[This is a commentary on the Central Bank of Ireland speech today on fintech. My comments in square brackets.  First appeared on my LinkedIN page on 15 November 2016]

I would like to take this opportunity, in my capacity as Chair of FinCoNet, to highlight the importance of the role played by supervisory authorities in helping to protect the interests of consumers and to look at a number of the challenges we face in delivering on our mandates in an environment where the pace and scale of innovation, through increasing use of new technologies, is increasing. [Oakes: at the outset, I think personally it has been great that the Irish Central Bank Director of Consumer Protection (Bernard Sheridan) is the first Chair of FinCoNet. I imagine that the benefits flowing to Ireland from the these discussions will be very helpful to the Central Bank of Ireland in the future and that the Mr Sheridan will continue to be a strong Ambassador for Irish fintech and innovation.]

Supervisory authorities, including the Central Bank of Ireland, play such an important role in helping to protect the interests of consumers of financial services. Financial products and services enable consumers to go about their daily lives, from making payments to saving or taking out a loan; from taking out insurance to protect them against risks, to making an investment in a pension to provide for the future. Our lives as consumers are, in many ways, dependent on financial services and the providers of them. That is why most countries require financial firms to be regulated and to be supervised by a supervisory authority with a core objective to ensure that such firms are treating their customers fairly.

Since its formal establishment just three years ago, FinCoNet has been providing a very useful forum for supervisory authorities to engage with and learn from others on how best to meet these challenges. It provides a forum for sharing current and emerging risks and challenges to consumer protection. The supervisory toolbox will be a very useful resource for members as they develop their approach to monitoring and oversight of firms. FinCoNet has also been working on key areas of responsible lending practices as it is such an important consumer issue across countries. I believe its work, including the upcoming guidance on sales incentives, will help supervisory authorities shape a more consumer-focussed culture within lenders. Considerable work has also been done by FinCoNet on the emerging consumer risks in the area of payments with the recent publication of the Report on Online and Mobile Payments which focuses on how regulators and supervisors are responding to emerging risks particularly security risks and are keeping up with the pace of innovation.

One important emerging challenge for supervisory authorities and consumer protection is the extent of innovation taking place, through greater use of modern technology (fintech). Fintech can have a really positive impact on society, helping to make products and services more accessible, improving service delivery, providing greater convenience for consumers and increasing choice. For firms it can help reduce costs, enable new products and services to be developed as well as improving the quality of service delivery. Fintech can also help markets become more competitive by enabling new firms to enter a market and compete with existing firms in a viable way. However new innovations bring new risks for consumers and new challenges for supervisory authorities and it is important that supervisory authorities remain focussed on their core responsibilities for consumer protection while recognising the potential benefits for consumers. [Oakes: I don't disagree with this point, yet regulators don't appear comfortable stating what they think these specific risks are. Without which we cannot have the broader discussion about the mitigants which can be adopted to reduce gross risks to acceptable net residual risks]. FinCoNet, at its Open meeting in Amsterdam in April 2016, acknowledged the growing importance of the digitalisation of financial products and distribution channels and the specific challenges that digitalisation can pose for supervisory authorities. It is in this context, that I think it is both timely and appropriate that FinCoNet has identified the digitalisation of high cost lending and the practices and tools that are required to support risk-based supervision in a digital age as two of its priority themes for 2017-2018.


Supervisory authorities are a key part of the overall consumer protection framework. We are the gatekeepers in controlling which firms enter, and also stay in, the market. In our role as gatekeeper we seek to ensure that the senior people setting up and running firms are fit and proper to do the job. We have to determine if the proposed service falls to be authorised under relevant legislation. With the pace and scale of technological innovation it is becoming increasingly difficult for firms and regulators to determine what falls to be regulated and what falls outside, and for us all to be consistent in how we are interpreting the rules. This is particularly noticeable in the provision of payment services as well as other areas such as crowdfunding. It is important that supervisors work closely with one another and the relevant law makers to be clear on what is in and out of scope. Where innovation relates to services which fall outside of our scope, we need to be aware of the risks they may pose to consumers and have a forum for engaging with government and other policy makers to consider the appropriate response. [Oakes: This is an interesting comment. Just last week I heard from a number of European Commission, German Central Bankers, ESMA and EU government officials at a private conference in Madrid say that regulation is technology neutral and that they they are not in the business of examining one business model's delivery channel versus another's. Surely this type of analysis is necessary "if the relevant law makers [are] to be clear on what is in and out of scope. Whether we or they like it or not, regulators of financial services will soon be regulators of technology - in substance if not in form.]


