Are mobile payments a “terrorist dream” or not?

Greyscale backing image
[Dave Birch] A couple of years ago, I expressed some scepticism as to whether the tight know-your-customer and anti-money laundering rules would actually achieve anything and suggested that the net welfare attending a more relaxed structure might be significantly greater. In particular, I commented on the potential for mobile payments to help or hinder.

The use of mobiles to make payments is clearly a boon to terrorists (or, at least, terrorists who have never heard of 500 euro notes) as Rachel Ehrenfeld, founder of the Terror Finance Blog has noted. She calls the hook-up between the GSMA and MasterCard a “terrorist dream”. David Nordell, another finance terror blogger, says, “Person-to-person transfers via mobile phones will be almost anonymous, and completely uncontrollable unless the regulators intervene and block these new services until ways are devised to track the flow of funds.”

[From Digital Money Forum: The prepaid backlash]

A year ago, I expanded on this discussion in an article for the Journal of Internet Banking and Commerce. David Nordell was kind enough to read the whole article and recently provided a considered response. I asked him for his permission to excerpt part of it and he agreed, and I think it’s worth quoting a few passages in full. David says…

I’m afraid that you have reached entirely the wrong conclusions. For all that I agree that there is indeed an element of ‘security theatre’ in the regulatory regime for anti-money laundering and counter-terror finance there is also a great deal of genuine value in the at least some of the regulations, and they are not there just to oppress the general public. The amounts of money that are needed to actually carry out terrorist operations of the kind we saw in London in July 2005 or that planned against the airliners two years ago are small, in the order of a few thousand pounds, and therefore well within the range of a dozen e- or m-payments.

This is a point well taken. Suspicious Activity Reports (SARs) that focus on transactions above £10,000 will not, under any regime, actually catch any more than mildly unintelligent criminal, terrorists, corrupt politicians or child pornographers. According to the Serious Organised Crime Agency (SOCA) here in the UK, there were 228,834 SARs filed last year and of these 703 were referred on to the terrorist finance investigation. Naturally, the report can’t say how many of these 703 (0.3% of the SARs filed) were actually related to terrorist activity (although it does note that one of the terrorist SARs was filed by a charity and one by an estate agent, just to indicate the spread). So far as money laundering goes, and financial crime, I can’t find any figures that show whether the money spent on SARs is a good investment or not. In the Royal Society of Arts debate on white collar crime, one of the researchers put total fraud in the UK last year at about £60 billion so it doesn’t look as if SARs are making much of a dent in that, although hopefully they are deterring some major crimes. David continues…

No financial intelligence unit or police force that I know supports the idea of monitoring every possible financial transaction, whether through conventional banking or technology-enabled services; and all the professionals I know in this field understand perfectly well that the SAR regime, which is based on arbitrary reporting limits, will inevitably produce far more noise than signal. However, there is a lot of value in carrying out KYC checks, in e-money services just as much as in conventional banking: these can help to provide predictive intelligence about people who may be planning to carry out financial fraud, launder money from other criminal activity, or finance terrorist operations in planning.

I wasn’t not arguing that we should have no KYC checks, but what I was arguing for was a sensible floor below which KYC checks are not needed. I happened to be in a local branch of national financial services organisation a few weeks ago when, for dreary reasons, I had to get into a queue. The person in front of me in the queue was trying to send fifty pounds to a relative in Liverpool. The clerk told him that couldn’t, because he didn’t have a passport and a utility bill. The chap complained that he had been sending this birthday money every year for decades. The clerk was unmoved. So who benefits from this? I didn’t stop the 911 terrorists (who used credit cards in their own names) or the crotchbomber (who paid for one-way air ticket in cash) or the tube bombers (who were carrying identity documents). My argument was, and is, that we should decide where the balance should be in order to get the best result for society as a whole.

