Arnold Schilder: Banking in the new economy: a supervisory perspective Speech by Mr A. Schilder, Executive Director of De Nederlandsche Bank N.V., at the Take Off Conference ‘Information Battle: Consequences of the New Economy on Economic and Business Life’, University of Maastricht, 14 February 2001. * * * Introduction The new economy affects the almost two-hundred-year-old Nederlandsche Bank in many ways. Today, I will focus on the implications of the new economy for banks and for banking supervision. The subject therefore is: e-banking supervision. Electronic banking First, what is e-banking? E-banking is the provision of banking services by means of electronic data transfer between participants. The information is transferred via a network, which may be a computer network such as the Internet, or a telecommunications network. Rabobank’s Random Access Banking is an example of e-banking. By that, customers can make payments, deposit savings, and make investments over the Internet or by telephone. In addition, when people shop in a Dutch cybermall, such as Davista (www.davista.nl), Random Access Banking mostly offers the possibility to pay using Rabo Direct. This last application could be described as using your PIN code over the Internet. Another recent example of e-banking is Wellowell, owned by ING. This is an on-line marketplace. Customers can compare insurance offers and banking products from various providers here, and close the deal there and then. Examples are a car insurance or a savings account. In this way, ING offers its own products, as well as those of its competitors. What does the advent of electronic media mean for banks? I would like to mention three consequences. One is that the Internet makes the market more transparent. Consumers can compare products and services from different providers more easily, and shop around for the best offers. This is particularly the case for standard products like consumer credit, where price is the key factor determining the customers’ selection. In addition, the costs of switching suppliers are lower in the case of electronic banking. Combined with the increased comparability of products, this could reduce customer loyalty. This in turn means fiercer competition for banks. A second consequence of the new information and communication technologies is that the organisational structure of banks will be affected. Banks have a very integrated value chain, horizontally as well as vertically. This means that all elements of their service are provided by the same organisation. Examples are account management, product development and infrastructure. The Internet puts pressure on this integrated organisational structure. An important aspect of Internet technology is that its development requires very high initial investment, but that the marginal costs of use are low. This raises the possibility that new, specialised suppliers are able to carry out certain specific activities more efficiently than the banks themselves. On the one hand, this situation offers the banks the option to outsource some of their operations to others, thus achieving cost reductions. On the other hand, it could bring unwanted pressure on parts of the banks’ value chain, and ultimately lead to deconstruction of the chain itself. A practical consequence of this trend is that banks are developing into network organisations by way of alliances and cooperation with both financial and nonfinancial institutions. For example the cooperation between ABN AMRO and KPN in relation to the launch of the ‘Money Planet’ Internet site. A third consequence is that new suppliers can enter the market more easily. In the virtual world, barriers to entry are significantly lower. There is no longer a need for an extensive branch office network, for example. Lower entry barriers mean more suppliers in the market, which intensifies competition. These suppliers may take different forms. They may be existing banks originating from other countries. These banks can use the Internet to bring about a rapid internationalisation of their activities. Various institutions have already set up electronic subsidiaries, which offer banking services on an international scale under a new brand name or under the name of the parent bank. Examples include the Bank of Scotland’s electronic subsidiary Eubos, which offers mortgages on the Internet in this country, or ING Direct, ING’s electronic offshoot, which is active in Canada and elsewhere. New suppliers can also be pure electronic banks, or institutions from the non-banking sector. Pure electronic banks are not linked to an existing physical bank. Although they do not have the high fixed costs of a branch network, they do have to invest heavily in building up their reputation. It is interesting to note that the current market share held by such banks is still very small. The principal reasons for this are probably the lack of confidence resulting from the lack of a physical presence and the high cost of marketing the brand name. Newcomers from the non-banking sectors can be existing non-financial institutions that offer a limited range of financial services through electronic channels. Volkswagen in Germany is one example. They offer consumer credit. Also companies which specialize in payment systems are part of the non-banking category. Right now I am talking, they offer you the possibility to make payments over your mobile telephone. This sevice is already available in the United States. Other non-banking institutions include consumer comparison sites like Wellowell, portals and personal agents. The implications of e-banking for supervision So far I have described some consequences of electronic media for the banking system. But what are the implications for banking supervision? Let me discuss some recent activities undertaken by supervisors. First, the Nederlandsche Bank supervises the banking system in accordance with the Dutch Credit Systems Supervision Act. The Policy Regulations for the Media (Beleidsregels Media) were formulated to indicate how this Act should be applied where financial services are offered via electronic media. Briefly put, these Regulations state that it makes no difference whether banking services are provided via traditional channels such as branch offices, or over the Internet. In both cases the institution concerned is required to hold a banking license. For example, an institution established in the Netherlands which provides banking services over the Internet comes under the supervision of DNB. However, a provider which is established abroad but via the Internet is active in the Dutch market is also subject to DNB supervision. Several indicators play a part in deciding whether activities are considered to be directed at the Dutch market, like the use of the Dutch language, contact points in the Netherlands, and the addressees of the media