Supervisory authorities can also play an important role in influencing and shaping the consumer protection framework by working with governments, standard setting bodies and other international bodies. We have the expertise and knowledge of what is happening in the market to inform wider policy developments and it is important that we proactively input into such developments. Clearly it is a challenge for supervisory authorities to keep up with the pace of change in order to ensure that the consumer protection framework is fit for purpose. FinCoNet aims to help its members to identify emerging issues through the sharing of current and emerging risks.


In most countries, it is important to note, a consumer protection framework is already in place, which can be based on domestic (national legislation/codes), regional (European directives) or international standards (OECD/G20 Principles). Even where such frameworks are not in place the OECD/G20 high level consumer protection principles, developed by the G20/OECD Task Force on Consumer Protection, set out clearly the key elements of what is necessary for consumer protection. Therefore, innovators working with regulated firms or developing unregulated financial products or services need to take these existing consumer protection standards into account. They should not be starting with a blank canvas!  Other international bodies are also looking at the impact that fintech is having in the market. The G20/OECD Task Force has identified fintech as one of the key areas for examination. FinCoNet needs to work closely with the Task Force to help inform its work and to influence how the wider consumer protection framework can be enhanced to address these emerging risks. [Oakes: How do we reconcile this with the evident regulatory arbitrage happening right now in the area of crowdfunding, where in some members states the exact same activity is regulated under the EU Payment Services Directive in one member state but is not considered to be a payment services in another? This is industry issue, but it is caused directly by a lack of conformity in interpretation and is just one example which the European Commission needs to address.] Also there is a growing recognition among supervisors of the need to focus more on product development, oversight and governance in order to seek to pre-empt problems. This is particularly timely as fintech increases in importance. By developing standards on how products and services should be developed, tested, rolled out and monitored, supervisory authorities are providing the framework within which consumer-focussed innovation can happen.  Regulated firms need to really think through and test their ideas before launching them and be able to demonstrate that they are meeting the needs of consumers in a fair and transparent way. Changes to distribution channels and how firms communicate with their customers also need to be fully considered by firms as to the impact they will have on customers. 

Market conduct authorities also work closely with other authorities which have responsibility for prudential regulation and financial stability as we recognise the interdependence between these functions and market conduct supervision as well as the critical role they play in consumer protection.  Managing risks which impact on consumers, on individual firms as well as on the wider market, needs to be done in a coordinated way across all relevant responsible bodies including market conduct supervisory authorities. For example, the need for authorities to work closely together to deal with the threat and impact of cyber attacks is becoming even more important in the digital age. [Oakes - Strictly speaking, Fintech isn't the cause or the attraction of cyber security attacks but it does add to the pool of candidates likely subject to attacks. Fintech is, according to some, the new wave of disruptors developing new IT, platforms and systems in financial services. They are not immune to cyber attacks, however proponents argue that they have the advantage of developing new systems from scratch based on current software and coding which is (hopefully) more resilient to successful attacks than legacy systems used by many incumbents. Having said that, new systems cannot be guaranteed to be immune from deficiencies - plenty of examples here. I was reminded last week that Tesco Bank is arguably a challenger bank and ipso facto it is a fintech company and that it was the victim of a successful cyber attack fraud. I may have a different view on whether Tesco Bank meets the definition of (new) fintech, but that isn't the point here - which is that regulators are right to continuing to warn in this area. And don't forget that financial stability, market integrity and consumer protection are the top three areas which they are most concerned about because they are generally statutory objectives for many of them. Regulators obviously don't like failing, so they will continue to place downward pressure on financial services firm to ensure that they don't risk putting the central banks/regulators in a position of breaching their objectives. And hopefully finserv firms don't need encouragement from regulators to have robust systems - that is something which is simply and necessarily good business practice].


