Where and how to look for innovation in payments ?

This week I had the pleasure of joining a panel on retail payments innovation as a part of a seminar by van Doorne and Innopay on the Payment Services Directive and the future changes for the payment industry. Panel chair Gijs Boudewijn challenged me to formulate some thoughts on the future direction of retail payments. I answered that the best place to look would be in places and via perspectives that we could be overlooking right now.

1. Is it access to the account or a traceable id that matters?
There is a lot of discussion on the text of the second Payment Services Directive and on the legal and technical mechanisms that are required to make access to the account work. Due to their origin, these discussions are quite bank centric and the implementation issues surrounding this topic will drain a lot of resources of many players involved.

While being busy with this PSD2 issue, we may overlook the fact that all one really needs is a simple chip-id. In the Netherlands for example, one could use the chip-id of public transport ticket issuer TLS as a basis for use in hip and new proprietary retailer/consumer applications. These would combine the chip-id with an intelligent voucher/billing/customer system that utilises SEPA-direct debits in the back-end. It would provide a smooth customer and retailer experience while the bank only sees regular transactions.

My proposition here is that if we're all looking towards access to the account as the hot spot for innovation, we may be looking in the wrong direction. It might be more about the traceable id.

2. The retailers have landed in an interesting position
In his tomorrows transactions blog Dave Birch referred to an analysis by Peter Jones from PSE on the impact of the interchange fee regulation, published in the Journal for Payments Strategy and Systems. The main conclusion of it was that financially the retailers are the winners by getting a cap on their fees. I agree with that and would be inclined to broaden this perspective.

By tradition banks were the players with the monopoly on payments technology and security knowledge. Even in the 1980s, the collective of retailers in the Netherlands had done a feasibility study to set up their own Point of Sale system. This showed they could set it up for € 5 million euro but they didn't want to take the risk of it failing. So they left it to the banks (to complain about high fees later).

Since that time, the knowledge on processing and payments has become available to a wide range of players, to the extend that banks are now lagging in expertise and capability (while being locked into old technology solutions). The consequence is that retailers will be well able to develop or use in-house apps, customer relation services and payment mechanisms that use the bank infrastructure, without being subject to the rules of the Payment Services Directive.

The main development is therefore that the obliged intermediary role of banks in providing payment mechanisms is gone and will erode. Retailers can regain their customer relationship by themselves or in cooperation with any other ICT-provider that allows them to identify the customer and provide a processing infrastructure. Some interesting innovations can therefore be expected at the outer boundaries of the PSD, as a consequence of the possible exemptions.

I expect both physical and e-retailers to use the non-bank, non-payment space that the PSD defines to achieve exactly what they're after: increased customer retention, increased conversion and a smooth payment experience. Bottom line: we might better be looking outside of the PSD to see innovation in action.

3. On ledgers and tokens
As a final thought I would encourage everyone to try a different mindset for the developments that we are witnessing. Because in essence, anything that happens (in payments/retail) boils down to either tokens (coins, notes, points) or ledgers (private or public). Now let's see what happens if we apply this framework.

We might then appreciate the bitcoin emergence as an innovation in the area of collective ledger provision with distributed trust. We could reposition Linked-In as a privately owned, open and self-administered ledger, that logs individuals achievements that are relevant in the work domain. The same would hold for Facebook and many other e-commerce companies. We would call banks the keepers of the trusted and well protected financial ledgers and would also note that in the public domain, a whole range of ledgers are being interconnected for the sake of security, anti-fraud measures etc.

We could also look at the world of tokens, in its many variations. Tokens of shopping behaviour (saving points), tokens of access (tickets), tokens from government (coins and banknotes), tokens of appreciations (awards, prizes) and tokens that prove identity or personal characteristics. Some of those tokens might be valuable and lead to a change of some of the ledgers, while others would have a role in their own right (voucher for a free coffee).

While it is clear that there are quite a few interesting new developments in the ledger-space, could it be that it is the token-domain where the true action is going to be ?

Payments as an afterthought
In sum: the non-bank, identity-based, non-regulated commercial domain might well be the area where we can see innovations that show us how today's technology can be made to work best so that payments become the afterthought that they are.

Lawsuit in the Netherlands on Bitcoin as 'money' or 'current money'

Since May this year, there is an interesting discussion here in the Netherlands on the legal status of Bitcoin as money.

First law suit on failed bitcoin delivery 
The discussion starts with a law suit of two people engaged in a bitcoin transaction. Party B failed to pay up the whole amount of bitcoins, although it had received all the money for it. Party A, after two weeks partially annulled the agreement (for the part of the bitcoins not delivered). However, this party later on decided to demand to be compensated for the financial loss that resulted due to the increase in price of bitcoins over the course of the year (after the moment of canceling the contract).

Party A based its reasoning on the fact that our law allows for something as 'current money' to be used in order to pay a sum of money. This terminology was explicitly chosen by our legislator (instead of the legal tender concept) to allow non-State forms of money to be condoned in our country in situations where it was commonly used and accepted by all the people.

Should this argument succeed and bitcoins be considered such 'current money' the consequence could have been that an additional compensation claim could be made under our civil law. The judge however outlined that Party A should be compensated for the price rise of Bitcoin between the moment of concluding the contract and of canceling it (some € 1700). No compensation was due however for the remainder of the time, as it was party A that had initiated the canceling of the contract.

In addition the judge outlined that Bitcoins cannot be considered current money that is condoned by the State. Our Ministry of Finance has outlined that it doesn't fit the definition of legal tender, nor that of electronic money and that it should be considered a means of exchange. The nature of bitcoin (tradeable) doesn't work as an argument as also silver and gold are tradeable but not considered to be current money.

New law suit on status of bitcoin as money
A number of players in the Dutch Bitcoin community have chosen to challenge the above verdict of the judge and has raised more than  € 15.000 to pay for expenses of a law suit. It challenges the first verdict in order to have the judge reconsider its position and outline that Bitcoin is money. As a consequence it feels that it must then also be treated as such by our administrative bodies, supervisors, tax authorities etc. This would mean that bitcoin operators could be payment institutions, supervised and exempt from VAT (which, as I understand, are the underlying goals).

While I am very sympathetic to the concept of challenging a status quo and laws, I fail to see how a verdict on civil contract law could spill over into:
- the definitions of payments, money and payment institutions under the Payment Services Directive (and Dutch law),
- the definitions of payments under the Sixth Tax Directive.

