Contemplating 75 years of freedom: a dark story on three Dutch lessons never learnt

First of all I must warn all readers. This is not a happy blogpost. It is not funny. It is a dark and sobering tale of lessons that we should have learnt in the Netherlands. A tale about lessons that we never learnt. Lessons that still hold immense value today. Lessons that we owe it to be taken to heart when we reflect on the 75 years of freedom that we will celebrate next week.

From Rotterdam to Amsterdam: records and track records

This post connects two cities that I lived in for the longest time in my life. First of all; Rotterdam, the place of my birth. It was bombed to ashes early on in WorldWar 2. Except for one place: the city hall. Reason being? That's where the population records were. Cunning Germans, as my dad explained to me. 

Next up is Amsterdam, where the Anne Frank house and her statue form the background against which new children grow up in freedom. Where Stolpersteine remind us of those who lived here before us. Where the elder lady with her dog told us what is was like to grow up here. How the Germans were raiding the houses and pushing their bajonets into the ceilings to discover if people were hiding.

Amsterdam is the city of the 'dot-map'. It is the map that the Amsterdam city administration drew up on request of the occupying Germans, that wanted to know: where do the jewish people live?

It sounds like a simple question: an administrative thing, strange request perhaps, but why not just answer it? Let's cooperate collaborate. So the map says: One dot is 10 jews. Take it in and look history in the face.

The particular situation here in the Netherlands (J.H.Blom - source) was that our government had fled and the Germans put their officials in charge of the Dutch civil servants. This is a marked contrast with Denmark, where they let the Germans enter with the military but stayed in office and controlled their bureaucracy.

There is a lot more to read in the study of Blom but one of the very striking elements is the efficient bureaucracy in the Netherlands, in combination with a tendency to cooperate and answer properly to Authority. Whichever the source of Authority.

The very sad fact of the matter is that after the war we could learn that in Western Europe, the Netherlands turned out to be the country where 75% of its Jewish population died, as compared to 40% in Norway and Belgium, 25% in France and almost 0% in Denmark.

If we look history in the ugly eye, this is (literally) a track record that the Dutch must carry as a scar on and in their souls. A fact that obliges us to honour the deceased and make sure that we learnt something. But do we really?

History is distant and can be easily forgotten
This is all maps and statistics from earlier days. If we wish we can look away and forget. So let me warn you as I bring the lesson closer to home. To this end I draw on a pre-Corona visit that I paid to the excellent exposition covering 300 years of insurer Stad Rotterdam. now ASR. During the visit I stopped by and looked at the part on World War II, where I bumped into someone who turned out to have contributed to that part of the exposition.

He is a commited lawyer who until today still tries to resolve the administrative wrongdoings of the past. His story on what he found in archives, on what he did not find, was very sobering. He had seen files where a fanatic anti-semite employee hammered a J multiple times on the insurance policies of Jewish clients. And he explained how the Germans would start out with simple requests with more serious consequences kicking in later.

A typical example of this is the introduction of a generic duty to register and issue personal ID-s. This was formally introduced in October 1940 in the Netherlands and came info effect in April 1941. And then, one year later, all IDs of Jewish people needed to be stamped with a J. So we see bureaucratic evil of the end made possible by fairly innocent baby steps in the beginning.

Administrative witnesses of the insurance sector: during the World War 2
One of the most well known German tricks pulled in World War 2 in Amsterdam was the take over and manipulation of the Lippman Rosenthal brand by setting up a sort of second bank or branch-office with the same name. This second office was effectively German run and a 'robbery-bank' that sold off assets of Jewish clients. This bank plays a sinister role in the documents that I will be publishing here.

It started out with a request that Jewish people declare to their bank that they are Jewish, as via a specific Regulation, the only bank paying out the life insurances would be the Li-Ro-robbery bank. Here's the snapshot of the regulation and the form to be filled in.

Regulation outlining obligatioo to insurers to pay out
their clients only via the Li-Ro robbery bank

And here is the form and letter that people were sent. Please declare yourself to be Jewish.

Form with request to fill in if you are Jewish or not

Now the involved insurers didn't really all like this idea and they figured out: if we don't know for certain if someone is deceased, we can't really transfer all the money to Li-Ro bank. So the exposition shows a bank writing to the Li-Ro bank on this specific issue. 

Now beware of the answer which dates to January 1943.  I will translate it here:

Through the contact that we have with the relevant authorities we have been informed that Jewish people that have been deported by government order will be totally taken out of the society and nothing will be ever possibly heard of them. As a result they are, sort of automatically, also completely annihilated in respect to your administration but we note that, if no further measures are taken, their remaining insurances would continue to exist.

It will be clear to you that the circumstances in which the aforementioned Jewish people find themselves in society - but with respect to you as well - have lead to a situation that is equal to that where an insurance policy ends due to the death of the insured, which means that we need to find a way to bring those insurance to a pay-out.

We invite you, the pay to us the relevant reserves that you have amassed to this end, while deducting a considerable reward for the risks that you have taken.We look forward to your proposal.

Administrative witnesses: after the war
Imagine that you survived this World War 2. And that you want to claim the insurance funds that you are entitled to. And the response being: please can you prove that the person you are referring to is actually dead? Survivors of the war atrocities had to endure long and terrible administrative procedures to restore their rights.

Here is a witness that matters. It is a letter dating from 1950 and it is a declaration by a Red Cross official. It specifies the dates of deportation as well as the names of three survivors who have had to make a personal declaration to the Red Cross. It says that

... it is clear from the declaration of those three people (out of 33.000 deported to Sobibor), who stayed of a longer period in time in the camp, that almost all people that came to Sobibor were almost immediately being suffocated by gas and cremated afterwards. Given that nothing has ever been heard since the conclusion is that the person in question has died on 11-6-1943 of the consequence of suffocation.

No happy ending.... 
There is no happy ending to this story.

Survivors had to fight administrative wars and it took until 1999 before some sort of settlement was made between representatives of the Jewish community and the Dutch Insurance Industry. Part of the settlement is that a Foundation for individual claims SJOA has been set up. And until today the foundation is still actively assisting and doing research to do justice.

Which brings me full square back to my neighbourhood in Amsterdam. There are not just the silent physical reminders of history, the Stolpersteine in the streets. We also find reminders on the web, in this list of holders of insurance premiums. If I type in the names of the streets around me, their names come back to help me remember what happened.

Three lessons to heed...
We, society in general but the Dutch in particular, owe it to all of those who gave their lives during the war, hoping for true freedom, to heed three lessons we appear to have never really learnt:

1- we must better understand the mechanics, the workings of records, administrations and bureaucracies and the ease with which what looks like a legitimate government action can turn into an evil one that starts a persecution on illegitimate grounds,

2- we must remember that it is the atrocities of World War 2 that made us formulate the Human Rights Declaration, which formulates the fundamental rights that protect us,

3- we must cherish and protect our fundamental right to privacy as one of the most important defenses against bureaucracies turning evil.