My suggestion is that we fix on 500 euros as the breakpoint. People should be allowed prepaid cards, prepaid accounts, money transfer accounts or whatever with no identification provided that the maximum balance is limited to 500 euros (it is currently 150 euros) and a maximum annual turnover over 10,000 euros (it is currently 2,500 euros). This will lower costs and ease accessibility — I might even go and get an O2 Money card — thus achieving a variety of goals including social inclusion and reduced transaction costs for the poor.

The problem, of course, is that the existing system makes it extremely difficult to cope with forged identity papers and stolen identities, which are used in the majority of cases of serious financial crime. I certainly agree with you that AML regulations do make access to the conventional financial system more difficult for people, such as recent immigrants, who don’t have the right papers to satisfy what are basically unintelligent regulatory requirements. I’ve actually witnessed an example of the stupidity of these requirements while waiting at a counter at Lloyds Bank – stupidity that the bank official himself didn’t agree with but left the prospective customer unable to open an account. Is there a better way? Yes, but I don’t agree that it should be based on just dropping KYC requirements, because this will just encourage the growth of fraud. On the contrary, I believe it should be based on making KYC more rigorous in order to exclude as many fake and stolen IDs as possible, and then as easy as possible to use in order to make the financial system inclusive.

This is a very different approach. I didn’t suggest dropping KYC requirements completely, to be fair, but I did suggest raising the requirements for the financial products that need KYC. Specifically, I suggested that there should be no KYC prepaid card or mobile money transfer accounts that have a maximum allowable balance of €500. But David’s approach suggests that pursuing the “identity is the new money” meme further might be

Supercollider

Greyscale backing image
[Dave Birch] As I said on Twitter, Australia is the Large Hadron Collider (LHC) of the payments world, where an expensive experiment is underway to smash payment card companies and retailers together at high energy. At the LHC, physicists have a number of competing ideas about how the universe might work and they are looking at the results of collisions to find evidence for one theory or another. In Australia, there are no ideas about the system should work. No-one knows what the correct level of interchange should be. But what is the experiment telling us? Well, for one thing (and this is a message that needs to be transmitted around the European Commission) it is telling us that the results of the collisions tend to be the unexpected.

Perhaps more vexing, Australian merchants, including retailers, restaurants and airlines, are imposing surcharges for each credit card transaction, even though fees the merchants pay card companies have fallen.

[From U.S. Looks to Australia on Curbing Credit Card Fees – Series – NYTimes.com]

Well, well. Now this can't be because all Australian merchants are corrupt and are trying to get paid in cash in order to avoid taxes, so there must be something else going in and if I were to ask an economist about this, I suspect the answer might be something to do with the imperfect nature of the competition between payment choices at the point of sale and an information asymmetry between retailers and consumers.

Regulation isn’t a bad thing

Greyscale backing image
[Dave Birch] One of the areas of great interest for this blog is the evolution of “alternative” payments in different environments. As a consequence, I am always very interested to see how alternative payment system differ between markets. For example, the Russian market for alternative payments is very different from the European market. This year, broadly speaking, it will break down into

  • About 14 billion Roubles spent via the leading e-wallet schemes Webmoney and Yandex.
  • About 9 billion Roubles spent via mobiles for digital content.
  • About 10 billion Roubles spent via the near-ubiquitous “terminals”, the reverse ATMs that are on every street corner in Moscow (more on these below), some of which goes into loading e-wallets and mobile prepay accounts.

So a big chunk of the alternative payments market in Russia is taken up by a payment system that simply doesn’t exist in Europe (or, in fact, anywhere else so far as I can see), which is the near-ubiquitous “cash in” terminals or, as we tend to cal them, “reverse ATMs”.

In the last ten years, a rapidly growing shadow banking system has sprouted up in Russia to service these small payments by turning cash into electronic currency, or e-money. And now that this sector has reached the $1 billion mark – and this in a crisis – and has expanded to include 10 million customers, e-money business owners are getting antsy about government regulation.