Having said that, it will surely be very interesting to see which approach will be taken by the law firm involved and see if they are able to convince the judge that at least in civil contracts bitcoins may act as money.


Last edit: October 1, to outline that it's not the whole Bitcoin community that seek to challenge the verdict.

EBA concerned about anonimity and security for bitcoin

From May 15th until May 17th, the Bitcoin 2014 conference took place in Amsterdam. One of the break-out sessions was dedicated to the topic of Anti-Money Laundering on Transparent Networks. During this session, Dirk Haubrich of the European Banking Authority (EBA) outlined some of the issues and concerns of the EBA with respect to digital currencies and bitcoin.

In his initial statement Haubrich sketched the concerns of the EBA with respect to:
- the use of digital currencies to transfer the proceeds of crime and act as money transmission,
- the fact that anonimity is a burden to link the transactions to persons,
- seizing assets and restoring or undoing criminal or illegitimate transfers,
- the emergence of a hawalla-like new channel via which international transfers may occur to countries that are on the FATF-sanction list,
- the use of those currencies by terrorists and criminals,
- the integrity of creators of digital currencies.

Role of the EBA
As a part of the discussion, mr Haubrich outlined that the EBA has a specific remit in the area of consumer protection and financial innovation. It is from this perspective that the EBA issued its warning on virtual currencies in December 2013. The question whether or not to further regulate virtual currencies is now being investigated by a cross-sectoral working group of European supervisors. This group will publish its outcome in a couple of months.

When asked to discuss the major challenges for digital currencies, he outlined anonimity and it-security as major topics of concern. In combination with the aforementioned list of concerns, the overall impression was one in which further regulation appeared to be more likely than a continuation of the current hands-off approach.

Dutch central bank will strictly supervise banks / payment institutions that deal with virtual currencies (and companies)

Just one hour ago DNB, the Dutch central bank and bank supervisor, issued a warning on bitcoin. It was not the regular warning or disclaimer for consumers, but a warning for the payments industry. Essentially DNB concludes that virtual currencies (bitcoins and altcoins) are viewed as products with a very high risk profile. DNB also announces that it will strictly supervise banks and payment institutions:

DNB will therefore strictly assess the compliance with applicable law (a.o. Wwft and Wft) for those banks and payment institutions that decide to get involved - in whichever way - with virtual currency-companies or that decide to invest in virtual currencies themselves. In 2014, DNB will investigate whether banks and payment institutions are actively involved with new payment products such as virtual currencies and (it) will assess the degree to which these institutions control/manage their integrity risks. The control should include effective measures with respect to client acceptance and the monitoring of new innovative suppliers. 

Guidance considerations
The brief statement of DNB contains some considerations that are the basis for this decision. A first consideration has to do with anonimity. DNB notes that transactions are being recorded in a public transaction ledger. Given that these transactions cannot be matched to physical persons and the virtual currencies are usable as a means of payment, they are an attractive chain of a money laundering process.

The current anonimity in virtual currency systems has consequences for banks and payment institutions. As a result of this anonimity, the buyers and sellers of virtual currencies become indirect relations of the bank. Thise indirect relations can also affect the reputation of the institution which leads to a 'derived' integrity risk. Without having that intention, banks and payment institutions could be facilitating money laundering.
DNB doubts whether banks and payment institutions are able - as a part of their controlled business operations and integrity of policies - to take the appropriate measures for transactions or clients that involve virtual currencies.

A meteorite or a pebble in the virtual currency pond ?
With the statement being just published it is too early to tell whether this is a meteorite that effectively wipes out the virtual currency business in the Netherlands or whether it is merely a pebble that aims to ensure that all virtual currency businesses doing business in the Netherlands ensure full identification and transaction monitoring.

My best guess is that the strong wording is used to stress the urgency and degree of concern that the Dutch bank supervisor has on this matter. So anyone operating in the Dutch environment better take this to heart.

The Euro Retail Payments Board: first meeting and outlook

On Friday, the 16^th of May, the Euro Retail Payments Board (ERPB) held its first meeting (with this agenda) in Frankfurt. The ERPB is the successor to the SEPA Council, which aimed at realising the SEPA-project. Whereas the SEPA Council was co-chaired by the ECB and the European Commission, the chair of the ERPB is Yves Mersch, Member of the Executive Board of the ECB.

First Meeting

The first meeting was dedicated to agree to the mandate, functioning and work plan of the ERPB. The ERPB Members decided to set up a working groups on post-migration issues relating to the SEPA credit transfer and SEPA direct debit schemes as well as one working group on pan-European electronicmandate solutions for SEPA direct debits. In addition the ERPB acknowledged and asked the Cards Stakeholder Group (CSG) to carry out a stock-taking exercise and devise a work plan with respect to card standardization.

The ERPB further discussed the expansion of the SEPA Direct Debit scheme (SDD) with a non-refundable (one-off) direct debit. It was agreed that the EU legislators would be asked to clarify legal refund-conditions when evaluating the Payment Services Directive and that a possible scheme would be launched only after this review was complete.

In order to further investigate the future use of pan-European electronic mandatesfor SDD, the ERPB set up a separate working group. Finally, the EPC presented the latest update on the migration to SEPA. Whereas the migration to credit-transfers was very close to completion, there remained work done for direct debits. The ERPB called upon all stakeholders in the euro area to complete their migration to SEPA payment instruments as early as possible and before the deadline. 

Outlook for the ERPB

The launch of the European Retail Payments Board marks a new starting point for discussing the future of European payments with all stakeholders involved. The inclusion of payment institutions and e-money industry can add considerable value given their different approach and background. These providers live and breathe Internet-based technology, seek EU-standardisation and do not have similar legacy-systems as the banks. I expect this to lead to fruitful debates and exchange of insights.

Some observers may cite the lack of legislative powers as a disadvantage of the ERPB. Others may wonder if it is possible to achieve results in a body that only meets twice a year. I would submit however that in ten year’s time, the sceptics will look back in surprise to see how the ERPB has positively shaped the outcome of the European debate on retail payments. The Dutch experience with similar standing committees (see this separate blog) demonstrates that there is a lot of unlocked potential that lies in the trust and bonds that will be formed and shaped by this collective effort. 

FCA kicks the Securepay-can down the road...

In March 2014, the FCA, the prudential supervisor for UK based payment institutions and e-money providers, outlined that it would not be strictly assessing the compliance with the Securepay Recommendations on the security of Internet Payments. This announcement was quite interesting as in February 2014, the Forum also published an assessment guide that assists payment service providers with the implementation of these Recommendations by February 2015.

