How Technology Can Revitalize Financial Services Innovation and Minimize Risk

Non-bank innovation in the financial services sector has traditionally been viewed with caution by both regulators and banks. Both legitimately fear the introduction of undue and potentially destabilizing risk into the financial sector. The question of risk is particularly important now while the economy remains fragile and sluggish and the extent of systemic risk introduced by earlier innovations is still unclear. 

For banks, there is an added concern: That non-bank technology innovations threaten to disintermediate legacy bank technologies that evolved over time and at great expense. Consequently, as banks and regulators begin to contemplate the future, it is important to consider how technology might revitalize and improve the financial services sector. 

The dawn of the World Wide Web not only created a new channel for activities like shopping and bill paying, it also created new markets, including auctions, music and video downloads, and new advertising models. These new activities required new payment methods, new customer service capabilities and new communication methods. And although banks ultimately went online, non-banks like Amazon, PayPal, CheckFree and even Wal-Mart were the early Internet pioneers. These players simplified customer experiences, streamlined processes, reduced customer costs and created new business and payment models that customers embraced. They also reduced artificial complexities associated with regulations and risk and underwriting models created for the physical world. Instead of replicating physical world experiences, they created simple, intuitive and easily accessible financial experiences. 

New Risk Models 

Today, new Web technologies and business models are creating new risk underwriting models such as Prosper and Pay Rent, Build Credit (PRBC) that offer both regulatory challenges and opportunities. Prosper, Zopa and other “P2P lenders” allow individuals to underwrite loans, in theory democratizing credit. However, when individuals began losing money -- often without understanding why -- regulators, including the SEC, stepped in. Now regulated, these players provide an interesting, Internet-driven competitive force to traditional lending that may cause the banks themselves to innovate. Since each of these players use non-traditional, Internet data sources to “score” consumer credit and give consumers a greater number of lending options, banks may be forced to do likewise to compete. 

For example, PRBC and other new Internet companies are attempting to use non-credit bureau data, including data from social networks, to improve credit underwriting for thin file and no file customers. Rather than competing with banks, these players in most cases would like to work with banks to help them reach new customer segments without increasing overall risk. This type of “win win” innovation may help banks expand revenues even as margins shrink due to regulatory pressure. 

In the current, risk-adverse environment, risk officers and regulators are challenged to learn from these technology and risk innovations to find better, more predictive underwriting vehicles. Particularly as many consumers are struggling to free themselves from excess credit, risk models that incorporate non-traditional elements may be extremely important in the near future. Even learning from the mistakes and failures of these innovations may provide critical insight for next generation risk models. 

Web 2.0

The term “Web 2.0” came into widespread use in 2004 after Tim O’Reilly hosted a conference that focused on technology companies that had “come back” from the 2001 dot-com collapse to establish new capabilities leveraging the Internet as a platform. Classic Web 2.0 solutions share several common traits: openness, interconnectivity, decentralization, customization, and they are democratic. Wikipedia, Facebook, Blogger, Twitter, and YouTube enable anyone to publish content, connect that content to relevant networks and customize their Internet experiences. RSS Feeds, Google Local and Mobile Phone applications enable consumers to customize where and how they interact with the Internet. 

Prior to the recent banking crisis, many banks were starting to experiment with Web 2.0 capabilities while non-banks -- especially in financial management and investments --- forged ahead aggressively to create stickier, customer friendly solutions. Google, Amazon, Apple, and PayPal each combine Web 2.0 capabilities with financial services to make the customer experience simpler and more relevant. 

Some in the banking industry fear that stepped up privacy regulation might also restrict banks from participating in open Web 2.0 forums and data mining. If this were to occur, banks could end up as low-profit “utility players” while Web 2.0 companies establish more-profitable relationships with customers based on information-rich, customer specific offerings, like tailored investment recommendation, savings plans, and even unique discounts on savings goals (e.g. trips, cars, etc.). At the same time, the banks may find technology partners eager to collaborate with them to access their existing customer networks. For example, several data aggregation/personal financial management companies (Mint.com, Wesabe, Yodlee), would be very interested in accessing bank data to learn more about customer preferences. 

The opportunity for risk managers across the industry is to understand both the promise the potential risks of these capabilities. For example, openness and lack of centralized control in social networks has potential to compromise customer privacy and security since some social spaces thrive on sharing personal data. At the same time, many of the most successful Web 2.0 companies, including PayPal, have incorporated network feedback ratings to enhance risk management and make customers even more safe. 

