FATF as in: Facebook As The Foe or Facebook As The Friend ?

Dear Mr Billingslea, dear Members of the FATF and dear civil servants in the room,

As you are nearing the end of a very productive year I wish to commend you on your very hard and wise work of the last year. If we look back on the objectives that the President laid out for 2018-2019 we can see the many accomplishments of this year. It has been a very productive year and one that will be remembered for many years to come. Because you will define what FATF truly stands for. 

Of course there are some commentators that challenge the legitimacy of your work on virtual assets. They outline that your so called open-ended mandate is by definition constrained by the boundaries set by Human RightTreaties, UN Resolutions, Fourth Amendments or rulings of the EU court ofJustice (Tele2) or the US Supreme Court (Carpenter). And they outline that effectively the FATF Standards are leading to a privacy infringement under those Human Rights agreements. I leave those comments aside for now. Historians and judges may be the judge for that.

For now, I wish to draw your attention to a practical dilemma that you will be facing the upcoming week. The dilemma is: does FATF stand for Facebook As The Foe or Facebook As The Friend? 

The answer depends on your own view: which society do you wish to leave behind for your kids?

FATF: Facebook As The Foe
While you were looking out of the frame of libertarian misuse of virtual currencies for all kinds of criminal purposes, you may have forgotten to look out the other window: at bigtech players such as Facebook and Google. Widening your view is of particular relevance now that you are about to endorse a virtual asset recommendation that obliges names of citizens to be sent along with virtual asset transfers (one way or the other).

Let's take a closer look at Facebook. They have thrown the privacy hundreds of million people under the bus. They opened up their systems to developers and allowed mass scale harvesting of personal data to other companies. They have come under severe criticism for this. And they changed a lot of operations, moved people out and such, all in other to counter the criticism about their harvesting of data. Bottom line: they need to remove personal data or ensure that they have proper consent from citizens that are properly informed on the whereabouts of their personal data.

Their latest project is a cryptocurrency / virtual asset programme, with the naam Libra. It leads to the creation of a world currency, backed by a combination of assets. And Facebook will cooperate with other bigtech and Fintech players to make it happen. As the Wall Street Journal outlines:

FATF-virtual asset rule: cryponite to send and harvest personal data without caring about consent 
I am wondering if you have thought trough your recommendation on standards for virtual assets sufficiently. Are you aware that Facebook itself will become a huge Virtual Asset Service Provider? Are you aware that it is now soliciting other big tech companies to become verification nodes in their virtual asset programme? And are you aware this means they don't have to ask any consent from the users who use their coins, to add name information in or with the transaction (whichever way they see fit, as long as they oblige). And this information must also be shared with counterparts (if any) meaning that if I operate a verification node, I am sitting on the information as well? 

The unintended consequence of what you are doing with the virtual asset rules is that, in times of personal data as the economic fuel for society, you are handing out cryptonite to all kinds of private sector players that want to have a free pass for passing on and harvesting personal information. All kind of other companies may follow suit as the FATF-rule is really an easy tool in the box of companies that actively seek to engage in regulatory arbitrage to avoid privacy rules as much as possible. 

Facebook as the Friend....?
The other alternative is that the FATF effectively sees Facebook as a friend. You are aware of the above consequence and view it as a necessary consequence that will be very helpful in capturing the criminals of the future. That would mean that with the FATF-rule you have deliberately chosen to marry with bigtechs.

Now if I Imagine the biggest data-harvesting company in the world marrying the world-wide law enforcers in the world I must say I am sort of afraid to imagine what their kids will look like. This would be too big a confluence of private and public sector roles and it will have a desastrous impact on the world. Some may argue that we were already living in Orwells 1984, but with this rule you will have definitely sealed the deal. 

What you may just do when agreeing to this virtual asset rule, is outlaw all the citizens of their world. Their data are free for all to harvest and in the process you will ride along to see if you capture a terrorist every now and then. 

Historic data does show, by the way, that all the virtual transaction data will not really help as evaluations of the impact of the travel rule indicate that the number of crooks preventively caught in 15 years of its use can be counted on one or two hands. It is always other law enforcement info that gets you to detect them beforehand, never the transaction data.  

What will FATF stand for: wich kind of society do you leave behind?
Will FATF stand for Facebook as the Foe and will you reconsider virtual asset article 7b?
Or will FATF stand for Facebook as the Friend and will you outlaw all personal data of world citizens?

Next week the choice is up to you. I have a hunch you will be going for the Facebook is my Friend model. Because in your groupthink you may be driven to annihilate all kinds of perceived criminal evil even when the tools for doing so are ineffective. Or just beause your are inclined to do as is told and answer to call of your bosses as they said to approve the virtual asset rules. 

Thereafter, you may end up seeing your choice annulled by judges. This may be the result of lengthy procedures or otherwise geopolitical incidents in which one of the kids of the marriage of FATF and Facebook will have turned evil. And then, each one of you in the room will have to answer towards its citizens, politicians, children and grandchildren: how did you not see this coming? 

Don't finalise the paragraph 7b text
I call upon you to consider the above with an open mind and an open heart.
Do the right thing: vote to re-consider or postpone finalisation of the pragraph 7b text. 

Postponing allows for more time to explore all impacts and consequences and have a further debate on what you wish the true acronym FATF to stand for.

Simon Lelieveldt

Dutch central bank can further encourage innovation for payment institutions with a quick win

Article 18.2 in PSD2 (Article 15 in PSD1) on the nature of funds
 in a payment account of a payment institution

It's a logical thing. As the bakery provides bread, banks provide loans and allow savings, e-money institutions offer e-money, payment institutions are allowed to provide payment accounts to their customers. These accounts would neither be redeemable deposits or repayable funds, nor e-money, as the article in the PSD(2) states.

Stricter interpretation by De Nederlandsche Bank 
De Nederlandsche Bank, our local supervisor, however does not appear to allow the above flavour in the Netherlands easily. Companies that have business models in which payment accounts (whether with or without IBAN) are offered, should not be surprised if they are told that the funds would qualify either as redeemable deposits or e-money, with little inbetween.