FCA Statement:
We have decided to await the publication of guidance from the European Banking Authority on measures for the security of internet payments and will begin to assess firms’ implementation of these security measures when the updated Payment Services Directive requirements take effect.

The updated Payment Service Directive will enter into effect at the earliest by mid 2016. It will assign the European Banking Authority with the task of further developing guidance for the security of retail payments. The FCA has chosen to wait for this guidance rather than pre-empt it.

Kicking the security-can down the road
It is interesting to note that the FCA seeks a pragmatic middle ground. It carefully states that it finds security an important issue while at the same time outlining that it will wait for a solid legal basis to assess the security of retail payments. In doing so it effectively kicks the tricky security can down the road.

I can well understand the FCA desire to kick this can. The Securepay recommendations on security lead to quite some questions in their practical application for different technologies (see the blog here). On top of that, the detailed prescriptions on the basis of the new Payment Services Directive may lead to further rules that limit the choices that market entities can make to achieve a certain level of security.

Rather than confuse the market with layering requirements which quickly follow each other, the FCA apparently chose to wait and see, hoping that the final rules on security for retail payments may become more balanced.

It will be interesting to see if other supervisors follow suit.

ECB provides outlook on retail payments in Europe at EPCA-conference

Pierre Petit, deputy director general (payments and market infrastructure) of the European Central Bank, has outlined the ECB’s  views on European retail payments. He made his remarks at the EPCA Summit 2014, where he defined the role of the European Retail Payments Board (ERPB) and the follow-up on the SecurePay recommendations on access to payment accounts.

New players to be part of drive towards integrated European payments market

The ERPB is to become a forum for driving the further development towards an integrated European payments market in the post-SEPA situation. Petit confirmed that the first meeting of this group is to take place in May, and new industries such as e-money providers and payment services institutions are to join in these discussions, along with other representatives of both consumers and providers.

The ERPB will aim to further stimulate the development of the European retail payments market by working together on topics such as innovation and integration.  The group will identify  and address strategic issues and work priorities, including business practices, requirements and standards. Issues could include the development of a single e-mandate solution or the improvement of interoperability between national e-payment schemes.

Security requirements for payment account access services

The ECB announced that it would this month publish the responses and the results of the consultations on security for payment access to the accounts. The publication would be for information only, given that the European Banking Authority will be providing guidelines on security measures under the revised Payment Services Directive.

Although the ECB does not want to impose formal requirements as there is a risk that the EBA could take a different position, it is likely that the two-factor authentication model of the SecurePay forum will remain the norm for retail payments account access services and mobile payments.

Mount Gox tumbles off the learning-curve

This week, Mount Gox, a very large provider of bitcoin services, couldn't live up any more to its services agreements with bitcoin users. It provided exchange and storage services for bitcoins, but due to a technical implementation flaw, the bitcoin holdings of users were compromised. Essentially it wasn't clear who really owned the bitcoins. The website went black and users can no longer claim their bitcoins.

Tumbling off the learning curve
I view the failure of Mt Gox as a logical consequence of the learning curve that bitcoin holders and bitcoin companies face. The bitcoin, although considered decentralized, is just as centralised a system as any other value transfer mechanism. However, for ideological reasons, the developers chose to only describe the technical heart of the system (the algorithm) leaving the rest up to the market.

This open source code approach has some advantages, among which a very speedy development of applications. Yet, we are for some time now witnessing what it means if systems lack a central authority or scheme manager. There is no entity taking responsibility and chasing users or companies because they don't abide by:
- usage conditions (demanding user identification),
- security requirements and certification of tools,
- specific legal frameworks.

As a result we have seen a whole community of interested companies and users climbing up the payments, banking, investments and monetary learning curve. The inevitable consequence is that those who do not get it right, will pay a price, while the others continue to learn. Due to the digital nature of bitcoin, these developments unfold rapidly, allowing us a compressed overview of lessons from financial history.

Frijda's theory of money (1914)
The essential lesson at stake is that the usage of any value transfer mechanism does not just rest on its acceptance by users, but just as well on the rules and regulations that underly the value transfer. In 1914, the Dutch lawyer Frijda analysed this topic in his dissertation on the theory of money. At that time discussions emerged on the nature of banknotes. Did they have value because they were exchangeable for bullion, because they were defined as legal tender or because the public used and accepted it?

Frijda pointed out that the underlying legal framework that safeguards property in a society constitute a necessary precondition for the use of payment instruments. Without such safeguards, people will tend to stick to other stores of value rather than attaching value to local bank notes. Until today this effect is clearly visible: consumers tend to hold and use foreign cash or commodities if they live in country with a lot of curruption, a weak system of justice and an instable monetary climate.

Trust is built by institutions and markets
What makes money tick is a solid institutional basis, upon which trust can be further developed. The latter part can be done by a combination of regulation (supervision) and self-regulation (market action). Which brings us back to the Mt Gox case.

Following the events of this week, a statement was released by the bitcoin companies Coinbase, Kraken, BitStamp, Circle, and BTC China. The industry leaders committ to safeguarding the assets of customers, to applying strong security measures, to using independent auditors to ensure integrity of their systems and to have adequate balance sheets and reserves to be able to ensure continuity.

In sum we can now see both a gradual development of both the institutional framework for virtual currencies and the market-driven self-regulation. This reflects the fact that - whether you like it or not - trust for financial services is always built on institutions, regulations and self-regulation.

The bitlicense: current state of thinking in New York

A week ago, the New America Foundation organised a meeting (Cryptocurrencies, the new coin of the realm) on the topic of virtual currencies and regulation in New York. Some news bulletins picked up on the meeting and the future New York Bitlicense regime. The good thing is that the New America Foundation has streamed the whole event, so it allows me (and you) to listen first hand to the speech by Benjamin M. Lawsky, Superintendent of Financial Services, New York State Department of Financial Services (DFS).

I will outline some of the highlights of his contribution below as I think that the New York discussion represents a good example of the issues at stake when it comes to regulation of Bitcoin. I expect to further touch on those issues in my contribution to the Bitcoin Pre-conference expert session of the EPCA-summit in Brussels (March 12-13).

Open source code currencies and open source code regulation
In his speech, Lawsky outlines the current remit of the NY department of Financial Services. It acts as the supervisor for money transmission companies in New York. The DFS-starting point is therefore that in some instances dealing with virtual money may effectively constitute money transmission, which needs to be regulatred. This is similar to the approach in the FINcen guidance of one year ago.