Mainstream wireless technology 

In addition, the prevalence of WiFi, the emergence of WiMAX and wireless infrastructure improvements today give consumers and businesses the reliability and confidence they need to trust wireless devices for more than just communications. Over the last three years mobile financial applications have gone mainstream, with mobile alerts, mobile banking, mobile remittances and mobile financial management all gaining traction. Banks and non-banks alike have played key roles innovating in this space. Traditional banks have led the way in mobile banking, mobile security and financial alerts. Non-banks, like Mint, Wesabe and Obopay, have played leadership roles in mobile financial management and money transfer capabilities. 

Given the breadth of mobile applications in the market, the regulatory environment is exceedingly complex. The Federal Communications Commission (FCC) regulates telecommunications providers, while the Office of the Comptroller of the Currency (OCC), the Federal Reserve, and state regulatory agencies each regulate banking services. State laws around money transfer add further complexity and securities laws related to financial advice add further potential complications. All the complexity notwithstanding, consumers and businesses are adopting new mobile services at increasing rates, making it imperative that banks, regulators and non-banks work together to reconcile the possibilities of this technology with the prudence the general public expects.

Authentication and Customer Security 

Evolution of electronic channels and customer data proliferation also drove innovation in authentication, encryption and security. For example, the Secure Electronic Transaction (SET) protocol was developed in 1996 for the Internet by a Visa and MasterCard consortium, which also included GTE, IBM, Netscape, RSA and Verisign. That solution failed to gain adoption, because its cost and complexity outweighed its perceived benefits (especially for consumers and merchants). Instead, most retailers chose Secure Socket Layer (SSL) protocols to protect transactions, and relied on usernames and passwords for site authentication. Similarly, early attempts by NACHA, the Electronic Payments Association, to require public key infrastructure (PKI) for Internet transactions were rejected by the market and ultimately replaced with the simpler WEB rule. In both cases, market dynamics and customer convenience were key to establishing standards. Traditional rule-making entities, banks and regulators played relatively small roles in setting these standards. 

Later attempts by industry insiders to enhance authentication and security also had mixed results, underscoring the difficulties of driving innovation via regulation or rules. Visa, MasterCard, and JCB implemented 3-D Secure protocols as added security for online credit and debit card transactions. In the US, these programs achieved minimal adoption, primarily because they interfered with the customer checkout experience. Another attempt includes the 2005 Federal Financial Institutions Examination Council (FFIEC) guidelines for multi-factor authentication for Internet transactions. The guidelines were intended to drive banks to stronger, multi-factor authentication. However, because the guidelines were not specific, many banks were unclear about how to comply. In addition, the costs to implement strong solutions were high, some estimated at $15-30 per customer. 

Although insiders struggled to find a “silver bullet,” technology players continued to innovate. RSA and Verisign successfully established token-based solutions for businesses. Cyota, PassMark and Arcot worked directly with banks and others to identify and implement customized retail authentication and security solutions. Bank of America’s Site Key is an example of a bank partnership with a technology company (PassMark). That solution enhances authentication without hindering the customer experience. Other banks, like Standard Charter, partnered with solution providers like Arcot to beef up behind-the-scenes security. 

Today, the competitive technology environment continues to drive innovation, much of which will benefit banks and keep customers and their data safe. Regulators still face challenges since no single standard has emerged, and even industry-standard “audits” and “protocols,” like the Cardholder Information Security Program (CISP) from Visa are hard to monitor and do not fully protect against security breaches. And yet, an entire industry of security-oriented technology and service firms has sprung up to help firms comply with new security standards, while also helping Visa and the regulators monitor compliance. Furthermore, given that the “fraudsters” are some of the most innovative players in financial services, this is one area where partnerships between banks, non-banks and regulators are truly critical. Historically the role of regulators in innovation was to set standards, many of which were proved unworkable in the marketplace. In the future, banks, technology companies and regulators should work together to understand the key security priorities; create incentives to solve those problems; and work with non-banks to ensure that technology and service companies can reasonably implement the appropriate solutions. 

Conclusion

As banks and the economy emerge from the current financial crisis, innovation will be critical. A recovering economy, increased global competition, and increased fraud/security threats will demand better solutions. Since technology players are not as limited by the current economic crisis, they will play an important role in jump starting innovation. Consequently, the challenge and the opportunity for banks and their regulators will be to work in partnership with technology innovators on customer-enhancing innovations, without sacrificing safety and soundness or risking consumer privacy, security or financial well-being.

Author bio

Margaret Weichert is the Founder and CEO at The Morgan Weichert Group, LLC, a financial services consulting firm. Weichert recently served as the eCommerce/ATM Business Planning and Analytics Executive at Bank of America (BAC), with responsibility for strategy, innovation, business development, business intelligence and analytics for eCommerce, ATM and mobile channels.