Guidelines for Oversight of Non- Banks Electronic Retail Payment Systems

Transcription

1 Guidelines for Oversight of Non- Banks Electronic Retail Payment Systems A paper submitted to MEFMI Secretariat in partial fulfilment of the requirements of the Fellowship Apprenticeship Program Kennedy J. Komba August

2 Table of Contents Table of Contents... 2 Abstract... 3 Chapter I: Introduction Importance of Electronic Payment Systems to the Region Problem statement Objectives Motivation Structure of the Paper... 5 Chapter II: Non-Bank Electronic Retail Payment Systems Oversight Issues Types of non-bank electronic retail payment systems in the region Regulatory Issues of non-bank electronic retail payment systems in the region... 8 Chapter III: Guidelines for oversight of non-bank electronic retail payment systems Risk Management Oversight of non-bank retail electronic payment systems Chapter IV: Conclusion and Recommendations

3 Abstract The rapid growth and proliferation of non-banks electronic retail payment systems in MEFMI member states has created concerns for the central bank on how to effectively regulate the industry. Electronic retail payment systems have gained acceptance in most countries in the region for their role of financial inclusion, cost effective payment services and convenience. Their benefits transcend from the individual customers to the wider spectrum of the economy in countries where more than 60% of the population do not have bank accounts. Central banks have not been able to fully implement risk management approach to oversight of the electronic retail schemes due to regulatory challenges and human capacity issues, as a result some central banks have not been able to grant licences to some innovative retail schemes in their markets. This has generally affected optimum implementation of such electronic schemes which are beneficial to the economy by inclusion of unbanked population to the financial services stream. Effective oversight of the electronic retail payment systems will enhance implementation of such systems in the region, improve their risk management and create an efficient competitive environment. The paper proposes a generic guideline for oversight of electronic retail payment systems. The framework is based on risk management approach using some indicators that can be built in to assist oversight of the electronic retail systems in MEFMI region. Keywords: Non-banks electronic retail payment systems, oversight, risk management, indicators. 3

4 Chapter I: Introduction 1.1 Importance of Electronic Payment Systems to the Region Electronic retail payment systems are important to the economies of the MEFMI region due to their beneficial value: significant being their role of financial inclusion of the unbanked population. In most of the member states > 60% of the population have no bank accounts or access to formal banking service while > 80% of the population have mobile phones which can be used as instruments to facilitate retail electronic payments 1. Other forms of electronic retail systems prominent in the region include money transfers/remittances and retailers card payments schemes. The business potential of these systems has attracted non-banks to crowd the market with innovative electronic payment systems which have a wide consumer acceptance and usage. 1.2 Problem statement Whilst these systems do offer beneficial values to consumers they on the other hand poise regulatory challenges to central banks; since being operated by non-banks they do not fall within the regulatory jurisdiction of central banks. 2 As a result, most central banks do not conduct oversight on such systems. Without apparent regulations system operators of these electronic retail products have unfair competitive advantage of the banks and their business risks left unchecked will affect the financial sector and the economy at large. 1.3 Objectives The main objective of the study is to develop guidelines for the oversight of non-bank electronic retail payment systems. It has been observed that not all forms of electronic retail systems mentioned above operate in all member states however the principles elucidated in the guidelines are intended to be generic for ease of adoption by the member states irrespective of the level of penetration of the electronic payment systems. Other objectives of the study include: (i) To enable oversight units in the member states have a working tool for oversight of retail payment systems. (ii) To enhance the skills and techniques in oversight of electronic retail systems and other fields of oversight. 1 Findings of a survey conducted in MEFMI regional payment systems activities and country missions. 2 Ibid 4