 As a result, one will not encounter a lot of payment-account issuing by payment institutions in the Netherlands. And this is in spite of the fact that even the Explanatory Memorandum of our Financial Supervision Act explicitly mentioned this possibility.

Other supervisors follow the EU-approach 
Thus we can see issuers from other countries, such as Pocopay from Estonia, offer payment services and payment accounts to students where these can't be offered by local players. On their website, we see this issuer outlining (USING CAPITALS) in the terms and conditions that the funds are not redeemable, to be used for payments and not covered by deposit insurance of any kind.

Other instances can be found in German or French markets, leading to the situation that Dutch payment institutions are restrained in product innovation and less able to compete with PIs from other countries, which may offer a broader solution range to their customers.

Quick win to facilitate innovation in payments in the Netherlands 
There is a clear quick win here in the Netherlands in terms of payment regulation. Instead of claiming that funds are either deposits or e-money, De Nederlandsche Bank should more easily allow payment institutions to also offer the third flavour: non-redeemable funds on payment accounts, used for payment purposes.

Of course, one could raise the question whether it is possible to make such a business model work, but it should be the market that decides rather than the supervisor.

This article is a translation of a contribution to the Financieel Dagblad of July 29, 2017.

'DNBcoin': the Dutch central bank experiment with a blockchain-based coin

Today, the Dutch central bank published its Annual Report. This coincided with the death of our most famous soccer player, Johan Cruyff, so it's clear that there is not so much undivided attention to their whole report.

 Scanning through the report, I noticed an interesting paragraph in the sustainability-part of the report (p. 208), under the header of inclusion and accessibility of payments. It stated that DNB aims to develop a working prototype DNBcoin based on blockchain technology.

So, there we have it: central banks are entering the market of digital cash once again. After the announcements on RSCoin, the blockchain based electronic cash proposed for the UK central bank, the Dutch central bank is following suit.

So is this new and revolutionary?

No and yes.

No, because I recall that twenty years earlier, the Danish central bank sold its electronic cash solution (Danmont) to the market (withdrawn as a micropayment tool in 2005), as did the Canadian central bank (selling of its Mintchip). So there is not much news in central banks setting up electronic cash. 

What is new however is the environment in which this development occurs. Previously, central banks were keen on getting rid of cash as an inefficient payment method. As this starts to be succesfull (in Sweden and the Netherlands for example) the central banks adapt their position. The policy line now is that for availability and financial inclusion reasons cash still needs to be around as a payment mechanism.

So when we now see central banks moving forward in the electronic cash domain (now conveniently labelled: blockchain/fintech, instead of bitcoin) it might be to no longer spin it off to the market, but to create a permanent digital replacement of cash.

Therefore, this time it might be different.

ECBs renewed virtual currencies report: implications for the Third Payment Services Directive

This week the European Central Bank (ECB) revisits the subject of virtual currencies (VCS) in a renewed virtual currencies report with a further analysis. I have read the publication with interest to discover that the previous position on the subject essentially remains the same:
- virtual currencies don't come near money or legal tender concepts,
- the uptake of virtual currencies is still very limited
- the wait and see approach of the ECB will be continued.

The typical paragraph that summarises this approach is:
The usage of VCS for payments remains limited for now, which implies that there is not yet a material risk for any central bank tasks, including promoting the smooth operation of payment systems. However, a major incident with VCS and a subsequent loss of trust in VCS could also undermine users’ confidence in electronic payment instruments, in e-money and/or in specific payment solutions. 

Whereas at first sight the report doesn't lead to a lot of new insights, the broader scope of its definition of virtual currencies does beg a number of fundamental questions with respect to the future regulation of payments. These questions lead me straight into a renewed regulatory approach, to be used in the Third Payment Services Directive.

An improved definition
The major improvement of this Eurosystem-report over the previous one lies in its correction of the definition used for virtual currencies. In an earlier blog I commented that the definition was too vague:
“A virtual currency is a type of unregulated, digital money, which is issued and usually controlled by its developers, and used and accepted among the members of a specific virtual community”.
With this report, the definition of virtual currencies has formally changed into:
"a digital representation of value, not issued by a central bank, credit institution or e-money institution, which, in some circumstances, can be used as an alternative to money."

I am quite pleased with this change as it allows for a better understanding and classification of the subject of virtual currencies. Interestingly, the elimination of the element of decentralized issuance leads to a far broader range of virtual currencies than previously discussed. And this leads to an interesting follow up question.

Virtual currencies are suddenly everywhere... 
The table below lists the major payment options in the Netherlands, with the virtual currencies listed at the far right. When looking at the turnover figures, one can understand why the Eurosystem will be primarily monitoring the virtual currency scene. The most interesting observation is however that all the blue coloured segments of the table are now also considered to be virtual currencies.

We can see that in particular the giftcard and transport payments (which are out of scope of the payment regulations for a number of reasons) do amount to quite a substantial payments volume. Literally these payments are now also considered to be payments with virtual currencies. And from an analytical perspective, this is a logical consequence.

Regular (e-) payments	OV-Chipcard	Mobile telephone	Retailer Giftcards	Bitcoin / alt-coins
16 million per day	5 million per day (includes loads)	Premium services	500.000 - 1.000.000 per day	Less than 1000 trx per day in NL
€ 903	€ 2 - € 20	€ 2- € 5	€ 12	€ .?
Payment Services Directive (PSD)	Exemption under PSD1	Explicit exemption of PSD1	Out of scope when issued as a single retailer	Out of scope of PSD

Effectively we can now better appreciate today's payments world, seen from the eyes of the consumer. Because the consumer is not bothered by the details of Payment Services Directives and obscure exemptions of mobile payments. The consumer will use the mobile or ticketing payment means as a matter of convenience (or: obligation) and will have to undergo the payment experience as a fact of life.

Particularly in the Netherlands this leads to the interesting situation where a sloppy and easily hackable implementation of NFC is being widely used for public transport payments, alongside a safer NFC implementation of banks that is still working on its nationwide roll-out. Users use them both.

