Opportunities and Challenges for Payments & Fintech in Europe

Transcription

1 Opportunities and Challenges for Payments & Fintech in Europe A Bryan Cave Webinar Thursday January 21, pm GMT; noon Eastern; 8-9 am Pacific Judith Rinearson, Bryan Cave New York and London Jane Jee, Bryan Cave London With Guests David Parker, Polymath, London Sarah Francis, Polymath London

2 Agenda Introduction - Fintech and Payments: What makes Europe so Different? Judie Payments Landscape in the EU David What is the EU and SEPA Which emerging products are growing? Types of Licence in the UK/EU Jane Do you need a licence? Or should you just partner? - Sarah The process of obtaining a licence Jane Passporting and related decisions Sarah Key differences to US Judie, Jane and Sarah What is PSD2? Key points Jane Closing Judie

3 Section 1 Fintech and Payments: What makes Europe so Different? Judith Rinearson

4 Introduction What makes the EU so different from the US? Moving towards single marketplace - US v. EU Currencies Languages History/borders Desire to replace US leadership Attitudes on competition rooting for the underdog Attitudes on consumers very paternalistic

5 Section 2 The Payments Landscape in the EU David Parker

6 What is the EU?

7 What is the EU? 28 member countries 11 Currencies 24 Official EU Languages Differing Alphabets i.e. Latin, Cyrillic

8 The Single Currency: Euro

9 The Single Currency: Euro 19 Countries using the Euro

10 EEA The European Economic Area (EEA) provides for the free movement of persons, goods, services and capital within the internal market of the European Union (EU) between its 28 member states, as well as three of the four member states of the European Free Trade Association (EFTA): Iceland, Liechtenstein and Norway.

11 SEPA: Single European Payments Area SEPA consists of the 28 member states of the European Union, the four member states of the European Free Trade Association (Iceland, Liechtenstein, Norway and Switzerland), Andorra, Monaco and San Marino.

12 SEPA: Single European Payments Area SEPA consists of the 28 member states of the European Union, the four member states of the European Free Trade Association (Iceland, Liechtenstein, Norway and Switzerland), Andorra, Monaco and San Marino. In Summary 19 Euro Countries 28 EU Members 33 EEA Members 34 SEPA Markets

13 All Europeans are NOT the same 13

14 And Also Not For Payments Despite the EU s efforts, the financial services industry in each country has unique characteristics which do not appear to be converging.; e.g. German consumers generally use credit cards significantly less than other Europeans, and also like to pay in cash; internet purchases are usually paid for through invoicing, with funds being transferred from a bank account. Netherlands a lot of people pay online with ideal, an online payment method that allows customers to order online using direct transfers from their bank account. Belgian customers primarily use cards and online bank payment to pay online Luxembourg customers use credit cards. Poland mbank supports mobile payments direct from bank accounts, Finland has by far the highest proportion of non-cash payments in the world

15 Payments Across Europe Also Differ Hugely Source: Polymath Analysis of Published Data 2014

16 Use of Cash and Other Payments UK Source: Deloitte2015

17 Market Share of Alternative Payments 2015 Source: Worldpay 2015

18 Emerging Payment Trends EMEA Payment Type Debit Card 29% 26% ewallet 20% 21% Bank Transfer 17% 18% Credit Card 13% 12% Charge Card 7% 5% Cash on Delivery 6% 7% PrePay 3% 5% Direct Debit 1% 1% einvoices 1% 1% Other 1% 2% PostPay 1% 1% Prepaid Card 1% 1% Source: Worldpay 2015

19 Section 3 Types of EU Licence Jane Jee

20 Full banking licence Full banking licence is granted by the Prudential Regulation Authority (PRA) (part of Bank of England) and Financial Conduct Authority (FCA) PRA prudential regulator - imposes Threshold conditions and Fundamental Rules FCA conduct regulator European Banking Authority (EBA) ensures prudential regulation and supervision across EU banking sector - Basel Committee on Banking Supervision issues the Basel Accords prudential capital requirements for banks globally

21 What can regulated banks do? Offer a wide range of services loans, current accounts savings accounts etc. Hold and utilise deposits Offer interest Access to payment systems e.g. Faster Payments The Financial Services Compensation Scheme - Government backing for e.g. savings Passporting - A firm authorised in the EEA can carry on certain permitted activities in any other EEA state by either exercising the right of establishment (of a branch and/or agents) or providing cross-border services. Some services will require regulation by local EU host regulator More favourable securitisation terms from card schemes (costs are same)

22 Challenger banks The process of setting up a bank was made simpler in 2013 by the FCA - several government enquiries criticised the lack of competition in retail banking. A raft of challenger banks are now established in Britain e.g. Charter Savings, Shawbrook, Paragon, Secure Trust, Hampden & Co, Aldermore and Metro. Not all offer current accounts. About 24 start-ups are in talks to gain banking licences.