5 (iii) To create a rational for enactment of enforcement instruments that will facilitate effective oversight of the retail payment systems. 1.4 Motivation The motivation to develop these guidelines arises from the need to fill in the apparent absence of guidelines for overseeing electronic retail systems in most member countries 3. The increased proliferation of non-regulated electronic retail payment system operated by non-banks is no longer a domestic problem these systems are susceptible to be used for facilitating cross border transaction, money laundering, terrorist financing and other cross border illegal transactions. The guidelines will be used as best practice in oversight of electronic retail payment systems. 1.5 Structure of the Paper The paper is structured as follows: Chapter 2 covers the types of electronic non-bank retail systems operated in the region and regulatory/oversight issues. Chapter 3 provides the generic guidelines for oversight of electronic retail payment systems. This chapter details the steps to be followed for risk management and possible definitive oversight actions. Chapter 4 concludes the paper with recommendations for further enhancement of the oversight of electronic payment systems in the region. 3 The author made a survey of the existence of oversight guidelines for retail e-payments in the region from MEFMI payment systems regional workshops and country missions 5

6 Chapter II: Non-Bank Electronic Retail Payment Systems Oversight Issues 2.1 Types of non-bank electronic retail payment systems in the region For purposes of developing the guidelines proposed in this paper, concentration has been given to the non-bank electronic retail payment systems in the region which are not regulated by most central banks. These include: money transfers/remittances, retailers card payments schemes and mobile phone payment schemes. Table 1 below shows the country distribution of such schemes. Table 1: Country Distribution of Non-bank Retail Payment Schemes. Country Type of non-bank retail payment Scheme Mobile Phone Money Transfer/ Retailers card Others Money transfers Remittances payment Angola Botswana YES (just started-trust YES YES YES (Switch) a/c model) Kenya YES (trust a/c YES YES N/A model) Lesotho NO YES YES NO Malawi YES YES YES Mozambique N/A YES N/A N/A Namibia Rwanda Swaziland N/A YES YES N/A Tanzania YES (trust a/c model) YES (trends) N/A YES (Switch) Uganda YES YES YES N/A Zambia Zimbabwe NO YES YES N/A Source: Author s Questionnaire sent to NPS Departments of MEFMI member states Mobile Phone Money Transfer Systems (m-payments) In the context of this paper m-payment money transfer system refers to transfer of funds from one person to the other (P2P) by use of a mobile phone. The service of which is provided by a non-banking entity such as an Mobile Network Operators (MNO). The business model of the m-payment allows customers to deposit and withdraw money from a network of agents that includes airtime resellers and retail outlets acting as MNO agents. In the region only three countries (Tanzania, Kenya and Uganda) do have this P2P operated by 6

7 MNO in Tanzania and Kenya the central bank has managed to ensure that the MNO operates a trust account in a commercial bank for all deposits obtained for the service. In Botswana applications have been submitted and they are contemplating on the trust account approach too Money transfers/remittances systems Money transfers/remittances systems in the region are mostly operated by international remittances companies: such as Western Union and Money Gram. In some countries they are licensed as independent money transfer companies in others they are required to operate through a bank or postal institutions Retailers card payment systems Retailers card payment systems are operated by retail outlets for consumer products such as petrol stations, supermarkets, clothing chains etc. The retail outlets brand their cards and offer the cards to their customers with loaded e-money (from the customer deposits) to be used in the retailers outlets. The aim of this business model is to create a customer base and it has several benefits to the retailer including holding on to the float and investing on the same. In the region six countries have indicated existence of such payment service and none oversees such a system. The scale of operations of such retail system is not wide spread however central bankers need to underscore the nature of such transactions and the risk imbedded to be able to make informed oversight decisions. Without measuring it is not possible to rule out the significance of this retail outlet payment system. It is noted from the survey that such transactions are limited in few countries mostly operated by petrol stations and supermarkets. In the CMA countries retail outlets are subsidiaries of South Africa and assumptions is placed on them being regulated in South Africa. The growth and level of penetration of such retailers card payment systems cannot be compared to m-payments because the latter transcends across the whole spectrum of the population, while the former is focused on the middle and upper class urban dwellers which are < 20% of the economies 7