Zimmermans' relevance for discussions on human rights and ICT-security surveillance

If we look at economic and social risks of new technologies, outsiders will often immediately fall into the trap of considering this to be about the illegal use of peer-2-peer networks, applications such as bitcoin etc, for socially unwanted activities or even criminal activities. From there on it is a small step to forbid such activity, regulate it, overregulate it. But we should take a wider perspective here.

For me, Phil Zimmerman was the person who made a lasting impact, when he explained, somewhere in the late 1990s, during a speech at a digital money conference his considerations behind developing Pretty Good Privacy (see also his explainer himself: Why I Wrote PGP). His argument was mainly that the new digital society has to be built in such a way that it guarantees a situation in which a people are still able to communicate and act in way which is not invaded or controlled by government tools/techniques. Whereas the old analogue world would allow the people smart analogue ways of creating their own spaces for communicating and fooling government with fake analogue id's and such, it would be much harder to do this in a digital world. Hence the need for a peer-2-peer simple mechanism as Pretty Good Privacy.

Zimmerman outlined one very significant theme during his speech. He noted that the assumption of a continuous benevolent government is not realistic. Governments come and go, some may be more democratic than others and even strong democracies may turn into dictatorships, depending on the circumstances. It is therefore important to design society, governments and the technologies that we use to manage society, guarantee that a balance exists between the powers of government and those of the public. The public, the people should always be allowed to remain digitally out of sight of government. Such a robust structure would be important to ensure a fair treatment of the people over a long period of time.

It is clear that this requirement: to allow for and to actually create areas where the government cannot see what happens means that those areas are scary for regulators. Will they facilitate crime by doing so? Perhaps. Will they allow for huge pockets of creativity? Certainly ! But it will be the strong governments that are able to allow this. They will act from a position of strength and not be afraid. The weak governments, or the scary governments, or the ill-intending governments will seek to monitor everything and control all digital activities. This will certainly fail. But while doing so, they may instil tools that are very dangerous tools in the hand of governments when they turn from benevolent to evil. It will tilt the balance towards a situation that ill-intending governments can no longer be overturned by a social revolution.

There is no need for governments to be afraid of technological progress in the hands of the people. It is a good thing, to be cherished and to be allowed. The simple labelling of such activity as possibly criminal is the wrong frame. The reverse is also wrong: regulators with good intentions are not by definition tools in the hands of dictators. The right frame is: dictators exist just as criminals. Society should ensure that neither of these can become too powerful due to technological of legal measures and it is for this reason that we need to balance our human rights to privacy with the goal to prevent criminality.

Finding this balance is not easy but over the last weeks we have witnessed too many occasions where governments seem to go to far. German police wanting access to home devices. The FATF-ruleon surveillance for virtual assets. Ghost accounts into Whatsapp. Giving your social media handles when entering the US. We should not let ourselves be caught in this wrong direction over intrusive government behaviour.

There is a very legitimate reason to develop and create new technologies that safeguard the public and it is a pity that many policy makers in the world may not have been hearing the clear message that Phil Zimmerman sent them. They really could do with open their minds more. So for them I’m embedding this video. Just to be able to learn from history.

FATF and EU need to fundamentally rethink their approach to virtual assets/currencies...

Virtual currencies are on the radar of regulators for quite some time. Yet it is clear that they still struggle with definitions (which always happens when new technologies arise). The FATF is a key example now that they are seeking to harmonise international guidelines for applying FATF-rules to the crypto-world.

In this post I will look at some of the issues at stake and explain why the FATF-exercise requires a lot more time and thinking before the FATF (or EU) move forward. Do note that this is a longread, more geared to specialists in the field, than the general public.

For the public it boils down to this. The US is pushing all countries in the world to a situation where with each virtual or crypto transaction, your information needs to be distributed (by definition) to other players in the value chain.

But as the crypto definitions in countries diverge (and the FATF-definition is ill defined, potentially covering everything in the world), the only sensible thing to do is to stick with the local definitions of crypto-assets and to demand transaction information to be stored locally at the point of transaction. Any law enforcer wishing access to that information should thus approach the relevant local authority for that information.

Apart from this legal argument, we must acknowledge the recent regime changes in the world. It is by no means clear that countries that used to obey the law and follow the rule of law, will do so in the future. Thus, foreign law enforcers may become tools in the hands of local undemocratic rulers.

That is an additional argument that requires the EU (but also the FATF itself) to avoid the situation that a local law enforcer in an undemocratic country can get EU data by harvesting its home companies data for the EU-info, without having an appropriate legal warrant under EU-rules.

And now for the longread part of it...

Definitions: always tough
Back in 2012, the ECB had a hard time grasping the concept of cryptocurrencies. They used the fact whether or not virtual currencies were regulated as their guiding principle:
A virtual currency can be defined as a type of unregulated, digital money, which is issued and usually controlled by its developers, and used and accepted among the members of a specific virtual community.

The US regulator (FINCEN) chose the following approach in 2013:
In contrast to real currency, “virtual” currency is a medium of exchange that operates like a currency in some environments, but does not have all the attributes of real currency. In particular, virtual currency does not have legal tender status in any jurisdiction. This guidance addresses “convertible” virtual currency. This type of virtual currency either has an equivalent value in real currency, or acts as a substitute for real currency. 

FINCEN then applied the money transmitter laws in an extensive way to bring exchanges of virtual currencies into their supervisory remit.

Later on, the ECB changed its definition to:
For the purpose of this report, it is defined as a digital representation of value, not issued by a central bank, credit institution or e-money institution, which in some circumstances can be used as an alternative to money. 
The EU stance remained that cryptocurrencies did not conform with definitions of funds and such in the EU legislation, hence their exchange and use was not regulated as such. Of course the integrity and consumer risks were identified and warned for.

In the FATF-context (2015) we read:
Virtual currency is a digital representation of value that can be digitally traded and functions as (1) a medium of exchange; and/or (2) a unit of account; and/or (3) a store of value, but does not have legal tender status (i.e., when tendered to a creditor, is a valid and legal offer of payment)6 in any jurisdiction. It is not issued nor guaranteed by any jurisdiction, and fulfills the above functions only by agreement within the community of users of the virtual currency. 

While these definitions may seem to work at first sight, we still need some creativity to determine the boundaries of these virtual currencies. Essentially it is possible to bring any loyalty point scheme under these definitions, as they do not use a subject based qualification to determine what exactly virtual currencies are.

