumer reimbursement for unauthorized transactions. Aligning ongoing collaborative efforts with leading practices could help regulators and market participants resolve disagreements over financial account aggregation and related consumer compliance issues more quickly and in a manner that balances the competing interests involved.

With our past work finding that an effective financial regulatory system needs to be flexible and forward looking to allow regulators to more readily adapt and oversee new products, U.S. regulators could potentially improve their oversight of innovative fintech activities by considering adoption of some of the efforts already being successfully used by regulators abroad. While constraints may limit the ability or willingness of regulators to fully adopt these practices, opportunities exist to assess ways to tailor them to the U.S. context. Some U.S. regulators have established innovation offices that can help fintech providers more easily obtain needed information from relevant regulators; however, FDIC and NCUA have not established such offices, which could help facilitate these regulators’ interactions with fintech firms and with the entities they regulate. Also, initiatives such as regulatory sandboxes or proofs-of- concept that provide fintech firms the opportunity to operate and share information with appropriate regulators have helped regulators abroad educate their staff and thereby improve their oversight capacities. However, the Federal Reserve, CFTC, FDIC, NCUA, and SEC have not initiated such programs due to concerns about favoring certain competitors over others or that they may not have the authority to initiate these programs. While constraints may limit the ability or willingness of regulators to fully adopt these practices, additional consideration by these regulators of some of the approaches taken by regulators abroad could assist U.S. regulators in learning more about new financial technologies that could provide useful knowledge for their own regulatory activities.

Recommendations for Executive Action

We are making a total of sixteen recommendations.

The Chair of the Board of Governors of the Federal Reserve System should invite NCUA to participate in the Interagency Fintech Discussion Forum. (Recommendation 1)

The Chairman of the Federal Communications Commission (FCC) should discuss with the Presidents of the Federal Reserve Banks of Atlanta and Boston whether the topics of the 2018-2019 biennial regulators meeting of the Federal Reserve’s Mobile Payments Industry Working Group would make FCC participation beneficial to the FCC or the group, and take steps accordingly. (Recommendation 2)

The President of the Federal Reserve Bank of Atlanta should discuss with the Chairman of the FCC and the President of the Federal Reserve Banks of Boston whether the topics of the 2018-2019 biennial regulators meeting of the Federal Reserve’s Mobile Payments Industry Working Group would make FCC participation beneficial to the FCC or the group, and take steps accordingly. (Recommendation 3)

The President of the Federal Reserve Bank of Boston should discuss with the Chairman of the FCC and the President of the Federal Reserve Banks of Atlanta whether the topics of the 2018-2019 biennial regulators meeting of the Federal Reserve’s Mobile Payments Industry Working Group would make FCC participation beneficial to the FCC or the group, and take steps accordingly. (Recommendation 4)

The Director of the Consumer Financial Protection Bureau should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers’ use of account aggregation services. (Recommendation 5)

The Chair of the Board of Governors of the Federal Reserve System should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers’ use of account aggregation services. (Recommendation 6)

The Chairman of the Federal Deposit Insurance Corporation should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers’ use of account aggregation services. (Recommendation 7)

The Chairman of the National Credit Union Administration should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers’ use of account aggregation services. (Recommendation 8)

The Comptroller of the Currency should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers’ use of account aggregation services. (Recommendation 9)

The Chairman of the Federal Deposit Insurance Corporation should formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point, including at least a website with a dedicated email address. (Recommendation 10)

The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point, including at least a website with a dedicated email address. (Recommendation 11)

The Chair of the Board of Governors of the Federal Reserve System should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 12)

The Chairman of the Commodity Futures Trading Commission should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 13)

The Chairman of the Federal Deposit Insurance Corporation should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 14)

The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 15)

The Chairman of the Securities and Exchange Commission should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 16)

Agency Comments and Our Response

We provided a draft of this report to CFPB; CFTC; FCC; FDIC; the Federal Reserve; FTC; NCUA; OCC; SEC; and Treasury, as well as CSBS and FINRA. We received written comments from all of these agencies except for Treasury and FINRA; the comments are reprinted in appendixes IV through XII, respectively. Agencies to which we directed recommendations agreed with our recommendations, as detailed below. All of these agencies except FCC and NCUA also provided technical comments, which we incorporated as appropriate.

In response to our recommendation that CFPB engage in collaborative discussions that incorporate leading practices with other financial regulators on financial account aggregation issues, CFPB stated in its letter that it concurred. CFPB stated that it has taken steps to address related issues independently. CFPB also noted that it has participated in related ongoing collaborative discussions and that it would continue to do so.