23 Open Banking Working Group The Open Banking Working Group a collective of banking, open data and FinTech professionals, and wider business and consumer groups has been formed at the request of the UK Government. Its aim is to develop a framework for adopting an open API standard across banking and explore how open banking will impact consumers, regulators and industry. This initiative builds upon the UK Government s prior call for evidence on data sharing and open data in banking. Due to report later this month (January 2016) Firms seeking authorisation to carry on regulated activities other than as a bank apply to the Financial Conduct Authority (FCA)

24 Consumer Credit Licence Since April 2014 the FCA is the body responsible for granting consumer credit licences and supervising firms Consumer Credit regulation encompasses credit broking, lending, hire and debt management across markets as diverse as vehicle sales, dentistry, training and renewable energy. There are two types of FCA Consumer Credit authorisation, referred to as Limited Permission and Full Permission. No passporting available each jurisdiction in EU has different rules

25 E-money Licence The Electronic Money Regulations 2011 create a separate authorisation and registration regime for issuers of electronic money that are not full credit institutions, credit unions or municipal banks: E-money Licence 2 types Full E-money institution (EMI)licence If you expect your business to not exceed an average of 5m of outstanding e-money per month, you may apply to register as a small EMI but no passporting can provide unrelated payment services if the average monthly turnover isn t more than 3m FCA e-money approach document FCA Guidance on e-money

26 E-money Licence As an EMI you are permitted to engage in the provision of payment services as well as other activities without needing to be separately authorised or registered under the Payment Services Regulations 2009 (PSRs) BUT you have to report all your regulated activities to FCA (or your regulator). However, the conduct of business requirements in Parts 5 and 6 of the PSRs apply to all payment service providers, whether they are payment institutions, banks, building societies, e-money issuers or any other category.

27 Payment Institution Licence Law is in the first Payment Services Directive 2007/64/EC Implemented in UK by the Payment Services Regulations 2009 Need a licence to provide payment services i.e. 1. services enabling cash to be placed on a payment account and all of the operations required for operating a payment account; 2. services enabling cash withdrawals from a payment account and all of the operations required for operating a payment account; 3. the execution of the following types of payment transaction (i) direct debits, including one-off direct debits; (ii) payment transactions executed through a payment card or a similar device; (iii) credit transfers, including standing orders;

28 Payment Institution Licence 4. the execution of the following types of payment transaction where the funds are covered by a credit line for the payment service user (i)direct debits, including one-off direct debits; (ii)payment transactions executed through a payment card or a similar device; (iii)credit transfers, including standing orders; 5. issuing payment instruments or acquiring payment transactions; 6. money remittance; 7. the execution of payment transactions where the consent of the payer to execute the payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to the telecommunication, IT system or network operator acting only as an intermediary between the payment service user and the supplier of the goods or services.

29 Payment Institution Licence Businesses that exchange currency, transmit money or cash cheques for their customers are known as Money Service Businesses. The term Money Service Business has a special meaning under the Money Laundering Regulations Your business is a Money Service Business under these regulations if it: acts as a bureau de change - even if this is on a ship that isn t always in UK territorial waters transmits money, or any representation of money, in any way (just collecting and delivering money as a cash courier isn t transmitting money) cashes cheques that are payable to your customers Even if your business only does one of these things, it is still classed as a Money Service Business.

30 Payment Institution Licence HMRC is the supervisory body for most Money Service Businesses under the Money Laundering Regulations. If you run a Money Service Business it s your responsibility to register with HMRC regarding AML unless you re already supervised by the Financial Conduct Authority (FCA) for the purposes of the Money Laundering Regulations. You mustn t act as a Money Service Business until you re registered with HMRC and supervised by the FCA. If you exchange currency or cash cheques only occasionally, or only on a limited basis, then you don t have to register as a Money Service Business low limits apply

31 Section 4 Do you need a Licence? Sarah Francis

32 Do you need a Licence? In simple terms this can often be answered by the question are you at any time handling customer funds? If the answer is yes then its time to consider what type of licence you need. Sitting outside of the EU and collecting consumer funds for distribution is, in most cases, not an option. It is worth keeping in mind that undertaking regulated activities without a licence is a criminal activity. The proceeds of crime fall under Money Laundering regulation regardless of where the crime is committed However, there are what can be considered easier measures of sitting under a regulatory umbrella!