[From Crashing Russia’s all-cash culture – Fortune Brainstorm Tech]

Estimates vary, but there are somewhere in the region of 400,000 of these terminals in use right now. On literally every street corner is a terminal that Russians feed with banknotes to top up their mobile phone, pay utility bills, obtain pre-paid virtual credit cards (I did this: you feed the cash in and the Visa card number, expiration date and CVV are sent by text to your mobile phone). You can see from this screenshot the wide range of services available:

Cash-in Terminal

It seems like a bizarre market arrangement, one that the laws of economics should mitigate against. As Evgeniya Zavalishina, the General Manager of Yandex Money put it rather neatly, people are taking money out of an iron box, walking a metre and then putting the money back in another iron box. Incidentally, Evgeniya will be joining an excellent line-up of speakers at the Electronic Money Association’s 3rd annual conference in London on 24th November so if you are interested in learning more about the evolution of e-money regulation around the word, head on over to the EMA web site and sign up. But back to the iron boxes. By astonishing coincidence, the restaurant where I went to dinner with Evgeniya and other members of the Russian E-Money Association (set up by a good friend of the Digital Money Forum, Victor Dostov) had precisely such an arrangement!

Iron Boxes

How can this be economic? Surely you would expect banks to incentivise the terminals to take chip cards so that people could pay their bills with a debit card. Come to that, why can’t they do that from a bank ATM in the first place instead of going to a terminal at all?

Well, one reason might be a lack of regulation. At the excellent Russian E-Money conference I attended, one of the speakers placed Russian banks as the 53rd most efficient in the world, but the Russian non-banks as the 4th most efficient in the world (for payment services). Yet both the banks and the non-banks would benefit from a better regulatory infrastructure. The problem that was discussed at the event was that everyone knows that regulation needs to come, but no-one is sure what that regulation might look like (and some of it, such as impending regulation on data protection) simply won’t work technologically. Nevertheless, a good infrastructure for electronic payments would, I’m convinced, help both the alternative payment providers (ie, the terminal networks) to invest further and develop new services while at the same time enable banks to invest in their own terminal and enhanced ATM services. Everyone would benefit.

This reinforces something that has been said before on this blog: no regulation is not a way forward. We want to see digital money deliver real solutions to real problems all around the world and a good regulatory framework helps in this enterprise.

Innovation that matters for the majority

Greyscale backing image
[Dave Birch] That there is an interplay between the technology and monetary policy is obvious. Look what is going on in Africa. People who aren’t allowed to hold dollar bank account hold dollar-denominated mobile top-up vouchers instead. Ugandans without an effective electronic payment system are using M-PESA from Kenya to execute local transactions in Kenyan shillings. Congolese without access to any banking network use mobile money instead (and may never, ever, want or need a bank account as a result). In India and elsewhere the banks have managed put a regulatory finger in the dyke but the pressure is building and money is already leaking away from conventional institutions and networks into newer, mobile-centric, customer-facing organisations. The dam will, at some point, burst. How will governments be able to “manage” the money supply when it is being zipped across borders by mobile phones, global handset hyper-hawala.

At the very first Digital Money Forum, the late Professor Glyn Davies (author of the magnificent “A History of Money“) said that every technology revolution in money led to less centralised control. That’s a good thing, but it also explains why the conservative nature of governments and regulators comes to the fore in questions concerning money. If anyone anywhere in the world can transact in any currency, then the weak will go to the wall very, very quickly. Gresham’s Law on a global scale.

What’s in a name?

Greyscale backing image
[Dave Birch] I got caught out in a meeting referring to the APACS Card Payment Group, which of course no longer exists. I thought I’d render a quick public service to help other people to avoid similar mistakes. Here’s your handy cut-out-and-keep guide to the UK’s new payment organisation landscape.

The Payments Council was created in March 2007 to set out the national strategy for UK payments. It has a Payments Council Board made up of banking representatives, some independent directors and an independent chairman (Brian Pomeroy). The principal UK payment schemes (listed below) have a contract with the Payments Council to set out rights and duties.