CFTC concurred with our recommendation that it formally evaluate adopting knowledge-building initiatives related to financial innovation. CFTC also noted that it is either using or exploring the use of some of the knowledge-building initiatives identified in the report. However, the agency also raised concerns that, without targeted legislative changes, some of those initiatives may violate federal procurement laws and gift prohibitions.

In its letter, FCC agreed with our recommendation that it should discuss with the Presidents of the Federal Reserve Banks of Atlanta and Boston whether the topics of the 2018–2019 biennial regulator meeting of the Federal Reserve’s Mobile Payments Industry Working Group would make FCC participation beneficial to FCC or the group, and take steps accordingly. FCC noted that it will reach out to the Federal Reserve Banks of Atlanta and Boston to determine whether FCC participation would be beneficial.

Regarding our recommendation that FDIC engage in collaborative discussions that incorporate leading practices with other financial regulators on financial account aggregation issues, FDIC stated in its letter that it recognizes the benefits of engaging in collaborative discussions with other relevant regulators. It noted that it has been involved in ongoing collaborative discussions about such issues and that it would continue to do so, particularly regarding liability for unauthorized transactions and consumer reimbursement. Regarding our recommendation that FDIC formally evaluate the feasibility and benefit of establishing an Office of Innovation or clear contact point, FDIC stated that it would conduct such an evaluation, and acknowledged that it has a long history of engaging in open dialogue with any party interested in discussing matters related to FDIC’s mission and responsibilities. Regarding our recommendation that it formally evaluate adopting knowledge building initiatives related to financial innovation, FDIC stated that it recognizes the importance of knowledge building and has developed a framework and implemented initiatives to facilitate this. It also noted that it will continue ongoing efforts to build knowledge related to financial innovation and will consider other relevant knowledge building initiatives, as appropriate.

In response to our recommendations that the Federal Reserve include NCUA and FCC in relevant working groups, the Federal Reserve stated in its letter that its Board staff would seek NCUA’s participation and that staff from the Reserve Banks in Atlanta and Boston would discuss FCC’s participation in relevant working groups. Regarding our recommendation that the Federal Reserve engage in collaborative discussions that incorporate leading practices with other financial regulators regarding financial account aggregation issues, the Federal Reserve acknowledged the importance of working together to ensure that consumers were protected, and noted a variety of ways it already coordinates on such issues, and noted that it will continue to engage in such discussions to address the important issues surrounding reimbursement for consumers using these services. Regarding our recommendation that it formally evaluate adopting knowledge-building initiatives related to financial innovation, the Federal Reserve noted that it recognizes the importance of such efforts and has recently organized a team of experts to ensure that fintech-related information is shared across its organization.

NCUA stated in its letter that it concurred with our recommendations to engage in collaborative discussions that incorporate leading practices with other financial regulators on financial account aggregation issues, formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point, and formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge- building initiatives related to financial innovation. NCUA noted that evaluations of fintech activities are challenging for NCUA because it does not have vendor authority like the other federal banking regulators. We have previously raised NCUA’s lack of vendor authority as a matter for congressional consideration. NCUA stated it will continue to monitor risks posed by fintech firms to the credit union industry by working with the banking regulators.

Regarding our recommendation that OCC engage in collaborative discussions that incorporate leading practices with other financial regulators on financial account aggregation issues, OCC stated in its letter that it recognizes the importance of this recommendation. It noted that it has been involved in ongoing collaborative discussions about such issues and that it would continue to do so.

SEC stated in its letter that it concurred with our recommendation to formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. SEC also stated that it will coordinate with other agencies as appropriate during its assessment.

In its letter, CSBS drew connections between steps that state regulators have taken and those that we are recommending to federal agencies. CSBS also provided additional information regarding state licensing requirements, which we incorporated into our report. Additionally, CSBS expressed support for our recommendations on federal interagency collaboration and stated that it would support related efforts that respected the role of state regulators. In addition, CSBS said that these efforts could benefit from the participation of state regulators and that it would be willing to participate if invited. Similarly, CSBS expressed support for our recommendations that certain federal agencies formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point and formally evaluate the feasibility and benefit of adopting knowledge-building initiatives related to financial innovation. However, CSBS also cautioned that knowledge-building initiatives should not preempt state consumer protection and licensing laws for fintech payment providers or fintech lenders.

As agreed with your offices, we are sending this report to the appropriate members of Congress; CFPB; CFTC; FCC; FDIC; the Board of Governors of the Federal Reserve; FTC; NCUA; OCC; SEC; and Treasury, as well as CSBS and FINRA. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-8678 or evansl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) fintech benefits, risks, and extent of legal or regulatory protections for users; (2) efforts by U.S. regulators to oversee fintech activities; (3) challenges that the regulatory environment poses to fintech firms; and (4) the steps taken by domestic and other countries’ regulators to encourage financial innovation within their countries.

