Draft EBA response to the EC Consultation Document on Fintech: a more competitive and innovative European Financial Sector Background
1. On 23 March 2017 the EC published a Consultation Document on Fintech - A more competitive and innovative European Sector. This document sets out the EBA response to a subset of questions that are being asked in the Consultation Document.
The EBA has selected questions that are relevant for, i.e, fall into the scope of action of, the EBA and its 28 national member authorities.
2. In addition, the EBA is in the process of carrying out its own assessment of FinTech activities and estimates to publish its own Discussion Paper in the coming months.
Questions in the EC Consultation Document and the EBA response
Question 1.5: What consumer protection challenges/ risks have you identified with regards to artificial intelligence and big data and analytics (e.g. robo-advice)? What measures, do you
think, should be taken to address these risks/challenges?
3. The EBA has reviewed the topic of automation in financial advice, often referred to as roboadvice, within the Joint Committee of the ESAs and published, in December 2016, a Report that outlines the main risks and opportunities of this innovation cross the insurance, banking and investment sectors.
The Report looked at the various ways in which the human
interaction in the relationship between consumers and financial firms is being replaced by automated tools and algorithms through which the consumer receives, or perceives to
receive, advice or advice-like recommendations.
4. The main consumer protection risks identified by the Joint Committee were related to the following aspects:
a. consumers having limited access to information and/or limited ability to process that information (e.g.: consumers might make unsuitable decisions or receive unsuitable advice or be not fully aware about the extent to which the tool
produces recommendations tailored to them, etc.);
1 See the Report on automation in financial advice, published by the Joint Committee of the ESAs in December 2016
b. possible malfunctioning of the tool due to errors, hacking or manipulation of the algorithm (e.g.: consumers might suffer detriment because the automated financial advice tool they use is hacked and the underlying algorithm is manipulated; etc.);
c. legal disputes arising due to unclear allocation of liability (e.g.: consumers might lack motivation to act on advice given by automated tools where such tools do not facilitate an end-to-end process, etc.); and
d. the widespread use of automated tools (e.g.: consumers might lose out as a result of automated advice tools being based on similar algorithms, resulting in many consumers taking the same actions in relation to the same types of products/services; etc.)
5. The ESAs arrived at the conclusion that the proliferation of this innovation is still at an early stage and is not equally widespread across the three sectors, being currently most prominent in the investment sector.
As a result, the Report concluded that additional cross-sectoral requirements are not necessary at this stage, but that, given the growth potential of this innovation, the ESAs should continue to monitor the evolution of this innovation separately, in each of their respective sectors.
Following this joint work, the EBA is continuing to monitor this innovation within its regulatory remit.
6. The EBA is also currently looking, together with the other two ESAs, at the use of Big Data analytics by financial institutions. The Discussion Paper published in December 2016 by the
Joint Committee of the three ESAs outlined a number of potential benefits and risks of this innovation.
At the time of writing this response, the ESAs were analyzing the responses received to their public consultation on this topic, with a view to fine-tuning their analysis and decide which, if any, regulatory and/or supervisory actions may be needed.
7. The main classes of risks to consumers identified in this area include risks related to reduced comparability of financial services as a consequence of the increasing personalisation that Big Data makes feasible. Increasingly personalised methods for disclosing information and/or personalised products could ultimately make it harder for consumers to compare offers with
another.
8. Unclear information and limited comprehension by consumers about the extent to which the offer or service provided is tailored to them and/or represents a personal recommendation
may also create detriment to consumers. Big Data might also be used to monitor and predict consumer sentiment towards certain products and institutions and to understand consumers preferences, with a view to offer targeted discounts or additional services.
In the end, targeted offers and advertisements could be seen as aggressive or lead to investment decisions which may not be always in the interest of consumers.
9. In parallel, the EBA has also undertaken an extensive analysis of the use of innovative uses of data by financial institutions (see EBA/DP/2016/01 on innovative uses of consumer data by financial institutions) highlighting the potential benefits and risks of the innovative uses of consumer data that the EBA has observed across its regulatory remit, and the extent to which existing EU law may already address some of the risks identified.