And critically we monitor and enforce these standards to ensure consumers are benefiting from them and that firms are acting in their best interests. This is a core function for any supervisory authority and one on which the focus needs to be retained. It is important to say that first and foremost it is the boards and senior management of the firms themselves that have primary responsibility for ensuring they are acting in their customers’ best interests and behaving in a compliant way. They need to have the appropriate resources, controls and procedures in place. Innovation cannot be an excuse for lowering standards or for not focussing on consumer outcomes. [Oakes - I haven't heard anyone (sensible) in fintech argue that innovation should disregard consumer protection outcomes or lower regulatory standards. Indeed there are a number of fintech firms focussing on innovating in the space of client asset protection and evidencing title to assets in the face of a financial services company going into liquidation. Arguably, the stronger the digital audit trail of consumers' right of title, terms and conditions kept in durable mediums, instant access to balances and multi-factor authentication etc are evidence of innovation (and fintech) raising the bar higher for standards of financial stability and consumer protection??]. However, it is also important that there is close monitoring and oversight of firms’ activities and that supervisory and enforcement actions are taken when necessary.

But how do we know if we are doing a good job or not? This is where FinCoNet can and does provide real ‘added value’. By sharing best practices and engaging with other authorities we can learn and develop. Helping supervisory authorities deal with the challenges posed by fintech will, in my view, be a priority for FinCoNet for a considerable time.

It is fair to say that much of our work may go unnoticed or not be recognised. We, as supervisory authorities, often intervene to prevent consumer detriment from happening; we can be prohibited from disclosing the firm-specific supervisory actions we take; and we may face criticism from the media, politicians or consumer advocates for the actions we take or for not acting sooner. [Oakes: I have a lot of empathy here having been a regulator in four countries. You are never credited with preventing consumer loss, disorderly insolvencies and removing bad actors from the stage; but by God if something isn't identified in a robust risk based supervisory model, no one is interested in listening to a regulator's excuses]. We need to inform the public of our role, what we do and what we don’t do, in a way that helps them understand. We need to listen to our stakeholders and in particular, consumer groups to understand their issues and how we can best intervene. It is important that we are not only delivering for consumers but that we also have the trust and confidence of the public. [Oakes: Yes, regulators need far better narratives of their work in this area. When they are silent, people will fill the void with incorrect assumptions which damages fintech as a whole. And regulators need dedicated innovation departments which can at least help new players navigate the particular regulator's labyrinth of mazes to find the right people who can help advance discussion with start-ups. Associations and trade bodies serve a good purpose. But if you are regulator you really need to hear from the designers, architects, engineers and entrepreneurs which are turning finserv upside down].

In conclusion, as we focus on our future priorities, it is important to remind ourselves of the critical role supervisory authorities play in protecting consumers, of consumers’ reliance on us and the onus that is placed on us to act effectively, in an open and transparent way and to strive for improvement. It has been a privilege for me to act as the first chair of FinCoNet which reflects the importance that the Central Bank of Ireland places on its consumer protection role and the need to deliver to the highest standards. The Central Bank will continue to support the work of FinCoNet as it grows and develops with the aim of helping its members as they strive to protect the interests of consumers.

We will be discussing Brexit and its impact upon fintech in Northern Ireland at our event on Tuesday 27th September at 6pm in Belfast.  See more here.

Senior financiers are alarmed at growing political momentum behind a so-called “hard Brexit” that they fear will erode business confidence, trigger corporate departures and damage the City of London

Leading bankers who have held talks with government ministers have told the Financial Times they believe Theresa May, the prime minister, will end up taking Britain out of the EU’s single market and customs union.

They fear policy is being shaped by pro-Brexit ministers like Liam Fox, international trade secretary, who said in July that Britain would probably leave the customs union, and Brexit minister David Davis, who says it is “improbable” that Britain would stay in the single market.

“The danger of hard talk now is that it increases uncertainty, reduces confidence and will result in businesses triggering their exit plans from the UK,” said John McFarlane, chairman of Barclays and TheCityUK lobby group.