While fintech does not have a standard definition, for the purposes of this report we focused on products and services leveraging technological advances offered by financial institutions; nonbank financial companies; and technology companies within the payment, lending, and wealth management sectors, as well as products or services operating under distributed ledger technology (DLT). Within these four identified sectors, we examined particular products and services. In the payments technologies sector we limited our scope to mobile wallets, peer-to-peer payments, and peer-to-business payments products and services. To identify these four sectors, we conducted background research and reviewed prior GAO reports on fintech, person-to-person lending, and virtual currencies. In the fintech lending sector, we focused on consumer lending—including credit card and home improvement loans—and small business lending services from direct and platform lending models; however, we did not include mortgage lending in our scope, due to the significant amount of regulation within the subsector. In the digital wealth management sector, we examined firms that exclusively offer advice using algorithms based on consumers’ data and risk preferences to assist or provide investment recommendations and financial advice directly to consumers. We also examined issues relating to fintech account aggregation companies that consolidate and display data from consumers’ accounts across financial institutions to help consumers more easily see their overall financial health. For DLT, we focused on providers that used DLT in payments and securities processing and token sales. We also included information on the use of DLT in virtual currencies, such as bitcoin and Ethereum. We also reviewed available data on transaction volumes for the payments, lending, and robo advising sectors.

To identify the benefits provided and risks posed to consumers by fintech services, we conducted a literature review of agency, industry participant, and industry observer documents that analyzed developments within fintech. Using ProQuest, Scopus, SSRN, and Nexis.com databases in the literature review, we identified over 500 relevant articles out of over 1,100 search results by using search terms associated with the four fintech subsectors mentioned above. Our search included articles from 2011 to October 2017. To determine the usefulness of the studies for inclusion, we conducted a review of search results involving multiple content reviews by GAO analysts to determine which relevant articles could (1) provide credible sources of information to help address our researchable questions, or (2) help identify knowledgeable persons or groups to interview. We excluded documents based on the following criteria that eliminated articles that were (1) duplicated; (2) related to countries outside our review; (3) about virtual currencies; (4) categorized as “marginally relevant” by analysts based on the article’s title, publication date, and source; (5) less recent documents from each author or source; (6) from news outlets or nonauthoritative sources; or (7) deemed irrelevant or not useful.

To obtain the financial services and fintech stakeholder perspectives on fintech benefits and risk, we reviewed academic papers, reports, and studies by other organizations on fintech activities we identified through a literature search. We also conducted over 120 interviews with financial regulators; banks; fintech providers; consumer groups; trade associations; academics; think tanks; and consulting and law firms. We identified potential interviewees by conducting Internet research; reviewing literature search results; reviewing recommended interviewees from our initial interviews; and selecting interviewees based on their relevance to the scope of our review. We selected fintech firms and financial intuitions, industry observers, and federal agencies based on the product or service conducted by the firm, expertise of the industry observers, and oversight authority of the federal agencies. We identified fintech benefits and risk by speaking with relevant regulators and other knowledgeable parties including: the Board of Governors of the Federal Reserve System (Federal Reserve); the Federal Deposit Insurance Corporation (FDIC); the National Credit Union Administration (NCUA); the Office of the Comptroller of the Currency (OCC); the Commodity Futures Trading Commission (CFTC); the Bureau of Consumer Financial Protection, known as the Consumer Financial Protection Bureau (CFPB); the Department of the Treasury (Treasury); the Federal Communications Commission; Federal Trade Commission (FTC); the Financial Industry Regulatory Authority (FINRA), the Securities and Exchange Commission (SEC); and the Small Business Administration.

To obtain state-level perspectives we interviewed representatives of the Conference of State Bank Supervisors (CSBS), National Association of Attorneys General, Money Transmitter Regulators Association, National Association of State Credit Union Supervisors, and the North American Securities Administrators Association. We also interviewed staff from three state financial regulatory agencies in states with active fintech firms and regulatory activities: California, Illinois, and New York.

To assess the regulatory environment and various challenges faced by fintech firms, we identified relevant laws and regulations pertaining to fintech companies within our scope by reviewing prior GAO reports on financial regulation and fintech, interviewed agency staff and industry participants, and analyzed relevant agency documents, including relevant laws and regulations. We also reviewed guidance; final rulemakings; initiatives; and enforcement actions from agencies. To obtain federal regulatory perspectives, we interviewed staff from the Federal Reserve, FDIC, NCUA, OCC, CFTC, CFPB, Treasury, FTC, FINRA, SEC, and SBA.