The EBA aims to publish later this year its final Report on this topic. On this topic, the main risks for consumers that have been identified are
a. the risk that consumers are not being properly informed of, or not being able to understand, how their data is being used;
b. the risk of consumers data being misused for purposes that were not disclosed to them or to which they did not consent; and
c. the risk of consumers choice to change providers being limited, if financial institutions do not allow them to transfer their data to a new provider (lock-in risk).
10. The EBA preliminary assessment indicates that further policy actions should focus on raising consumer awareness, supervisory convergence and encouraging further dialogue and cooperation between national competent authorities across policy boundaries, in order to ensure consistency in the application of the legal framework and provide more legal certainty
to market participants.
11. Within the context of this work, the EBA also noted a number of specific concerns raised by market participants relating to Big Data, such as risks related to price discrimination, financial exclusion or non-transparent credit scoring and decision-making. Given the cross-sectoral nature of these risks, the EBA will further assess them in the context of the joint work of the ESAs on the topic of Big Data.
Question 1.6: Are national regulatory regimes for crowdfunding in Europe impacting on the development of crowdfunding? In what way? What are the critical components of those
regimes?
12.The EBA is aware that a number of Member States have adopted national authorisation or registration regimes in relation to crowdfunding. Overall, these regulatory interventions seem
to have the twofold objective of promoting crowdfunding as a source of funding to the economy and address key risks that arise from this financing channel, notably for investors.
Some of these regimes have a prudential component, some have a conduct of business component, and some impose reporting or disclosure requirements, for example by requiring
adequate disclosures to make lenders aware of the risks associated.
13.National regulatory regimes may support a safe development of crowdfunding at national level. On the other hand, platforms will need a sufficient pipeline of project owners seeking funding, or of investors, to grow their business. One response to the search for economies of scale by platforms has been to develop cross-border participation, particularly where the platform is located in a smaller Member State.
There are examples of both investment and lending-based crowdfunding platforms which have overcome the diverging domestic regulatory frameworks and have successfully set up individual legal entities in each country where they seek to operate.
14.However, the need to comply with different requirements may be costly for platforms. It has to be noted that the lack of a passport could make it harder for platforms to achieve the
scalability they need. Further, although national regimes seem to be overall consistent in their approach, divergences in the specific design and implementation of regulatory frameworks
could create obstacles to the development of cross-border activities and lead to market fragmentation. This could prevent smaller platforms achieving the scale necessary to comply
with the costs of operating across borders.
15. It is therefore unfortunate that there is no bespoke regulatory regime for such entities under EU law. This may create regulatory gaps, leave some risks un-addressed, and impede the growth opportunities that crowdfunding achieves.
16. Such a regime is what the EBA recommended in its 2015 Opinion on lending-based crowdfunding, which was addressed to the European Commission, the European Parliament and the EU Council. In the Opinion, the EBA advocated for a consistent convergence of practices across the EU for the supervision of crowdfunding, in order to avoid regulatory arbitrage, create a level-playing field and ensure that market participants can have
confidence in this new market 2. See EBA Opinion on lending-based crowdfunding, published in February 2015.
17. The Opinion also highlighted the risks identified by the EBA (to borrowers, lenders and platforms) and proposed solutions on how to address those risks. It proposed to the European Commission and EU co-legislators to clarify the applicability of already existing EU law to lending-based crowdfunding and identified the Payment Services Directive as the Directive that is most feasibly applicable to lending-based crowdfunding, covering the payments-related aspects of crowdfunding activities.
However, unfortunately, the EU Commission subsequently decided not to follow our recommendation and did not introduce
an EU-wide regime.
18. The EBA Opinion also highlighted that the PSD would still not be sufficient to cover the lending-related aspects of crowdfunding, which may leave several risks unaddressed, such as insufficient requirements on any due diligence processes and assessment of borrowers creditworthiness conducted by a platform, and lack of safeguards against platform default.
19. For these risks and risk drivers, the EBA Opinion suggested potential ways to address them, including requirements regarding due diligence procedures on projects advertised on a
crowdfunding platform, and requirements regarding internal procedures and to address platform defaults.
