Frank Elderson: Payment systems – security, governance and SEPA Speech by Mr Frank Elderson, Executive Director of the Netherlands Bank, at the “Future of the Payments System” conference, Amsterdam, 18 June 2013. * * * Ladies and gentlemen, As you all know, DNB’s objectives include ensuring secure, reliable and efficient payments. That means making sure we can rely on having good and effective payment systems. This is the moment when speakers usually introduce their metaphors. And, in the Netherlands, these are often metaphors involving water. Water that has to flow, and rivers that have to be channelled. And then the dikes that have to be built. But I have decided I am no longer going to do that. Instead, it is now time for conferences on water management to start comparing themselves to payment systems. In other words, to systems that always have to work and that have to be secure, reliable and efficient. Ladies and gentlemen, There are three things I would like to talk to you about today. These are firstly the security of the payment system, and I believe there should be an increasing focus on that. Secondly, what we refer to as “governance”. In other words, how we manage the payment system. And thirdly, which is where I am going to begin today, the near future. In other words, the Single European Payments Area, or SEPA. I think I am right in assuming that everyone here today has been very involved in the introduction of SEPA, and so there is no need for me to explain to you what a complex project it is. And, as always happens with complex projects, that there have been all sorts of problems along the way, and fortunately also some things that have gone well. And that we should really count our blessings. Internet banking systems are switching relatively easily to SEPA. Many businesses have already completed the process, and consumers seem to be accepting IBAN without any major difficulties. The tax authorities, for example, are now generating huge volumes of SEPA payments each month, and believe me when I say that even the Emmer Compascuum volleyball club, which has always been very diligent, has also completed the switch. However I also know from very reliable sources that others, such as the tennis club around the corner here in Amstelveen, are first waiting to see how things develop. On a more serious note, we have seen that introducing the European collections system is proving quite challenging. Although the system is already working well at many businesses, others – particularly some of the larger groups – have had to deal with “bugs”, either in their own systems or in their communications with banks, or sometimes even at the banks themselves. Transactions involving large volumes of collections in particular have not always gone entirely smoothly. I firmly believe, however, that we will be able to resolve all these problems. And my belief has so far been backed up by the facts. What does concern me, however, is that we do not have much time left before 1 February. To be more exact, there are only 161 working days to go. Luckily there are still 228 calendar days to go, and I suspect that, for a few of us, there will not be much difference between a working day and a calendar day over the coming months. Even if a company has calculated that it still has enough time to complete the process, there is always a danger of logjams arising. Many companies and even some banks themselves have experienced delays in their projects, and that means more businesses than expected will need help over the coming period. BIS central bankers’ speeches So what are we going to do? There is no need for me to say that SEPA should be a top priority for you all, and I assume it already is. But just in case you are here today representing a company that has not yet started its preparations, I am afraid to say you will probably have to work through most of your weekends until February next year. There is one other thing I would like to add today. I know that people in some countries are slightly less concerned about the deadline of 1 February. That may be because they are more light-hearted by nature. Personally, however, I think there are two other reasons that may explain the differing attitudes. Firstly, the biggest challenge for SEPA is setting up the European collection system, and many countries use collections far less than in the Netherlands. Secondly, certain other countries are making far more use of conversion services. These services mean businesses can make far more modest adjustments to their systems and then use a conversion service so that the payments they send to their banks are SEPA-compliant. These conversion services have never been able to count on much support in the Netherlands as, ultimately, they mean you are not making genuine SEPA payments. However, they are an interim solution that will certainly help some parties to meet the 1 February deadline. Please do not understand me wrongly. I am certainly not suggesting using conversion services as an alternative to switching over to SEPA. All I am saying is that you should consider whether you need to use these services to meet the deadline. And make sure you do this in time because conversion services also involve more than just pressing a button and suddenly, all at once, you are SEPA-compliant. You also need some preparation time, particularly for collections. I hope, therefore, that conversion services will be included in banks’ discussions with clients who are at risk of missing the deadline. Whether they see these services as a temporary bridging facility, as an emergency sticking plaster or as a solution. That is entirely up to them. There is just one final comment I would like to make on conversion services. What exactly are they? If I enter a payment into my payments engine in the old-style format, is that a conversion service? The answer to that question is “no”. A conversion service is a separate service that is independent of the bank’s payments engine. It is a service you can arrange for separately, either at a bank or from another provider. You might expect to have to pay a fee for the service. Indeed, it was previously said that conversion services would have to be provided