To determine the steps taken by domestic and other countries’ regulators to encourage financial innovation in their countries, we conducted fieldwork—including interviews with regulatory agencies, fintech firms, and industry observers, as well as, observations of fintech programs—in the United Kingdom, Singapore, and Hong Kong. We also conducted interviews with a regulatory organization and fintech firms operating in Canada. We identified and selected countries for our fieldwork through criteria that focused on the extent to which these locations had significant (1) financial services activities, (2) fintech activities, and (3) fintech regulatory approaches. We conducted Internet research, literature searches, and interviews to identify relevant foreign regulators within the selected fieldwork sites. To obtain other countries’ regulator perspectives, we interviewed and analyzed agency documents on regulatory efforts and views on fintech innovations within their financial markets from regulators in Hong Kong, Singapore, and the United Kingdom. To obtain the perspective of fintech firms operating in the selected fieldwork sites, we conducted Internet research, literature searches, and interviews to determine relevant fintech firms and foreign trade associations, including recommendations from domestic industry participants and observers.

We conducted this performance audit from initiation August 2016 to March 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Interagency Collaborative Efforts That Have Addressed Fintech Issues

In this appendix, we present interagency working groups (including task forces and other interagency collaborative bodies) that have discussed fintech issues, and in some cases, taken specific actions. This list includes interagency groups that are dedicated exclusively to fintech as well as those that may discuss fintech as part of their broader financial regulatory focus. Also, it includes interagency groups that operate at both the domestic and international levels (see tables 2 and 3). This list is based on information we obtained from the federal financial regulatory agencies we met with and is not intended to be an exhaustive list.

Appendix III: Regulatory Sandbox Examples

UK Financial Conduct Authority’s Regulatory Sandbox

According to officials, the purpose of the Financial Conduct Authority’s (FCA) sandbox is to allow firms to test innovative products, services, or business models in a live market environment, while ensuring that appropriate protections are in place. FCA has stated that its sandbox has (1) reduced the time and cost of getting innovative ideas to market; (2) facilitated access to finance for innovators; (3) enabled products to be tested and introduced to the market; and (4) helped the agency build appropriate consumer protection safeguards into new products and services. The characteristics of the FCA sandbox, according to the agency, are listed below.

Eligible Participants: Currently regulated firms as well as unregulated firms.

Eligibility Criteria: Firms submit an application outlining how they meet the eligibility criteria for testing, which are (1) carrying out or supporting financial services business in the UK; (2) genuinely innovative; (3) identifiable consumer benefit; (4) need for sandbox testing; and (5) ready to test.

Testing Parameters: If a firm is unauthorized it must obtain authorization or restricted authorization prior to participation in the sandbox. Prior to participating in the sandbox a firm must design, and obtain agreement on, the parameters of the sandbox test, including the duration; customer selection; customer safeguards; disclosures; data; and testing plans.

FCA has four ways that it can help firms operate more easily in its sandbox. First, it can provide restricted authorizations that are a tailored authorization process for firms accepted into the sandbox. Any authorization or registration is restricted to allow firms to test only their ideas as agreed upon with agency staff, which is intended to make the process easier for firms to meet requirements and reduce the cost and time to initiate the test, according to the agency. Second, FCA provides individual guidance to firms in the sandbox that are unclear on how the agency’s rules apply, whereby FCA will interpret the regulatory requirements in the context of the firm’s specific test. Third, in some cases, FCA may be able to waive or modify an unduly burdensome rule for the purposes of the sandbox test, but it cannot waive national or international laws. Finally, FCA can issue no enforcement action letters in cases where they cannot issue individual guidance or waivers but they believe regulatory relief is justified for the circumstances of the sandbox. According to the agency, no enforcement action letters are offered only during the duration of the sandbox test to firms that keep to the agreed- upon testing parameters and that treat customers fairly. Also, no enforcement action letters only apply to FCA disciplinary action and do not limit any liabilities to consumers. Officials we interviewed noted that rule waivers and no enforcement action letters are rarely used tools. As of January 2018, FCA had received more than 200 sandbox applications. Eighteen firms had successfully graduated from the first cohort, 24 firms were preparing to test in the second cohort, and 18 other firms were accepted to test in the third cohort.