8 in the region. Even then, central banks are required to servile and understand the implications of the retail payment systems in their market. 2.2 Regulatory Issues of non-bank electronic retail payment systems in the region Central banks in the region are challenged with the oversight/ regulation of the non-bank electronic retail payment systems. Table 3 below provides an highlight of the oversight/regulatory status in the region on the non-bank electronic retail payment systems discussed in this paper. It is observed that most central banks do not oversee such systems in countries, and where it is done, there is no in-depth analysis of the statistics that are obtained from these systems. The retail card payment system is not overseen at all and the Money transfer/ remittances is left for the banking supervision or exchange controls department. On the m-payments in the three countries (Botswana, Kenya and Tanzania) that have the system are using a trust account model; where MNOs are required to open a trust account with a bank and deposit all monies obtained from their customers in the transfer services. Hence the trust account is mirroring all electronic money circulated by the MNO. Uganda and Malawi have not yet commenced oversight on their Mobile Phone Money Transfer System. The survey has shown that countries do not conduct a full risk assessment on the non-bank retail payment systems. The paper provides some guidance in chapter 3. Table 3: Oversight/Regulation of Non-bank Retail Payment Schemes by Central Banks. Country Mobile Phone Money transfers (m-payments) Oversight of non-bank retail payment Schemes Money Transfer/ Remittances Retailers card payment systems Others Angola Botswana YES (just startedtrust a/c model) NO NO YES (Switch-obtaining statistics only) Kenya YES (trust a/c YES (through NO N/A model) bank supervision) Lesotho N/A NO NO N/A Malawi NO (not yet NO (lack of capacity) commenced oversight) Mozambique N/A NO N/A N/A Namibia Rwanda Swaziland N/A NO NO N/A Tanzania YES (trust a/c YES (trends) N/A YES (Switch-obtaining model) statistics only) Uganda NO NO NO N/A Zambia Zimbabwe N/A NO (exchange NO N/A control only) Source: Payment Systems Department of MEFMI Member States, August

9 The major issues that impede the oversight/regulations of the non-bank electronic retail systems include authority issues, interpretational issues and skills based (human capacity) Authority issues Authority issues occur in domestic and international operations. Domestic authority issues relate to the limited regulators powers of an authority to oversee or regulate an entity that it has not licensed but apparent operations of this entity falls within the regulator s scope of regulatory jurisdiction. This conflict is vividly exemplified by m-payments operated by MNOs (money transfers falls within the concern of central banks), however MNOs are licensed by telecommunication regulatory authorities legally they are answerable to their parent regulator, in absence of clear regulatory frameworks MNOs operations of money transfers in most countries is left unchecked, save for those that have improvised by requiring the MNOs to operate their money transactions through a bank by opening a trust account. The trust bank requirement enables the central bank to conduct limited oversight monitoring the trust account. Other issues relating to the risk management of the MNO are not clearly overseen by central banks as non of the central banks has clear agreements with the telecommunication authorities to conduct joint oversight of the MNOs Interpretational issues Interpretational issues relate to the complications of legal definitions of the providers of electronic retail payment system, if they should be defined as banks or non-banks or neither. The way they will be legally defined will impact on the regulatory framework. If they are categorised as banks then the provider falls within the jurisdiction of the central banks where banking laws apply. However, if they are not categorised as banks then new regulatory framework will be required. In all the countries surveyed, they have not categorised these retail systems as banking business except for the remittances/money transfer services offered by Western Union, Moneygram and such other companies which are required to operate through bank networks. M-payment retailers card payment systems are not legally defined as banking business in the surveyed countries. Table 2 below highlights some examples of existing legal definitions of banking business and its implication on the electronic retail systems discussed in this paper. 9

