Abdul Rasheed Ghaffour: Reimagining the regulatory landscape for payment systems Keynote address by Mr Abdul Rasheed Ghaffour, Deputy Governor of the Central Bank of Malaysia (Bank Negara Malaysia), at the Global Payments Week 2018 &quot;Reimagining the regulatory landscape for payment systems&quot;, Kuala Lumpur, 4 December 2018. * * * Making a payment used to be an ordinary affair. You’d fill up your cart, head on to the cashier, and reach for your wallet. Today, that cart could be a screen, the cashier a machine, and the wallet a phone. In a span of about 10 years, digital innovation has radically transformed payments. Digital technologies now enable payment services to be easily replicated and rapidly scaled, often at a small incremental cost and increasingly by new and non-traditional players. Geographical and time constraints are becoming less relevant when transferring funds especially with the advent of real-time payment services. Mobile money and e-wallets have brought millions more individuals into the financial fold. ‘Super apps’ combined with payments functionalities have created entirely new ecosystems – these enhance user convenience and offer new opportunities for businesses beyond the area of payments. Cash and cards are no longer the only ways to pay – soon, we may no longer even need to present our physical or digital wallet. Last year, a global fast food chain started accepting facial recognition as a mode of authorising payment in China. This is – quite literally – the new face of payments.

To that end, regulations must seek to ensure that payment systems are secure, reliable and resilient. Given the increasingly unpredictable sources of risk, regulatory initiatives would benefit from an ‘assumed-breach’ philosophy. Systemically important payment systems must be set up to be able to withstand disruption. This would entail requiring adequate financial buffers and robust business continuity arrangements to preserve the continuity of key payment services under stressed conditions. With increasing digitalisation, cybersecurity incidences have the potential to not only cause significant business disruptions and monetary losses, but also undermine the trust and confidence in the global financial system. Due to the interconnectedness of the global economy, cyber resilience is only as good as the strength of the weakest link. It is important therefore for regulators to formulate and promote the adoption of holistic cybersecurity strategies that are constantly enhanced. This should be complemented by strong public-private collaboration at both domestic and international level to strengthen collective resilience. With payment systems becoming more efficient and interconnected, it is also important to prevent their abuse by illicit actors, such as for money-laundering and terrorism financing (ML/TF). Notably, the availability of instant payments poses challenges to traditional AML monitoring tools that operate on a batch mode, rather than on a real-time basis. Regulations should thus focus on continuous enhancement of AML controls among industry players, supported by improved AML compliance procedures and more advanced monitoring approaches.