At that point in time, where the focus was mostly on payments and such, using the experience we had with e-money definitions, I suggested a framework based on objects of the digital values at hand:

	User cannot buy tokens at all (loyalty-type)	User earns tokens and can buy additional (hybrid of loyalty/payment)	User buys and sells tokens (payment-type)
Tokens used in digital issuer-domain only		World of Warcraft	World of Warcraft Lynden Dollar
Tokens used in digital or physical issuer-domain only	Starbucks	Nintendo Points -Digital Payment loyalty schemes for single retailers
Tokens used at other entities than the issuer	Frequent Flyer Programmes	Frequent Flyer Programmes	Bitcoin, e-money on mobile phone's

I think it would be fair to say that, while we pretend to have solved the application of crypto-legislation to the payment-type currencies, we actually haven't truly done so. There are still classification issues pending, but they may have appeared to be too irrelevant to matter,

Enter: ICO's and token frameworks
The next stage however was the widening of the blockchain concept, the application of crypto to generic tokens and the use of tokens as a form of share, security or other representation of objects, value, cash flows. This leads to a big confusion all around the world whether or not to view some tokens as security tokens, utility tokens and such. So, while our first definition already had flaws, we chose a new wording to cover this brave new world: crypto-assets or virtual assets.

As ESMA noted in their warning on ICO's at the time:
Where ICOs qualify as financial instruments, it is likely that firms involved in ICOs conduct regulated investment activities, in which case they need to comply with the relevant legislation.
So the essential discussion of application of financial law was left to local supervisors interpretations and definition of financial instruments.

The definition-side remained quite weak, with crypto-assets being loosely described as:
Crypto-assets are a type of private asset that depends primarily on cryptography and Distributed Ledger Technology (DLT). There are a wide variety of crypto-assets. Examples of crypto-assets range from so-called cryptocurrencies or virtual currencies, like Bitcoin, to so-called digital tokens issued through Initial Coin Offerings (ICOs). Some crypto-assets have attached profit or governance rights while others provide some consumption value. Still others are meant to be used as a means of exchange. Many have hybrid features. 

ESMA noted then that there were many variations and that it was not necessary to regulate all forms of crypto-assets. In 2019 they published an updated analysis with still a very weak definition of crypto-assets:
Crypto-assets are a type of private asset that depend primarily on cryptography and distributed ledger technology as part of their perceived or inherent value. A wide range of crypto-assets exist, including payment/exchange-type tokens (for example, the so-called virtual currencies (VCs)), investment-type tokens, and tokens applied to access a good or service (so-called ‘utility’ tokens).

In their report they distinguish between payment, investment and utility token, to immediately outline that this distinction does not cover everything. So the definition issue remains as well as the question: which type of digital token falls under which type of regulation. Hence the EU is in need of more EU clarity on the subject.

On the other side of the ocean, the SEC has further fleshed out how to interpret generic financial sector rules to digital asset issuance/use. In a long awaited guidance note the answer ends up being: it depends on the way you structure the functionality of the token/asset and the use between investors and issuer. So depending on those features, it may well be a regular financial instrument and facilitating trading may constitute a regulated business of operating an exchange.

The FATF-approach: hammering financial services law into hardly defined virtual assets
In essence, the idea of the FATF is now to make sure all crypto-related business is covered in a layer of regulation that at the least ensures proper KYC and AML/CTF rules. As such, this can be appreciated and understood as a recognition of the fact that cryptocurrencies and crypto-assets are here to stay. If we bring the sale of high-value items such as diamonds or gold watches under the FATF-KYC/AML remit, it makes sense to also do so for digital goods/assets/cryptocurrencies (whichever legal status they have).

We do have a problem however, which is that the definition used by FATF, since October 2018, is still shaky:
A virtual asset is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations. 

This definition is so wide, that the FATF needs to explain:
The FATF emphasises that virtual assets are distinct from fiat currency (a.k.a. “real currency,” “real money,” or “national currency”), which is the money of a country that is designated as its legal tender.

The further definitions of virtual asset service provider clarify the intent of the FATF-definition: they wish to cover both former virtual currencies and the ICO area and use a very broad definition to describe virtual asset service providers. These are companies that for a business conduct:
i. exchange between virtual assets and fiat currencies; 
ii. exchange between one or more forms of virtual assets; 
iii. transfer of virtual assets; 
iv. safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; 
v. participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset

These definitions are very shaky grounds to use. One particular troublesome issue is that the virtual asset definition has a negative part: it does not cover currencies, securities and other financial assets that are already covered elsewhere in the FATF-recommendations. It is a catch all phrase that brings all loyalty points in the world under the FATF-remit. Now, the FATF will of course outline that that was not their intent, but as soon as you devise a crypto-based loyalty scheme, who is going to decide?

And taking it one step further: if I convert my multilevel marketing scheme into digitally represented agreements on a blockchain, do these new tokens qualify as a contract (not covered) or as their value and virtual assets? And how does this interpretation play out in the US vs the EU legislative context?

I am certain there is a host of applications/use cases where we will find the FATF definitions being not suitable for use. How about CO2-emission rights. World of Warcraft-tools. Shared ownership of my house or my bycicle. I would urge the FATF to do some more thinking in that respect. The negative catch-all in a definition (it is a virtual asset when all other definitions in our recommendations fail) is just not good enough.

I can only commend the FATF on one point however. The positive thing about the definition is that it speaks of representation of value. This implies a monetary or self-invented value/currency. It does not state that it is about the representation of physical assets or objects (such as real estate). Or that value can also be understood to consist of anything in the real world, to which value can be attributed (ie. everything).

Applying FATF-money transmission rules to crypto-assets: technicalities!
Right now the FATF has closed its public consultation on applying the money transmission rules to crypto-assets. They are hammering a payments-network idea onto cryptocurrencies and crypto-assets alike to not just demand identification and transaction monitoring. The idea is to also apply the addition of originator and beneficiary into crypto-transactions:

(b) R.16 – Countries should ensure that originating VASPs obtain and hold required and accurate originator information and required beneficiary information2 on virtual asset transfers, submit the above information to beneficiary VASPs and counterparts (if any), and make it available on request to appropriate authorities. It is not necessary for this information to be attached directly to virtual asset transfers. Countries should ensure that beneficiary VASPs obtain and hold required originator information and required and accurate beneficiary information on virtual asset transfers, and make it available on request to appropriate authorities. Other requirements of R.16 (including monitoring of the availability of information, and taking freezing action and prohibiting transactions with designated persons and entities) apply on the same basis as set out in R.16

Where the approach worked in 2001 in a world where a payment was a payment, funds are funds and wire transfers are wire transfers how can it work in a world where fundamentally the core definition of virtual asset or crypto-asset is as vague as it is in EU and the US?

The whole exercises strikes me as a hasty effort, given that the authors have not noticed that also the interpretative note for Recommendation 16 should be changed to include virtual assets (exempting intra-VASP payments and e-commerce virtual currency payments from the scope). And it is clear that the US is driving the FATF to adopt the above change hastily - and without solid analysis - by June 2019.

To me, there is only one logical conclusion: in the decentralised world of virtual assets, with jurisdictions each applying different boundaries to crypto-stuff, there is no sufficiently harmonised basis to enforce the attachment of data to each transaction. Requiring service providers to hold the info and make it available by request is not a problem, but sending it out as we did with the former FATF7-rules is impossible due to the patchwork of diverging definitions.