10 Table 2: Interpretation of Banking Business in the region and its impact on electronic systems Country Definition of bank business by Banking Act/ Central bank Acts Botswana [Banking Act, 1995]... (i) the business of accepting deposits of money repayable on demand or after fixed periods or after notice, as the case may be, by cheque or otherwise; and/or (ii) the employment of deposits in the making or giving of loans, advances, overdrafts or other similar facilities and in the making of investments or engagement in other operations authorised by law or under customary banking practice, for the account of, and at the risk of, the person or persons accepting such deposits, and includes the discounting of commercial paper, securities and other negotiable instruments, for the purpose of extending loans or other credit facilities Kenya [Banking Act S2(1)]...is a business that accepts money from the public on deposit or on current account and uses this money by lending, investment or in any other manner for the account and at the risk of the person so employing the money. Malawi [Banking Act ]...the business of receiving funds from the public by accepting demand, time and savings deposits or by borrowing from the public or other banks, and of employing such funds, in whole or in part, by granting loans, advances and credit facilities and by investing or by any other means at the risk of the person conducting such business. Interpretation /Implications/Effect [Whether MNOs, Retail Card Payment Systems are covered?] Interpretation: Not complying with the definition since the deposits are not payable on demand and are not used for lending or investments. Implication: Since legally not banks, they are not required to comply with the financial regulations and standards (domestic or international). Effect: left unregulated introduces risks to the financial sector: by accepting public deposits. Interpretation: Not complying with the definition since they do not use deposits for lending or investments (second leg of definition). Implication: Since legally not banks, they are not required to comply with the financial regulations and standards (domestic or international). Effect: left unregulated introduces risks to the financial sector: by accepting public deposits (first leg of definition) =ditto= In other countries like Philippines the central bank has classified some mobile phone payment as remittance agents as such allowing for minimum regulatory oversight. In the countries with in the region with NPS Acts they are able to designate a system or instrument such that it falls within its oversight scope irrespective of the company operating such business. In the survey none of the countries with the NPS Acts enforce conducts detailed oversight on the non-bank retail systems discussed in this paper. It should be noted however that it is one thing to have the regulatory powers and the other to actually perform such powers. Some of the reasons that stalls back some of the countries with powers to oversee are discussed in the preceding sections. 10

11 2.2.3 Skills Gap Most of the central bank surveyed cited capacity as one of the stumbling block to regulate innovative electronic systems. The dynamism in the electronic retail payment systems makes it difficult for the central banks to be abreast with pace of innovations introduced in their markets. Innovations in information technology always surpass regulation. This phenomenon stretches the central banks capacity to effectively oversee the systems. This explains the level of oversight activities relating to retail electronic payment systems. This calls for central banks to continue building human capacity, device staff retention policies and use a complement of multi disciplinary staff available in the bank itself, that is skills from other departments to assist in either building internal department skills or in conducting oversight functions through collaborations. 11

12 Chapter III: Guidelines for oversight of non-bank electronic retail payment systems 3.1 Risk Management From the survey of the member states, almost all of them do not conduct retail system oversight to the non-banks. Even in those that do it is only for a selection of one or two of the products and the oversight activity is mainly collection of data on the trends and usage of the product with limited in-depth analysis of the risks. The reason raised for this situation is that the electronic retail payment system has no significant contribution to systemic risk. While this may be true to some extent, it only holds if proper analysis is made to evidently validate the assumption. Analysis should be made on the electronic retail payment systems aggregate values vis-à- vis those of other systems, its comparison to the GDP and its economic impact in the event of failure (what it translates to movements of M2 in the economy etc), its interdependencies and linkages, the risks inherent, its management process and its usage. Overlooked also is the fact that failure of such system have a negative impact on the perception of the consumers on similar or other electronic products, and their views on the central bank s ability to regulate. Losses that may transcend to the consumer and the economy at large needs to be analysed from the values processed in the system. Some of the countries have adopted a bank-led model for such systems and rely on the comfort of regulations the banks are required to comply with (banking supervision function). However, on the payment system front there is limited payment system oversight interventions which include, requests for monthly transactions data to analyse the usage trends. 3.2 Oversight of non-bank retail electronic payment systems The following steps may be used by member states in conducting oversight of non-bank retail electronic payment systems. STAGE I: Off-Site Analysis Step I: Profiling the Non-bank retail system (System/instrument Profiling) (i) Types of systems/instrument (ii) Operator of such system/instrument 12