Monetary Authority of Singapore’s Regulatory Sandbox

Recognizing that when lack of clarity over whether a new financial service complies with legal and regulatory requirements could cause some financial institutions or start-ups to choose not to implement an innovation, the Monetary Authority of Singapore’s (MAS) purpose in establishing its sandbox was to encourage such experimentation so that promising innovations could be tested in the market and have a chance for wider adoption, according to the agency. In addition, the agency stated that sandbox tests include safeguards to contain the consequences of failure and maintain the overall safety and soundness of the financial system. The characteristics of the MAS sandbox, according to MAS, are listed below.

Eligible Participants: Firms that are looking to apply technology in an innovative way to provide financial services that are regulated by MAS, including financial institutions, fintech firms, and professional services firms partnering with such firms.

Eligibility Criteria: Firms submit an application outlining how they meet the eligibility criteria for testing, which are that (1) the product uses new technology or existing technology in an innovative way, (2) the product benefits consumers or industry, and (3) the firm intends to deploy the product in Singapore on a broader scale after exiting the sandbox.

Testing Parameters: Firms must define the following testing parameters prior to participating in the sandbox: (1) clearly defined test scenarios and expected outcomes must be established; (2) boundary conditions that facilitate meaningful experiments while sufficiently protecting the interests of consumers and maintaining the safety and soundness of the industry must be in place; (3) the firm assesses and mitigates significant associated risks; and (4) an acceptable exit and transition strategy must be defined.

MAS stated that it will consider relaxing various regulatory requirements for the duration of the sandbox test. However, they emphasized that their sandbox is not intended and cannot be used as a means to circumvent legal and regulatory requirements. MAS staff determines the specific legal and regulatory requirements that they may be willing to relax on a case- by-case basis. According to MAS, some of the regulatory requirements that could be relaxed included maintenance of certain levels of financial soundness, solvency, capital adequacy, and credit ratings as well as licensing fees, board composition requirements, and management experience requirements, among others. However, MAS has also laid out some requirements that it will not consider relaxing, including those regarding consumer information confidentiality, anti-money laundering, and countering terrorist financing. MAS officials said that all firms in the sandbox will receive some form of regulatory relaxation. As of November 2017, MAS had received more than 30 sandbox applications. One firm had successfully graduated, and a few other firms were testing or were in the process of initiating a sandbox test.

Hong Kong Monetary Authority’s Fintech Supervisory Sandbox

According to the Hong Kong Monetary Authority (HKMA), the purpose of the HKMA sandbox is to enable banks and technology firms to gather data and user feedback so that they can make changes to their innovations, thereby expediting the launch of new products and reducing development costs. HKMA officials stated that the sandbox allows banks and their partnering technology firms to conduct pilot trials of their fintech initiatives involving a limited number of participating customers without the need to achieve full compliance with HKMA’s supervisory requirements. The characteristics of the HKMA sandbox, according to the agency, are listed below.

Eligible Participants: Regulated banks and their partnering technology firms.

Eligibility Criteria: Fintech initiatives that are intended to be launched by banks in Hong Kong are eligible for the sandbox.

Testing Parameters: Participating firms must (1) define the scope, phases, timing, and termination of the sandbox test; (2) establish customer protection measures, including disclosures, complaint handling, and compensation for consumer loss; (3) establishing risk management controls; and (4) establish a monitoring program for the sandbox test.

Similar to MAS, HKMA stated that its sandbox should not be used as a means to bypass applicable supervisory requirements; however, HKMA will relax regulatory requirements on a case-by-case basis. As of November 2017, nine banks had participated in 26 HKMA sandbox tests. Twelve of these tests had been completed and banks collaborated with fintech firms in 15 of the tests.

Appendix IV: Comments from the Consumer Financial Protection Bureau

Appendix V: Comments from the Commodity Futures Trading Commission

Appendix VI: Comments from the Conference of State Bank Supervisors

Appendix VII: Comments from the Federal Communications Commission

Appendix VIII: Comments from the Federal Deposit Insurance Corporation

Appendix IX: Comments from the Board of Governors of the Federal Reserve System

Appendix X: Comments from the National Credit Union Administration

Appendix XI: Comments from the Office of the Comptroller of the Currency

Appendix XII: Comments from the Securities and Exchange Commission

Appendix XIII: GAO Contact and Staff Acknowledgments

GAO Contact

Lawrance L. Evans, Jr., (202) 512-8678 or evansl@gao.gov.

Staff Acknowledgements

In addition to the contact named above, Cody Goebel (Assistant Director); Chloe Brown (Analyst-in-Charge); Chris Ross; Davis Judson; Ian P. Moloney; and Bethany Benitez made key contributions to this report. Also contributing to this report were Joanna Berry; Timothy Bober; Richard Hung; Pamela Davidson; Tovah Rom; Cynthia Saunders; and Jena Sinkfield.