20.Since then, the EBA has also observed some platforms that are currently operating within the scope of MiFID and PSD and that are therefore automatically captured by the Directive (EU) 2015/849 (the “4AMLD”) and are obliged to carry out due diligence checks on their customers, which would in most cases include project owners as well as investors. In that way the crowdfunding platforms can reduce the risk that they could be used to raise funds for terrorist financing, or to launder illicit funds.
21.However, the extent to which anti-money laundering and counter-terrorist financing measures should be applied by platforms which fall outside the scope of MiFiD and PSD would depends currently on the scope of national law.
This presents the risk of regulatory arbitrage and crucially, creates terrorist financing and money laundering vulnerabilities. Due to the fact that crowdfunding is akin to regulated activities such payment services and credit intermediation, and considering its cross-border potential, it would therefore be desirable if a European wide regime could be created which would ensure that all crowdfunding platforms fall within the
scope of the 4AMLD.
22.However, before reaching definitive conclusions an in-depth analysis of current national debt based crowdfunding regimes would be required. In the context of the EBA ongoing work on
FinTech, the EBA is undertaking a comprehensive analysis of these regimes and will report in the coming months on this topic.
Question 1.7: How can the Commission support further development of Fintech solutions in the field of non-bank financing i.e. peer-to-peer marketplace lending, crowdfunding, invoice and supply chain finance?
23. With reference to lending-based crowdfunding, please see answer 1.6 above. The EBA is also currently undertaking a broader assessment of FinTech innovations, is carrying out its own assessment on this topic and aims to publish its conclusions later this year.
Question 1.8: What minimum level of transparency should be imposed on fund-raisers and platforms? Are self-regulatory initiatives (as promoted by some industry associations and
individual platforms) sufficient?
24.The EBA Opinion on lending-based crowdfunding identifies a number of ways in which the risks identified could be mitigated. This includes, among others, a number of disclosure requirements with which crowdfunding platforms should comply.
The following should be considered only as a general policy indication. More detailed analysis of impacts on the lending
based crowdfunding industry has to be provided before setting the specific disclosure requirements.
25. For example, and without prejudice to a more detailed analysis that you would be required, in order to address the risk that lenders might not have sufficient financial literacy to conduct a risk assessment of a particular crowdfunding initiative, the website of the platform should contain information on projects, fund-raisers and financing mechanisms and also include
information on the risks for lenders, including the risk of total or partial loss of the capital invested, of not obtaining the expected return and of the lack of liquidity.
Also, another way of addressing this risk would be if crowdfunding platforms were required to conduct, and make available to lenders, a risk analysis, of the project financing provided by a borrower.
26. Also, fund-raisers could be required to provide important data regarding their creditworthiness to crowdfunding platforms and/or to lenders.
27. Furthermore, crowdfunding platforms should disclose detailed information of the extent to which a risk assessment has been performed and disclose the checks that have been
performed during the selection of projects, in order to strengthen the ability of lenders to make informed decisions. In any event, a platform should be required to disclose, in a way
that is fair, clear and not misleading, if it does not undertake risk assessments for projects at all.
Question 2.4: What are the most promising use cases of technologies for compliance purposes (RegTech)? What are the challenges and what (if any) are the measures that could be taken at EU level to facilitate their development and implementation?
28.The EBA would welcome a coordinated approach to the use of technologies for regulatory and compliance purposes and is ready to work with competent authorities and the industry to
identify the most relevant use cases, in particular in the field of supervisory reporting, and the use of innovative technologies to improve supervisory efficiency and effectiveness and ensure
that at least a certain degree of standardisation and interoperability is achieved.
Question 2.5: What are the regulatory or supervisory obstacles preventing financial services from using cloud computing services? Does this warrant measures at EU level?
29. There is a growing importance of cloud services as a driver of innovation and an increasing interest for the use of cloud outsourcing solutions within the banking industry. Following
interactions with several stakeholders, the EBA identified the need for developing specific guidance for outsourcing to cloud service providers. It appeared that there is a high level of
uncertainty regarding the supervisory expectations that apply to cloud outsourcing and that this uncertainty forms a barrier to institutions using the cloud services.