13 (iii)regulators of the operator (iv) Interlinks/interdependencies of the system/instrument in the the market, that is if it is linked to a clearing system or the instrument is acceptable as a means of payment from other retailers. (v) Operations Status (whether services are currently being offered i.e. a going concerns). (vi) Market Share (the level or percentage of the services/usage in the market compared to the similar products). (vii) Oversight Activities on the system (the current/previous oversight activity conducted on the system). (viii) Remarks (what should be done/recommendations after analysing the profile). An example of the system/instrument profile of the non-bank retail electronic payment systems is provided in Box 1 below. NOTE: Information to fill in the profile may be obtained from own assessment or the operator or regulators of the non-bank retail systems. Box 1: Profiling the Non-bank retail system (System/instrument Profiling) NPS/No:... System Instrument Profile Form: Name of the System/Instrument: Mobile Phone Money Transfer System Date of Profiling:.../.../2010. Type of System/ Instrume nt E.g. Mobile Phone Money transfer System Operator of the System/ Instrument ShamwariN et Private Company Regulator of the Systems/ Instrument Telecommunicati on Regulatory Authority Interrelations/linkag es of the System/ Instruments NONE Operation s Status Going Concern Market Share 100% (Only Mobile Paymen t System) Oversight Activities the system on TRENDS ONLY (Volumes/Valu es of transactions Remark s Need to be analyse d further Profiled by: Checked by:. Approved by:. 13

14 Once the institutional profile is complete the next step is to develop a risks and risk indicators profile. NOTE: the System Profile is a snap analysis of the system/instrument it should give the overseer information as to whether to conduct a further investigation or oversight of the system. From the example in BOX 1 above it is evident that this System needs to be further overseen as it has 100% market share and the current oversight activity doesn t give a full picture of risk management. Step II: Risk and Risks Indicators Profile (i) List the identified risks in the system/instrument (ii) List possible indicators of the risks (iii)determine the likelihood of occurrence (the assessment of the risks occurring given the current regulatory and risk management process). (iv) Determine the impact: (the assessment of the impact of the risks on the parties concerned: users, institutions, economy given the level nature of the risks and its rate). (v) Determine the overall rating: (based on the probability and possible impact determine the overall rating, e.g if probability is high and impact is high then overall rating must be high). (vi) Control gaps: (what is amiss in managing/controlling the identified risks) (vii) Risk mitigation action plan (what actions (which are feasible) to be applied in managing the identified risks. (viii) Residual risk ( the level of remaining risks after the mitigation action plan is implemented: the aim is to have a minimal residual, hence the mitigation actions should be as practical and relevant as possible) An example of the risks and indicators profile is provided in Box 2 below. NOTE: Information relating to the risks to be filled in the profile may be obtained from either own assessment of the system/instrument, or the operator or from the regulators of the non-bank retail systems. A check list should be prepared to assist in obtaining such information. A letter may be sent to obtain the information and or the operator may be called to make a presentation. 14