The New York regulator chose to emulate the open source code approach of virtual currencies. And thus, Lawsky refers to the DFS-approach as 'open source code regulation': regulation based on a public exchange of thoughts, allowing the best insights to be used. Given their current remit, the main idea is to see where the money transmitter rules need to change in order to suit the nature of virtual currencies.

As for the further process in 2014, Lawsky explained that the DFS will move towards further regulation this year and will most likely hold a  market consultation for the proposed regulatory framework for companies that want a so-called 'bit-license.'

What will the bitlicense be like?
When listening to the speech, my impression is that the core fundamentals of the bitlicense will be:
- very strong customer disclosure, requiring companies to outline that transactions are irreversible and that the digital currency may be very volatile,
- a strict adherence to know-your-customer requirements, essentially demanding that anti-money laundering rules are adhered to,
- a robustness/capital requirement, ensuring that the company will be able to withstand some of the market shocks that may occur when dealing with volatile digital currencies/commodities,
- safety and soundness requirements, ensuring a certain quality of operations and consumer protection.

As for the nature of capital and collateral requirements, the DFS is still wrestling with the concept of virtual currencies. This has to do with the angle and object of regulation. While it is easy to require capital safeguards for banks that deal with attracting and lending money, this is harder to apply for companies that issue, distribute or redeem virtual currencies.

Similar questions arise when defining the scope of transaction monitoring. Should only the purchase and redeem-transactions be subject to rules or does the supervision extend to a full transaction logging of all transactions with the virtual currency? Should those transactions be in a public ledger and to which extend can they be anonimized?

Step-up regulatory approach with a safe harbour
Although the DFS is still contemplating its exact licensing regime, I expect it to also contain a safe harbour provision. This would allow companies that comply with customer disclosure and know-your-customer rules, to continue to operate, while further obtaining the full bitlicense. Such a regime would assist in lowering the barriers for virtual currency platforms/traders/exchanges and create an easy entry towards the proper regulatory regime.

Lawsky outlined that the regulator prefers companies to be in his state and regulated, rather than driven off-shore. A safe harbour rule helps achieve that and fits a model where a light-weight, low-barrier entry model is developed to prevent legitimate providers from leaving the jurisdiction, while creating a sufficient barrier for the illegitimate players in the market. This is also a realistic approach considering the alternative channels for illegitimate behaviour: cash and banks. In the words of Lawsky:

Let's be frank: a lot more money has been laundered through banks than through virtual currencies'

Boldly go where no man has gone before?
I commend the DFS for their open minded approach to the topic of regulation of virtual currencies. I do disagree however with one of the remarks of the Superintendent. He outlined that regulators are in new and unchartered waters when it comes to virtual currencies.

I don't think they are.

Since day and age, people have used all kinds of symbols, coins and means of representation of goods that worked fine for transferring ownership of property. We created a number of laws and institutions to ensure these property rights and a fair treatment of parties to certain contracts. In doing so we were able to move from coins to paper-based money to deposit accounts. At the same time we created digital representations of shares, bonds, IOUs and agreed that ledgers at private companies and government institutions could officially represent a claim on goods, services, bits of land, anything.

Then, when it comes to new forms of money, we also have recent experience. In the late 1990s we witnessed a very similar type of discussion on bank supervision and specialised supervision regimes for new forms of 'electronic-money' as it was called in those days. It took some time and deliberation to get to grips with pre-paid digital representations of fiat-currencies, but we found our way in the end.

The challenge: finding the right regulatory framework
The true challenge is to first consider the fundamental nature of virtual currencies and then determine the appropriate regulatory framework. In essence, the DFS is doing the reverse as their starting point is their existing legal competence as supervisor of money transmitter businesses. While there is a lot of logic to it, it might be useful to reconsider alternative types of regulation that exist.

It's my hunch that perhaps an exchange/trade oriënted regulatory framework might make more sense as the basis for regulation, than the money transmitter framework. So that is what I will explore in my next blog.

Towards a more flexible approach of authentication

In July last year, the European Commission published a proposalfor a revised Payment Services Directive (PSD). The proposal draws on the work of the SecuRePay forum of supervisors and requires ‘strong customer authentication’ when a payer initiates an electronic payment transaction.

Strong authentication
Strong authentication is defined as a procedure for the validation of the identification of a natural or legal person based on two or more elements categorized as knowledge, possession and inherence. These elements are independent, in that the breach of one does not compromise the reliability of the others and is designed in such a way as to protect the confidentiality of the authentication data.

The concept of strong authentication is in itself nothing new. What is new however, is its appearance as a detailed regulatory requirement. So far, both the Payment Services Directive and the Electronic Money Directive contained a more generic requirement for licensed operators to demonstrate that their governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate. This allows for a system wide supervisory review of risks and security measures.

The current approach in both the envisaged PSD and Recommendations of the supervisors in Europe is however to take out and stress one element of the risk/security puzzle. This approach may turn out to be counterproductive and be an impediment to achieve retail payments that are as secure, efficient and as frictionless as possible.

Different market approaches to customer authentication
Traditionally the banking sector and card schemes have played a major role in the payments industry. For a long time they acted as the main channel through which new technological developments were introduced. In this process, strong authentication in a range of countries became a standard for use in payments. Further security measures for use in transactions over the Internet were then being developed as an add-on to the basic design.

More recently, Electronic Money Institutions (EMIs) and Payment Service Providers (PSPs) have entered the payments value chain using the Internet as their basic transaction processing initiation channel. As a result, their approach to payment security tends to be based on a variety of methods, to be able to counter a range of attacks associated with this inherently unsafe environment. PSPs have had to move very quickly up the e-payment security learning curve and found out that they must remain vigilant with respect to new threats. PSPs are consistently using additional information (geo-location information, IP address matching, IP address pattern detection, industry blacklists, comparison against a customer’s existing “profile” etc.) to validate the interaction with a user.

There is still much to gain by combining the expertise of both the “classic” and more recently-established providers of payment services. Customers will be using all kinds of devices as a service entry point; this requires a flexible approach to authentication. Rather than two-factor authentication we could speak of multi-factor authentication, which would include the specific user-payment service provider interaction context. But that is not all.

Stuck with two-factor customer authentication?
The analytical flaw that underlies the SecurePay recommendations is its strong focus on too detailed a part of the business and security process: customer authentication. Of course this is quite an important element of the transaction process, but the overall security of (mobile) retail payments is always achieved by a proper combination of security measures.