Similarly interesting was the occurrence, last month, of a virtual currencies bank run. As retailer V&D threatened to go out of business, one could witness the sale of its pre-paid gift cards on Marketplace (the Dutch ebay) for considerable discounts. At the same time everyone in the Netherlands dug up and spent their old gift cards, before it was too late.

What the third Payment Services Directive will have to look like 
If we take the wider definition of virtual currencies that the ECB uses, it becomes clear that the user experiences with virtual currencies (and losses: for example the sudden vaporisation of retailer gift card value after a period of 18 months) happen alongside the heavily PSD-regulated instruments and mechanisms.

Based on some prudential rules we now burden some forms of payments with a whole lot of rules, while we neglect all schemes that are out of scope (but may still have relevant consumer effects). This difference is - in my view - too big and requires a changed approach to be used for the Third Payment Service Directive (PSD3).

Under the Third Payment Service Directive, we should recognise that payments can and will be made and offered by everyone to everyone. The PSD3 should thus define a light-weight conduct supervisory framework for all payment mechanisms, regardless of the institutional status of the issuer. Alongside this wide conduct framework, we keep the current prudential framework intact, which outlines the prudential rules applicable to the different institutional payment setups (e-money, payment institution, bank).

The new conduct based framework would apply to payment mechanisms and e-money alike and have as a goal that the user is always properly informed on the basic terms and conditions, redeemability etcetera. The control-mechanisms should not be supervision based, but could be reputation-based for example, allowing the market to monitor and redress, rather than costly supervisors. Only in exceptional circumstances would a European conduct supervisor step in.

In sum: more analysis ahead
The broader scope of the Eurosystems definition of virtual currencies begs a number of fundamental questions with respect to the future regulation of payments. In particular the area of non-regulated payment schemes at the fringes of the PSD might deserve more attention than they do receive right now.

Not only could the question be whether or not a separate regulatory conduct-framework should apply, the European Retail Payments Board might also decide to expend its analysis towards these mechanisms, particularly when they reach a volume/scale which is equivalent to that of the regular payments.

Lawsuit in the Netherlands on Bitcoin as 'money' or 'current money'

Since May this year, there is an interesting discussion here in the Netherlands on the legal status of Bitcoin as money.

First law suit on failed bitcoin delivery 
The discussion starts with a law suit of two people engaged in a bitcoin transaction. Party B failed to pay up the whole amount of bitcoins, although it had received all the money for it. Party A, after two weeks partially annulled the agreement (for the part of the bitcoins not delivered). However, this party later on decided to demand to be compensated for the financial loss that resulted due to the increase in price of bitcoins over the course of the year (after the moment of canceling the contract).

Party A based its reasoning on the fact that our law allows for something as 'current money' to be used in order to pay a sum of money. This terminology was explicitly chosen by our legislator (instead of the legal tender concept) to allow non-State forms of money to be condoned in our country in situations where it was commonly used and accepted by all the people.

Should this argument succeed and bitcoins be considered such 'current money' the consequence could have been that an additional compensation claim could be made under our civil law. The judge however outlined that Party A should be compensated for the price rise of Bitcoin between the moment of concluding the contract and of canceling it (some € 1700). No compensation was due however for the remainder of the time, as it was party A that had initiated the canceling of the contract.

In addition the judge outlined that Bitcoins cannot be considered current money that is condoned by the State. Our Ministry of Finance has outlined that it doesn't fit the definition of legal tender, nor that of electronic money and that it should be considered a means of exchange. The nature of bitcoin (tradeable) doesn't work as an argument as also silver and gold are tradeable but not considered to be current money.

New law suit on status of bitcoin as money
A number of players in the Dutch Bitcoin community have chosen to challenge the above verdict of the judge and has raised more than  € 15.000 to pay for expenses of a law suit. It challenges the first verdict in order to have the judge reconsider its position and outline that Bitcoin is money. As a consequence it feels that it must then also be treated as such by our administrative bodies, supervisors, tax authorities etc. This would mean that bitcoin operators could be payment institutions, supervised and exempt from VAT (which, as I understand, are the underlying goals).

While I am very sympathetic to the concept of challenging a status quo and laws, I fail to see how a verdict on civil contract law could spill over into:
- the definitions of payments, money and payment institutions under the Payment Services Directive (and Dutch law),
- the definitions of payments under the Sixth Tax Directive.

Having said that, it will surely be very interesting to see which approach will be taken by the law firm involved and see if they are able to convince the judge that at least in civil contracts bitcoins may act as money.


Last edit: October 1, to outline that it's not the whole Bitcoin community that seek to challenge the verdict.

EBA concerned about anonimity and security for bitcoin

From May 15th until May 17th, the Bitcoin 2014 conference took place in Amsterdam. One of the break-out sessions was dedicated to the topic of Anti-Money Laundering on Transparent Networks. During this session, Dirk Haubrich of the European Banking Authority (EBA) outlined some of the issues and concerns of the EBA with respect to digital currencies and bitcoin.

In his initial statement Haubrich sketched the concerns of the EBA with respect to:
- the use of digital currencies to transfer the proceeds of crime and act as money transmission,
- the fact that anonimity is a burden to link the transactions to persons,
- seizing assets and restoring or undoing criminal or illegitimate transfers,
- the emergence of a hawalla-like new channel via which international transfers may occur to countries that are on the FATF-sanction list,
- the use of those currencies by terrorists and criminals,
- the integrity of creators of digital currencies.

Role of the EBA
As a part of the discussion, mr Haubrich outlined that the EBA has a specific remit in the area of consumer protection and financial innovation. It is from this perspective that the EBA issued its warning on virtual currencies in December 2013. The question whether or not to further regulate virtual currencies is now being investigated by a cross-sectoral working group of European supervisors. This group will publish its outcome in a couple of months.

When asked to discuss the major challenges for digital currencies, he outlined anonimity and it-security as major topics of concern. In combination with the aforementioned list of concerns, the overall impression was one in which further regulation appeared to be more likely than a continuation of the current hands-off approach.

FCA kicks the Securepay-can down the road...