In my response to the FATF-consultation I have outlined this problem:

In addition I would like to note that the divergent legal status of virtual assets (considering its wide definition) in different countries may have the consequence that under some local laws the transfer is not financial in nature and will not be covered under the financial legislation and AML/TF frameworks. It is possible that a sufficient legal basis is lacking in some jurisdictions to apply the crossborder wire transfer regime to such non-financial transactions and that data protection regulations take prevalence. This could be solved by applying the domestic wire transfer regime to transfers of virtual assets, regardless of their potential cross-border nature. The further application of this regime on the domestic level can then be geared to the specific legal qualifications for virtual assets in that specific jurisdiction.

My proposal is to follow the most efficiënt way. Strike out the part that says: submit the above information to beneficiary VASPs and counterparts (if any).  It is simply not proportional and economically sensible to demand as the FATF to include privacy-sensitive information in crypto-transactions. Officers can can have access by asking and demonstrating lawfulness of the request via international channels. But the day and age of using local tricks and harvesting local companies for EU-data should be over.

The area of digital assets, virtual assets is so ill-defined that the FATF cannot claim a full competency, as the legal basis in a number of jurisdictions will not be there. We should also keep in mind that the catch all definition - not elsewhere regulated under these FATF-rules - is still written under from the FATF role of being Financial Action Task Force, focusing on financial industry and financial services as the main objective. So if my home country defines certain digital goods as digital goods and not in scope of crypto legislation, that to me would be the end of the remit for the FATF (and it would remain out of scope of the catch-all clause as well).

So much for the technicalities.

Applying FATF-money transmission rules to crypto-assets: geopolitics
We should recognize that we are in a different moment in time than in 2001, when the FATF-7 rules were introduced. At that point in time the US was a beacon for democracy and rule of law. But it isn't any more.

It's role became fuzzy when it turned out that US law enforcers had used US based servers of EU companies (Swift) to get hold of EU-data. And this made the EU sensitive to the protection of its citizens against unwarranted overly ambitious law enforcing in other countries.

We should again be sensitive. The EU, but also the FATF, also have an obligation to protect their citizens from unduly harassment and intrusion by law enforcement authorities. And creating tons of data outside the consent-scope of the citizen does not sound like a good protection at all.

Right now, we can witness around the world, an increase in countries with all kinds of 'strong leaders' that violate human rights agreements, do not obey the rule of law, that are involved in money laundering schemes, do not listen to lawful requests of their constituents and ignore climate agreements.

I think the EU has a duty to not cooperate with implementation of so-called FATF-requirements when it is clear they are increasingly unable to protect the privacy and guarantuee the lawfulness of the data exchange. Requesting other states to go get the data (and ensure that it is proportional) is a better way forward.

In sum: improve definitions and reconsider the worldwide distribution of transaction data for virtual assets/currencies
While I think that FATF should fully reconsider its definitions and redo its homework, this virtual-asset momentum and this train that is being pushed by the US may be rolling too fast to stop it. So as a stop-gap one could propose to eliminat 7b or at least strike out the distribution line:

(b) R.16 – Countries should ensure that originating VASPs obtain and hold required and accurate originator information and required beneficiary information2 on virtual asset transfers, submit the above information to beneficiary VASPs and counterparts (if any), and make it available on request to appropriate authorities. It is not necessary for this information to be attached directly to virtual asset transfers. Countries should ensure that beneficiary VASPs obtain and hold required originator information and required and accurate beneficiary information on virtual asset transfers, and make it available on request to appropriate authorities. Other requirements of R.16 (including monitoring of the availability of information, and taking freezing action and prohibiting transactions with designated persons and entities) apply on the same basis as set out in R.16

The FATF-proposal is disproportional, technically unsound and uneconomic. We'd better store the citizens data locally and ensure distribution on piecemeal basis, based on solid legal grounds, only when there is a true virtual asset under local definitions.

To the EU I ask to protect my reasonable concerns as a private citizen and not implement the proposal that comes out, until it ensures that my data stay local where they are and are not distributed at large to possibly evil states, dubious countries and their law enforcers.

The latter holds particularly true when we can observe that the chair of the FATF, the US Treasury Secretary, is not living up to his national constitutional obligations to comply with the US law himself.


PS. I noted that the interpretative note to recommendation actually also holds an additional new definition, apart from the main text:
1. For the purposes of applying the FATF Recommendations, countries should consider virtual assets as “property,” “proceeds,” “funds”, “funds or other assets,” or other “corresponding value”. Countries should apply the relevant measures under the FATF Recommendations to virtual assets and virtual asset service providers (VASPs).

Now that the voting on the PSD is done, the real work starts...

The second Payments Services Directive, also known as PSD2, will be officially established today. In the plenary session discussion yesterday all political groups backed the achieved consensus and highlighted the benefits to consumers, the increased security of payments, further innovation in the payments area and lower cost overall.

Some work ahead...
We should realize however, that with the promulgation the real work will start for a whole range of involved players. First and foremost, there is a lot more work ahead for regulators and supervisors in the transposition process, but in particular also for the European Banking Authority. The PSD2 that seeks to open up access to banks and customer bank accounts for new players, leaves quite a bit of work to be done by EBA.

EBA should:
- develop rules on level of guarantee/professional indemnity insurance for payment initiation service providers and account information service providers,
- set up standards for cooperation and data exchange between local supervisor and resolve disputes on different applications of the PSD2,
- set up a central register of payment institutions and agents licensed under the directive,
- develop regulatory standards that define when the appointment of a central local contact point can be demanded by local supervisors and what its functions should be,
- be informed immediately in the case of emergency situations (such as large scale fraud),
- coordinate requirements as to the security frameworks applied,
- specify the requirements of common and open standards of communication to be implemented by all account servicing payment service providers that allow for the provision of online payment services,
- develop guidelines on a harmonised set of information to be provided during the application for a payment institution license,
- publish local exemptions under article 3k and 3l in the public register,

Clarity for industry on EU-application of definitions and scope
When the first PSD was delivered, it turned out that quite some players in the market required timely insights as to the future scope of the directive and how it would impact them. The European Commission then published an FAQ that further outlined how definitions should be understood.

It seems to me that it would be worthwhile to perform a similar exercise right now as there are quite some areas that can give rise to questions. As an example: the recital on the agency exemption leaves open the existence of agents for both buyer and supplier as long as the agent does not enter into posession of the funds. Yet, the definition of acquiring appears to be purposefully wide, meaning that such commercial agents might after all be viewed as acquirers.

The sooner this clarity is provided, the better it is, as the lead time for setting up and getting a license as a payment institution is similar to the lead time that now exists for transposing the PSD2.

I therefore hope that, for the sake of a proper EU level playing field, the collective of regulatory players involved in the transposition and application of the PSD2, will seek to address those scoping and definitions issues early-on.

