The Regulatory Framework of E-Banking

1. The Regulatory Framework of E-Banking David Carse Deputy Chief Executive Hong Kong Monetary Authority 8 October 1999

2. The “Age of the Internet” • Technology is now the single biggest strategic issue in banking • In particular, banks should be urgently reviewing the opportunities provided by the internet • Businesses that fail to meet the challenge of the internet will have a limited future

3. The challenge for the regulators • The regulatory framework of the HKMA is largely based on the more traditional frame of reference • Therefore we need to ensure that our framework continues to evolve and keeps pace with technological developments • We certainly do not want to stand in the way of innovations such as e-banking

4. The state of e-banking in Hong Kong • The HKMA separates e-banking into two streams: • electronic money products, mainly in the form of stored value cards • electronic delivery channel products

5. Stored value cards • Progress so far has been disappointing as far as bank-issued cards (like Visa Cash and Mondex) are concerned • This has been consistent with experience around the world - the product appears to be ahead of customer demand • Technological advance (eg combined credit, debit and electronic purse cards) may help to increase public acceptance

6. The Octopus card • This has been the real success story • 5.6 million cards in issue with 3.8 million transactions per day • Shows that there is real attraction in Hong Kong for a technological innovation that is genuinely useful and convenient • reflects the fact that the core use of the card in linked to a specific purchase (transport) that people have to make in their everyday lives

7. Electronic delivery channels • Increasing number of banks have introduced or are planning to introduce shortly transactional internet banking • Mobile phone banking is also very much a live issue • E-banking has the potential to succeed in Hong Kong because there is the supply, the demand and the infrastructure (physical, financial and, shortly, legal)

8. The implications for banks • The internet has enormous potential for the banks in terms of cost-saving and increased revenue generation through more effective cross-selling • But there are also risks • strategic • legal • operational • reputational • liquidity and credit

9. Strategic risk • “Will the bank get it right?” • will it invest in the wrong technology? • should it be an innovator or a follower? • how should it cope with competition from low cost entrants? • what should it do with the existing branch network? • how does it retain customers as their power to “shop around” is increased? • how can it build and exploit its brand name?

10. Operational risk • Although banks face all sorts of security risk day to day, the internet poses new challenges because of its open nature • Perhaps the biggest concern among customers and therefore the biggest barrier to customer acceptance of internet banking

11. Internet security arrangements • The security arrangements should have the following objectives • restrict access to the system to authorized users • authenticate the identity of the parties concerned • maintain confidentiality of information in transit and ensure that it has not been modified • prevent unauthorized access to the bank’s main computer system and data base

12. HKMA’s assessment of security • Based on the advice of industry experts, the HKMA believes that developments in internet security technology have reached the point where it is commercially viable to obtain adequate security for banking transactions • But this cannot hold good indefinitely • Banks will have to strive to keep up with technological developments to counter new threats to security as they arise

13. Legal risks • There are many aspects to this (eg legal recognition of digital signatures) • But an aspect of particular concern to HKMA is to ensure a fair division of loss-sharing between bank and customers • Our view is that customers should not be liable for losses from a security breach or system problem that is not caused by their own negligence

14. Reputational risk • The threat of damage to the bank’s reputation goes along with the other risks • successful hacking of a system may cause bad publicity and undermine customers’ confidence in internet banking even if they suffer no loss • system breakdown may also arouse public concern • Banks therefore need to adopt specific strategies to manage reputational risk

15. Banking risks • Internet banks face the same types of banking risk as conventional banks, but the risks may be heightened in some respects • liquidity risk may increase if it becomes easier for depositors to transfer deposits at the touch of a button (the “virtual” run) • credit risk may increase if the relationship with the customer becomes more distant and transitory, or if competitive pressures lower credit standards

16. Regulatory framework • Our supervisory framework needs to address the above risks • This is part of the general process of trying to determine that banks have in place adequate systems to measure, identify and monitor the various types of risk they face • E-banking poses particular challenges because of the pace of technological change • Will require us to improve our expertise, eg by hiring examiners with specialist IT skills

17. Regulation of stored value cards • Need to regulate in order to • protect consumers • safeguard the stability of the payment system • possible contagion effect on other schemes if something goes wrong with a particular scheme • Multi purpose cards are similar to the taking of deposits and the issue of bank notes

18. The main regulatory issues • Who should be allowed to issue stored value cards? • How can the potential risks to the payment system and cardholders be minimized? • quality of issuers • security of the card • risk management policies and procedures • assets backing the stored value

19. Banking Ordinance • Issuers of multi-purpose cards must be approved by HKMA • Banks deemed to be approved • Non-banks may apply to be approved as a special type of DTC • service providers who want to issue limited purpose cards • Exemption for very limited purpose cards (like Octopus)

20. Electronic banking • Regulatory approach is less specific and is still evolving • Banks should inform us in advance of their plans to offer an internet banking service and discuss the implications with us • Main concerns are • security (should be “fit for purpose” and reviewed by independent experts) • risk management systems and internal controls need to be subject to regular review • approach to the other types of risk described earlier • contingency plans

21. The virtual bank • At some stage we may be asked to authorize a virtual bank that offers its services wholly over the internet • If it wished to take deposits in Hong Kong, it would need to have a physical establishment here • provide a point of contact with the bank and place at which HKMA could inspect its books and records • Would need to have capital and liquidity like any other bank and strong parentage • Must have substance, not simply be a “concept”

22. Offshore internet banks • Such banks may try to attract HK residents to place deposits outside Hong Kong • would not require authorization under the Banking Ordinance • But would breach the rules on advertising for deposits unless it complied with the statutory disclosure requirements • Problem is to know when a particular web-site is targeting Hong Kong

23. Offshore internet banks (2) • Hong Kong may being targeted if, eg • advertisements for service placed in local press • deposits taken in HK$ • Hong Kong not on list of excluded jurisdictions • If so, one option will be to write to the bank (if respectable) and its home supervisor to ask it to comply with the Hong Kong rules • May also be possible to seek the cooperation of local ISPs

24. Offshore internet banks (3) • If the bank is not respectable and is based in an uncooperative centre, the situation would be more difficult to handle • The public needs to be very cautious about sending any money to such a bank • No form of regulation can replace the public being careful about who they do business with

25. Conclusions • E-banking is clearly the way forward for the banking industry and the banks in Hong Kong are well placed to capitalize upon this • The HKMA’s task as regulator is to help minimize the risks and to secure the benefits by providing an appropriate regulatory environment • This is an ongoing task which has only just begun