In March 2014, the FCA, the prudential supervisor for UK based payment institutions and e-money providers, outlined that it would not be strictly assessing the compliance with the Securepay Recommendations on the security of Internet Payments. This announcement was quite interesting as in February 2014, the Forum also published an assessment guide that assists payment service providers with the implementation of these Recommendations by February 2015.

FCA Statement:
We have decided to await the publication of guidance from the European Banking Authority on measures for the security of internet payments and will begin to assess firms’ implementation of these security measures when the updated Payment Services Directive requirements take effect.

The updated Payment Service Directive will enter into effect at the earliest by mid 2016. It will assign the European Banking Authority with the task of further developing guidance for the security of retail payments. The FCA has chosen to wait for this guidance rather than pre-empt it.

Kicking the security-can down the road
It is interesting to note that the FCA seeks a pragmatic middle ground. It carefully states that it finds security an important issue while at the same time outlining that it will wait for a solid legal basis to assess the security of retail payments. In doing so it effectively kicks the tricky security can down the road.

I can well understand the FCA desire to kick this can. The Securepay recommendations on security lead to quite some questions in their practical application for different technologies (see the blog here). On top of that, the detailed prescriptions on the basis of the new Payment Services Directive may lead to further rules that limit the choices that market entities can make to achieve a certain level of security.

Rather than confuse the market with layering requirements which quickly follow each other, the FCA apparently chose to wait and see, hoping that the final rules on security for retail payments may become more balanced.

It will be interesting to see if other supervisors follow suit.

Mount Gox tumbles off the learning-curve

This week, Mount Gox, a very large provider of bitcoin services, couldn't live up any more to its services agreements with bitcoin users. It provided exchange and storage services for bitcoins, but due to a technical implementation flaw, the bitcoin holdings of users were compromised. Essentially it wasn't clear who really owned the bitcoins. The website went black and users can no longer claim their bitcoins.

Tumbling off the learning curve
I view the failure of Mt Gox as a logical consequence of the learning curve that bitcoin holders and bitcoin companies face. The bitcoin, although considered decentralized, is just as centralised a system as any other value transfer mechanism. However, for ideological reasons, the developers chose to only describe the technical heart of the system (the algorithm) leaving the rest up to the market.

This open source code approach has some advantages, among which a very speedy development of applications. Yet, we are for some time now witnessing what it means if systems lack a central authority or scheme manager. There is no entity taking responsibility and chasing users or companies because they don't abide by:
- usage conditions (demanding user identification),
- security requirements and certification of tools,
- specific legal frameworks.

As a result we have seen a whole community of interested companies and users climbing up the payments, banking, investments and monetary learning curve. The inevitable consequence is that those who do not get it right, will pay a price, while the others continue to learn. Due to the digital nature of bitcoin, these developments unfold rapidly, allowing us a compressed overview of lessons from financial history.

Frijda's theory of money (1914)
The essential lesson at stake is that the usage of any value transfer mechanism does not just rest on its acceptance by users, but just as well on the rules and regulations that underly the value transfer. In 1914, the Dutch lawyer Frijda analysed this topic in his dissertation on the theory of money. At that time discussions emerged on the nature of banknotes. Did they have value because they were exchangeable for bullion, because they were defined as legal tender or because the public used and accepted it?

Frijda pointed out that the underlying legal framework that safeguards property in a society constitute a necessary precondition for the use of payment instruments. Without such safeguards, people will tend to stick to other stores of value rather than attaching value to local bank notes. Until today this effect is clearly visible: consumers tend to hold and use foreign cash or commodities if they live in country with a lot of curruption, a weak system of justice and an instable monetary climate.

Trust is built by institutions and markets
What makes money tick is a solid institutional basis, upon which trust can be further developed. The latter part can be done by a combination of regulation (supervision) and self-regulation (market action). Which brings us back to the Mt Gox case.

Following the events of this week, a statement was released by the bitcoin companies Coinbase, Kraken, BitStamp, Circle, and BTC China. The industry leaders committ to safeguarding the assets of customers, to applying strong security measures, to using independent auditors to ensure integrity of their systems and to have adequate balance sheets and reserves to be able to ensure continuity.

In sum we can now see both a gradual development of both the institutional framework for virtual currencies and the market-driven self-regulation. This reflects the fact that - whether you like it or not - trust for financial services is always built on institutions, regulations and self-regulation.

The bitlicense: current state of thinking in New York

A week ago, the New America Foundation organised a meeting (Cryptocurrencies, the new coin of the realm) on the topic of virtual currencies and regulation in New York. Some news bulletins picked up on the meeting and the future New York Bitlicense regime. The good thing is that the New America Foundation has streamed the whole event, so it allows me (and you) to listen first hand to the speech by Benjamin M. Lawsky, Superintendent of Financial Services, New York State Department of Financial Services (DFS).

I will outline some of the highlights of his contribution below as I think that the New York discussion represents a good example of the issues at stake when it comes to regulation of Bitcoin. I expect to further touch on those issues in my contribution to the Bitcoin Pre-conference expert session of the EPCA-summit in Brussels (March 12-13).

Open source code currencies and open source code regulation
In his speech, Lawsky outlines the current remit of the NY department of Financial Services. It acts as the supervisor for money transmission companies in New York. The DFS-starting point is therefore that in some instances dealing with virtual money may effectively constitute money transmission, which needs to be regulatred. This is similar to the approach in the FINcen guidance of one year ago.

The New York regulator chose to emulate the open source code approach of virtual currencies. And thus, Lawsky refers to the DFS-approach as 'open source code regulation': regulation based on a public exchange of thoughts, allowing the best insights to be used. Given their current remit, the main idea is to see where the money transmitter rules need to change in order to suit the nature of virtual currencies.

As for the further process in 2014, Lawsky explained that the DFS will move towards further regulation this year and will most likely hold a  market consultation for the proposed regulatory framework for companies that want a so-called 'bit-license.'