One Wall Street boss expressed concern that Mrs May did not fully grasp the consequences for the City of a “hard Brexit”, while other financiers claim civil servants are afraid to speak up to explain the broad risks of leaving the EU’s economic core.

Meanwhile John Holland-Kaye, chief executive of Heathrow, warned that leaving the EU customs union would “add massive overhead” for businesses and port operators. “Can you imagine operating something like the Euro[tunnel] if you had to suddenly build in all these checks in place? It would be completely unmanageable,” he told the FT.

One banker said that pro-Brexit ministers like Mr Fox and Mr Davis had yet to engage with the City. “If you try to discuss detail with them, you are dismissed as questioning the merits of Brexit,” said one.

Whitehall insiders say that while Philip Hammond, chancellor, is fighting for the City, a rupture is inevitable: “Of course we will end up out of the single market and customs union,” said one. “It won’t be great but we will get the best possible deal.”

Ministers have ordered Treasury officials to come up with ways to soften the impact of leaving the customs union, including recruiting hundreds of customs officers and expanding border facilities.

Mr Fox, Mr Davis and Boris Johnson, foreign secretary, argue that Britain must make a clean break from the EU to recover UK sovereignty, establish immigration control and regain the freedom to sign bilateral trade deals elsewhere in the world.

Downing Street said Mrs May had two key objectives in Brexit talks: regaining control over Britain’s borders and “making sure British firms are able to continue to succeed in the world”.

Mr Hammond has promised that EU bankers would continue to be able to work freely in the City and that he values the “passporting” arrangements that allow financial services companies to trade freely across Europe.

But the Brexiters’ push for a break from the single market and customs union stance has caused irritation in the City. “Why is that in anybody’s interest?” said Mr McFarlane. “[Mr Fox] needs to look at the numbers. There has to be a balance between the rational and the political. It can’t just be politics.”

TheCityUK is preparing to publish a major report on the economic contribution of Britain’s financial services industry that is expected to highlight its importance to European corporate funding, as well as the contribution to UK tax coffers.

Much of that business stems from the ability of international banks, insurers and asset managers, which are registered in the UK but which trade freely throughout the EU single market using so-called regulatory passporting.

Research by the FT shows the scale of the UK-based banks using passporting to sell into the EU. The group of 96 banks has assets of £7.5tn, directly employ more than 590,000 people and make annual profits of around £50bn.

Bank executives say EU passporting makes up 20-25 per cent of the London business of international investment banks, including the five big US players, who have assets of £1.5tn and staff of 21,000 in their UK-based banks, and the two big Swiss, which have assets of £415bn and staff of more than 6,000.

If you try to discuss detail with them, you are dismissed as questioning the merits of Brexit

Financiers say that while some of that business could be straightforwardly rerouted, there would be chaos if large chunks of it could no longer be transacted in London. There is particular concern about the provision of wholesale banking services to companies, from SMEs to blue-chips. “The infrastructure simply doesn’t exist elsewhere in the EU,” Mr McFarlane said.

The FT’s figures on passported business only cover the Swiss and Americans’ legal entities that are either incorporated or designated entities under the Bank of England’s supervisory regime, and file full financial accounts — the banks employ thousands more and have significant other assets in branches and other structures.

Copyright: Financial Times.  We make no claim on any IP in this article.  Source: http://www.ft.com/cms/s/0/dd666fb8-833c-11e6-a29c-6e7d9515ad15.html#axzz4LL4flyng

Yesterday (13 September), the Central Bank issued through its Policy & Risk Directorate, a Cross Industry Guidance in respect of Information Technology and Cybersecurity Risks.  

The Directorate falls under the leadership of Gerry Cross.  A short video about the Central Bank’s thinking on the topic was released in conjunction with the Guidance – see You Tube channel. While its great to see the Central Bank embrace the use of social media, it seems to have a long way to go to have this recognised - at the end of the day on 14 September there had been only 131 views of the video.  That is quite remarkable given that the Central Bank regulates about 10,000 financial service providers and funds in Ireland and protects directly and indirectly a population of 4.8million. 

The Central Bank’s concerns are being driven by the potential impact of inadequate cybersecurity controls on the firms themselves, their customers and the risks for financial stability.

