1. Technological changes in the finance sector
Adam Farkas, EBA Executive Director
Oxera CCRP event - London, 26 October 2018

2. EBA role in FinTech
Legal and Reputation
ICT security
ICT data integrity
Vulnerabilities from use of third parties
Conduct risks
RISKS
EBA objective to balance protection of financial system and promotion of innovation
Improved customer experience
Improved efficiency, cost reduction, faster services
Rise to new services and business models
Potential to improve services
Easier access to financial services
Enhanced security
OPPORTUNITIES

3. Which incumbents’ business lines are mostly affected by new entrant FinTech firms?
Q: Impact of FinTech firms on incumbent banks’ current business lines
Source: EBA RAR H2 2017

4. PSD2 has a number of different, often competing, objectives
Objectives of PSD2
PSD2 has a number of different, often competing, objectives
Competing objectives of PSD2
Enhancing competition
Facilitating innovation
Ensuring technology & business-model neutrality
Promoting customer convenience
Contributing to a single EU payments market
Protecting consumers
Strenghtening security
e.g. tension between customer convenience and strengthening security; or between innovation and single EU payments market.

5. Balancing different objectives
High degree of security and safety would suggest high demands in security of authentication
User friendliness would require lighter standards in authentication requirements
Integrating a single payment market would require more details in technical standards to avoid fragmentation across geographical sectoral or other lines
Facilitating innovation requires technology and business model neutrality, which would require less detail in technical standards
For instance, the objective of ensuring a high degree of security and safety would suggest that the EBA’s technical standards should be rather demanding in terms of authentication, whereas the objective of user-friendliness would suggest that the RTS should be less strict.
Another example is on the level of detail required in an EBA instrument: The objective of PSD2 to facilitate innovative payment services and be technology and business-model neutral would suggest that the EBA should pitch the technical standards at a higher, i.e. less detailed, level. However, this may result in many different industry solutions emerging across the EU, which could lead to a fragmentation across geographical, sectoral and/or other lines, and potentially undermine PSD2’s objective of integrating retail payments in the EU.

6. DLT/Blockchain

7. Blockchain / DLT  Crypto-currencies
In its 2014 Opinion, the EBA sketched a possible regulatory framework that would be required for crypto-currencies to be regulated comprehensively but suggested that the framework would enter uncharted territory and would require many years to develop.
In the short term, a more nuanced strategy was preferable, built around three pillars:
full application of customer due diligence obligations under the anti-money laundering and counter terrorist financing (AML/CFT) regulations – a point that has now been included under the revised Anti-Money Laundering Directive (AMLD5)
warnings to consumers that investments in these assets are not protected by any regulation and, therefore, by any safety net, so that they may lose all the money invested – a step that has been accomplished through a recent warning the EBA issued jointly with ESMA and EIOPA
Discourage regulated financial institutions from buying, holding or selling these products – and possibly also from establishing direct or indirect connections with managers of crypto-currencies, so as to segregate the two sets of players and avoid contagion.
Crypto-currencies !
This example shows the difficulties in dealing with perimeter issues. Regulators need to continuously review the boundaries and consider including new players under their remit. But they need to maintain an informed and measured approach.

8. Cloud adoption in banking –opportunities and challenges
Economies of scale (more efficient resource utilization, “state-of-the art systems”)
Cost effectiveness, “pay as you use” turning large up-front fixed costs into variable costs
Cost-savings (physical storage, personnel, infrastructure development and maintenance)
Operational efficiencies
Flexibility and scalability (on-demand infrastructure, scale resources up and down as needed)
Business agility eases deployment of new services
Enabling of innovation (FinTech) and reduction of “time to market”
CHALLENGES:
Data security and data protection
System and network security (any limitations on networking such as data import/export bottlenecks or service disruptions can reduce cloud utility)
Browser security (browser security failures can lead to cloud security breaches)
Concentration risk (from institution/system perspective (large cloud service providers can become a single point of failure))
Compliance and governance/control risks (cross-border settings, use of a chain of sub(sub)contractors)
Provider lock-in and other exit-related issues (secure transfer and removal of data from the cloud)
Business continuity (service provider outages)

9. Future: Oversight of big players?
Future of cloud
Future: Oversight of big players?
NB not supervision
PRESENTATION TITLE