33 Do I want a Licence? It essentially comes down to time, money and return on investment. Is your business model based around payments: If the answer is yes you are likely to be prepared for the time and investment. If the answer is no its about keeping customers happy and adding revenue then a partner might be the answer. Investment in a licence includes: People Offices Technology Legal contractual structure Security (These are cash funds and can be substantial, especially if the schemes are involved.)

34 What can I get from a Regulated Partner? In simple terms your Regulated Partner/Sponsor becomes responsible for Compliance under the regulations. There are opportunities to become an Agent sitting under the supervision of your chosen Partner. The opportunity to practice regulatory business and gain experience and knowledge. Decreased investment required Decreased delivery timeline Partner has to monitor and advise about regulatory changes

35 The downside of a regulated Partner? You can only work within their chosen areas It is their risk structure and approval. Requires strong communication lines Decreased revenue

36 One stop Partner the good and the bad They manage in entirety the Payment Project The distribution / branding is yours Utilise their technology (Good and Bad) Quick Delivery Requires careful choice to meet quality standards Requires a close working relationship Decreased investment Decreased returns

37 The Cost of an EMI Presence The cost of Locally based Senior management (Inc MLRO) The cost and up keep of offices Regulatory Licence Application Cost (UK 5,000) Security (available Asset) typically 350,000 Technology Ether in-house or out-sourced - be prepared for detailed review Probable PCI requirements Scheme Licence 30,00-80,000 (Dependent on Scheme and area covered) Security typically 100,000-1,000,000 dependent on scope of business

38 The Cost - BIN Sponsorship Initial Programme/Programmes Typically 20,000 60,000 (dependent on scope of project) Processor set-up Typically 20,000-60,000 (dependent on services used and scope of project) Costs dependent on own BIN or shared BIN Scheme Costs (Pass Through) These may include BIN Set-up Projects (c 15,000) Cost of becoming a TPP (Trusted Third Party), ISO (Independent Sales Organisation) or other representative c 5,000-10,000 per annum per Scheme.

39 Cost of setting up with a Programme Manager The cost of setting up with a one-top shop programme manager may be relatively simple. C 30-80,000 There is of course correspondingly lower returns due to extended supply chain.

40 Consumer Credit Licence Generally speaking if you offer credit to consumers you need a licence There are a few exceptions. You do not need a licence just to accept payment by credit card (unless it is a credit card you've issued yourself). You do not need a licence to let customers pay for goods they have bought from you in 12 or fewer instalments, within a year from the date of sale (This instalment credit exemption increased from 4 to 12 months from March 2015); You do not need a licence to offer credit to limited companies. You generally do need a licence to offer credit to businesses such as sole traders and small partnerships (with two or three partners), but not if the value of your sales is always more than 25,000.

41 Section 5 The Process of obtaining a licence Jane Jee

42 Full Banking Licence 2013 FCA lowered the capital of start-up banks to 4.5% of their overall credit exposure, compared with between 7%- 9.5% for major existing banks. However application is a complex process you need resources, time, money and tenacity! Metro Bank licensed first new high street bank for more than 150 years. It took almost 2 years to obtain a banking licence (licence granted 2010 and Metro opened 40th branch in December 2015 in Maidstone, Kent) Hampden & Co had to submit a 550-page application to the PRA for a licence Above UK only - similar process across the EU

43 Non banking licences FCA has service levels have to process application within 3 months but if application not complete then FCA has 12 months The applicant must be either: a body corporate (for example, a limited company or LLP) constituted under the law of a part of the UK and whose head office and, where relevant, its registered office, is in the UK; or a body corporate which has a branch that is located in the UK and whose head office is situated in a territory that is outside the EEA.

44 Head office The EMRs don t define what is meant by a head office. Where the applicant is a body corporate constituted under the law of a part of the UK, this is not necessarily its place of incorporation or the place where its business is wholly or mainly carried on. The FCA judge each application on a case-by-case basis, the key issue in identifying the head office is the location of its central management and control, that is, the location of: 1. the directors and other senior management, who make decisions relating to the business s central direction, and the material management decisions on a day-to-day basis; and 2. the central administrative functions (for example, central compliance, internal audit). For the purpose of regulation 6(4) a virtual office in the UK does not satisfy this condition.