Customers, devices, processes and issuers should all be authenticated properly. And any risk control structure does not just rest on authentication but on a wide array of logical and functional controls. These controls may sometimes be labeled: 'fraud detection' but the quality of the risk prevention that they achieve can be just as good as one of the classic factors, that are not in the definition of strong authentication.

It is evident that new authentication measures and security challenges are being used and developed to achieve a level of security in retail payments which is contingent on the risks that are relevant in the user-transaction-device context. We can witness this in the bank, card, Internet and mobile payment domain. As these developments occur, it is unwise to freeze one detailed building block of security measures into a regulatory requirement. This will skew the market into less efficient and more cumbersome customer experiences, while technically not necessarily safeguarding a strong level of security.

In particular the mobile domain allows for a wide array of additional capabilities to achieve the security levels that supervisors desire. It would therefore be wrong to make the low-value threshold of the PSD the dividing line between strong and alternative customer authentication measures. A better approach is to link the degree of authentication to the degree of risks and the further security measures that are in place. This will allow the market to develop solutions that achieve both ease of use to the consumer and the desired level of security.

A more future-proof approach
It is not unlikely that the envisaged inclusion of a detailed requirement on strong customer authentication may distort the current market developments rather than allow for further innovation and market development. A more future-proof approach is desirable.

In my view such an approach would be to allow for a broader 'multi-factor authentication' which includes authentication based on the user-interaction context. In addition it would be good to recognise that the quality of some of the security measures which are often labeled: 'fraud detection' may have become such that they achieve a similar level of security as the traditional authentication factors.

We should also allow alternative authentication mechanisms to be used, dependent on the risk involved, rather than a certain value threshold. It would then be up to the supervisors to make the context-based and risk-based assessments on the whole array of security measures as a part of their supervisor reviews.

This approach should ideally be complemented by excluding todays specific definitions of strong authentication from the wording of the Payment Services Directive and replacing them with a generic reference to the relevant security recommendations.

The result would then be that we will have a clear and flexible security requirements framework in Europe that sets the boundaries within which the market can futher innovate and develop.

Is a 'democratic' crowd based cryptocurrency just as fair as the traditional ones?

Having gone through my daily portion of Bitcoin-reads (and being somewhat sceptic), it struck me that one of the compelling arguments of collective currencies: 'money to the people' is highly flawed. It is the strong resentment against governments and financial institutions that makes many people believe that it would be good to take the power of money-creation out of governments' hands. But what would happen if we would indeed forget for a moment about the governments?

Crowd based currencies: exclusive and leading to private gains
As nice as it appears, these new currencies will then not be as evenly spread as the current ones in existence. There is quite bit of knowledge and expertise involved in obtaining, developing and working with new crowd-based currencies. So the 'democratic' nature of these currencies is not as democratic as we may think. The amount of people that may vote and can use cash is considerably wider than the amount of people able to use or make virtual currencies. 

We should realise ourselves that in essence, any currency, whether it is a government-owned or private in nature, leads to a certain distribution of value and wealth for the issuer and among the user base. And the question that is not being asked, at present, is whether the new crowd-based currencies will distort the distribution of value and wealth in society? Nor do we ask ourselves the question if we would prefer to be subject to the consequences of behaviour of (collective) private entities, manipulating a currency while we can't influence them, instead of a government structure (however flawed it may appear).

The redistribution of value that can occurs with these new currencies may look democratic, but that is a wolfe in sheep' s clothes. Effectively the new currencies are and will be the domain of private individuals trying to seek private gain rather than anything else. And there is no guarantee whatsoever that this constellation will have the interests at heart of all people in society. It will be Darwins' survival of the fittest all over again, which will exclude certain groups of citizens from participating fully in society. As democratic as a crowdbased currency looks: you will still be a puppet but on a different string, with unknown gains being made by unknown players in the value chain of this collective currency.

Currencies should be as fair as possible
Thus, the claim that crowd-based exchange mechanisms or digital currencies are more democratic than the existing ones must be strongly rejected. They are not and they lead to a very uneven an undemocratic redistribution of value in society. The central question in this debate should be which institutional design prevents the most harm from being done. 

Despite all the existing flaws that may be present in our governments or current monetary situation, the truly democratic currencies and those that may do the least harm are those operated by the governments that we can vote in or out.

Bitcoin legal classification in Germany: much ado about ... ?

These days I noticed an interesting discussion in my Twitter time line and on the web on the fact that the German government has 'recognized' Bitcoins (even as legal tender, as cnbc reported for some time). There were many reports on the matter, outlining that Bitcoin is apparently gaining further acceptance among regulators. But as the reports were a bit confusing I felt it would be good to track the sources.

German MP Schäfflers enquired about tax-treatment for Bitcoins
It turns out that a German MP, Frank Schäfflers, has been asking his Ministry of Finance how the taxation rules applies in situations where people use Bitcoin as an instrument of trade/payment. And later on he asked a follow up question whether or not the use of Bitcoins as a payment mechanism would be exempt from VAT (as is the case with German legal tender). Here is the link to the source documents.

The German Ministry of Finance outlined in its response that:
- commercial transactions where bitcoins are being used for payment, have the tax regime on the basis of the transactions' commercial nature; so the use of bitcoins doesn't disturb the regular taxation rules,
- goverment agencies are still discussing how to tax the value increase of bitcoin holdings over a year,
- bitcoins are not legal tender, nor e-money, but a form of private currency which classify as 'Devisen oder Rechnungseinheiten': under the German supervision law (article 11, sub 7).

The Rechnungseinheiten can be translated as unit of accounts, but the explanation of the German Ministry of Finance is that this definition covers - amongst others- all private currencies or units of accounts which are not based on legal tender. Essentially is a catch-all definition to capture any sort of privately agreed payment mechanism that can be used in multilateral clearing or settlement.

The regulatory logic: classification rather than recognition
While to the observer it may appear that the German regulator is leapfrogging into the modern world by outlining the status of bitcoin, the reality may be less exciting. The German Ministry of Finance merely outlined how, given the existing rules on taxation and payments, bitcoins qualify under their supervision law. This is rather a technical exercise and it can be seen that only for income tax issue (what to do with bitcoin holdings that change in value), they haven't yet got an answer.

So yes, the bitcoin has a legal status, but then again: any new development, instrument or technology already is subject to the law book. The fact that the Ministry has now pinpointed the article of the law book where they think the object fits, may therefore not be so spectacular.