What will the bitlicense be like?
When listening to the speech, my impression is that the core fundamentals of the bitlicense will be:
- very strong customer disclosure, requiring companies to outline that transactions are irreversible and that the digital currency may be very volatile,
- a strict adherence to know-your-customer requirements, essentially demanding that anti-money laundering rules are adhered to,
- a robustness/capital requirement, ensuring that the company will be able to withstand some of the market shocks that may occur when dealing with volatile digital currencies/commodities,
- safety and soundness requirements, ensuring a certain quality of operations and consumer protection.

As for the nature of capital and collateral requirements, the DFS is still wrestling with the concept of virtual currencies. This has to do with the angle and object of regulation. While it is easy to require capital safeguards for banks that deal with attracting and lending money, this is harder to apply for companies that issue, distribute or redeem virtual currencies.

Similar questions arise when defining the scope of transaction monitoring. Should only the purchase and redeem-transactions be subject to rules or does the supervision extend to a full transaction logging of all transactions with the virtual currency? Should those transactions be in a public ledger and to which extend can they be anonimized?

Step-up regulatory approach with a safe harbour
Although the DFS is still contemplating its exact licensing regime, I expect it to also contain a safe harbour provision. This would allow companies that comply with customer disclosure and know-your-customer rules, to continue to operate, while further obtaining the full bitlicense. Such a regime would assist in lowering the barriers for virtual currency platforms/traders/exchanges and create an easy entry towards the proper regulatory regime.

Lawsky outlined that the regulator prefers companies to be in his state and regulated, rather than driven off-shore. A safe harbour rule helps achieve that and fits a model where a light-weight, low-barrier entry model is developed to prevent legitimate providers from leaving the jurisdiction, while creating a sufficient barrier for the illegitimate players in the market. This is also a realistic approach considering the alternative channels for illegitimate behaviour: cash and banks. In the words of Lawsky:

Let's be frank: a lot more money has been laundered through banks than through virtual currencies'

Boldly go where no man has gone before?
I commend the DFS for their open minded approach to the topic of regulation of virtual currencies. I do disagree however with one of the remarks of the Superintendent. He outlined that regulators are in new and unchartered waters when it comes to virtual currencies.

I don't think they are.

Since day and age, people have used all kinds of symbols, coins and means of representation of goods that worked fine for transferring ownership of property. We created a number of laws and institutions to ensure these property rights and a fair treatment of parties to certain contracts. In doing so we were able to move from coins to paper-based money to deposit accounts. At the same time we created digital representations of shares, bonds, IOUs and agreed that ledgers at private companies and government institutions could officially represent a claim on goods, services, bits of land, anything.

Then, when it comes to new forms of money, we also have recent experience. In the late 1990s we witnessed a very similar type of discussion on bank supervision and specialised supervision regimes for new forms of 'electronic-money' as it was called in those days. It took some time and deliberation to get to grips with pre-paid digital representations of fiat-currencies, but we found our way in the end.

The challenge: finding the right regulatory framework
The true challenge is to first consider the fundamental nature of virtual currencies and then determine the appropriate regulatory framework. In essence, the DFS is doing the reverse as their starting point is their existing legal competence as supervisor of money transmitter businesses. While there is a lot of logic to it, it might be useful to reconsider alternative types of regulation that exist.

It's my hunch that perhaps an exchange/trade oriënted regulatory framework might make more sense as the basis for regulation, than the money transmitter framework. So that is what I will explore in my next blog.

Towards a more flexible approach of authentication

In July last year, the European Commission published a proposalfor a revised Payment Services Directive (PSD). The proposal draws on the work of the SecuRePay forum of supervisors and requires ‘strong customer authentication’ when a payer initiates an electronic payment transaction.

Strong authentication
Strong authentication is defined as a procedure for the validation of the identification of a natural or legal person based on two or more elements categorized as knowledge, possession and inherence. These elements are independent, in that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

The concept of strong authentication is in itself nothing new. What is new however, is its appearance as a detailed regulatory requirement. So far, both the Payment Services Directive and the Electronic Money Directive contained a more generic requirement for licensed operators to demonstrate that their governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate. This allows for a system wide supervisory review of risks and security measures.

The current approach in both the envisaged PSD and Recommendations of the supervisors in Europe is however to take out and stress one element of the risk/security puzzle. This approach may turn out to be counterproductive and be an impediment to achieve retail payments that are as secure, efficient and as frictionless as possible.

Different market approaches to customer authentication
Traditionally the banking sector and card schemes have played a major role in the payments industry. For a long time they acted as the main channel through which new technological developments were introduced. In this process, strong authentication in a range of countries became a standard for use in payments. Further security measures for use in transactions over the Internet were then being developed as an add-on to the basic design.

More recently, Electronic Money Institutions (EMIs) and Payment Service Providers (PSPs) have entered the payments value chain using the Internet as their basic transaction processing initiation channel. As a result, their approach to payment security tends to be based on a variety of methods, to be able to counter a range of attacks associated with this inherently unsafe environment. PSPs have had to move very quickly up the e-payment security learning curve and found out that they must remain vigilant with respect to new threats. PSPs are consistently using additional information (geo-location information, IP address matching, IP address pattern detection, industry blacklists, comparison against a customer’s existing “profile” etc.) to validate the interaction with a user.

There is still much to gain by combining the expertise of both the “classic” and more recently-established providers of payment services. Customers will be using all kinds of devices as a service entry point; this requires a flexible approach to authentication. Rather than two-factor authentication we could speak of multi-factor authentication, which would include the specific user-payment service provider interaction context. But that is not all.

Stuck with two-factor customer authentication?
The analytical flaw that underlies the SecurePay recommendations is its strong focus on too detailed a part of the business and security process: customer authentication. Of course this is quite an important element of the transaction process, but the overall security of (mobile) retail payments is always achieved by a proper combination of security measures.

Customers, devices, processes and issuers should all be authenticated properly. And any risk control structure does not just rest on authentication but on a wide array of logical and functional controls. These controls may sometimes be labeled: 'fraud detection' but the quality of the risk prevention that they achieve can be just as good as one of the classic factors, that are not in the definition of strong authentication.