The UK Cards Association is the successor the much-loved APACS Card Payments Group (CPG). It is the trade body for the UK cards industry. Its 14 members, the major card issuers and acquirers, work together here on non-competitive issues.

Financial Fraud Action UK was created earlier this year to work alongside the UK Cards Association on the specific issue of reducing fraud.

The Dedicated Cheque and Plastic Crime Unit (DCPCU) is a specialist law enforcement unit made up from officers from the City of London Police and the Metropolitan Police and funded by the banking industry. It investigates serious and organised cheque and card fraud.

SWIFT (UK) Limited is the membership organisation representing the UK’s SWIFT users.

SEPAaratists

Greyscale backing image
[Dave Birch] At a SEPA seminar I went to — at which, as an aside, the delegates agreed overwhelmingly with the statement that “bank payment products are inadequate for the Internet and mobile world” — we were given a curious pamphlet from the European Payments Council (EPC) called “The most popular misunderstandings about SEPA clarified”. One of the statements was “SEPA is a demand-driven initiative” (which, of course, it isn’t). The clarification from the EPC says “European integration is rarely carried forward on a wave of popular support” (I’ll say!) and goes on to say that monetary union did not materialise by distributing euro banknotes and coins and hoping that national currencies would be enthusiastically abandoned. Indeed. But that’s not say that that idea was wrong: on the contrary, national currencies would have been forced to keep their value up relative to the euro or begin losing seigniorage (and influence). That was one of the points in favour of dear old John Major’s plan for the hard e-euro.

Help! I can’t stop posting about SEPA

Greyscale backing image
[Dave Birch] I saw a very good talk by Gerard Hartsink, Chairman of the European Payments Council. He was talking about SEPA and the evolution of the European payments sector. The context isn’t important, but I did want to highlight one comment he made — which caused some passionate discussion — about the future of payment cards. He said that he could see a situation in 2011 or 2012 when magnetic stripe transactions would be banned in SEPA and only chip transactions would be allowed at ATM and POS. Now, before we launch into a debate on this, let me point out that he is not the only person of influence who is thinking this way.

Tony Chew, head of the technology risk supervision division of the Monetary Authority of Singapore, is advocating for a concerted global effort to phase out magnetic stripe technology entirely. “We can all go chip and PIN which will be a more effective method of combating counterfeit card fraud,” says Chew.

[From Vendor Articles: 12/6/2009 Credit card fraud rising]

It’s the rise in fraud that is causing this kind of thinking. Far from shrinking card fraud, the introduction of chip & PIN in the UK has multiplied a thousandfold the number of places where people use PINs and therefore where PINs can be stolen from. So long as there are places where easy-to-copy magnetic stripes can be used, the incentive for criminals is clear. Things are getting worse.

It is my belief – and feel free to come back and tell me that it’s me that is the idiot – that after a number of years of declining card present fraud (magnetic stripe cloning is so much easier, and a gift from the card issuers), we are now going to see a dramatic increase, and there is nothing we can do about it!

[From 2009 – is that the year we all went online?]

I happened to be reading this month’s Fraud Watch, and one of the front page stories is “ATM fraud threatens global acceptance”. The story says that “several issuers are considering blocking major cities and possibly whole countries where international card fraud is high, because there is no chance for reimbursement for those losses even though the original cards are EMV chip and PIN compliant”. (There are, as I understand, no plans for a liability shift to rectify this, particularly in the USA.) Oh dear. Incidentally, the top three destinations for ATM fraud on UK-issued cards last month were…. 1. Canada, 2. Italy and 3. the USA.

Suppose Gerrard is right? What will happen in 2012 when travellers from the USA arrive in Paris and discover the shops, hotels and ticket machines won’t accept their cards any more?