Dutch central bank will strictly supervise banks / payment institutions that deal with virtual currencies (and companies)

Just one hour ago DNB, the Dutch central bank and bank supervisor, issued a warning on bitcoin. It was not the regular warning or disclaimer for consumers, but a warning for the payments industry. Essentially DNB concludes that virtual currencies (bitcoins and altcoins) are viewed as products with a very high risk profile. DNB also announces that it will strictly supervise banks and payment institutions:

DNB will therefore strictly assess the compliance with applicable law (a.o. Wwft and Wft) for those banks and payment institutions that decide to get involved - in whichever way - with virtual currency-companies or that decide to invest in virtual currencies themselves. In 2014, DNB will investigate whether banks and payment institutions are actively involved with new payment products such as virtual currencies and (it) will assess the degree to which these institutions control/manage their integrity risks. The control should include effective measures with respect to client acceptance and the monitoring of new innovative suppliers. 

Guidance considerations
The brief statement of DNB contains some considerations that are the basis for this decision. A first consideration has to do with anonimity. DNB notes that transactions are being recorded in a public transaction ledger. Given that these transactions cannot be matched to physical persons and the virtual currencies are usable as a means of payment, they are an attractive chain of a money laundering process.

The current anonimity in virtual currency systems has consequences for banks and payment institutions. As a result of this anonimity, the buyers and sellers of virtual currencies become indirect relations of the bank. Thise indirect relations can also affect the reputation of the institution which leads to a 'derived' integrity risk. Without having that intention, banks and payment institutions could be facilitating money laundering.
DNB doubts whether banks and payment institutions are able - as a part of their controlled business operations and integrity of policies - to take the appropriate measures for transactions or clients that involve virtual currencies.

A meteorite or a pebble in the virtual currency pond ?
With the statement being just published it is too early to tell whether this is a meteorite that effectively wipes out the virtual currency business in the Netherlands or whether it is merely a pebble that aims to ensure that all virtual currency businesses doing business in the Netherlands ensure full identification and transaction monitoring.

My best guess is that the strong wording is used to stress the urgency and degree of concern that the Dutch bank supervisor has on this matter. So anyone operating in the Dutch environment better take this to heart.

FCA kicks the Securepay-can down the road...

In March 2014, the FCA, the prudential supervisor for UK based payment institutions and e-money providers, outlined that it would not be strictly assessing the compliance with the Securepay Recommendations on the security of Internet Payments. This announcement was quite interesting as in February 2014, the Forum also published an assessment guide that assists payment service providers with the implementation of these Recommendations by February 2015.

FCA Statement:
We have decided to await the publication of guidance from the European Banking Authority on measures for the security of internet payments and will begin to assess firms’ implementation of these security measures when the updated Payment Services Directive requirements take effect.

The updated Payment Service Directive will enter into effect at the earliest by mid 2016. It will assign the European Banking Authority with the task of further developing guidance for the security of retail payments. The FCA has chosen to wait for this guidance rather than pre-empt it.

Kicking the security-can down the road
It is interesting to note that the FCA seeks a pragmatic middle ground. It carefully states that it finds security an important issue while at the same time outlining that it will wait for a solid legal basis to assess the security of retail payments. In doing so it effectively kicks the tricky security can down the road.

I can well understand the FCA desire to kick this can. The Securepay recommendations on security lead to quite some questions in their practical application for different technologies (see the blog here). On top of that, the detailed prescriptions on the basis of the new Payment Services Directive may lead to further rules that limit the choices that market entities can make to achieve a certain level of security.

Rather than confuse the market with layering requirements which quickly follow each other, the FCA apparently chose to wait and see, hoping that the final rules on security for retail payments may become more balanced.

It will be interesting to see if other supervisors follow suit.

Towards a more flexible approach of authentication

In July last year, the European Commission published a proposalfor a revised Payment Services Directive (PSD). The proposal draws on the work of the SecuRePay forum of supervisors and requires ‘strong customer authentication’ when a payer initiates an electronic payment transaction.

Strong authentication
Strong authentication is defined as a procedure for the validation of the identification of a natural or legal person based on two or more elements categorized as knowledge, possession and inherence. These elements are independent, in that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

The concept of strong authentication is in itself nothing new. What is new however, is its appearance as a detailed regulatory requirement. So far, both the Payment Services Directive and the Electronic Money Directive contained a more generic requirement for licensed operators to demonstrate that their governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate. This allows for a system wide supervisory review of risks and security measures.

The current approach in both the envisaged PSD and Recommendations of the supervisors in Europe is however to take out and stress one element of the risk/security puzzle. This approach may turn out to be counterproductive and be an impediment to achieve retail payments that are as secure, efficient and as frictionless as possible.

Different market approaches to customer authentication
Traditionally the banking sector and card schemes have played a major role in the payments industry. For a long time they acted as the main channel through which new technological developments were introduced. In this process, strong authentication in a range of countries became a standard for use in payments. Further security measures for use in transactions over the Internet were then being developed as an add-on to the basic design.

More recently, Electronic Money Institutions (EMIs) and Payment Service Providers (PSPs) have entered the payments value chain using the Internet as their basic transaction processing initiation channel. As a result, their approach to payment security tends to be based on a variety of methods, to be able to counter a range of attacks associated with this inherently unsafe environment. PSPs have had to move very quickly up the e-payment security learning curve and found out that they must remain vigilant with respect to new threats. PSPs are consistently using additional information (geo-location information, IP address matching, IP address pattern detection, industry blacklists, comparison against a customer’s existing “profile” etc.) to validate the interaction with a user.

There is still much to gain by combining the expertise of both the “classic” and more recently-established providers of payment services. Customers will be using all kinds of devices as a service entry point; this requires a flexible approach to authentication. Rather than two-factor authentication we could speak of multi-factor authentication, which would include the specific user-payment service provider interaction context. But that is not all.

Stuck with two-factor customer authentication?
The analytical flaw that underlies the SecurePay recommendations is its strong focus on too detailed a part of the business and security process: customer authentication. Of course this is quite an important element of the transaction process, but the overall security of (mobile) retail payments is always achieved by a proper combination of security measures.

Customers, devices, processes and issuers should all be authenticated properly. And any risk control structure does not just rest on authentication but on a wide array of logical and functional controls. These controls may sometimes be labeled: 'fraud detection' but the quality of the risk prevention that they achieve can be just as good as one of the classic factors, that are not in the definition of strong authentication.

It is evident that new authentication measures and security challenges are being used and developed to achieve a level of security in retail payments which is contingent on the risks that are relevant in the user-transaction-device context. We can witness this in the bank, card, Internet and mobile payment domain. As these developments occur, it is unwise to freeze one detailed building block of security measures into a regulatory requirement. This will skew the market into less efficient and more cumbersome customer experiences, while technically not necessarily safeguarding a strong level of security.

In particular the mobile domain allows for a wide array of additional capabilities to achieve the security levels that supervisors desire. It would therefore be wrong to make the low-value threshold of the PSD the dividing line between strong and alternative customer authentication measures. A better approach is to link the degree of authentication to the degree of risks and the further security measures that are in place. This will allow the market to develop solutions that achieve both ease of use to the consumer and the desired level of security.