It is evident that new authentication measures and security challenges are being used and developed to achieve a level of security in retail payments which is contingent on the risks that are relevant in the user-transaction-device context. We can witness this in the bank, card, Internet and mobile payment domain. As these developments occur, it is unwise to freeze one detailed building block of security measures into a regulatory requirement. This will skew the market into less efficient and more cumbersome customer experiences, while technically not necessarily safeguarding a strong level of security.

In particular the mobile domain allows for a wide array of additional capabilities to achieve the security levels that supervisors desire. It would therefore be wrong to make the low-value threshold of the PSD the dividing line between strong and alternative customer authentication measures. A better approach is to link the degree of authentication to the degree of risks and the further security measures that are in place. This will allow the market to develop solutions that achieve both ease of use to the consumer and the desired level of security.

A more future-proof approach
It is not unlikely that the envisaged inclusion of a detailed requirement on strong customer authentication may distort the current market developments rather than allow for further innovation and market development. A more future-proof approach is desirable.

In my view such an approach would be to allow for a broader 'multi-factor authentication' which includes authentication based on the user-interaction context. In addition it would be good to recognise that the quality of some of the security measures which are often labeled: 'fraud detection' may have become such that they achieve a similar level of security as the traditional authentication factors.

We should also allow alternative authentication mechanisms to be used, dependent on the risk involved, rather than a certain value threshold. It would then be up to the supervisors to make the context-based and risk-based assessments on the whole array of security measures as a part of their supervisor reviews.

This approach should ideally be complemented by excluding todays specific definitions of strong authentication from the wording of the Payment Services Directive and replacing them with a generic reference to the relevant security recommendations.

The result would then be that we will have a clear and flexible security requirements framework in Europe that sets the boundaries within which the market can futher innovate and develop.

Bitcoin legal classification in Germany: much ado about ... ?

These days I noticed an interesting discussion in my Twitter time line and on the web on the fact that the German government has 'recognized' Bitcoins (even as legal tender, as cnbc reported for some time). There were many reports on the matter, outlining that Bitcoin is apparently gaining further acceptance among regulators. But as the reports were a bit confusing I felt it would be good to track the sources.

German MP Schäfflers enquired about tax-treatment for Bitcoins
It turns out that a German MP, Frank Schäfflers, has been asking his Ministry of Finance how the taxation rules applies in situations where people use Bitcoin as an instrument of trade/payment. And later on he asked a follow up question whether or not the use of Bitcoins as a payment mechanism would be exempt from VAT (as is the case with German legal tender). Here is the link to the source documents.

The German Ministry of Finance outlined in its response that:
- commercial transactions where bitcoins are being used for payment, have the tax regime on the basis of the transactions' commercial nature; so the use of bitcoins doesn't disturb the regular taxation rules,
- goverment agencies are still discussing how to tax the value increase of bitcoin holdings over a year,
- bitcoins are not legal tender, nor e-money, but a form of private currency which classify as 'Devisen oder Rechnungseinheiten': under the German supervision law (article 11, sub 7).

The Rechnungseinheiten can be translated as unit of accounts, but the explanation of the German Ministry of Finance is that this definition covers - amongst others- all private currencies or units of accounts which are not based on legal tender. Essentially is a catch-all definition to capture any sort of privately agreed payment mechanism that can be used in multilateral clearing or settlement.

The regulatory logic: classification rather than recognition
While to the observer it may appear that the German regulator is leapfrogging into the modern world by outlining the status of bitcoin, the reality may be less exciting. The German Ministry of Finance merely outlined how, given the existing rules on taxation and payments, bitcoins qualify under their supervision law. This is rather a technical exercise and it can be seen that only for income tax issue (what to do with bitcoin holdings that change in value), they haven't yet got an answer.

So yes, the bitcoin has a legal status, but then again: any new development, instrument or technology already is subject to the law book. The fact that the Ministry has now pinpointed the article of the law book where they think the object fits, may therefore not be so spectacular.

If we look at the Netherlands, a similar situation appears. Anyone is free to determine whether to exchange services by paying for them or by using other forms of payment. . I could buy a bread in exchange for washing a car. And if the bakery would accept bitcoin rather than washing their car, it would work as well. The use of bitcoin can be considered payment in kind. Given this regulatory payment mode, our legal system is already recognising alternative forms of payments.

The same holds for the taxation part. The VAT rules on services do not change if the payment leg of my transaction is different. And the income tax rules don not change either. The Dutch rules state that if you hold something which has value, it must be registered on the tax declaration. In this declaration, the bitcoins in a wallet thus show up as the money in my bank account does.

As for the legal tender part of the discussion: I view that as an overrated concept. While in earlier times, the concept of legal tender meant that the other entity in a transaction had to accept the notes and coins, this obligation has been struck out of our Dutch law book many years ago. But it still lingers in the mind of many people and may of course in some other countries still be more relevant.

Future developments
What I find most interesting about the news is the quick and fast coverage that new forms of payments and regulation get in the media and with the public. We can see that the developments are positioned as the story of the recognition of bitcoin by the regulator or as the coming of age for bitcoin. Regardless of the angle of these reports, it is clear that things are happening and moving in the area of private, digital, distributed currencies. And it will be interesting to see this area develop further.

Bit instant to introduce 'bitcoin'-card...

As you may know I am somewhat sceptic about the underpinnings of Bitcoin (see my previous posts), but the system does keep innovation going. Bit-instant for example is a company that helps consumers convert money into bitcoin and vice-versa. And such services are surely helpful in bringing more reach to the system.

Bit-instant is apparently now planning to bring a debit-card on the market, in two months time, that marries the bitcoin and money world even more. In this article here you can find a link to an IRC chat with Bit-instant, in which it announces its plans. It also provides a link to the picture of the card, showing a QR code that can be used to quickly deposit bitcoins residing in other applications to the card-account.

Now as I understand it, it is a regular worldwide ATM/Payment card. And it looks like it allows bitcoin to be deposited on the card balance. But essentially the bitcoin holder can ask Bit-instant for a conversion of some bitcoins to money and this money will then be deposited on the card balance for payment. By also printing the bitcoin identification on the card the concept very much looks like bitcoin is entering the card-market. And certainly to the user it will feel/look that he can pay with his own minted bitcoins.