Given that Information technology is now at the heart of the supply of financial services and that the incidence of cyber-attacks and business interruptions is on the increase, the Central Bank is saying that firms should assume that they will be successfully targeted. Its view is that the security and resilience of IT systems, their governance and management must improve to reflect this reality.


Summary of Central Bank inspection findings:

• Alignment between firms’ IT strategy and the overall business strategy is weak. IT capabilities are not matched to the business ambitions.
  
• Firms are not taking a holistic view of IT risks across the business, which results in poor identification, monitoring and mitigation of IT risks.
  
• Shortcomings in IT risk assessment and identification with many firms not maintaining comprehensive IT risk registers and risk identification being backward rather than forward looking.
  
• Older technology supporting key business operations and requiring significant resources and/or investment to manage associated risks.
  
• Non-existent or inadequate data classification frameworks and policies.
  
• Staff not sufficiently trained on cybersecurity risks.
  
• Ineffective firewall management/inadequate intrusion detection processes with weak IT security monitoring.
  
• Deficiencies in governance of IT related outsourcing including a lack of thorough due diligence on prospective service providers, poorly documented/constructed outsourcing agreements and inadequate monitoring of service delivery.
  
• Inadequate and untested disaster recovery and business continuity plans.
  

Expectations of the Regulator

The Central Bank expects that:

• Boards and Senior Management of regulated firms fully recognise their responsibilities for these issues and put them among their top priorities.
• Firms must robustly address key issues such as alignment of IT and business strategy, outsourcing risk, change management, cybersecurity, incident response, disaster recovery and business continuity. 
• Firms make sure that they understand these risks and that they are managed effectively. 
  

The Central Bank's supervisory engagement will reflect the new Guidance when it assess firms.

Director of Policy & Risk, Gerry Cross, said: “Developments in technology have fundamentally changed business processes and models in financial firms.  These advancements have resulted in benefits for firms and their customers.  However, they also bring significant risks as firms become increasingly interconnected and more reliant on complex IT systems, including outsourcing service providers.”  

“The Central Bank is demanding increased effectiveness in this area.  We are undertaking considerable work to require improved IT risk management and cyber resilience across regulated firms. This includes enhanced supervisory capabilities and increased focus on these risk areas."

So what’s in the Guidance? 

Here’s the table of contents:

• Executive Summary
  
• Purpose
  
• Background
  
• Supervisory Issues Identified To Date.
  
• Next Steps.
  

1. GOVERNANCE

• Board of Directors and Senior Management Oversight of IT and Cybersecurity Risks 
  
• IT Specific Governance.

2. RISK MANAGEMENT 

• IT Risk Management Framework 
  
• IT Disaster Recovery and Business Continuity Planning 
  
• IT Change Management
  

3. CYBERSECURITY

4. OUTSOURCING OF IT SYSTEMS AND SERVICES 

• Appendix 1: Glossary 
• Appendix 2: Key International Guidance for Firms
  

If you need to know more or wish to discuss, please contact Peter Oakes at [email protected] / +353872731434.  Peter Oakes is a board director of regulated firms which too must implement this Guidance, he is a former Director of Enforcement at the Central Bank and works across cross-industry in financial services in London and Dublin. 

We are pleased to announce our upcoming event to take place at StartPlanet NI, 112-114 Donegall Street, Belfast BT1 2GX, Northern Ireland on Tuesday 27th September kicking off at 600pm (registration from 530pm) to 800pm.  We will be discussing Northern Ireland’s Fintech Scene and its Challenges and Opportunities Post Brexit and shinning a bright light on Northern Ireland’s burgeoning fintech industry and the innovators helping to drive Northern Ireland’s continuing success.

Peter O'Halloran - Collaborator, Fintech Ireland has written this insightful piece on Brexit and the future of European Fintech
[Check out Peter's LinkedIN profile and twitter @p_ohalloran]

June 23rd 2016 may yet prove to be a seminal date in the history of European Fintech. On that date a non-binding referendum, colloquially known as "Brexit", in the United Kingdom supported leaving the European Union.  If the United Kingdom invoke Article 50 of the Lisbon Treaty they are entitled to leave the European Union in an as yet to be determined time period.

