Financial Technology: When and How To Regulate

Transcription

1 Financial Technology: When and How To Regulate Andrew Lorentz Davis Wright Tremaine LLP ACI Emerging Payment Systems Conference September 17-18, 2015 Washington, D.C.

2 FinTech Worlds Colliding or Bridging a Divide? 2

3 Catalyst: Growth in Alternative Payment Providers In January 2014, it was estimated that APPs will account for 59% of online transactions and that e-wallets will equal cards in terms of market share in 2017 Peer-to-peer payment market expected to reach $17 billion in 2019 Growth of P2P Market, APPs for online transactions, e- wallets, mobile payments, Buy Buttons Source: The Clearing House, Ensuring Consistent Consumer Protection for Data Security: Major Banks vs. Alternative Payment Providers (August 2015) 3

4 Culture Clash 4

5 What Divides Them Banks Product Development: Bank grade product / technology before it hits the market Invest on the front end Slow to market Don t fail (or even better, be too big to fail ), don t run out of other people s money Ask permission Outsourcing means Due Diligence, Contract, Monitoring: Protracted and detailed APPs Product Development: Philosophy of Lean Startup by Eric Ries: only Minimum Viable Product before it hits the market Invest on the back-end Rush to market Fail fast, iterate product, don t run out of money Beg forgiveness Outsourcing means take out food: Handshakes instead of contracts

6 The Clearing House Diagnosis: An Uneven Playing Field in Data Privacy and Security Financial Institutions are subject to extensive regulatory, supervisory and enforcement scrutiny by their prudential regulators GLBA Interagency Guidelines More stringent implementing regulations and consequences Safety and soundness Banks ultimately bear customer service and fraud costs Alternative Payment Providers (APPs) provide products and services utilizing backbone of existing payment systems and avoid the reach of prudential regulators GLBA FTC Safeguards Rule Not subject to regular examinations, enforcement actions or oversight Lighter substantive requirements Lower odds of facing enforcement actions or sanctions Banks and APPs engaging in functionally similar activities should be subject to similar regulatory regimes. The Clearing House Source: The Clearing House, Ensuring Consistent Consumer Protection for Data Security: Major Banks vs. Alternative Payment Providers (August 2015) 6

7 The Clearing House Prescription: Fill the Gaps REGULATORY FAILURE Enhance substantive regulatory requirements imposed upon APPs Use available examination authority to examine APPs CFPB should designate larger participants in payments market CFPB and others use authority over service providers Enforce existing requirements for APPs FTC GLBA Safeguards Rule FinCEN (money services businesses) Legislate additional data security requirements for APPs, resource FTC further, give FTC or CFPB exam authority over APPs Source: The Clearing House, Ensuring Consistent Consumer Protection for Data Security: Major Banks vs. Alternative Payment Providers (August 2015) 7

8 Gaps in The Clearing House Paper Premise is wrong regarding sources of risk to data Encryption, tokenization and biometrics are APP staples Treats banks as a monolith and APPs as a monolith ignores tremendous variation within both groups, except that: All banks enjoy exclusive powers in the business of banking including certain network access Banks can borrow at the Fed window and are FDIC insured Nationally chartered depository institutions benefit from preemption Ignores possibility that cacophony* of legislatures and regulators and fractured regulatory regime are the root causes of disparities in regulation, supervision, and enforcement Soft-pedals bank obligations to oversee service providers *jarring, discordant sound; dissonance. The Free Dictionary. 8

9 Gaps in The Clearing House Paper Fails to ask whether regulation is sensible why should we level to inappropriate standards? Ignores policy preferences for performance over design standards BUT beware UDAP/UDAAP combined with excessive authority Ignores considerations of consumer choice and reaching underserved markets for financial services Is one-dimensional data privacy and security only when the need for (sensible) regulatory policy changes is much broader Data-driven risk-based approach informed by behavioral economics? Fails to ask why bank partners of APPs agree to participate in platforms that so disadvantage them 9

10 Food for Thought American Bankers Association: Lets Innovate. Not Mandate. U.S. Chamber of Commerce: [T]he Chamber believes that industry selfregulation and technology-neutral best business practices are the most effective way to enhance innovation, investment, competition, and privacy. Building a 21 st -Century Regulator s Toolkit by Daniel Gorfine and Chris Brummer of the Milken Institute 21 st Century Regulation: Putting Innovation at the Heart of Payments Regulation by Ebay/PayPal s Public Policy Lab The Regulator of Tomorrow by Shrupti Shah, Rachel Brody, & Nick Olson of Deloitte 10

11 THANK YOU! Andrew J. Lorentz

12 Disclaimer This presentation is a publication of Davis Wright Tremaine LLP. Our purpose in making this presentation is to inform our clients and friends of recent legal developments. It is not intended, nor should it be used, as a substitute for specific legal advice as legal counsel may only be given in response to inquiries regarding particular situations. Attorney advertising. Prior results do not guarantee a similar outcome. Davis Wright Tremaine, the D logo, and Defining Success Together are registered trademarks of Davis Wright Tremaine LLP Davis Wright Tremaine LLP. 12