I hope regulators get real

Greyscale backing image
[Dave Birch] Competition is a good thing. Competition in financial services is a good. If society wants a better payments system (which it should, for many reasons) then the way to get it is by creating a regulatory infrastructure that fosters, encourages and perhaps even demands competition in the provision of payment services. This is why the Payment Services Directive (PSD) has a chance of making life better for European consumers. Should that competitive environment embrace banks and non-banks? Yes, it should. If banks and non-banks are to make progress together, then it is not clear that simply leaving them to get on with it is good enough. For one thing, banks in many countries don’t really want to compete, so if there is no explicit regulation to create a competitive landscape then there is a temptation to fall back on the old kind of competition in banking, which means competing and the regulatory level. This is the kind of situation that we see in Africa. Nigeria is a case in point.

Indications have emerged that Nigerian banks have moved against the quest of MTN Nigeria and Zain to obtain M-Banking license operations from the Central Bank of Nigeria (CBN). The regulatory body has only issued one mobile banking operating license to MoneyBoxAfrica to deplore branchless banking services across the country… the refusal of the apex bank to grant the [m-banking] license is as a result of Nigerian banks antagonistic to the idea.

[From ftr-africa.com – Financial Technology Report, Africa]

In Kenya, where the M-PESA mobile payment scheme is massive, the regulator had wisely decided to allow Safaricom to go ahead and launch that service despite bank pressure. The result has been a fantastically successful scheme that has transformed for the better the lives of million of Kenyans. But someone told me that the Kenyan regulator has now decided to revisit the situation and perhaps “tighten up” rules, inspired no doubt by the banks’ genuine concerns for customer protection and the soundness of the in-country remittance market. Incidentally, you may not be aware that M-PESA has been launched in other countries. Afghanistan, for example.

Take Afghan GSM operator Roshan; they recently licensed Safaricom’s hugely successful M-PESA system, and one of the first applications for it is paying the Afghan army.

[From Telco 2.0: March 2009 Archives]

When the alternative is transporting tons of cash through some of the most dangerous highways and byways in the world, the mobile phone offers a millionfold improvement whatever the regulators’ concerns might be. Mobile money is unstoppable.

Balancing act

Greyscale backing image
[Dave Birch] There was a great kick-off talk from Blums Pineda at the Mobile FInancial Services conference in Singapore. Now with Exicon, he was previously with Globe Telecom, home of GCash. Blums chose to focus on the balance between consumer protection and business opportunity, building on his experiences with G-Cash. He was essentially optimistic that regulators are embracing new models. As he pointed out, it’s the transaction space that is driving growth in the financial services market. In the mobile transaction space, we need regulatory certainty to encourage investment and no regulation at all is not the right kind of certainty. In the Philippines, the regulators did not over-react and use inappropriate banking regulation to constrain the evolution of payments business.

There are good reasons, as we have discussed before, why we actively want regulators in the m-payment space. That’s because while no regulation at all might minimise compliance costs for the provider, it does not minimise costs for society as a whole: consumers carry on using more inefficient forms of payment (cash, in the countries being discussed) because they have regulatory certainty. So there are great benefits to having regulation. Blums summarised these as benefits to consumers, providers and the common good. I thought he was dead right to include the common good as a separate and distinct beneficiary, serving to remind . Surprisingly, to some people, he said that one of the benefits of regulation was to encourage innovation.

The idea of regulators balancing prescriptive vs. principles-based

He gave a useful case study of the Philippine regulatory response to the development of G-Cash and Smart Money, showing how the regulators allowed the market to develop new solutions by working with the new entrants to find ways to make the regulations work. As an aside, later in the day a chap from Ernst & Young (who began by saying that, with admirable candour, that the “big four” have come “a little late” to m-payments) was drawing some lessons from the launch of Smart Money (in 2000), GCash (in 2004) and Citi (In 2008) in the Philippines. Smart Money has seven million registered users and 700K retailers, GCash two million registered users and over 600K retailers (and GCash customers have access to 6,000 ATMs) but these systems could be bigger still with bigger networks of agent, consumers and merchants. The barriers to entry are too high.