The notion of the European Union has been been around for almost 6 centuries.  George of Poděbrady is credited with its conception in 1464 during his reign as King of Bohemia (predecessor of modern day Czech Republic) when he outlined his vision to establish common European institutions and supranational insignia.  The European Union as an entity was established on January 1st 1958 and from a commercial standpoint, its key benefits are access to the European Single Market for Goods & Services, with 500 million internal consumers and a vast talent pool of human resources.

What does this mean for the Future of European Fintech?

In 2015 the United Kingdom Fintech sector generated £6.6 billion in revenues and attracted roughly £524 million in investment, according to EY (1).  If Brexit becomes a reality, London will face the very real prospect of losing its title as global capital of Fintech and the UK exchequer will be negatively impacted.  Commerce thrives in times of stability and certainty and their current conspicuous absence in the UK is already impacting service provider confidence as evidenced by the UK Flash Services PMI activity Index fall from 47.4 in July from 52.3 in June, marking an 88-month low (2).

PwC released a Global Economy Watch report in July 2016 which included a financial services attractiveness indicator ranking all European financial centres (3).  The current top 5 ranking in order is London, Dublin, Luxembourg, Paris & Vienna.  The report highlights the threat of Brexit to London’s position due to the importance of passporting of financial services across the Single Market.  The ranking of a hub city in terms of financial services attractiveness is important for Fintech but equally important is the attractiveness of the tech startup ecosystem.  London also holds this title in the EU for non-EU companies wishing to access the Single Market and this is now also under threat from Brexit.  Quartz have highlighted Dublin, Berlin, Amsterdam and Stockholm as hubs which have already announced their pretensions to the throne (4).  These hubs have considerable demonstrable success in the Fintech startup arena and crucially will retain access to the vast talent pool of people across the EU which is vital to scale startups quickly and something London & indeed the UK as a whole will potentially lose.  The Brexit vote threatens the UK’s hegemonic status and is akin to a modern day economic equivalent of the Berlin Conference of 1884-85 at which the terms of the Scramble for Africa were agreed.

An Irish perspective

There is a certain chronological symmetry to the Brexit vote happening in the year of Ireland’s centenary celebration of the 1916 rising.  It evokes the memory of W.B. Yeats’ poem Easter, 1916, “All changed, changed utterly: A terrible beauty is born”.  Brexit feels like that, an accidental consequence of a political strategy which creates threat and opportunity in equal measure.

In June 2016 the Dublin Commissioner for startups, Niamh Bushnell, issued a press release with the headline “Thanks to Brexit”.   The Irish Development Agency’s (IDA) Chief Executive Officer Martin Shanahan said "While not what we had hoped for – the situation may present opportunity for Ireland in attracting Foreign Direct Investment (FDI). Ireland will remain a member of the European Union with full market access and that will be attractive to investors." There is no doubt that based on Ireland’s attractiveness for financial services and startups it is well placed to capitalise but the extent of the opportunity is unclear because Brexit still has not happened. 

In Conclusion

It is interesting to note that in July 2016, MarketInvoice a London based peer-to-peer small business financing platform raised £7.2 million in Series B funding from a Polish private equity company, MCI.  On July 21st 2016 Mastercard acquired 92.4% of London based Vocalink Holdings Ltd., the payments processor, for $920 million.  These transactions and a number of others show that despite current uncertainty, appetite for UK Fintech remains strong.  It remains to be seen whether the UK and indeed London will retain their positions at the forefront of European Fintech or if they will mirror the fate of David Cameron who succinctly reflected upon his new situation in saying "I was the future, once".

(1). FT.com - “London’s booming fintech market under threat from Brexit vote”.

(2). IBTIMES.co.uk - “Brexit recession looms as UK economic indicators flash red”.

(3). PWC.com - “Global Economy Watch - July /August 2016”.

(4). QZ.com - “After Brexit, the race is on to replace London as Europe’s startup capital”.

Author: Peter O'Halloran, Fintech Ireland Collaborator, @p_ohalloran, https://ie.linkedin.com/in/peterohalloran