MyBank Article published in Trends im Zahlungsverkehr II, Bank-Verlag January 2015 / Page 1

Transcription

1 January 2015 / Page 1 Unlocking the payment account for online services while keeping account-related data safe: Payments, mandates, identity and online trust services with MyBank Management Summary: Account-based payment services provide numerous benefits for consumers and retailers in the internet age where the buyer and seller are not face to face. There is space in the online payment market for a solution that is based on the four-corner model involving the online banking environments of the payment service providers of both buyer and seller. This is particularly true for a solution that is pan-european by nature and thus supports cross-border transactions. The present article describes the potential of the pan-european e-authentication solution MyBank taking into account the current European e-commerce market and emerging regulatory developments in the online space. Conceived as a multi-purpose solution, MyBank went live with a solution supporting the initiation of SEPA Credit Transfers for online purchases in 2013, will introduce e-mandate solutions at a pan-european level in October 2014 and is expected to respond to the demand for Access to Account services and e-identity services in the near future. Why payments often turn into a stumbling block online The internet has a growing impact on our shopping behaviour. Consumers expect to be able to buy goods and services from around the world at any time and place. Unfortunately, the reality of payments does not always seamlessly support this borderless world of instant execution. When it comes to paying for an online purchase, it often still matters where a merchant or a consumer is located, since this may restrict the range of available payment methods, of which many are based on national or regional schemes and legal frameworks. Some payment instruments that are very popular in the offline world also lack a practical electronic equivalent that would allow their wide use in an online environment. This is the case for SEPA Direct Debits, which need to be based on an electronic mandate to work online. While direct debits are widely used at a national level for online purchases as they are easy to use and highly trusted, currently no pan-european equivalent exists in the online world because the required electronic mandate has yet to be implemented. Accordingly, large creditors, such as utilities or insurance companies, find it difficult to unlock the benefits of Europe-wide direct debit collections online. Aside from legal and technical restrictions, lack of trust is another major issue hampering a smooth online check-out. Many consumers are still afraid to purchase online because of concerns that they may lose their money or that their payment or account data could be compromised; those who do often restrict themselves to well-known brands. Merchants, on the other hand, have to cope with rising fraud rates: in France, for instance, online payments represented 9.2 percent of the overall payment transaction value in 2012, but 61 percent of the value of fraudulent transactions. 1 The ECB reports for that 1. L Observatoire de la Sécurité des Cartes de Paiement. Rapport Annuel p Press release on the publication of the 3 rd report on card fraud. European Central Bank. 25 th February 2014.

2 January 2015 / Page 2 1 in every 2,635 was lost, and that fraudulent internet transactions continue to be on the rise, in line with the strong growth of online sales. Against this background, it should come as no surprise that only eight percent of EU consumers have used the internet to purchase goods from another EU country 3 and that merchants and big billers keep looking for safer payment methods with a potentially wider reach. Why online authentication is another key topic Payments are not the only stumbling block when it comes to buying goods or using services on the internet. As the range of products and services offered online continues to soar, there is a growing need for processes that allow the providers of these products and services to easily identify or authenticate their customers. This is a particularly pressing requirement for public agencies that wish to provide administrative services online or for merchants selling products or services that should only be made available to adults. Today, online processes are often not adequate for customer due diligence purposes, so currently many an online search, order or purchase still requires a final paper signature including key documents sent by fax or scan, if not the originals themselves. Ecommerce Europe, a European Merchant Association dedicated to e-commerce and online retail, states in its 2014 position paper: For merchants, it is key to verify the identity of the consumer. For consumers, properly functioning and reliable e-identification can help secure their online identities. Electronic signatures and e-identification mechanisms increase trust in the electronic commerce market. e-identification schemes based on real IDs, verified by the government (or another trusted party) would help to reduce cybercrime and fraud. The position of E-commerce Europe reflects the growing recognition among merchants that online authentication and authorisation of customers is a crucial issue, which can quickly turn into a considerable burden if the merchant himself has to collect and safeguard the necessary information. There is an increasing sensitivity to protect personal data online both from a privacy point of view and from the point of view of identity theft and fraud. With the growth of online services and the increasing amount of data stored online, security is becoming more and more important as the possible damage done by hacking an account has grown significantly. Accordingly, online merchants are calling for solutions that reuse existing authentication methods and e-identification operable on all devices; 4 most of them largely prefer such solutions to investing in the build-up and protection of their own data silos. Thus, there is a clear need in the market for widely available online authentication services based on highly secured data repositories. As Ross Anderson, Federal Reserve Bank, Kansas City, put it: If you solve the authentication problem... everything else is just accounting. 5 How European regulation will impact online payment and authentication services Facilitating e-commerce and e-government is 3. Eurostat community survey. ICT usage in households and by individuals Ecommerce Europe. Position Paper e-identification and Online Trust Service A Holistic Approach to e-identification, Online Authentication and e-signatures pp EBA Working Group on Electronic Alternative Payments. Opinion Paper on Digital Identity: From check-out to check-in. Version 1.0, 13 th May 2014, p. 9.