15 Box 2: Risks and Risks Indicators Profile for the Non-bank retail system NPS/No:... Risks and Indicators Profile Form: Name of the System/Instrument: Mobile Phone Money Transfer System. Date of Profiling:.../.../2010. Category Type of Risks Risk Indicators Probability Impact Overall Rating Consumer - Unsatisfactory service delivery -Loss of deposits Financial Sector Operational Reputation Systemic Unfair Competition - Delays/errors/poor customer care -Financial Problems & Insolvency of Operator -Down times -Errors -Fraud -Public complaints central bank - on -Interdependencies with other systems - Supernormal profits -Very low pricing of products & high turnover Control Gaps H H H -Lack of standards/regulations -No oversight conducted H H H -Lack of standards/regulations -No oversight conducted H H H -Lack of standards/regulations -No oversight conducted Risk Mitigation Action Plans -Develop standards/ Regulations -Conduct oversight Develop standards/ Regulations -Conduct oversight Develop standards/ Regulations -Conduct oversight L L L None Conduct oversight H H H Lack of standards/regulations -Not regulated under banking rules -Develop standards/ Regulations -Conduct oversight Residual Risk L L L L L Profiled by:...checked by:...approved by:... Key: Impact Probability Control Gap High= Significant loss High= Likely to happen High= No controls (lack of standards/ regulations/not regulated) Medium= Moderate loss Medium = Could happen Medium = Minimal controls/periodic reporting (basic standards) Low= Reduced substantially Low= Surprising if it happens Low= High Controls (best practice standards/regulations/continuous monitoring). Once the risks and risks indicators profile is complete the next step is to draw a report with recommendations to the management on the actions to be taken on the identified 15

16 high rated risks. The actions will include conducting an on-site oversight of the system to verify and understand the risk management process of the non-bank retail electronic payment system provider. NOTE: The risk Mitigation Action Plans in the profile are feasible and practical measures if appropriately implemented reduce the risks to low levels. Whatever actions plans advised it is important to ensure they are feasible and capable of mitigating the risks identified. STAGE II: On-Site Oversight Examination Step I: Pre examination Preparations (i) Prepare a memorandum for on-site examination (this includes the risks and risk indicators profile incorporating management s comments on the recommendations and actions) (ii) Access your on-site mandate on such systems (legal provisions if any). (iii) Communicate with the Operator and/or the Regulator of the system (schedule examination appointment, state the objective of visit and send check list where necessary). (iv) Organise an examination team (staff from payment system and other department with the skills and expertise relevant to the examination e.g. IT and banking examination units). NOTE: where there is no clear mandate the examination should be conducted jointly with the Operator s Regulator. (v) Conduct entry meeting with the management of the Operator (introduce the objective of the examination and the expected responses/compliance of the Operator). (vi) Conduct the on-site examination (interview the appropriate personnel of the operator relevant to the risks identified in the off-site analysis and any that may arise in the process of examination; additional information should be obtained from documentations of the Operator). (vii) Conduct exit meeting with the operators management (briefings relating to: the initial findings of the examination; the planned official communications 16

17 requiring their compliance and of the submission of the examination report with its compliance requirements). (viii) Brief oversight management of the examination and the initial findings with recommendations of immediate compliance actions (ix) Prepare the examination report. (x) Present the report to the Bank s Management. NOTE: The examination report is not the end of the oversight activities relating to the system overseen. It is a continuous process of ensuring that risks identified are mitigated. Hence continuous monitoring process should be conducted by updating the profiles proposed in Box 1 and 2 above and the whole process should be repeated. 17

18 Chapter IV: Conclusion and Recommendations This paper is an attempt to provide guidance on the problem of oversight/regulation of non-bank electronic retail payment schemes in the region. The paper adduces that most central banks are not conducting in-depth risk assessment of the non-bank retail payment schemes. The analysis of the information obtained from such schemes should portray the level of significance of such schemes in the economy. The proposed guidelines are quite applicable and allows flexibility in the enhancement of further risk management analysis. I hope that this contribution will spur payment systems analysts and overseers to enhance it future and incorporate more risk management analysis to their oversight function not only on the non-bank but in all other areas of payment systems. Future work should concentrate on quantitative techniques of risk management in oversight. 18

19 References: Michael Tarazi and Paul Breloff, Nonbank E-Money Issuers: Regulatory Approaches to Protecting Customer Funds, 2010, CGAP Bill Maurer, Retail Electronic Payments Systems for Value Transfers in the Developing World, Department of Anthropology University of California, Irvine Marianne Verdier, Retail Payment Systems: What can we Learn from Two-Sided Markets? 2006 Websites: 19