The increasing threats increasing threat of cyberattacks and their potential impact on the availability and security of data must be carefully considered. There are also some differences in the national regulatory and supervisory frameworks for cloud outsourcing. The EBA is of the view that there is a need for harmonization on cloud outsourcing. The Commission may consider whether existing EU law adequately covers these risks.
30.The EBA developed draft Recommendations on outsourcing to cloud service providers by credit institutions and investment firms, which were published for public consultation on 18
May 2017 (See the draft EBA draft Recommenadations on outsourcing to cloud service providers, published on 18 May 2017), but the maximum harmonising nature of the PSD2 makes it difficult to achieve the same for payment services providers. The aim of these recommendations is to provide
common guidance for credit institutions and investment firms should they wish to adopt cloud solutions and reap the benefits of cloud computing, while ensuring that risks are appropriately
identified and managed.
The recommendations also aim to foster convergence in the
supervisory expectations and practices on cloud computing. In particular, the recommendations address five key areas: the security of data and systems, the location of data and data processing, access and audit rights, chain outsourcing, and contingency plans and exit strategies.
Question 2.6: Do commercially available cloud solutions meet the minimum requirements that financial services providers need to comply with? Should commercially available cloud solutions include any specific contractual obligations to this end?
31. With the development of the draft Recommendations on outsourcing to cloud service providers, the EBA aims to provide common guidance to credit institutions and investment firms that wish to adopt cloud solutions, including requirements around key contractual provisions.
32. Compared to more traditional forms of outsourcing offering tailor made solutions for clients, cloud outsourcing services show a much higher level of standardization which allows the
services to be provided to a larger number of different customers, in a much more automated manner on a larger scale.
This could shift the negotiation power in contractual negotiations between large cloud service providers and relatively small institutions towards the service provider. The draft recommendations aim to provide not only clarity around supervisory expectations on key contractual provisions but can also be a useful tool for institutions in the negotiations with cloud service providers to ensure that the institutions can establish conditions that ensure that regulatory requirements are met.
Question 2.10: Is the current regulatory and supervisory framework governing outsourcing an obstacle to taking full advantage of any such opportunities?
33. Directive 2013/36/EU (CRD IV) requires institutions to meet at all times all regulatory requirements that are necessary to receive authorisation. This includes the requirements applicable to activities that are outsourced. The responsibility for meeting the requirements cannot be transferred to the service provider as they are in most cases not subject to authorisation and supervision.
Contracts for any outsourcing need to ensure sufficient control rights for the institution and their supervisors so that they can ascertain that the requirements are met. Changing this principle would put the institution and depositors at risk.
34. The CEBS Guidelines on Outsourcing (See CEBS Guidelines on Outsourcing, published on 14 December 2006) provide common principle based guidance for outsourcing by credit institutions. With banks increasingly relying on third parties, including FinTech organisations to support operations there is a need for appropriate due diligence and oversight.
Under the CEBS Guidelines on Outsourcing, the ultimate responsibility for outsourced functions must always be retained by the outsourcing institution, and institutions need to have appropriate processes for due diligence, risk assessment and ongoing monitoring of any operations outsourced to a third party provider.
35. One of the key enabling technologies driving the use of FinTech is cloud computing. The EBA developed draft Recommendations on Outsourcing to cloud service providers to provide additional guidance for the specific context of cloud outsourcing in addition to the general CEBS Outsourcing guidelines. The EU-wide common guidance should allow institutions to leverage the benefits of using cloud services, while ensuring that the related risks are adequately identified and managed.
Question 2.11: Are the existing outsourcing requirements in financial services legislation sufficient? Who is responsible for the activity of external providers and how are they supervised? Please specify, in which areas further action is needed and what such action should be.
36. In line with CEBS guidelines on outsourcing, a (credit) institution may outsource any activity as long as it does not impair:
a. The orderliness of the conduct of the outsourcing of the institution business or of the financial services provided;
b. The senior management ability to manage and monitor the institution business and its authorized activities;
c. The ability of other internal governance bodies, such as the board of directors or the audit committee, to fulfil their oversight tasks in relation to the senior management; and
d. The supervision of the outsourcing institutions.
