Grant Spencer: Innovation with resilience - a central banker's perspective

Speech by Mr Grant Spencer, Deputy Governor of the Reserve Bank of New Zealand, to the Payments NZ conference, Auckland, 8 November 2016.

The views expressed in this speech are those of the speaker and not the view of the BIS.

Thanks to Payments NZ for inviting me to speak again at your impressive conference. This is a great forum for all involved in the New Zealand payments sector.  I will give you a central banker's perspective.

My theme is innovation with resilience. We are seeing a huge amount of innovation in the payments industry. Since the last conference in 2014, the rapid pace of change has continued, driven by factors such as customer demands, changing technology, new players, and also regulatory changes. A challenge is to ensure that our systems remain resilient through this change.

The Reserve Bank is a system operator and the regulator. We want to be responsive on both fronts. As operator we are upgrading the Exchange Settlement Account System (ESAS) and NZClear systems to ensure they remain fit for purpose. As regulator we are developing an enhanced framework for oversight of New Zealand's financial market infrastructures (FMIs). Today, I will talk about some of the drivers of change, the many risks we face and the proposed new oversight framework.

Drivers of change

The payments landscape is changing dramatically as it experiences 'digital disruption'¹. Customers are now seeking to make and receive payments in real time, from any location, on any device, and at any time. These customers expect payment services to be faster, more personalised, easy to use, inexpensive and fully secure.

The rise in customer expectations is being met and expanded by new providers attracted to the payments industry. We have seen the telecommunications and computing industries merging with the financial industry to provide innovative financial services, including payments services. Much of the innovation in the sector is building on existing technology platforms that are getting faster and smarter. For example, the IBM "Deep Blue" supercomputer that you may recall beat Gary Kasparov back in 1997, is less powerful than the iPhone that we carry in our pocket.

Many of the new developments are taking place in the retail payments space - banks are introducing new services such as mobile and contactless payments, and engaging with new market players such as Apple Pay, Amazon and Alipay. For example, ANZ's recent partnership with Apple Pay. Banks are having to make crucial decisions about how best to respond in the new payments environment. We are also seeing the development of important new technologies, such as Distributed Ledger Technology (or Blockchain) that could have major impacts on payment systems and financial market infrastructures down the track. 

Major technology upgrades are underway in over 15 countries that have or are in the process of deploying real time payment systems. One close to home is the New Payments Platform in Australia, which will give immediate clearing and settlement, and is scheduled to be implemented next year.

Local banks are also speeding up their payments using existing technology. The payments pipeline project aims to address settlement risk within Settlement Before Interchange (SBI) by minimising the delays between the issuance and settlement of payment instructions. After two years of work, interbank retail payments should soon be settling within an hour. This will meet the consumer demand for faster clearing of funds and reduce settlement risk within SBI.

Payments NZ recognises the rapidly changing landscape and has initiated the Payments Direction project, which involves environmental scanning and collaboration with key industry players. This work, including various white papers and initiatives such as today's conference, are positive for the future of the industry.

Higher level of risks

Alongside the rapid pace of innovation and technological change, there are some serious risks.  For example, a couple of months ago, Yahoo confirmed that 500 millions user accounts had been stolen - one of the largest cybersecurity data breaches ever.

In the payments world, similar risks exist around the handling and storing of customer data. And, with customers increasingly demanding 24-7 access, payments disruptions for only short periods can cause major inconvenience. 

A particular source of risk is the concentration of outsourcing to third-party infrastructure suppliers. A major EFTPOS outage, for example, would mean many people and businesses cannot transact, even though they are connecting through a range of banks. For example, severe weather in Sydney a few months ago affected Amazon Web Services and led to widespread ATM and EFTPOS outages. This highlighted the issue of banks' reliance on third party providers and not always having backup for their servers at alternative sites. 

Another key risk is the growth in payments fraud. While consumers expect secure, fast and reliable service, the opportunities for fraud are widespread and perpetrators are more innovative. We saw this with the cyber-heist at the central bank of Bangladesh earlier this year. Nearly USD$80 million is still unaccounted for as a result of that breach. And the hackers came close to getting away with USD$1 billion.

New Zealand has been less exposed to cyber-heists than many other countries, ranking 18th of 19 in the list of most attacked countries in the Asia Pacific Region (Australia is 16th and Pakistan 1st)². But with the landscape evolving so rapidly, it is important that the industry remain ahead of the game on cyber-security and be cautious when adopting new technologies and payment solutions.

Network effects are inherent in payment systems and other FMIs, and result in a high degree of systemic risk. If FMIs are not well managed, they can become a conduit for the contagion of shocks across the financial system. This challenge concerns central banks and other payments regulators. How can we make FMIs more robust under stress, and how can we mitigate the potential contagion effects resulting from an FMI failure?

International policy response

International policy makers are responding to these growing risks in the FMI sector. Financial regulation since the global financial crisis has been strengthened, and this is also true for FMIs, particularly where systems are deemed to be systemic. 

Many new prudential standards now apply to FMIs, including the Principles for Financial Market Infrastructures (PFMIs)³ developed by the Committee on Payments and Market Infrastructures (CPMI) and the International Organisation of Securities Commissions (IOSCO); the OTC derivatives reforms agreed by the G20 and the Key Attributes of Effective Resolution Regimes from the Financial Stability Board (FSB)⁴. This year has seen the first internationally agreed guidance on cyber security from the BIS: Guidance on Cyber Resilience for FMIs⁵. Many jurisdictions, particularly within the G20, are implementing these reforms.

The Reserve Bank's response

This leads me to the new oversight framework that the Reserve Bank and Financial Markets Authority (the FMA) have been developing for FMIs in New Zealand.