by separate legal entities. But there is no need for you to worry. That is not necessary, and this is something I am saying in my capacity as “overseer” of SEPA. And this then brings me to my second topic today: governance of the payment system. I am going to dwell for just a while longer on the subject of SEPA as the Ministry of Finance has given DNB two hats to wear in this respect: that of overseer and that of catalyst. As far as DNB as overseer is concerned, this is when I put my strict hat on as it is the overseer’s task to make sure the banking sector complies with the law. That means staying on top of things, and we will be tightening the reins even more over the coming months. That will sometimes mean difficult discussions with some parties. And sanctions will follow if things are not satisfactory. Even, however, if we do decide to apply sanctions, we cannot do that before 1 February next year. That may sound a bit strange because, by then, it will in any event be too late. That is why we will also be looking at how parties are operating now when we consider whether to apply sanctions next year. BIS central bankers’ speeches I am sometimes asked “Exactly how strict is DNB going to be next year?” My answer to that is quite simple: “Strict”. The next question then is “But are you going to be thorough?” My answer to that question, too, is simple: “Of course we are”. If I then put on my other hat – that of the catalyst – it means looking at the issue from the typical Dutch polder perspective and switching to my role as chairman of the NFS National Forum on SEPA migration. That role means working with everyone to make sure we take account of all the interests at stake and arrive at optimal solutions for us all. Here, too, we regularly have to be strict. The overseer’s hat then comes in handy as there are times when we also have to take decisions. And not every decision is equally welcomed by everyone. The NFS is the SEPA variant of what we are doing on a broader scale in the National Forum on the Payment System (or MOB, as it is known in Dutch). I often have to explain to colleagues from abroad that this Forum works on the basis of equal participation by representatives of providers and users of payment systems. And, if you’ll forgive me this reference to water after what I said earlier: before we start work on, say, a project to build water defences, we first put up a coffee hut at the site. Setting up the coffee hut is not our main task, but we would not want to be without it as that is where we agree who is going to do what during the project. This is also a model that could prove useful in a European context. As you may know, there is a SEPA Council at a European level, and I have attended its meetings on various occasions. But the SEPA Council still has too few powers to make a real impact. However, and despite all the good aspects of the polder model, we also have to admit, in the current climate, that not everything can be done in an atmosphere of cooperation and consultation. Not everything can be voluntary. With the exception of our new SEPA task, DNB’s oversight task is still based on a voluntary agreement, and that is no longer appropriate for the times we live in. The payment system has become far too crucial for society to allow oversight of the relevant players to remain entirely voluntary. We really need legislation in this respect, and indeed some of this legislation is on its way. The Settlement Organisations (Financial Supervision) Act [Wet Financieel Toezicht voor Afwikkelondernemingen] will come into force next year. Although this will certainly provide a legal basis for our oversight activities, it will not plug all the gaps. We are still not allowed to impose measures on organisations such as iDeal, for example, and there is no need for me to tell you how tolerant society is about iDeal disruptions. To ensure secure, reliable and efficient payment systems in a broad sense, DNB needs legislation covering every aspect involved in these systems. That is something we are currently discussing with the Ministry of Finance, and I certainly hope we succeed as the payment system is simply too important for us to be satisfied with the current patchwork of laws. We need a single consistent framework so that we can supervise all the links in the horizontal chain of the payment system. We still do not have that single framework, and that is something that today’s world demands. And now I am coming to my third and final point: the security of the payment system. In April this year various Dutch banks in the Netherlands were hit by a series of DDOS attacks, and this is a matter of great concern to DNB. Fighting cybercrime and dealing with the digital disruption it causes are high priorities for us. Last month I attended discussions at the Dutch House of Representatives to explain my views on these subjects. Society has become less tolerant about disruptions to the payment system as more and more people are using on-line payment products, and consumers increasingly expect BIS central bankers’ speeches payment systems always to work. Those are facts we have to accept. We also have to accept, however, that 100% availability is an illusion. That is just impossible. So what can we do? There are three things we have to work on: 1. Prevention 2. Damage limitation if and when things go wrong, and 3. Communications. In the case of prevention, I believe that we as a sector are going to have to focus more on security and availability. And yes, that may mean we have to accept that systems will sometimes be less efficient than otherwise. By harmonising systems and technologies we can certainly boost efficiency. But this also creates SPOFs, or single points of failure, and these make us vulnerable and, therefore, a more attractive target for cybercriminals. And although I always sleep extremely well at night, cybercrime does sometimes mean I go to bed later. A lot of parties are working extremely hard to avoid becoming victims of cybercrime. But we can never rest on our laurels. It is a race, and the enemy never sleeps. There is one other aspect I would specifically like to draw your attention to, and that is the need for diversity. In other