If we look at the Netherlands, a similar situation appears. Anyone is free to determine whether to exchange services by paying for them or by using other forms of payment. . I could buy a bread in exchange for washing a car. And if the bakery would accept bitcoin rather than washing their car, it would work as well. The use of bitcoin can be considered payment in kind. Given this regulatory payment mode, our legal system is already recognising alternative forms of payments.

The same holds for the taxation part. The VAT rules on services do not change if the payment leg of my transaction is different. And the income tax rules don not change either. The Dutch rules state that if you hold something which has value, it must be registered on the tax declaration. In this declaration, the bitcoins in a wallet thus show up as the money in my bank account does.

As for the legal tender part of the discussion: I view that as an overrated concept. While in earlier times, the concept of legal tender meant that the other entity in a transaction had to accept the notes and coins, this obligation has been struck out of our Dutch law book many years ago. But it still lingers in the mind of many people and may of course in some other countries still be more relevant.

Future developments
What I find most interesting about the news is the quick and fast coverage that new forms of payments and regulation get in the media and with the public. We can see that the developments are positioned as the story of the recognition of bitcoin by the regulator or as the coming of age for bitcoin. Regardless of the angle of these reports, it is clear that things are happening and moving in the area of private, digital, distributed currencies. And it will be interesting to see this area develop further.

The proposed EU-directive on Bank Accounts: wrong tool

Today, the European Commission will announce a proposal for a Directive on Bank Accounts that covers the following areas:

- comparability of bank account fees: the aim is to make it easier for consumers to compare the fees charged for bank accounts by banks and other payment service providers in the EU;

- bank account switching: the purpose is to establish a simple and quick procedure for consumers who wish to change from their current bank account to a different one, with the same or a different bank or other financial institution;

- universal access to bank accounts: the aim is to allow all EU consumers, irrespective of their country of residence or financial situation, to open a payment account, which allows them to perform essential operations.

 

With the proposal the Commission continues its standard policy towards the financial sector: ride the road of regulation as long as the sector is still unpopular with the public. It has done so with regulation 2560 (on fees) which had to motivate banks to speed up intercountry payment processing in Europe and it has in a similar vein used the regulatory process for the Payment Services Directive. Repeatedly we see the banking sector respond with initiatives to improve operations and just as repeatedly we see the European Commission and Parliament find that this was not sufficient and move forward with regulation.

 

At face value, the goals of the Commission with this Directive seem laudable. But what would interest me most is the degree with which the Commission has done its regulatory homework. Quite some time ago, there were EU-initiaves and rules on 'better regulation', which meant that a solid cost-benefit analysis would be required by the Commission before proceeding with further regulation. In the process of discussing switching cost, the Commission did not follow these rules however (see blog).

I remember that at the time I was amazed by the ease with which the Commission bypassed the work done by an EU expert group on user mobility in bank accounts (of which I was a member). The consequence was that, without having proper data as to the degree of problems experienced, the nature of the problems in different countries, the discussion remained a yes/no discussion. So I was quite interested to see if in the mean time there is more hard evidence on the table to determine the nature of the problem that needs to be solved (and to see if it is a European or a national problem).

A quick look at the impact assessment tells me that not much has changed. It is essentially a fast forward reasoning towards the norm that unless everyone in Europe switches bank accounts quite a lot, the market is evidently failing and thus regulation is necessary. Furthermore there is a blind eye as to the different types of service providers: the document assumes all players to be banks with a full service package. In terms of analysis, it is skewed as it misses one alternative explanation for low bank switching rates. That explanation could be that, from a consumer budget point of view, it is more economical and rational to use the scarce time to chip off a small percentage of other purchases (mortgage or lending percentages, tablet-purchases or mobile phone subscriptions) than to spend a lot of time comparing and switching banks and earning very little revenue in the process (see also the presentation here that discusses which assumptions lead to which regulatory preference).

Seeing the current state of discussions (a directive proposal) it seems hard to imagine that the plan would be withdrawn or modified seriously. Still, it would be useful if the Commission had done their homework a bit better and at least had chosen a proper regulatory tool. If indeed the provision of bank accounts accross the EU is a concern, why not choose Universal Services Obligation as the regulatory mechanisms, that is most suited?

We used this mechanism before in Europe, to designate the amount of public telephone's that had to be available to the public. And setting it up for banking isn't hard to do (read this Tilburg University Report) but it does require one thing: a better cost/benefit analysis:
Furthermore, designating all banks to take care of the product dimension of a Universal Services Obligation (e.g., consisting of only a basic bank account service) may be the most effective way of implementing it, provided that the USO has a minimal scope. However, with regard to the geographical dimension of a USO, designating all banks leads to unnecessary cost duplication, so that it is worthwhile to consider other options, such as self-regulation and a franchising mechanism in combination with an auction. In addition, technological developments in a sector are very relevant when assessing the need or desirability of universal service obligations. By interfering in these processes without having made it clear in advance that there is a problem, such developments may be distorted; hence the importance of carrying out a cost-benefit analysis as a starting point.

I think the citizens of Europe are best off with goverments that only regulate when the facts are evident and the tools of regulation are properly geared to the problem at hand. At this point in time, with this Bank Account Directive, I believe we are heading for another emotion-based, cost-increasing all-in Eu-wide regulation, which underlying problems (if any) could have been solved much cheaper and easier by using other more appropriate regulatory tools.


PS. The post is updated at 1823 to include some of the impact assessment data.
 

The ECB-report on virtual currency schemes: some reflections

The last month, the ECB published a report on virtual currency schemes. I have been reading this with great interest as it signals the involvement of the central banks in a new area: virtual currrencies. The relevance of this report must therefore not be misunderstood. We should remember that in 1994, the EMI-report on pre-paid cards signalled the start of the regulation of prepaid-cards and electronic money products. And in a similar style, this report may become the starting point for regulation of virtual currencies.

In general, central banks are to be commended for monitoring the developments in the area of money, retail payments and near-money products. If you're a central bank, an institution that is responsible for true money, than it it always good to know what other forms of money are in circulation. And as such the report of the ECB demonstrates that the European central banks are alert.

Analytical basis could improve
I must say however that I was also somewhat disappointed. The analytical framework presented in the report is a bit shaky in my view.  It does not rest on the nature of the subject discussed (virtual tokens and currencies), but on how they are 'regulated'. As an approach, I find this little convincing. Furthermore I noted that 'unregulated' is not defined. Does it mean that central banks or supervisors are not involved or that no regulation applies at all?