GCash need to make it easier for new members (consumers or merchants) to join system. But they also need to do something with the agent network. There is an onerous process for new agents to join the GCash network and since agents only get 1% commission for cash loads compared to 10% commission for airtime top-up, there’s not much of an incentive for them. These factors have limited the growth of the agent network which has, in turn, limited the growth of the scheme. As an aside, here’s a useful data point: Blums reckons that the shift to m-payments has eliminated nearly 80% of microfinance provider costs in the Philippines. Now, the environment there is most conducive to m-payment — 95% of Philippine towns have mobile coverage, only 60% have a bank branch. There are 10,000 ATMs but a million airtime resellers — but so the cost savings may be at high end of possibility, but the opportunity to significant cost reduction in many markets is clear.

Looking forward, he reiterated the growing need to regulate the agent networks in the m-payments space (Globe has something like 1,800 accredited partners for the GCash service), something that we have been thinking about with some of our customers and something that we will be sure to return to on the Digital Money Blog. Finally, he noted that a key element of the future platform is some form of mobile identity infrastructure. GCash has over-the-air registration, but if you use it at POS you have to present an ID card, which makes it less convenient than it might be. I couldn’t agree more, which is why I was so keen to have a mobile eID panel session at the recent Identity and Privacy Forum and I’ll be talking on this subject in Session C European eIdentity Management, the 22nd eema conference, on 25th June in London.

The 50 year plan

Greyscale backing image
[Dave Birch] When I took one for the team and went to the SEPA session at the International Payments Summit. I did learn something new, which was that at the current rate of progress it will take about 50 years (the actual estimate was 47 years) to migrate European credit transfers to the SEPA Credit Transfer (SCT), which is not bad I suppose. After all, it takes time to develop and integrate new systems, and banks have other priorities. Neverthless, it is fair to observe that progress is slow.

What I was mainly interested in was the zeitgeist around the Payment Services Directive (PSD) rather than SEPA itself. That’s because it will have more of an impact on more of our customers. Selfish, I know. But the thinking is straightforward: for our financial sector customers in the payments business, the PSD introduces new consumer rights and so forth and this will cause them some hassle. One particular impact, which may well be under-emphasised in strategic evaluations of the PSD, is the panoply of new customer rights that come with the PSD. These include transparency. So (under articles 36 and 37) your card issuer has to tell you (when you’re buying a meal in a Greek restaurant) the maximum execution time for a payment, all charges payable and a breakdown of those charges and the actual (or reference) exchange rate. Gulp. That sounds like the Greek restaurant will have to give a British cardholder a couple of pages of A4 and make sure that the customers reads them before they punch in their PIN.

You’d think that a key impact of the PSD would be pan-European, but a couple of people I overheard were definitely sceptical. In fact, some people think it is likely to entrench national markets for the time being. I saw Bob Lyddon give a talk about this recently and he made the point that the combination of national “gold plating”, the mixed adoption of the rights of derogation and different interpretations of non-negotiable elements after national transcription (ie, the process of turning the directive into national law) means that there is a high likelihood of national markets becoming more different, not more similar. (And one country, Sweden, is opting out of it at the moment.) Thus, although a Payment Institution (PI) can theoretically passport, national differences mean that costs and complexity will not reduce for the time being.

Anyway, the point is that for banks, the PSD comes at an interesting time when transaction banking is becoming more central to strategy. The threats from both new entrants and substitutes are, according to Bob (and I agree with him), high. In these circumstances, regulation is turning from a moat that competitors cannot cross into a millstone around the incumbents necks.

Subscribe to our newsletter

You have successfully subscribed to the newsletter

There was an error while trying to send your request. Please try again.

By accepting the Terms, you consent to Consult Hyperion communicating with you regarding our events, reports and services through our regular newsletter. You can unsubscribe anytime through our newsletters or by emailing us.