A more future-proof approach
It is not unlikely that the envisaged inclusion of a detailed requirement on strong customer authentication may distort the current market developments rather than allow for further innovation and market development. A more future-proof approach is desirable.

In my view such an approach would be to allow for a broader 'multi-factor authentication' which includes authentication based on the user-interaction context. In addition it would be good to recognise that the quality of some of the security measures which are often labeled: 'fraud detection' may have become such that they achieve a similar level of security as the traditional authentication factors.

We should also allow alternative authentication mechanisms to be used, dependent on the risk involved, rather than a certain value threshold. It would then be up to the supervisors to make the context-based and risk-based assessments on the whole array of security measures as a part of their supervisor reviews.

This approach should ideally be complemented by excluding todays specific definitions of strong authentication from the wording of the Payment Services Directive and replacing them with a generic reference to the relevant security recommendations.

The result would then be that we will have a clear and flexible security requirements framework in Europe that sets the boundaries within which the market can futher innovate and develop.

Outsider ideas in the payment space.... seldom really new..

One week ago Rabobank Nederland announced that it might de-activate the possibility to use their debit-card outside Europe, in an effort to eliminate fraud. And today the Financieele Dagblad has an article in which it becomes clear that an entrepreneur claims that this is actually his idea and not Rabo.

He's written the idea of functional/geographic application controls (including de-activation for certain geography) down as his idea, sent it to the Rabobank. And some time later he even spoke with Rabobank. And now that he discovers that Rabobank will in practice block geographic use, he claims that Rabobank has stolen his idea. It appears that he's in full swing with preparation of a court case.

I think this court case may not be effective. Application and functional controls in the payment area are around since ages. There can be checks and limits on payments via certain channel, with certain amounts, to or from a geographic area, number of times of use, branche-codes and what have you. And we have seen these developing over the years. In a planned talk on this issue in 2004 I already mentioned the user control of these application controls.

In this particular case (blocking a geographic area for card use), it was clear ten years ago that there would come a time that EMV-debit-cards would be blocked for use in countries that hadn't fully migrated to EMV. And that the amount of fraud would essentially determine the timing.

Now I do understand the serendipity-element in this story. It must be frustrating for an outsider to think that he has found the golden idea in payments and observe one bank (that he spoke to) introducing 'his' idea. However, this was certainly not a unique idea, but an inevitable, already foreseen consequence of technology migration and fraud.

Digital Money Forum 2012... 15th anniversary and lively as ever

The Digital Money Forum is an event that this year reached it's 15th anniversary. And a special event it is. My previous visit to the Forum was probably some ten years ago, when everyone was pretty much into the e-money way of life. But technology, money and society continue to develop and that's where Dave Birch and his team of Consult Hyperion come in. In setting up the forum they provide for a lively and thought-provoking event where money is dealth with from all different angles. And as before, it was a pleasure to participate.

So this years event was special in many ways. We all got a better look at the evolving phone payment landscape, delved into possible future scenario's for the world and money, we spoke about the future and death of cash, about social inclusion and lots, lots more. And, quite fascinating, I got to issue my own currency, PunkMoney, via Twitter, by promising the developer, Eli Gothill, two beers and a financial history tour in Amsterdam.

A bit more on the principles of Punkmoney (as I understand them). If we look at money it is an invention to facilitate transactions in society. But before the official money we had mutual obligations and trust relations in society. I would help my neighbours out with building their house, assuming they would do the same for me, in time. And so on. So there was this web of mutual obligations and promises that cemented the relations in society.

Now what Punkmoney does is to leave all the monetary issues and digital money aside and elegantly replicate this web of promises. With some rules as how to form proper messages, Twitter as the carrier and a software enige that scans twitter for any promises of Punkmoney. And when it finds one, it registers it and there you have it. Not the real money, but something even better: real promises. Just as trustworthy as... yourself.

After Punkmoney, we moved on to another kind of money. Monopoly money, sitting on a Samsung phone (with an application neatly developed by Easan).

Six teams on six tables started playing and as for me personally, I was literally quite lucky. I landed on 3 airports in the beginning of the game, won some lotteries and eventually turned into a big shot property owner. I turned out to be the winner of the competition, with an awesome price: this incredibly beautiful banknote (an official German forgery of a UK 20 pound note; part of the Bernhard operation):

Some more on that will follow on my financial history blog later.

Costs of fraud by phishing at banks doubles in 2011

The Dutch Bankers Association today starts a campaign to increase awareness of consumers that they shouldn't fall for the numerous phishing mails that flood their inbox. The reason is the fraudnumbers in banking. After the first half year of 2011, the fraud by onlinebanking had already succeeded that fraud over 2010 (9 million euro). And similarly, the number of phishing incidents in this first half year amounted to 2418 while over the whole year 2010 this number was 1383.

The NVB has also renewed the website VeiligBankieren.NL; a website that I personally helped come into existence in 2005, as it was clear that awareness on the risks of e-banking required timely communication. This still is the case and thus the campaign/trailer below was developed. It will air extensively the coming days. The commercial shows the physical equivalent of phishing and warns consumers not to open fake-mail from their bank.

Fed issues rules to debit card interchange...

After a lot of thinking, the FED issued its rules for debit card interchange. Essentially they've outlined the borders beteen which the outcome in the market is acceptable. And it's a smart solution for a tricky debate, because at some point it looked as if the FED didn't really knew what they were up to.

An interesting element is that 3 party networks are excluded from the regulation (which is legally inevitable). And that a sort of competition appears to be forced upon the issuer. In any case, the markets reaction in terms of increasing share price was quite clear. Although it might also have been the short-squeeze in US treasuries that did the trick.

And another nice example of attempted internet-fraud....

It's not always nice to be subject to Internet fraud. Last weekend I heard about a couple that had their hotmail account hacked. And I asked for the example at hand. The result was that suddenly, their friends and family got the e-mail below. Which evidently was a scam (asking for a quick money transfer) but still got some of their friends fooled.

So for prevention purposes I thought I better put the e-mail on the web. So be warned, don't fall for this !!


I am sorry i did not inform you about my trip and I do hope that you receive this email in good health. I am presently in Great Britain,London to be with my ill Cousin. She's suffering from a critical uterine fibroid and must undergo a hysterectomy surgery to save her life . I am deeply sorry for not writing in our usual language or calling you before leaving, the news of her illness arrived to me as an emergency and that she needs family support to keep her going, I hope you understand my plight and pardon me..

Hysterectomy surgery is very expensive here, so I want to transfer her back home to have the surgery implemented there am wondering if you can be of any assistance to me with her hospital bills including ticket fees, I need about €2,300(euro)) to make the necessary arrangement; I traveled with little money due to the short time I had to prepare for this trip and never expected things to be the way it is right now. I'll surely pay you back once I get back home, I need to get her home urgently because she is going through a lot of pain at the moment and the doctor have advised that it necessary that the tumor is operated soon to avoid anything from going wrong,she is currently taking care of at the Intensive care unit of the hospital and currently I am with her in there and i am restricted to make or receive any calls due to the patients in there but i have access to the Internet.

