Technological changes in the finance sector Adam Farkas, EBA Executive Director Oxera CCRP event - London, 26 October 2018

EBA role in FinTech Legal and Reputation ICT security ICT data integrity Vulnerabilities from use of third parties Conduct risks RISKS EBA objective to balance protection of financial system and promotion of innovation Improved customer experience Improved efficiency, cost reduction, faster services Rise to new services and business models Potential to improve services Easier access to financial services Enhanced security OPPORTUNITIES

Which incumbents’ business lines are mostly affected by new entrant FinTech firms? Q: Impact of FinTech firms on incumbent banks’ current business lines Source: EBA RAR H2 2017

PSD2 has a number of different, often competing, objectives Objectives of PSD2 PSD2 has a number of different, often competing, objectives Competing objectives of PSD2 Enhancing competition Facilitating innovation Ensuring technology & business-model neutrality Promoting customer convenience Contributing to a single EU payments market Protecting consumers Strenghtening security e.g. tension between customer convenience and strengthening security; or between innovation and single EU payments market.

Balancing different objectives High degree of security and safety would suggest high demands in security of authentication User friendliness would require lighter standards in authentication requirements Integrating a single payment market would require more details in technical standards to avoid fragmentation across geographical sectoral or other lines Facilitating innovation requires technology and business model neutrality, which would require less detail in technical standards For instance, the objective of ensuring a high degree of security and safety would suggest that the EBA’s technical standards should be rather demanding in terms of authentication, whereas the objective of user-friendliness would suggest that the RTS should be less strict. Another example is on the level of detail required in an EBA instrument: The objective of PSD2 to facilitate innovative payment services and be technology and business-model neutral would suggest that the EBA should pitch the technical standards at a higher, i.e. less detailed, level. However, this may result in many different industry solutions emerging across the EU, which could lead to a fragmentation across geographical, sectoral and/or other lines, and potentially undermine PSD2’s objective of integrating retail payments in the EU.

DLT/Blockchain

Blockchain / DLT  Crypto-currencies In its 2014 Opinion, the EBA sketched a possible regulatory framework that would be required for crypto-currencies to be regulated comprehensively but suggested that the framework would enter uncharted territory and would require many years to develop. In the short term, a more nuanced strategy was preferable, built around three pillars: full application of customer due diligence obligations under the anti-money laundering and counter terrorist financing (AML/CFT) regulations – a point that has now been included under the revised Anti-Money Laundering Directive (AMLD5) warnings to consumers that investments in these assets are not protected by any regulation and, therefore, by any safety net, so that they may lose all the money invested – a step that has been accomplished through a recent warning the EBA issued jointly with ESMA and EIOPA Discourage regulated financial institutions from buying, holding or selling these products – and possibly also from establishing direct or indirect connections with managers of crypto-currencies, so as to segregate the two sets of players and avoid contagion. Crypto-currencies ! This example shows the difficulties in dealing with perimeter issues. Regulators need to continuously review the boundaries and consider including new players under their remit. But they need to maintain an informed and measured approach.

Cloud adoption in banking –opportunities and challenges Economies of scale (more efficient resource utilization, “state-of-the art systems”) Cost effectiveness, “pay as you use” turning large up-front fixed costs into variable costs Cost-savings (physical storage, personnel, infrastructure development and maintenance) Operational efficiencies Flexibility and scalability (on-demand infrastructure, scale resources up and down as needed) Business agility eases deployment of new services Enabling of innovation (FinTech) and reduction of “time to market” CHALLENGES: Data security and data protection System and network security (any limitations on networking such as data import/export bottlenecks or service disruptions can reduce cloud utility) Browser security (browser security failures can lead to cloud security breaches) Concentration risk (from institution/system perspective (large cloud service providers can become a single point of failure)) Compliance and governance/control risks (cross-border settings, use of a chain of sub(sub)contractors) Provider lock-in and other exit-related issues (secure transfer and removal of data from the cloud) Business continuity (service provider outages)

Future: Oversight of big players? Future of cloud Future: Oversight of big players? NB not supervision PRESENTATION TITLE