3 January 2015 / Page 3 high up on the agenda of the European regulators as well. The Digital Agenda for Europe, which is geared at encouraging European citizens to make transactions online, has over 100 actions spread across seven pillars including Pillar I: Digital Single Market and Pillar III: Trust and Security. 6 The SEPA Migration End-Date Regulation, which came into force in 2012, mandated the roll-out of pan-european payment services with the aim to create an integrated payment environment for euro payments, the Single Euro Payments Area (SEPA), for the benefit of businesses and consumers. At present, regulatory initiatives are under way that will introduce new requirements in relation to payment and authentication services in an online environment: The Payment Services Directive 2 will provide a legal framework regarding the access to information on the availability of funds payment by third party providers; The General Data Protection Regulation is aimed at protecting individuals with regard to the processing of personal data, opening the market, but also imposing effective sanctions in case of breach of the law; The E-identity and Signature Regulation is geared at creating a predictable regulatory environment to enable secure and seamless electronic interactions between businesses, citizens and public authorities, which will increase the effectiveness of public and private online services, e-business and electronic commerce in the EU. The implementation of these new European Regulations and Directives will have an impact on the creation of new online payment and authentication services and the evolution of existing ones, since the new requirements are expected to improve the way consumer data is handled, protected and accessed in the context of online transactions and, in particular, payments. This should help to foster trust among European consumers with regard to online services offered in Europe. What value Online Banking e-payments solutions can deliver Aside from a trusted regulatory framework, trusted services and service providers are key to encouraging consumers to make online transactions. Convenience, familiarity and security are all integral to enhancing the user experience and ensuring that consumers complete their online purchases. The selection of a payment method and the successful execution of the payment are crucial elements in this check-out process. According to a Baymard Institute survey of June 2013 with 1,505 respondents, the choice of payment methods offered by an e-commerce site is one of the top five reasons why customers abandon their virtual shopping cart the other issues being extra cost (e.g. for shipping), forced account creation, credit card trust and a complicated check-out process. The average documented online shopping cart abandonment rate, by the way, stands at percent For further information on the Digital Agenda refer to For further information on Pillar I and III refer to Our Goals under digital-agenda/en/our-goals. 7. This value is an average calculated by the Baymard Institute based on 27 different studies from 2006 to 2014 containing statistics on e-commerce shopping cart abandonment:

4 January 2015 / Page 4 Offering a payment method based on an Online Banking e-payments (OBeP) solution helps e-merchants to avoid some of the major drop-out reasons: OBeP solutions require no special registration and simply redirect consumers to the familiar and trusted online banking environment of their own bank for the execution of a payment. In detail, the key benefits of such a solution for consumers are the following: Trusted environment: consumers trust the online or mobile banking platform of their bank, which they already use for other payments and financial transactions; Simple process: consumers are always redirected to their familiar online or mobile banking portal; they do not need to key in any additional passwords or manage any additional accounts; What added value the MyBank solution can deliver While there are OBeP solutions in place and thriving at national level in a number of European countries, the MyBank solution created by EBA CLEARING is the first such solution with a pan-european scope. The bank-owned provider of pan-european payment infrastructure solutions delivered MyBank as a result of its e-services initiative launched in 2010 with a view to helping to solve the growing demand for e-payments, e-mandates, e-invoicing and other e-services. The aim was to reconcile the requirements of consumers, merchants, banks of all types (including the newly created payment institutions) and create a light, realtime solution that would be both easy to use and highly secure and that could be used all across Europe, i.e. both for purely national transactions and cross-border transactions. Protected data: consumers do not disclose any personal details to the merchant as part of the payment process; the payment data stay with the bank. For merchants, the key benefits of an OBeP solution are the following: Fraud reduction: fraud rates can be significantly decreased through the use of an online banking-based payment method, since the payment is initiated through the customer s highly secured online or mobile banking interface; Growth of online sales volume: research shows that merchants can considerably reduce drop-out rates if they introduce payment methods that consumers consider as being of less risk to them. 8 MyBank went live in March 2013 in three countries with a solution supporting the initiation of SEPA Credit Transfers for online purchasing transactions. By early 2014, the solution had built up considerable reach in Italy in particular and merchant acquisition had taken off on a larger scale. Within less than twelve months after the launch, MyBank had become available to twelve million consumers. MyBank is based on a four-corner model involving both the buyer and seller side and supports the initiation of payments via online banking as well as mobile banking: 1. Customers select the goods they want to buy and proceed to a check out page. They are offered a method of payment and select MyBank. 2. They are prompted to enter the name of their bank and are then immediately 8. ibi research. Erfolgsfaktor Payment: Der Einfluss der Zahlungsverfahren auf Ihren Umsatz: Aktuelle Ergebnisse zum Bezahlverhalten der Endkunden aus dem Projekt E- Commerce-Leitfaden. Edition 2, 2013.