37. In order to ensure an appropriate management of outsourced activities, credit institutions must retain an appropriate organization to oversee and manage the relationship with the service provider and in particular have control functions in place that manage the risks related to the outsourcing contracts and outsourced activities. The guidelines require for all
outsourcing arrangements to be subject to a formal contract.
This outsourcing contract should ensure that the outsourcing service provider performance is continuously monitored and assessed and include an obligation on the outsourcing service provider to allow direct access by the outsourcing institution supervisory authority to the relevant data and premises of the outsourcing service provider.
The guidelines also require that the outsourcing contract includes the right for the supervisory authority to conduct on-site inspections at an outsourcing service provider premises, where provided for by the national law.
38. The draft Recommendations on Outsourcing to Cloud service providers require for outsourcing institutions to ensure that the outsourcing contract allows for the right of access for the institution, its competent authority, or any appointed third parties to the cloud service provider business premises, including the full range of devices, systems, networks and data used for providing the services outsourced.
The outsourcing institution should ensure that the contractual arrangements do not impede its competent authority to carry
out its supervisory function and objectives. Based on the findings of its audit, the competent authority should address any deficiencies identified or impose measures directly on the
outsourcing institution.
39. In addition to the CEBS Guidelines and the EBA draft Recommendations on Outsourcing to Cloud service providers (that apply to credit institutions and investment firms), further
provisions on outsourcing are included under the Payment Services Directive (PSD2) that apply to payment institutions and electronic money institutions.
Similarly with the CEBS Guidelines, PSD2 provides that the outsourcing payment institution remains liable for the
activity of the external providers to which activities are outsourced and provides a series of obligations with which payment institutions and electronic money institutions have to
comply if they wish to outsource activities to third parties, including oversight rights for competent authorities.
40. The EBA will update the CEBS Guidelines on outsourcing later in the year.
41. In addition, the EBA has issued a Consultation paper on internal governance of credit institutions that was published on 28 October 2016 for a 3 month Consultation and that includes requirements on outsourcing policy.
Question 3.1: Which specific pieces of existing EU and /or Member State financial services legislation or supervisory practices (if any) and how (if at all) need to be adapted to facilitate implementation of Fintech Solutions?
42. The EBA is currently undertaking a comprehensive review of Fintech entities in the EU, including their activities and regulatory status under EU and national law and will be reporting on these issues in the coming months.
43. However, by way or preliminary observations, the EBA notes that FinTech entities may be regulated pursuant to EU law (e.g the CRD/ERR,PSD and EMD) but other may be regulated
pursuant to an authorisation or registration regime prescribed under national law and indeed some firms may not be regulated at all at EU or national level.
44.The scope and elements of the regulatory regimes, from both a prudential and conduct of business perspective, differ leading to the potential for differences in the treatment of similar
products and services posing similar risks. The EBA also observes that competent authorities are using different approaches in respect of sandboxes innovation hubs, and similar regimes.
This could give rise to the risk of regulatory arbitrage and level playing field issues and present risks to consumers (e.g. arising from the absence of clarity regarding the regulatory status of
the FinTech entities with whom they are transacting and the benefits and risks of using one firm compared to another) and undermine the achievement of other objectives, for instance,
financial stability.
45. At this stage it is not possible to comment on all aspects of EU law that may need to be changed. However, in the context of the EBA wider work on FinTech, the EBA expects to be in a position to present its observations over the coming months.
46. However, it can be noted that the AML legislation is one of the fields in which further steps could be taken. The Union anti-money laundering and counter-terrorist financing (AML/CFT) framework is set out, amongst others, in the Directive (EU) 2015/849 (the “4AMLD”).
Directive (EU) 2015/849 has to be transposed by 26 June 2017. Until then, many Member States legislation will reflect
similar provisions in Directive 2005/60/EC.
While the Directive does not distinguish between FinTech and non-Fintech firms, it applies only to firms that that are obliged entities for the purpose of Article 2 of that Directive, or to whom AML/CFT obligations have been extended by Member States.