45 Process for non-banking licences in EU Complete Application Form Overriding key principles take all reasonable steps to protect customers interests and ensure continuity and reliability of service Need to comply with Capital Requirements Safeguarding Conduct of Business Rules Full disclosure of beneficial ownership chain Robust business plan & organisation structure - see next slides Risk management procedures see slides Auditing, Safeguarding, Governance Internal control may need internal audit function Systems and Controls IT systems

46 Business Plan Background to application Location of business and intention to passport Sources of funding Target markets Marketing plan Types of product/service both within regulation and outside Types of payment service Use of branches including numbers and locations Budget for first 3 years Level of detail to reflect scale and complexity of business

47 Structural Organisation A structure chart Description of intended use of agents distributors and branches What functions are you outsourcing? Outsourcing arrangements to third parties or other group members? Participation in any national or international payment systems

48 Safeguarding What is safeguarding? Why safeguarding? No Financial Services Compensation Scheme (FSCS ) cover for customers Therefore need to protect client funds How to safeguard? Segregation in an account with a credit institution; Insurance or guarantee; Investment in secure, liquid assets held by a custodian

49 Risk management procedures Settlement risk (a settlement of a payment transaction does not take place as expected) Operational risk (loss from inadequate or failed internal processes, people or systems) Counterparty risk (that the other party to a transaction does not fulfil its obligations Liquidity risk (inadequate cashflow to meet financial obligations) Market risk (risk from behaviour of entire market) Financial crime risk (robust AML and CTF measures) Foreign exchange risk (fluctuation in exchange rates)

50 AML - Money Services Business To register with HMRC as a Money Service Business you ll need to fill in a registration form and provide all the information requested. You ll also need to apply for a fit and proper test This test is a check to make sure that certain people involved in running the business meet the requirements of the Money Laundering Regulations. From 1 st April 2015 the charge for the fit and proper test is 100 per person.

51 Section 6 Passporting Sarah Francis

52 What is Passporting? The mechanism by which your home authority informs other authorities you will be undertaking regulated business. Available only for full EMI s and API s. Covers only regulatory requirements. Be aware Branches may require additional local communication and/or regulation Some countries may require additional consultation over and above passport For example when marketing a prepaid product in Ireland the product structure and fees need to be approved by Irish Regulator.

53 Do not assume a Passport is all encompassing Regulatory authority does not cover: Local consumer law Local Data Protection regulations There may be additional requirements each country should be investigated accordingly.

54 Assessing the risks in each country Each country can have a unique payment culture in exactly the same way as it has a unique language do not assume everything runs the same as it does in the UK. Differing payment types represent different risks of both fraud and AML Differing spend patterns and lifestyles require consideration Available documents and third party databases can make KYC a challenge.

55 Section 7 Key differences to the US Judith, Jane and Sarah

56 AML in US Most regulated entities must register as an MSB with FinCEN Risk Assessment product, geographic, customer Four Pillars Policies and procedures AML Compliance officer Ongoing Training Independent Testing and Review Customer identity verification Customer due diligence and enhanced due diligence Transaction monitoring Reporting $10,000 cash transactions; suspicious transactions

57 AML in UK/Europe Some similarities AML law requires as risk based approach utilising Know Your Customer Due Diligence including understanding beneficial owners of businesses Monitoring of all transactions (no minimum or maximum) Reporting of Suspicious Activities (In the UK this would be to the NCA ) Training of all involved personnel Appointment of an MLRO (Money Laundering Reporting Officer) Failure to report activity can result in Criminal Procedures and ultimately Jail!

58 Data Protection in US Gramm Leach Bliley for financial institutions requires disclosure about what personal data collected and held, how used; consent for marketing use Federal Trade Commission (FTC) Act - prohibits unfair or deceptive acts or practices, including failure to protect consumer data or failure to comply with posted privacy policies Fair and Accurate Credit Transactions Act PCI compliance standards credit card data State data breach and privacy laws

59 Data Protection in UK/Europe First Data Protection Directive passed in 1995 in EU led to the Data Protection Act 1998 in UK In January 2012, the European Commission proposed a comprehensive reform of data protection rules in the EU The proposed reform consists of two instruments: The General Data Protection Regulation will enable people to better control their personal data. The Data Protection Directive for the police and criminal justice sector will ensure that the data of victims, witnesses, and suspects of crimes, are duly protected in the context of a criminal investigation or a law enforcement action and facilitate cross-border cooperation to combat crime and terrorism more effectively across Europe. Effect of Shrems case - Court of Justice of the EU (CJEU) October 6th 2015 ruling invalidating Safe Harbour