The case we make for oversight is driven by potential market failures inherent in many FMIs, in particular negative network externalities where operators or participants might not fully consider the wider social costs of their actions, particularly in stress situations.

While the Reserve Bank has had responsibility for overseeing the payments system for over a decade, we believe the current legislation is no longer fit for purpose. The lack of crisis management powers and our limited ability to induce system improvements mean we are not able to fully meet our mandate of promoting a sound and efficient payments system. Many of you provided input to our review of the FMI oversight regime over the last couple of years, and I thank you for that. We have taken our time in developing the framework so that it will be fit for purpose and reflect a risk-based approach to regulation.

The new oversight framework, yet to be enacted, has several key features:

• The Reserve Bank and FMA would have information gathering powers in order to better identify emerging risks
• An FMI that is assessed as being systemically important would be required to be designated under a revised Designation Regime
• The Reserve Bank and FMA would have enhanced oversight of designated FMIs, including powers to: set requirements on governance and BCP standards;  influence FMI operating rules, and play a key role in crisis management
• Currently designated FMIs would continue to be able to seek legal protection for netting and settlement under the revised regime. Other new non-systemic systems would also be able to opt-in to the new regime.

To assess whether an FMI is systemically important, we are using international standard criteria: the size and concentration of financial risks within the FMI; the role and the nature of the transactions it processes; the extent to which there are alternative services available; and the FMI's interdependencies with other FMIs. Our initial assessment identified nine FMIs that are either systemically important or potentially of systemic importance. Four of them are already designated systems: ESAS, NZClear, CLS and NZCDC. Two of the Payments NZ systems - SBI and HVCS - are also likely to be designated under the new framework. There are another three offshore based FMIs that are on this list too, including LCH, ASX Clear (Futures) and Singapore's DTCC (trade repository).

A key feature of the proposed new framework is crisis management. We are proposing that the Reserve Bank and FMA would have a tools to respond if a systemically important FMI fails or is about to fail. In such a situation, we want to facilitate an orderly recovery or resolution so as to minimise potential disruptions to the financial system.

While the focus will be on systemically important FMIs, the proposed framework will help us monitor emerging risks in the broader industry. This would not be an "all-or-nothing" oversight regime. Rather, it would give the Bank and the FMA flexibility to tailor the oversight regime in light of the risks identified. The oversight regime would continue to be less intrusive than in most other jurisdictions.

As in our recent engagement with the industry on the potential impact of a point-of-sale switch outage, we will seek to identify relevant action points for the Reserve Bank and industry. But, consistent with our broader regulatory philosophy, we will avoid prescriptive solutions if possible. Industry cooperation and rigorous self-assessment in the context of international standards is preferable to regulatory intervention.

The proposals are still subject to Cabinet approval. The next step in the process would be to prepare new legislation.  The Reserve Bank would issue an exposure draft for consultation around the end of Q1 or early Q2 next year.

Apart from the new regulatory framework for FMIs, the Ministry of Business, Innovation and Employment (MBIE) has recently released an issues paper on retail payment systems, their focus being on merchant service and interchange fees. This is an important efficiency and competition issue that many countries are grappling with. The Reserve Bank and the Government share the common objective of a sound and efficient payments system and which facilitates innovation and open access. The Government's issues paper looks at features of the retail payments system that may also have broader social efficiency implications, for example arising from the allocation of costs associated with new payment services. I encourage you to consider and make submissions on the issues paper.

Replacement technology for ESAS and NZClear

The Reserve Bank operates two important parts of the New Zealand payments infrastructure: ESAS and NZClear. These systems, both of which are designated, need to remain reliable, efficient and fit for purpose. We also need to be responsive to changing customer demands and new technologies. The current ESAS and NZClear systems, introduced in 1998 and 1990, have served us well, but both now require upgrades. The replacement project underway aims to implement systems that meet modern standards of reliability and security while having sufficient capacity and agility to meet customers' performance expectations.  At this point, these upgrades are expected to be completed by the end of 2018.

Closing

In conclusion, I want to reinforce what I have said about the proposed new FMI oversight regime.  We have sought your input to the regime over recent years and we believe we have listened. We do not envisage that the new framework will significantly change how the payments industry operates or how we engage with each other. We already have a very collaborative relationship with the industry, including Payments NZ. While some current processes will be formalised over time, the nature of our open engagement means there should not be surprises. We want to continue our open dialogue with the industry, allowing mutual goals to be achieved in a low key and non-prescriptive manner.

The rapidly changing payments landscape provides challenges and opportunities. Competition in payments is important but collaboration is also needed between financial institutions, new entrants and policy-makers. This is necessary to create the right environment for modernising the payments system and sensibly managing the risks that arise. Effective innovation is often best achieved through collaboration and we encourage the industry to move in this direction.

For the Bank, the main focus is on preserving financial stability while also facilitating innovation and improved efficiency. To do this, we need to keep abreast of the changing technology environment and continue to assess the level of preparedness of the system to handle adverse shocks. The challenge for the Reserve Bank, and for all of us, is to understand the evolving financial services landscape, including its opportunities and vulnerabilities. As we move forward in this rapidly changing environment, it serves all our interests to first ensure the safety of the system. This is the foundation for achieving innovation and growth in the industry. 

---

¹ Watson, A (2016), "Disruption or distraction? How digitisation is changing New Zealand banks and core banking systems', RBNZ Bulletin,78(8).

² Based on Microsoft's Malware Infection Index 2016.

³ Bank for International Settlements (BIS) - Principles for Financial Market Infrastructures (PFMI).

⁴ Financial Stability Board (FSB) - Key Attributes of Effective Resolution Regimes for Financial Institutions.

⁵ Bank for International Settlements (BIS) - CPMI-IOSCO release guidance on cyber resilience for financial market infrastructures.