words, the need for alternatives. If we cannot use iDEAL, but another easy-to-use alternative is available, that is fine. But that means that the alternative must not be reliant on the same technology as iDEAL. Diversity in technology is important. Also when you make PIN payments in a shop. If the PIN terminal does not work, you need to be able to pay in another way, and using a method that is not dependent on that PIN technology. We are now thinking about these alternatives, and maybe a more mobile society will help us in this respect. What I mean here is that technology has become more mobile. Mobile internet banking, for example, is becoming increasingly popular, and mobile payments are on the way. In other words, the distinction between point-of-sale and remote payments is becoming blurred, and maybe it will ultimately disappear altogether. If the various technologies become equally fast, it will soon no longer make any difference whether you use your phone to make a mobile payment (a PIN payment, for example) or an internet banking payment (in other words, a transfer). If I put my security hat back on, I would say that is fine, but we do need to make sure we use two different technologies. Otherwise, a single cause could result in both payment options being unavailable at the same time. Some of these changes are still in the future. But the issue also applies to the old tried and trusted alternative of cash. If the PIN system does not work, you need to be sure you can still get cash out of the cash machine. And luckily that is not usually a problem because you withdraw cash from your own bank’s cash machine system, which is separate from the PIN system. So there, too, technological diversity is important. And so, to go back to what I mentioned before, our resilience to cybercrime relies on our having good preventive measures in place and also on our having good mitigating measures, just in case things go wrong. Communications, however, are also important, which is why this topic was discussed at the extra meeting held by the National Forum on the Payment System on 15 April. We reached various useful agreements during this meeting, and these require us to be able to communicate very quickly. And in this case “very quickly” means that communications may often first have to be limited to process-related information. We also reached agreements on the need to communicate better. In other words, on who will communicate what in which circumstances. In the first instance, the bank that has been affected will communicate. If, however, the problem is more widespread, the Netherlands Bankers’ Association (NVB) will communicate on behalf of the sector. BIS central bankers’ speeches DNB will communicate only if the payment system as a whole is at risk. Or, to put it more accurately, the Tripartite Crisis Organisation (TCO) will communicate. DNB chairs the TCO, while the AFM and the Ministry of Finance are the other two members. DNB, or rather the TCO, will act as “communicator of last resort”. That is a role we are suited to. Will it mean we can avoid any form of disruption in the future? No. No-one can give any guarantee of that as there is simply no such thing as a risk-free society. Lastly I would like to look ahead to the future. We should not see SEPA as being finished by 1 February 2014. That date is really just the start. We are going to be seeing other developments, including electronic mandates, and probably more and more mobile payments. Time and experience will refine and change our payment products. And DNB is looking with interest at our neighbours to the east and the shorter transfer times they are achieving on SEPA Direct Debits. SEPA’s arrival will also change the playing field for payment service providers and banks, and innovative parties will grasp their opportunities. One of these innovations will involve parties wanting access to payment accounts so that they can offer new services. The Dutch payment sector has issued a position paper on this subject and has sent this to Europe. There is one issue in that paper, however, where our view may not get accepted, and that is the “dual consent” approach. Just to remind you what that is, it covers situations when a third party wants access to a person’s payment account, either to make a payment or to check the balance. That involves certain risks. In my view, those risks are acceptable only if both the consumer and the bank agree to the role of the third party. One good way of arranging this is for both parties to have to agree to grant access. In other words, dual consent. Our European colleagues are worried that, in practice, banks will not grant access to those third parties, and that this will hold back innovation. That is why there is currently insufficient support for the principle of “dual consent”. The Dutch market, however, is in favour of it, and so that is the challenge I am issuing to any payment service providers and banks here today. Show that it can be done. There is nothing to stop us from operating a “dual consent” approach in the Netherlands. And I for one would welcome it. “Dual control” is also secure, and I am sure no-one will blame me for saying that security is my top priority. And I think that you and the rest of society will probably all agree. Innovation is good, and even very good. But if your bank balance suddenly and innovatively disappears, you would wish that security had been the number one priority. People have to be able to trust that their payments will arrive in the right place and at the right time. The routes that monetary flows take need to be predictable and known. Ladies and gentlemen, It is now time for some rhetoric. If you have read Quintillianus, you will know that this is when I should return to my metaphor. In other words, to the metaphor that I threw overboard at the start of my speech. The metaphor of SEPA as a wonderful new waterway, with neatly finished retaining walls and an efficient system of locks. But I am not going to do that today. Instead I am going to tell you that there is a conference on water management being held tomorrow in Rotterdam and that you might find it interesting. Thank you for listening. BIS central bankers’ speeches