Innovation and Emerging Payments/FinTech

Transcription

1 Innovation and Emerging Payments/FinTech The Regulatory Perspective

2 Wild, Wild West Remote Payments - SMS & Internet Mobile Browser QR Codes mpos PayPal Here Merchant Apps PayPal Text to Buy Text Buy It Mobile App Stores First Mobile Card Acceptance/ mpos NFC + SE Mobile Wallet NFC Mobile Wallet Cloud Digital Wallet NFC + Host Card Emulation (HCE) Apple Beacon BLE Android Contactless Cards Proliferation of Mobile Apps Prepaid Prepaid Bank Account Apple Pay NFC + token AmEx Bluebird Direct Carrier Billing Mobile Bank Account Green Dot 2

3 Payments/FinTech Challenges Security & Standards Data Protec7on Consumer Privacy Fraud Preven7on Interoperability Infrastructure & Technology Online, mobile & POS channel convergence Compe7ng technologies NFC, Cloud, QR code, HCE EMV Migra7on Market & Adoption Low merchant acceptance Influence of nonbanks & merchants Fragmented market/ many wallet solu7ons Complex regulatory structure Legacy System Challenges Finding right value added incen7ves 3

4 Laws & Regs? 5 And ONLY 5 Payment Channels Cash ( Payment Rails ) Check (paper; Check 21 substitute check ) ACH (closed-system model; includes paper checks converted to ACH) Credit/debit/stored value cards (open-loop cards) Wire transfers 4

5 SeSlement Pipes Customer- Facing Payment Mechanism (Mobile Wallet, Retailer App, Mobile Banking App) Payment Processing (Mobile Payments Company, Processor, Bank) 5 RAILS (CC, ACH, Etc.) 5

6 Legal Landscape Fragmented Legal Framework Laws, regs & rules sets Dual banking system complexity Fragmented regulatory regime for non- banks More non- banks in MT business Different consumer protec7ons, disclosure reqs, & error resolu7on provisions depend on payment type Associated with a payment (debit card, credit card, stored value, online payment) should follow that payment through intermediary channels for clearing and seslement Dual banking system with na7onal preemp7on for state laws creates complexity for payment service providers FCC for telecoms, state banking commissioners for MSBs. May tax oversight resources of state banking authori7es 6

7 Consumer Risk Issues CFPB Authority over many applicable consumer laws, incl. EFTA/Reg E (and intnatl. remisance por7ons) Need to meet with new market entrants and ensure understanding of compliance obliga7ons under federal consumer laws (Project Catalyst) Authentication Key Consumer Risk Issues Varying consumer rights by payment channel (and how does a consumer know) BUT several basic payment func7ons that do not vary by channel (ini7a7on/seslement/ records; error resolu7on; who has liability for failure to complete payment) Data Storage and Retrieval (documenta7on/record reten7on) Privacy and Data Security 7

8 U.S. Regulatory System No one authority or law regulates payments or governs mobile commerce Mobile carriers Credit Unions NCUA FCC Federal Reserve U.S. Mobile Payments Ecosystem FDIC CFPB FTC Fraud & ID thef Consumers OCC FinCen CSBS States BSA/AML 8

9 Agency Cliff Notes Consumer Issues Market Monitoring & Regs CFPB, FDIC, FTC Federal Reserve Board & White House CFPB, FCC, FDIC, FFIEC, Treasury, Federal Reserve Banks & Board Emerging Payment En77es Privacy & Informa7on Security Cybersecurity & Fraud Other/ States Treasury & The Board FFIEC, FTC, GAO, Dept. of Commerce, White House Dept. of Commerce, FCC, GAO, Treasury, White House, & Federal Reserve Banks Conference of State Bank Supervisors 9

10 Privacy Laws Permissions & use for payments (linking payment account, use of access device = authorization) Data use and privacy issues: use for transactions, for system performance & third-party sharing Litigation over change in privacy policy terms 4/4/15: CA Federal judge refuses to dismiss classaction lawsuit vs. Google Wallet Google shared private data belonging to Google Wallet customers w/3 rd parties Plaintiffs alleged sufficient facts to show that Google may have breached its contractual obligations and California's Business and Professions Code 10

11 Privacy Laws (cont d) Svenson originally filed the suit in 9/13 after company allegedly shared her personal information with YCDroid, a software developer whose software she had purchased using Google Wallet Svenson claimed Google had shared personal information (name, phone #, & other data), w/ycdroid though the developer had no need for that information in order to complete the transaction Google had breached its agreement not to share Wallet customer data with others unless the data was required for specific purposes like processing a transaction or maintaining a user's account Svenson noted that Google has changed its policies regarding sharing of Wallet customer data w/3 rd parties, but only after she had filed the case 11

12 Takeaways Blurring lines of responsibility and liability but regulation follows the ACTIVITY not the entity New opportunities for compromise from malware and data breaches from new entrants Demonstrated need for stronger authentication and layered security (EMV, tokenization, Geo-location, biometrics) Privacy concerns from data monetization and locationbased services 12

13 Erin F. Fonté, CIPP Member Payments and Digital Commerce Privacy and Data Security Dykema Cox Smith 111 Congress Avenue, Suite 2800 Austin, Texas Direct: Link me in: Erin Fonte