In reality this is a very smart introduction of just another card in the market. It's a variation of the regular co-branded card where now we don't see a soccer club, automobile club, but the bitcoin club appearing. Still, it's another innovation worth exploring, so let's see where this card will take us.

The art of Reserve Banking (at the Zuidas Amsterdam)

Reserve Banking is an art. While Draghi and Bernanke are highly qualified and professional economists, they must also master the art of performance. As true actors, they use their voice, their remarks, eyebrows and somewhat vague statements to provide hints and indications that the market then swiftly responds to. It is something you can't learn from the books. It's an art that can only be mastered in practice.

Since this year, the Zuid-As in Amsterdam is also home to the art of reserve banking. But it's a bit different. I heard about it yesterday, when visiting the Holland Financial Centre. From high up in the nearby Symphony building I looked down onto a small rectangular area of the Art Reserve Bank, well fenced, with cameras and three small office buildings. One is the minting press, the other is the teller and the third one was hard to identify. It looked like this:

The Art Reserve Bank: an experiment
What happens there is a unique experiment. A group of artists have set up, without any monetary funding, a so-called Art Reserve Bank. The plan was there for some time, but as the financial crisis came along, it became easier to convince sponsors to join a project that questions the value basis of money. The main idea is that there is far too much money circulating in the world and that the crisis demonstrates that we need a new approach towards money and debt. And in the experiment, art (or: the intrinsic value of human artistic expression) becomes the money. And thus helps to freshen up or minds and stimulate us to re-think our concept of money.

The idea is that for a period of five years, each month 400 coins are minted. These are 4 series of 100 coins per week, costing 100 euro each. For each month: a different artist is asked to design the coins, which all bear the same backside with the motto: ARS PECUNIA MAGISTRA: Art is the teacher of money. A nice motto and also a tongue-in-cheek reference to the Amsterdam Zoo that bears the motto: Natura Artis Magistra (Nature is the teacher of Art).




Anyone can buy coins and thus becomes a member of the Cooperative Art Reserve Bank (Kunstreservebank). All holders of the coin are thus the collective owner of the bank. Of the 100 euro costs, 90 % is used to pay for the operational cost of the experiment and 10 % is withheld as a 'cash reserve'. Should a buyer not appreciate his/her work of art, he can return it to the bank and get the original value back with a 10% interest fee. There is also a dealing room on the site of the bank, for those who wish to buy or sell their coinst. And at the end of the five years, all owners of coins can collectively decide what will happen with accumulated capital (if there is any and if the bank stil exists).

Money, dreams and art
The experiment challenges one to consider: what is happening in our world of money and value?

For me, the Art Reserve Bank made me realize that there may now be so much difference between their coins and the official legal tender in circulation. Both coins are the product of our imagination, dreams and creativity. Which is quite clear for the Art Reserve Bank currency, but may be less clear for the euro. So let me try to explain.

What happened over decades is that we moved from a mentality of: save first, spend later, to a mechanism of: spend first, repay later. If your story about the future would be probable enough (having a job, education etc) some bank would lend you money. And the same thing was true for businesses. Essentially this is a mechanism where tough choices are made. If you don't have the job or a solid story explaining how you can repay in the future, you don't get money. Which all sounds very realistic.

Fact is however, that with hindsight we can now see that banks, consumers and companies have on a large scale lived in dream worlds with expectations of future income, growth that were not realistic after all. Money was created, lent on the basis of these dreams and imagination. And part of that money is now in our pocket. And we also know that some of the debts are definetely not going to be repaid in the future.

So wouldn't it be fair to state that some of our euros are just as much the result of our imagination, as the Art Reserve Bank coins?

Interesting paper on best practices for Payment Regulation

As I browsed through the programme and speakers of the E-MA conference on e-money I noticed that Rhys Bollen would present on regulatory issues. And upon googling I discovered his dissertation on best practices for Payment Regulation. Although I haven't finished reading it yet, I think it's quite a good read that deserves further attention.

Lessons from (Dutch) payment history

Around the year 2000 I was working on both my historical research about the development of payments in the Netherlands and in the payment policy department of the central bank. As a result I started to gain some more insight into the 'unchangeable' dynamics of the payment industry. I summarized these in a presentation that I gave on the First European Financial Cryptography Conference in Edinburgh. You can download the presentation here.

The location in Edinburg was very historic by the way. We were in the library, if I recall correctly, the library of the former parliament of the city. And we were in the hometown of John Law, a famous payment innovator, who was born in Edinburgh and at one point in time wrote: Money and Trade considered (with a Proposal for supplying the Nation with Money). Being asked to provide a key note speech, it seemed appropriate to me to refer to John Law, both in the title of my presentation as in the caveat at the end.

Overlooking many centuries of payment history, my main conclusions were:
1 - Payment techniques travel along with trade,
2 - as did John Law:
3 - The most efficient model is the centralised (giro) model . .
4 - but religion/legal rules determine local specifics of instrument use
5 - Kings and governments always want a piece of the action
6 - Country specific instruments only work with a fair deal of trust
7 - Security must be learnt - the Dutch banknotes
8 - Convertability into ‘real value’ is essential but not essential
9 - Accepted because confidence in the ability to respend it
10 - Any payment is in itself quite uninteresting to the user
11 - The payment product is a hygiene factor
12 - User risk depends on more than technical security
13 - Operating a payment system can be very profitable
14 - Respect existing deeply rooted traumas and successes
15 - Interoperability has never been a major problem for end-user
16 - Reduce the number of messages in payment protocols
17 - Don’t overvalue anonimity
18 - Multifunctionality won’t work with more than 1 organisation
19 - Critical role for government and the large retailers
20 - How to make new payment mechanisms work ?

And while all this took place at the second floor of the library in Edinburgh, his original book, as sent to parliament, was downstairs. What really made my day is that afterwards, when I went down, the librarian was so kind as to allow me to have a look at the original book, Money and Trade, that John Law sent to parliament (despite the fact that the library was officially closed and it was officially her free Saturday)

ING first to announce SEPA strategy for cards/terminals - all brands allowed

Yesterdays Telegraaf contained some interesting news. ING has announced that it will sell POS-terminals and contracts to retailers which accept V-Pay, Maestro and PIN, all for the low price of todays PIN-transaction. Only one condition applies: it should be an EMV compliant terminal.