While the 4AMLD is not prescriptive in relation to tools and solutions that can be used by obliged entities when identifying and verifying customers, it lays down only minimum requirements that the obliged entities must comply with, giving Member States flexibility in imposing more stringent standards through their national legislation.
This has led to some Member States imposing legislation which makes it extremely difficult to employ innovative and/ or FinTech solutions in their customer due diligence process. This could potentially hamper the development of FinTech firms providing innovative customer due diligence (CDD) solutions,
and the development of FinTech firms dependent on the use of secure and innovative (nonface to face) CDD solutions to comply with their AML/CFT obligations.
Therefore, it would be desirable for a common approach to be developed in respect of the extent to which FinTech solutions could be used by obliged entities in their CDD process.
47.Also, as financial services provided by FinTech entities are commonly provided via internet, it is often not clear when provision of services via internet means cross-border provision of services under the free provision of services or leads to an establishment, and on what basis.
Nevertheless, this issue is broader and also relate to other traditional financial market entities.
It would be beneficial if the European Commission could clarify these aspects, which in turn would also clarify the applicability of the AML/ CFT legislation and of the conduct of business rules of host Member States in cross-border provision of services.
48.In addition to AML regulation, in general terms, development of FinTech solutions require a regulation inspired by the principle of “same activity, same risks, same rules” in order to guarantee an adequate level playing field to avoid fragmentation in innovation policies, regulatory arbitrage and obstacles to effective competition.
49.Without prejudice to the above, the EBA is currently undertaking an ample analysis on FinTech innovations and is in the process of developing and defining its policy views on this topic, and aims to publish its preliminary conclusions on this topic in the coming months.
50.Finally, more clarity from the EC would be welcome on the scope of the directive 2002/65/EC of the European Parliament and of the Council of 23 September 2002 concerning the distance marketing of consumer financial services, and in particular if it applies to fintech firms.
Question 3.2- What is the most efficient path for Fintech innovation and uptake in the EU? Is active involvement of regulators and/or supervisors desirable to foster competition or
collaboration as appropriate, between different market actors and new entrants. If so, at what level?
51.An active participation of regulators and supervisors should be desirable, following the path opened by the international regulators or supervisors that have been most successful in
promoting FinTech activities. However, a balanced approach in this respect must be found.
Excessive regulation and supervision may impair innovation in the UE and endanger reputation in case of failure.
Question 3.7. Are the three principles of technological neutrality, proportionality and integrity appropriate to guide the regulatory approach to the FinTech activities?
52. The EBA welcomes the EU Commission principles to guide regulatory approach to Fintech: technologically neutrality, proportionality, market integrity, and fully supports this approach.
In addition, EBA would like specifically to add consumer protection principle as a key desideratum that must also be at the heart of any activity adopted by supervisory authorities, including regarding financial innovation. In this context, the mitigation of cyber risks are highly important to protect consumers personal data and against identity theft.
Question 3.8. How can the Commission or the European Supervisory Authorities best coordinate, complement or combine the various practices and initiatives taken by national authorities in support of FinTech (e.g. innovation hubs, accelerators or sandboxes) and make the EU as a whole a hub for FinTech innovation? Would there be merits in pooling expertise in the ESAs?
53. The EBA is currently undertaking an ample analysis on FinTech innovations and is in the process of developing and defining its policy views on this topic, and aims to publish its
preliminary conclusions on this topic later in the coming months
54. EBA believes that so far cooperation between the ESAs on FinTech related issues under the umbrella of the Joint Committee has proved very useful, as illustrated by the JC work on Big Data or automation in financial advice, and looks forward to continue cooperating with the European Commission, the other two ESAs, the EU data protection supervisors and other
national authorities, in its upcoming work on FinTech.
55.As a preliminary observation, the EBA notes that a more clear definition and characterization of innovation hubs and regulatory sandboxes is necessary.
Question 3.11 What other measures could the Commission consider to support innovative firms or their supervisors that are not mentioned above? If yes, please specify which measures and why.
56. Other measures that the Commission may consider include for example reinforcing the links between the EU and third countries notably those that are very active in the innovation
fields. Some NCA have already set up contractual agreement with other countries such as Singapore, Australia, Japan and Hong Kong.
Source: EBA document