As an alternative I would point out the possibility of using frameworks suchs as this one (taken from the American Law Review):

It is interesting to note that the empty box in this table can now be filled with: Bitcoin as an example of a system where money can circulate freely without returning to a central mint.

Which electronic tokens are currency of money and which are not?
The ECB distinghuishes between three virtual currency types, in terms of openness of the systems involved.

Type 1 is a closed link system in which the digital tokens are only usable in the system itself. The example the ECB provides is the World of Warcraft Gold. And although the picture suggests that there is no link to the real economy, the ECB notes: However, there seems to be a black market for buying and selling WoW Gold outside the virtual currency scheme. If Blizzard Entertainment discovers any illegal exchange, it can suspend or ban a player’s account. 

Type 2 contains systems where users pre-pay services of a supplier in the form of private issuer tokens such as facebook credits. And type 3 systems are open systems of privately issued tokens/currency that can be bought and sold. It is in this category that bitcoin and Linden dollars are placed.

What is lacking in this model, is the Type of model 1b where there is no formal buying or selling of tokens, but there is a relation to the physical world. It is the world of loyalty points and tokens, which can be earned and redeemed, but never exchanged for money itself. The ECB places these under the category II.

It appears to me that in doing so, the ECB doesn't distinguish sufficiently between loyalty tokens and payment tokens,which each have a different role to play in the business model of their issuer. An alternative table might have been:

	User cannot buy tokens at all (loyalty-type)	User earns tokens and can buy additional (hybrid of loyalty/payment)	User buys and sells  tokens (payment-type)
Tokens used in digital issuer-domain only		World of Warcraft	World of Warcraft Lynden Dollar
Tokens used in digital or physical issuer-domain only	Starbucks	Nintendo Points -Digital Payment loyalty schemes for single retailers
Tokens used at other entities than the issuer	Frequent Flyer Programmes	Frequent Flyer Programmes	Bitcoin, e-money on mobile phone's

The missing element: mobile money
What intrigues me is that the digital money on mobile phones is not a part of the discussion. It is by its definition (an exemption in the e-money directive) an unregulated form of digital money. Yet, the ECB has been so long accustomed to the strange sequence of events that made the European Commission decide that money on antenna's of MNO"s is not electronic money, that they forgot to include it in the analysis.

The reputation argument.....
Finally I noticed that the ECB finds, that if these virtual currency schemes (however defined) grow too much, they might give rise to a reputation issue for the central banks. Here again I think the analysis is a bit too strongly worded. Central banks can simply outline their scope of work and responsibility by stating that they  are not in any way responsible for money that they didn't issue and supervise. By clearly and repeatedly informing the public of this fact, the public can then choose to take a risk with the virtual currencies or stay out of them.

Yet, I wouldn't be surprised if this reputation argument (or a comparable public policy objective: transparancy) becomes the main angle from which future supervision of these schemes will be justified.

Use twitter to create banknotes: the punkmoney concept

This year in May, I was visiting the 15th Digital Money Forum (well organised as ever, by Dave Birch and his team at Hyperion), and ran across a very elegant alternative payment concept, that makes use of Twitter as a technology. The concept was called: Punkmoney and its developer Eli Gothill explained on the forum the workings and background of the concept (see the presentation here and read an interview with Eli on the background here). With the concept, he took a step back in time, skipping to the times before money was used widely.

In these early times, we can imagine societies to be local communities in which the economy consisted of exchange of services and committments. The scale of the village/community was limited and thus a trusted network of users would exchange services, goods or favours, knowing that either directly or over time, the service or favour (helping in building a house) would be returned. Later on in history the concept of money took over, so that the chain of exchange would become longer. A favour or service would then be paid for with money, that could be used to buy a service or good elsewhere.

Now, what Punkmoney does, is to use Twitter to re-create the old 'favour/gift-economy' in which no money existed. In order to print your own banknotes on Twitter, all you need to do is use your existing account and the hashtag #punkmoney. In English you might call these: Twitnotes or in Dutch: Twitbiljet. So let's see what a Twitnote looks like in real life:

As you can see, this is a promise from me to Occupy Amsterdam (@potbanging_NL) to deliver a brief talk on the financial history of Beursplein. As I used Twitter, it is a public statement that everyone can read. As such it is also read by the Punkmoney tracker, which makes a record of the statement. This central database registers all promises made on Twitter with the hashtag #punkmoney and thus serves as a register in which you can see which promises were made.

Now back to the Twitnote. My Tweet says NT at the end, which means that it is non-transferable. Another option might have been to state: TSA, meaning: Transfer Subject to Approval. In addition, my promise is quite exact in that it specifies specific moment in time when I will deliver a brief presentation (13 October on  a global noise manifestation). Alternatively I could have left out this specific time and have noted: expires in 2 years/months/days.

Of course there's a lot more technical details to be told on how to transfer and redeem notes. But the important thing to note here is that anyone who is seeking alternatives for money in its current form, can easily use the punkmoney concept in his/her community to start exchanging goods/services by using Twitter.

As I understand from Eli, he is going to be presenting his Punkmoney system/concept to the banking community on the next SIBOS (a very important banking conference for all companies, banks, central banks etc. in the world). And I truly hope that the delegates there will recognize the elegance and beauty of his design.

Google Wallet roll out.... without Google Bucks

It's about five years ago that I discovered, by accident and curiosity, that Google Payments Limited had applied for an e-money license at the FSA. Ever since, people have been wondering how Google would enter the payment space. Would they offer a wallet with virtual cards or would they issue their own new virtual worldwide currency (googles, googlets or gees)?

In good tradition, Google started out doing field tests with the wallet (which would sit in the mobile phone) and announced this in May 2011. The wallet was to contain your credit-card cards as well as a google-pre-paid card. And payment was possible with Paypass while the wallet would also facilitate the savings of loyalty-points. The card information was stored in the Secure-SIM-element in the phone and they experimented quite a bit since then.

So where do we stand now?

Well, the Google Wallet is now being rolled out and the Google development team sent out this video to further explain the wallet concept and roll-out. The most important change is that they decided to move the card-information to the cloud. This allows the Wallet to be used both via Phone and via the Web, with all your card details and important digital documents (ID's, transit pass etc) residing in a safe digital environment. So their distribution model for the application is now changing to making APIs available so that merchants and issuers can easily integrate the Wallet in their site/services.

As such, we can thus see Google moving into an integrators role, rather than a payment instrument issuer role. In fact, at some point in time, the company thought about issuing Google Bucks, according to Eric Schmidt, but abandoned the plan. The concept would consist of a “peer-to-peer” money system by which users seamlessly transfer cash to each other via a hypothetical application. However, various laws about currency and money laundering in different parts of the world made this too complicated to realize.

