This is supported by a tiered approach to managing AML/CFT risks, where limits on account functionalities serve as safeguards where more simplified customer due-diligence (CDD) methods are applied. This reflects the differentiated level of risks across different types of ewallet accounts. While such efforts are intrinsically more complex, they can accommodate a richer spectrum of business structures and operating models, which in turn can spur innovation. Importantly, this is not about regulations adopting a ‘light touch’; it is about having the right touch, guided by the degree of risks involved. We also should not shy away from exploring nascent technologies that could contribute to the overall resilience of payments infrastructure. As regulators, we should explore pilot programmes to test the potential of emerging technologies. Examples of this include the EU and Japan’s joint project ‘Stella’, as well as Canada’s project ‘Jasper’ that aim to study the possible use cases of distributed ledger technology. Even if these programmes do not immediately deliver scalable solutions, the experience can confer valuable lessons for future initiatives. Enabling connectivity The third area for regulatory focus would be to enable connectivity. A payment system is only useful if it has a wide network reach, be it across products or players, within a nation’s borders or beyond. In this regard, regulators can play a key role in fostering collaborative efforts towards greater standardisation and interoperability. At the domestic level, a few initiatives come to mind – all of which seeking to leverage on a common network.

This may include the use of machine learning and artificial intelligence capabilities to mitigate ML/TF risk, while preserving the speed and convenience of faster payment systems. Proportionate regulation Let me now turn to the next regulatory priority, which is proportionate regulation. Importantly, efforts to strengthen the regulatory and supervisory framework for payments oversight must seek to uphold a key principle: proportionality. More than ever, regulators will have to make tough 3/6  BIS central bankers' speeches  judgment calls on the appropriate trade-offs between competing regulatory demands. For example, open data initiatives that seek to democratise access to customer information would need to consider implications to data security as well as cultural attitudes to data privacy. Providing a seamless user experience to on-board customers for digital payments could also run counter to AML/CFT controls that are traditionally held up as best practice. These are but a few of the examples of the dilemmas that we will have to grapple with. In this regard, a ‘one-size-fits-all’ approach is tempting because it is simple. But its simplicity is precisely why regulators must avoid it. Effective regulation today demands differentiated regulatory requirements that cater for a spectrum of risk profiles. This should be ascertained after undertaking a granular assessment of these risk profiles, and identifying the necessary areas that continue to require risk mitigation measures. Of note, this goes beyond having sandboxes, which are already more common in the regulator’s toolkit. In Malaysia, for example, the regulatory regime for e-wallets is differentiated by size.