Well, this is exactly what retailers wished: clarity on future prices and terms and conditions. So one would think that would now be happy.... but are they...?

Well, no of course. The instant that a retailer gets the prices and desires he wants, he assumes that he has insufficiently bargained and that there is more left to bargain for. And he will immediately start negotiating for another round of fee cuts or what have you.

Likewise in the Dutch situation. In their reply to the ING announcement the retailers didn't spend any second complimenting ING on their vision, their fee structure or on fulfilling their previous demand. The next complaint in line is now that they find it intolerable that on the issuing side (which is completely not their concern) the PIN technology is based on magstripe and the other brands on EMV. In their view PIN should move to chip-based PIN as well....

To be continued.... I would say... until banks decide to stop participating in this retailer bargaining game.

van Hove's take on the Commission flawed interchange decision

Amidst all the political noise on the interchange decision of the Commission it is good to also see that some academics still see the whole picture and have the courage to challenge politicians where it hurts. See this article by Leo van Hove and more particularly his closing remark:

So if regulating one payment instrument can have unintended repercussions on substitutes, and a prohibition of interchange fees would be a leap in the dark, what are enlightened policy makers to do? They could simply try to ensure that market forces work, and in particular that merchants cannot be locked in by card networks. To that end, retailers should be allowed to "surcharge" and pass on interchange fees to consumers. Promoting competition among card networks as well as among various payment instruments should also be high on regulators' lists. More generally, we need policy makers who have a comprehensive vision of the future of our payment system -- and who have the political courage to make cash more expensive in order to lower its cost to society.

Single market review forgets better regulation principles

This recent single market review is interesting in many ways. We can see that the Commission is selling Europe to the citizen. And bashing banks is always popular, so we can see that happening now as well. Without awaiting the results of a consultation on a report (that finds no evidence base on the exisence of a switching problem) the Commission wishes switching services to improve. In doing so it jumps to conclusions and forgets it's own better regulation principles.

This is not the best way forward. Let's relook the earlier committments of Commissioner Mccreevy on this matter:
Ladies and Gentleman, this Commission is taking a more variable, more modern approach to regulation. Strict adherence to better regulation principles. Wide consultation. Full impact assessments to ensure that initiatives are fully thought through. Legislation only where clear benefits are apparent.
And let's now proceed to see the real-life case of user mobility in the retail financial services area.

1. In the white paper on financial services, the Commission set up an expert group to discuss user mobility.
2. After one years work, the group concluded that there was no evidence base and no agreement between different stakeholders on the issue: is there a problem or not.
3. Then, the commission sent out a (coloured) consultation on the report, which already had a spin on it; assuming that there was a user mobility problem. But, the positive news still was that the Commission claimed to adhere to better regulation:
In line with Better Regulation principles and as a follow-up to the Group's work, the Commission is opening a public consultation on the Group's report. Stakeholders are invited to comment by 1 September 2007. Comments should also address the impact of the Group's recommendations and suggest any other ways to improve customer mobility in relation to bank accounts.
4. To top it of however, without awaiting the results of the consultation, without doing any impact assessment whatsoever, the single market review heads for a specific direction (asking the industry to do national things on switching services) that should normally be the result of the analysis in the impact assessment.
5. Given that the results of this expert group do not at all come in handy (as it acknowledges the need for a solid evidence base), the work of the expert group is completely left unmentioned.
6. So now the Commission moves ahead, will undoubtedly publish a press release to take things a further step forward ('inviting the industry to come up with national solutions to switching') without due consideration to the real facts and developments in the market.

Interestingly: if the analysis is that switching is not a pan European issue, it's not up to the Commission to act. Similarly, if there is no impact assessment, it's not up to the Commission to do anything else than make one. But then again, the Commission seems to think: a scare tactic always seems to work with banks, so let's see if we can move them in a direction by threatening, even if we put aside our own principles and follow gut-feeling rather than facts and due process.

Unfortunately this fits nicely into an earlier grim picture that I sketched on the true better regulation approach of the Commission. Which essentially was that it is about lipservice more than true service to the citizens of the Community.

Barclays withdraws Offer for ABN AMRO

Well, another story begins to end. See the ABN AMRO Press Release that outlines that Barclays withdraws Offer for ABN AMRO.

The beginning of the end: blocking payments for gambling...

Quite interesting both the US officials (Treasury and Fed) see proposed rule here and the Dutch government seek to stop 'unlawful betting practices' by demanding the banks that execute the payments to block those.

Well, if we go down this road and allow our governments to dictate which payments which customers may send/acccept (and instruct our banks to act accordingly), we may as well make the Treasuries our single national payment institution. This is what in my view will happen.

First the rules will be targeted to situations to which no one can protest: companies that sell child porn. This will get the first round of regulation off the ground.

Then the question will be: can we also stop payments to/from betting companies? Which is not so easy: in the Netherlands all non-Dutch government agreed betting (from abroad) is viewed as illegal. But that is a political judgment call, stemming from the fract that our government earns money from some of those companies that it has provided a betting license with. With a little luck, you also get this second round of rules agreed.

Third, we will see how it's not the national government prescribing to block payments to/from specific companies/customers, but local police officers or DA's. And they'll also be allowed to automatically fine the users that try to make payments to those companies that are considered blacklisted. Because those users are doing something illegal too....

Now, while this last scenario appears politically impossible now, it won't be once we're used to the first two interventions.

It is quite bluntly a disgrace that politicians and policymakers so improperly and so recklessly invade our privacy and dictate our and the banks' behaviour. If the bottom line is that police officials are not sufficiently equipped to catch crooks... fine, provide them with more resources. But don't try short-cutting it with using tools/means that will only end up backfiring at some point in time.

Or as Kant would say it, put yourself in the position of the other and question yourself once again if the proposed ruling is fair to all involved...