I would appreciate anything you can do to help me,i promise to repay the money back to you as soon as I get back home safely with my cousin. Please if you have a western union office around you send the money to my name and address below, i know this is not in your budget now but i promise to refund the money to you as soon as i get back home and have access to my account.

Name: Anon. Ymus
Address: 70 Margaret Street
London W1W 8TF
Great Britain

I await your mail as soon as possible so that i can be able to receive the money today, Please let me know any information given to you after sending the money or preferably scan the receipt of the western union money transfer so that it will be safer for me to receive.

Please I await your early reply
groet XYZ (wife of ANON. YMUS)

Bitcoin.... dubious payment mechanism

Every now and then, Bitcoin keeps on popping up in posts (including mine). At first I only looked at the technical bit, but I've come to understand that essentially the amount of coins issued in the system will be fixed. Furthermore, in terms of governance, there is little known about the developer and designer.

So that leaves us with a payment instrument with:
- security by obscurity, both in technical and governance terms,
- uncertainty as to legal rules/jurisdiction applied,
- a limited amount of coins to be issued.
And let me be clear. All of the above mean that it is unfit for use and essentially only an activity that may somehow benefit or amuse the owner.

So, we can be brief about what it is. If presented as a solid payment mechanism, we must officially consider it a mere scam, designed to fool some subcultures in this world to believe that there may be something as a free unregulated worldwide anarchistic form of money that can work. History shows that while some of these systems may work for a while, they will never work for similar time periods as regular currencies do, and the reason for that is the lack of governance, security and legal underpinning.

To illustrate this in a simple way. Bitcoin has a fixed amount of coins. Now imagine a country with a limited amount of money available. This country cannot sustain the use of a limited amount of coins to pay for ever increasing trade and a growing economy. Unless it has a central bank monitoring the amount of money in circulation in relation to economic growth. But Bitcoin doesn't come with a central bank, so the coins will continue to increase in value until they become unpayable. As such it has all the characteristics of a ponzi-scheme. Which means: the last owners of IUOs will pay for those that have exited early.

[Update June 13, 2011: I've come to understand that in technical terms the scheme is open and transparant, yet I'm still struggling with the monetary and governance side of it. And it does take more than pure trust in technicalities to get a payment system to survive.]

Lessons from (Dutch) payment history

Around the year 2000 I was working on both my historical research about the development of payments in the Netherlands and in the payment policy department of the central bank. As a result I started to gain some more insight into the 'unchangeable' dynamics of the payment industry. I summarized these in a presentation that I gave on the First European Financial Cryptography Conference in Edinburgh. You can download the presentation here.

The location in Edinburg was very historic by the way. We were in the library, if I recall correctly, the library of the former parliament of the city. And we were in the hometown of John Law, a famous payment innovator, who was born in Edinburgh and at one point in time wrote: Money and Trade considered (with a Proposal for supplying the Nation with Money). Being asked to provide a key note speech, it seemed appropriate to me to refer to John Law, both in the title of my presentation as in the caveat at the end.

Overlooking many centuries of payment history, my main conclusions were:
1 - Payment techniques travel along with trade,
2 - as did John Law:
3 - The most efficient model is the centralised (giro) model . .
4 - but religion/legal rules determine local specifics of instrument use
5 - Kings and governments always want a piece of the action
6 - Country specific instruments only work with a fair deal of trust
7 - Security must be learnt - the Dutch banknotes
8 - Convertability into ‘real value’ is essential but not essential
9 - Accepted because confidence in the ability to respend it
10 - Any payment is in itself quite uninteresting to the user
11 - The payment product is a hygiene factor
12 - User risk depends on more than technical security
13 - Operating a payment system can be very profitable
14 - Respect existing deeply rooted traumas and successes
15 - Interoperability has never been a major problem for end-user
16 - Reduce the number of messages in payment protocols
17 - Don’t overvalue anonimity
18 - Multifunctionality won’t work with more than 1 organisation
19 - Critical role for government and the large retailers
20 - How to make new payment mechanisms work ?

And while all this took place at the second floor of the library in Edinburgh, his original book, as sent to parliament, was downstairs. What really made my day is that afterwards, when I went down, the librarian was so kind as to allow me to have a look at the original book, Money and Trade, that John Law sent to parliament (despite the fact that the library was officially closed and it was officially her free Saturday)

Serious trouble for Rabo with DDOS attack

Yesterday was the day that Rabobank was attacked by a DDOS. It took them more than a day to solve it, and they still warn the public that there may be hickups. As far as I recall, this is the most serious DDOS that we've encountered in the Netherlands. Earlier this year, the banks informed us that in 2010 the direct financial damage of attacks on e-banking in the Netherlands (trojan horses etc0 amounted to 10 million euro (five times more than the 2 million in 2009). So banks and police will remain alert and govcert will be glad that it could be of use to the banks.

Ocassional error with pre-paid card: prisoner withdraws half a million euro

Funny story on nu.nl today. A prisoner who received a pre-paid debit card (ensuring that he would never witdhraw more oney than on his account) was accidentally provided with a card without a spending limit. So over time he kept on withdrawing up until a total of almost half a million euro..

History (of e-money) repeats itself... central bank alert on crowd-funding.... and (still) missing the real issues in the market..

One of the major challenges for central banks and supervisors is to appreciate new technologies and to decide their policy stance on the subject matter. Currently we are witnessing a case of 'history repeats itself' here in the Netherlands, as the central bank, DNB, has informed the public that it will look out for instances of crowd-sourcing. They mean the situation that a group of people pre-pays the production of a book (tenpages.com), film or anything else. And suggest that this is the equiuvalent of attracting deposits (a bank activity), which therefore warrants a closer look by the supervisor.

I dare to disagree and would suggest DNB to reflect on their policy stance and take a closer look in the mirror and in their own recent history (of electronic money). When the first instances of e-money occured (on chipcards: Mondex and in software: e-cash), central banks were keen to quickly state that this was needed to be subject to bank supervision. This resulted in a clash between supervisors and European Commission (that wanted to stimulate competition and that viewed the vision of supervisors as protective). With the Electronic Money directive as the result, that outlined that issuers of e-money (regardless of technology) needed to be subject to supervision.

Since then, we have seen a number of initiatives with respect to e-money, varying from Paypal (now a bank) to Wally, global payways and what have you. Here in the Netherlands (just as in the UK) a separate organisation was set up to represent those issuers of e-money: http://www.11a2.nl. And whoever takes the time to read through their website will find out that the central bank itself was inconsistent in their supervisory approach. In principle, anyone issuing electronic money, was to be subject to bank supervision. So that would also apply to the digital funds, used for mobile phones and digital mobile services. Yet, in response to the lobby of mobile operators, DNB (and later even the European Commission) created an unequality in the market by saying... e-money should be supervised, unless it's e-money for mobile operators. And some more years down the road, they also used tiny holes in the E-money directive to not supervise the Dutch public transport company Translink, with all the requirements of the e-money directive.

