This may include the use of machine learning and artificial intelligence capabilities to mitigate ML/TF risk, while preserving the speed and convenience of faster payment systems. Proportionate regulation Let me now turn to the next regulatory priority, which is proportionate regulation. Importantly, efforts to strengthen the regulatory and supervisory framework for payments oversight must seek to uphold a key principle: proportionality. More than ever, regulators will have to make tough 3/6  BIS central bankers' speeches  judgment calls on the appropriate trade-offs between competing regulatory demands. For example, open data initiatives that seek to democratise access to customer information would need to consider implications to data security as well as cultural attitudes to data privacy. Providing a seamless user experience to on-board customers for digital payments could also run counter to AML/CFT controls that are traditionally held up as best practice. These are but a few of the examples of the dilemmas that we will have to grapple with. In this regard, a ‘one-size-fits-all’ approach is tempting because it is simple. But its simplicity is precisely why regulators must avoid it. Effective regulation today demands differentiated regulatory requirements that cater for a spectrum of risk profiles. This should be ascertained after undertaking a granular assessment of these risk profiles, and identifying the necessary areas that continue to require risk mitigation measures. Of note, this goes beyond having sandboxes, which are already more common in the regulator’s toolkit. In Malaysia, for example, the regulatory regime for e-wallets is differentiated by size.

Not too long ago, the advent of the Internet heralded a new era for payments by enabling transactions to be conducted remotely using online banking services and payment cards. Today, payment technologies have evolved rapidly to include an alphabet soup of different modes of payment – for example RFID, NFC and QR just to name a few. At the same time, new use cases leveraging on biometrics, open API, artificial intelligence and blockchain are also being developed. While such technological innovations demonstrate great potential, the full impact and resultant risk may yet to be fully understood. Cyber security is also a fast-growing area of concern, given the sophistication of cyber threat actors and as more consumers and businesses are plugged into digital payments. This is further 1/6  BIS central bankers' speeches  compounded by the interconnectedness of payment systems which heightens contagion risk. While sources of risks are borderless, the non extra-territorial nature of most payment regulation and supervision presents a key challenge to effective regulatory oversight. Concentration risks also require close attention, given the largely centralised model of prevalent payment systems. Network effects are a double-edged sword. As a payment system becomes more widely used, the implications of operational disruption would also be more far-reaching. In 2018, we have seen two global card networks face service disruptions, affecting at least five million transactions in Europe and the US. If the frequency and magnitude of such disruptions increase, there is a real risk that public confidence in digital payments would be undermined.