60 Data Protection in EU Safe Harbor 2.0? Eu data protection regulators have formed the Article 29 Working Party, (A29WP) A29WP will not take enforcement action until the end of January 2016 to allow businesses to put alternative arrangements in place However the Court of Justice of the European Union (CJEU) s two central concerns must be addressed First, US intelligence services can access data in an "indiscriminate generalised manner." If U.S. intelligence agencies can still access data relating to "all persons and all means of electronic communication and all the data transferred, including the content of the communications then it will fail. Specific limitations will therefore need to be set out in the agreement. Second, the new safe harbour must include appropriate guarantees to protect EU citizens. U.S. citizens and legal residents have a judicial remedy under section 702 of the Foreign Intelligence Surveillance Act of 1978 against government surveillance, EU citizens do not have similar rights. An independent body of an equivalent status to the FTC or FISC and a mechanism to enable EU citizens to initiate complaints to such a body would address the court's concerns.

61 Consumer Protection in the US Truth in Lending Act, Regulation Z credit cards and credit programs Electronic Funds Transfer Act, Regulation E debit cards, and (soon) prepaid cards Visa/MasterCard/Amex/Discover scheme rules Consumer Financial Protection Bureau CFPB enforcement actions and regulations

62 Consumer Protection in EU No consistent and uniform definition of consumer in EU law Consumer law differs between Member States, partly as a result of transposing EU directives into national legislation EU action on consumer policy is based on two measures: The European Consumer Agenda, which is the new strategy for EU consumer policy in line with the EU's growth strategy Europe 2020 and the EU Consumer Programme the financial framework complementing the strategy. The EU Consumer Agenda has four main objectives: improving consumer safety; enhancing knowledge; improving implementation, stepping up enforcement and securing redress and aligning rights and key policies to economic and societal challenges.

63 Consumer Protection Laws EU The Directive on Consumer Rights (2011/83/EC) replaces, as of 13 June 2014, Directive 97/7/EC on the protection of consumers in respect of distance contracts and Directive 85/577/EEC to protect consumer in respect of contracts negotiated away from business premises. Directive 1999/44/EC on certain aspects of the sale of consumer goods and associated guarantees as well as Directive 93/13/EEC on unfair terms in consumer contracts remains in force. No single EU-wide definition of what is fair!

64 Consumer Protection Laws UK The Consumer Rights Act 2015 (which came into force in October 2015) together with Regulations creates a greatly simplified body of consumer law. Taken together, they set out the basic rules which govern how consumers buy and businesses sell to them in the UK 2 key aspects For the first time rights on digital content have been set out in legislation There are now also new, clear rules for what should happen if a service is not provided with reasonable care and skill or as agreed.

65 Section 8 PSD2 overview Jane Jee

66 PSD2 an overview Passed into effect in January 2016 so Member states have to implement it by January 2018 Rationale for PSD2? PSD1 Review clause Differing interpretations in Member States Market changes Security issues PSD2 has same basic structure as PSD1 but broader scope - Increased territorial scope and narrowed exemptions called negative scope provisions

67 PSD2 an overview The Main Changes Access to Bank Accounts (Article 36) Authorisation Requirements All Currencies One Leg Out - now in scope Authentication/Security Transparency Third party access to Accounts ( XS2A )

68 Access to bank accounts Access to Bank Accounts Article 36 Member States shall ensure that payment institutions have access to credits institutions payment account services on an objective, non-discriminatory and proportionate basis. Such access shall be sufficiently extensive as to allow payment institutions to provide payment services in an unhindered and efficient manner. The credit institution shall provide the competent authority with duly motivated reasons for any rejection Designed to prevent banks from refusing to open and maintain bank accounts for payment institutions.

69 PSD2 other changes Other Changes Restriction of the Limited Network exemption Restriction of the Commercial Agents exemption. Passporting Role of the EBA & supervision of agents & branches Note: PSD2 confers 11 mandates on the European banking Authority of which 5 are Guidelines and 6 are Technical Standards

70 Thank you! Follow up questions & contact details - - Judie Rinearson judith.rinearson@bryancave.com US # UK# 44 (0) David Parker Jane Jee jane.jee@bryancave.com UK # 44 (0) Sarah Francis