Let's review the developments and arguments once again. The main issue here is: who's paying for what? Is the transaction that I am doing a prepayment for a specific good, or is it the purchase of a digital amount of money (or coins, or beenz or what have you) with which I can purchase a wider variety of goods, even goods from someone else than the person to whom I made the prepayment. In the case of crowd-sourcing on tenpages.com, it is clear that the customer does not prepay for any book, but for a specific book. So to call this deposit taking would be silly and no banking laws should apply. Yet, the central bank/supervisor seriously wants to delve into this issue, by going for crowd-sourcing.

Now let's take a look at the situation that I purchase a digital fund: to use on the mobile phone or in public transport. It looks to me that this is so close to money, that you would want the supervisor to take a good look at it. And since 2000, there have been numerous incidents in the Netherlands with a whole range of providers and users of these digital tokens. Over and again, the mobile operators have developed codes of conduct, rules, call centre's and what have you, to make sure that the unasked  provision of paid sms's (reverse billing) would not lead to phone users who suddenly see their phone-money disappear. While the level of annoyance has changed over time, the essential bottom line is that if treated as regular payment mechanisms under the current European Payment Legislation (Payment Services Directive) these services could not exist in this form any more. And a similar thing holds true for the transport company translink. They made a technical system in which the security is insufficiently guaranteed and money is deducted too easily from consumer accounts and cards. So there is actually a real case for concern by the central bank/supervisor. Yet, the supervisor sticks to the old adagium that these do not fall within the definitions and are thus not subject to supervision.

If we further evaluate the role of De Nederlandsche Bank, as a supervisor, we can see they failed big time over the last years, as they didn't succeed in properly monitoring DSB Bank, De Hoop and Icesave (all banks failed). For that reason, parliament has been digging into the topic and the Ministry of Finance and DNB have promised it will organise a change in culture, a change in approach. At the core of this change, we should expect a more self-critical approach in which policy stances are not developed in line with the managerial group-think or in response to lobbying by important stakeholders in the market, but as a result of an assessment of what is at stake essentially; trust in payment systems and any entity providing payments or banking services to the public.

While DNB tries to convince the public over and again that times have now changed and they have reinvented themselves with a new organisational culture, their unchanged policy stance on e-money issuers demonstrates that this is far from true. And although none of the exempted e-money issuers have caused a failure, big enough to worry parliament and society, one might view the current troubles at the OV-chipkaart company, as another demonstration of the failure of the current (failing) supervisory approach by DNB. It is stunning to see that DNB seeks to further investigate legally irrelevant crumbs of crowd-sourcing while missing the leaking boat of OV-Chipkaart/Translink company that is in everyones face nowadays and while ignoring the undermining spinoff that is created by phone companies that handle money (and customer complaints) with a different quality level than justified.

So this leaves us with a public opinion, parliament and Ministry of Finance believing things are now proceeding nicely and on track with DNB as a re-invented, more focused and less obedient supervisor, with the evidence of the opposite being ignored. It is interesting to see when this will further evolve. My guess is that eventually we will see a white washing scam where an actual terrorist attack appears to have been funded by money which has been transferred by mobile phone services (using anonymous top-up cards in country A to demand empty 'premium services' from country B). Yet, by that time, there will be no one around who is politically relevant today, so that means our future politicians can then blame the former politicians, ministries of finance, and supervisors.

And the world keeps on spinning.

Dutch contactless chip (OV Chipkaart) in trouble

Hello there again.

As you can see from the dates on the blog. I have been out for a while, taking a good number of sabattical years off and enjoying myself with other stuff than payments. But developments here in the Netherlands remain entertaining enough to take up some blogging. No too much, because I shouldn't overdo it.

Hottest news here in the Netherlands is that last week the OV-Chipkaart once again became the subject of media attraction as a tv program explained how to crack the card. A free program to increase the credit on the card became available and known through Geenstijl. And contactless card readers got sold out, even via the Internet.

So discussions in parliament and media once again occured and the province of Zuid-Holland decided to not completely migrate to the OV-Chipkaart but allow the old Strippenkaart to be used. And the Dutch Parliament did not wish to discard the whole project yet. Still, we should note that this is all not really new: already since 2008 the dutch newspaper Trouw decided to open a separate corner in their website for the 'Drama' of the OV-chipkaart.

Translink systems formally claim they can handle the frauds and point to the fact that also bank cards are prone to attack/fraud (forgetting to mention the differences in financial and technical impact). So thay play it all down. But we keep on discovering unintended or hidden consequences. For example: the sigar/tobacco shops that used to sell the strippenkaart found out sme serious financial impact of decreased visitors to their shops. And the new OV-chipkaart loading machines that some install in their shops, don't give as much kick-back as the strippenkaart.

Now, this is quite a nice time to have a renewed look at the cost benefit analysis of the OV-chipcard. Effectively the business case gets a bit worse, because there will not remain a lot left of the 'income' made by the reduction of fraud or 'grey' travel (possible with the Strippenkaart and assumed to be non-existent with the OV-chip). This is calculated as a benefit of between 380-500 million euro. Also the re-use of OV-chipkaart in other applications would give benefits of 100 million euro. So we'll be seeing a slow meltdown of the business case of the OV-chipkaart.

So while the business case is slowly fading into the sea, what in the end may make or break the card is the consumer-side of things. For example, right now, the handling of consumer complaints in case of forgetting to check-out, is near to disastrous. So there is not much of a warm feeling with the Dutch citizens with respect to this card. Also, in practical terms, the card doesn't completely do what its predecessor can. Try taking a group of people (of a school class of 14) to the ZOO and you'll discover the hassle soon enough.

It's a matter of time before we'll move on to the next generation or next system. And with this experience of a non-bank issuer/provider of payments means, perhaps the public will now more appreciate the quality of service that they are used to from their bank-issuer provided system.

Hey fool ! Don't become a money mule: unique prevention campaign of Dutch banks

The Netherlans Bankers' Association has today launched a unique prevention campaign to alert the public not to become a money mule in the hands of criminals. In a viral-style campaign 3 films are visible on a website that mocks the easy-money style job offerings a that are all around on the web (become our money transfer agent and earn 10% commission).

Most certainly for banks this is a highly unusal and innovative approach, executed in close collaboration with the national police authorities and the Ministry of Justice. The main goal: prevention and increasing the awareness with the public that becoming a money mule will damage your financial career.

The pay-off: hey fool, don't become a money mule .... should work in other countries as well...

Skimmers detected this morning

Nice article in newspaper: attentive customers discovered skimming device on an ING ATM. See also the two foto's:
foto 1
foto 2