used. The existing regulatory legislation is therefore adequate for proper banking supervision, also with the advent of e-banking. E-banking has however made the regulator’s task more complicated. How do we check that all providers that are active over the Internet in the Dutch market do indeed comply with regulatory legislation? This brings me to a recent DNB initiative. Second, in combination with its fellow regulators the Dutch Insurance Board and the Securities Board of the Netherlands, the DNB has entered into a co-operative agreement with the Dutch National Police Agency (Korps Landelijke Politiediensten, or KLPD) and the Dutch Economic Investigation Service (Economische Controle Dienst, or ECD). We are working together on developing new tracking methods. The objective is that those whose actions on the Internet are in breach of the regulatory legislation can be traced. A third initiative is the introduction of the internet officer. The digital detective, or cybercop, is already a familiar phenomenon in police circles. From the beginning, the use of cybercops has induced investigation authorities to develop techniques to discover the identity of those who are in breach of the law. The regulators want to use this technology in their supervision of the financial sector. The DNB now has one internet officer, which like the digital detectives is engaged in tracing financial offenders. So far, several indications of offences on the internet have been found. For example institutions that offer banking services over the internet without having a banking license. Also some so-called ‘study investment associations’ (studiebeleggingsclubs) were in breach of the regulatory legislation. These investment funds, founded by students, operated over the internet without a license of DNB. A fourth initiative to protect consumers against unauthorised banking services is the introduction of so-called hyperlinks. This possibility is currently being investigated. Every financial services provider using e-commerce would be required to place a hyperlink on its website referring to the relevant regulator. By clicking on this hyperlink, consumers would access a list of providers licensed by the regulator, and could easily see whether a provider is on the list, and therefore is trustworthy. Another possibility being considered is a regulator’s ‘black list’, which would be a special page on the regulator’s website listing financial services providers that are operating without a license and therefore not trustworthy. So we work together with fellow regulators, the police and investigation services. However, the Bank has a separate unit concerned with the supervision of banks and information technology within its Supervision department. The fact is that e-banking involves several specific operational risks. One operational risk mainly relates to the security of systems and transactions, including data confidentiality and authentication of the parties involved. Another operational risk refers to the continuous availability of the Internet as a medium for financial transactions. This availability is prone to serious hazards, such as computer viruses and hackers. Think for example of the Homebanking application of ABNAMRO, that was subject to an attack of hackers in September last year. Such an incident may damage the reputation of the internet as a means of payment. It is therefore very important for banks to ensure the safety of e-banking. The regulators at our IT- unit monitor whether this is sufficiently done. To that end, they have conversations with the banks to gain insight in the controls, the legal implications and particularly the security of e-banking. Furthermore, they retrieve documentation, such as the banks’ risk analysis, an independent EDP audit report and the results of a penetration test. This test is a legal attempt to hack, conducted by an external organisation. As well as the national initiatives I just mentioned, there are international activities under way in the e-banking area. A good example of this is the work of the Electronic Banking Group, or EBG, which is a working group of the so-called Basel Committee of Banking Supervision. This group is engaged in formulating international guidance and principles regarding e-banking. The EBG recently published its principles for risk management in electronic banking, which also include issues relating to consumer protection. One example is a principle that concerns appropriate disclosures for e-banking services. This principle states that banking organisations should provide on their websites some core information in order to assist customers in making informed choices. Examples of such disclosed information could include contact details for the supervisory authority responsible for the supervision of the bank’s head office as well as details of access to national compensation or insurance schemes. The risk management principles for e-banking are currently presented to the banking sector for consultation. It is expected that the final version will be presented to the Basel Committee next month. Around April, the principles will be published at the website of the BIS (www.bis.org). Beside the publications at our own website (www.dnb.nl), such as this speech, you also find a link to the site of the BIS. Besides the work of the Basel Committee that applies specifically to the banking sector, there is more general legislation in the form of EU directives. These affect e-banking as well. For example the Directive on electronic commerce, which requires providers of electronic services to make information on prices and conditions accessible for consumers. Another relevant directive for e-banking is that on the remote provision of financial services. This states for example that consumers have the right to recall an agreement if a supplier did not provide them with the terms of delivery, like prices, before entering into a transaction. Conclusion To summarize: e-banking is a phenomenon which affects both banks and regulators. I hope I have made clear that this subject has the regulators’ full attention, both nationally and internationally. As well as participating in international discussions on e-banking, the Bank has undertaken various initiatives to include e-banking in its supervisory policy. This does not mean that we can afford to be complacent. Developments are proceeding rapidly, and the DNB is closely monitoring developments to ensure a timely response. In various ways we keep up our know-how on an continuous basis. By means of courses and self-study, for example. But also by benchmarking through third parties, as it is relevant to review one’s own organization from time to time. Finally, a very important way for keeping up our know-how is by recruiting new staff. So if the supervision of e-banking has aroused your interest, DNB is probably something for you.