For now, the peer to peer payments in the Google Wallet are no longer on the agenda. And from a historical perspective (see my other blog) I think it is a good choice. Yet.... one of the developers did mention on this subject: it's impossible for now, but stay tuned for some announcements in the future.

So, are we still in for a surprise here?

Bit instant to introduce 'bitcoin'-card...

As you may know I am somewhat sceptic about the underpinnings of Bitcoin (see my previous posts), but the system does keep innovation going. Bit-instant for example is a company that helps consumers convert money into bitcoin and vice-versa. And such services are surely helpful in bringing more reach to the system.

Bit-instant is apparently now planning to bring a debit-card on the market, in two months time, that marries the bitcoin and money world even more. In this article here you can find a link to an IRC chat with Bit-instant, in which it announces its plans. It also provides a link to the picture of the card, showing a QR code that can be used to quickly deposit bitcoins residing in other applications to the card-account.

Now as I understand it, it is a regular worldwide ATM/Payment card. And it looks like it allows bitcoin to be deposited on the card balance. But essentially the bitcoin holder can ask Bit-instant for a conversion of some bitcoins to money and this money will then be deposited on the card balance for payment. By also printing the bitcoin identification on the card the concept very much looks like bitcoin is entering the card-market. And certainly to the user it will feel/look that he can pay with his own minted bitcoins.

In reality this is a very smart introduction of just another card in the market. It's a variation of the regular co-branded card where now we don't see a soccer club, automobile club, but the bitcoin club appearing. Still, it's another innovation worth exploring, so let's see where this card will take us.

The art of Reserve Banking (at the Zuidas Amsterdam)

Reserve Banking is an art. While Draghi and Bernanke are highly qualified and professional economists, they must also master the art of performance. As true actors, they use their voice, their remarks, eyebrows and somewhat vague statements to provide hints and indications that the market then swiftly responds to. It is something you can't learn from the books. It's an art that can only be mastered in practice.

Since this year, the Zuid-As in Amsterdam is also home to the art of reserve banking. But it's a bit different. I heard about it yesterday, when visiting the Holland Financial Centre. From high up in the nearby Symphony building I looked down onto a small rectangular area of the Art Reserve Bank, well fenced, with cameras and three small office buildings. One is the minting press, the other is the teller and the third one was hard to identify. It looked like this:

The Art Reserve Bank: an experiment
What happens there is a unique experiment. A group of artists have set up, without any monetary funding, a so-called Art Reserve Bank. The plan was there for some time, but as the financial crisis came along, it became easier to convince sponsors to join a project that questions the value basis of money. The main idea is that there is far too much money circulating in the world and that the crisis demonstrates that we need a new approach towards money and debt. And in the experiment, art (or: the intrinsic value of human artistic expression) becomes the money. And thus helps to freshen up or minds and stimulate us to re-think our concept of money.

The idea is that for a period of five years, each month 400 coins are minted. These are 4 series of 100 coins per week, costing 100 euro each. For each month: a different artist is asked to design the coins, which all bear the same backside with the motto: ARS PECUNIA MAGISTRA: Art is the teacher of money. A nice motto and also a tongue-in-cheek reference to the Amsterdam Zoo that bears the motto: Natura Artis Magistra (Nature is the teacher of Art).




Anyone can buy coins and thus becomes a member of the Cooperative Art Reserve Bank (Kunstreservebank). All holders of the coin are thus the collective owner of the bank. Of the 100 euro costs, 90 % is used to pay for the operational cost of the experiment and 10 % is withheld as a 'cash reserve'. Should a buyer not appreciate his/her work of art, he can return it to the bank and get the original value back with a 10% interest fee. There is also a dealing room on the site of the bank, for those who wish to buy or sell their coinst. And at the end of the five years, all owners of coins can collectively decide what will happen with accumulated capital (if there is any and if the bank stil exists).

Money, dreams and art
The experiment challenges one to consider: what is happening in our world of money and value?

For me, the Art Reserve Bank made me realize that there may now be so much difference between their coins and the official legal tender in circulation. Both coins are the product of our imagination, dreams and creativity. Which is quite clear for the Art Reserve Bank currency, but may be less clear for the euro. So let me try to explain.

What happened over decades is that we moved from a mentality of: save first, spend later, to a mechanism of: spend first, repay later. If your story about the future would be probable enough (having a job, education etc) some bank would lend you money. And the same thing was true for businesses. Essentially this is a mechanism where tough choices are made. If you don't have the job or a solid story explaining how you can repay in the future, you don't get money. Which all sounds very realistic.

Fact is however, that with hindsight we can now see that banks, consumers and companies have on a large scale lived in dream worlds with expectations of future income, growth that were not realistic after all. Money was created, lent on the basis of these dreams and imagination. And part of that money is now in our pocket. And we also know that some of the debts are definetely not going to be repaid in the future.

So wouldn't it be fair to state that some of our euros are just as much the result of our imagination, as the Art Reserve Bank coins?

Outsider ideas in the payment space.... seldom really new..

One week ago Rabobank Nederland announced that it might de-activate the possibility to use their debit-card outside Europe, in an effort to eliminate fraud. And today the Financieele Dagblad has an article in which it becomes clear that an entrepreneur claims that this is actually his idea and not Rabo.

He's written the idea of functional/geographic application controls (including de-activation for certain geography) down as his idea, sent it to the Rabobank. And some time later he even spoke with Rabobank. And now that he discovers that Rabobank will in practice block geographic use, he claims that Rabobank has stolen his idea. It appears that he's in full swing with preparation of a court case.

I think this court case may not be effective. Application and functional controls in the payment area are around since ages. There can be checks and limits on payments via certain channel, with certain amounts, to or from a geographic area, number of times of use, branche-codes and what have you. And we have seen these developing over the years. In a planned talk on this issue in 2004 I already mentioned the user control of these application controls.

In this particular case (blocking a geographic area for card use), it was clear ten years ago that there would come a time that EMV-debit-cards would be blocked for use in countries that hadn't fully migrated to EMV. And that the amount of fraud would essentially determine the timing.

Now I do understand the serendipity-element in this story. It must be frustrating for an outsider to think that he has found the golden idea in payments and observe one bank (that he spoke to) introducing 'his' idea. However, this was certainly not a unique idea, but an inevitable, already foreseen consequence of technology migration and fraud.