5 January 2015 / Page 5 redirected to their own internet banking site and enter their credentials. 3. The customer is presented with a secure, pre-filled credit transfer containing all the relevant payment details for the transaction. The customer confirms the credit transfer. Figure 2 below. MyBank goes a step further by bringing together five elements to create a trust framework: a central brand or trustmark, end-to-end rules for the participating parties, technical standards, a centrally maintained registration directory and a solution manager function managing all these components. Each component is necessary for an integrated solution that gives security and usability. A key role is that of the Solution Manager, which manages the rules around MyBank and further develops the offering. This entails setting the participation requirements and technical standards applicable to the MyBank participants. For the merchants, MyBank provides implementation guidelines and for the banks it maintains a directory of the security certificates used by payment service providers to connect to other participants or hubs of participants. The Solution Manager certifies the network nodes. Figure 1: Online payment initiation via MyBank (Source: MyBank) 4. The bank informs the customer that the payment order has been made and also confirms the payment order to the merchant via the seller bank in realtime. Figure 2: MyBank four-corner model (Source: MyBank) MyBank is similar to some of the four-corner model Online Banking e-payments (OBeP) solutions described in other articles 9 with the main actors the buyer and his/her bank as well as the seller and his/her bank shown in The result is a solution that is light to implement and run. Buyer banks need to implement or outsource a validation service to handle the transaction requests from the seller bank and 9. Broxis, John. MyBank: Creating and launching a pan-european e-authorisation solution for e-commerce transactions. Journal of Payments Strategy & Systems Volume 6 Number 4 ( ). Gonggrijp, Stefan, Max Geerling and Piet Mallekoote. Successful introduction of new payment methods through co-opetition. Journal of Payments Strategy & Systems Volume 7 Number 2 ( ).

6 January 2015 / Page 6 to communicate with their customer. Seller banks need a routing service to communicate with the merchant and the buyer bank. However, the main tool that banks need is already in place: their online banking platform, where the generation of each e-authorisation is highly secured through a double authentication process. Since MyBank has been conceived as a fully flexible digital authorisation solution rather than as a solution supporting a specific payment instrument, it can be used for initiating other payment methods than credit transfers and for authorising other transactions than payments. How MyBank will support the creation of direct debit mandates On 27 th October 2014, MyBank will launch the first pan-european solution for creating, modifying and cancelling electronic mandates for direct debits. Online buyers will be able to sign up for direct debits via their own online banking platform. Customers select MyBank on the merchant website and are automatically redirected to their own online banking platform where they can simply approve the pre-filled electronic mandate form. A mandate is an expression of consent for an account to be debited. Before SEPA, some countries made use of mandates or mandatelike authorisations, but others did not. Now all new direct debit instructions must be set up with a signed SEPA mandate which is returned to the creditor. The creditor is responsible for storing (or warehousing) the mandate. A mandate is valid across SEPA. Mandates may be signed by non-business consumers or by business- to-business customers. Currently, most mandates are signed (and often even completed) by hand and returned via the postal system. Paper mandates are cumbersome for creditors and debtors alike, time inefficient and expensive to store physically. Every paper mandate could be dematerialised (i.e. the physical data should be electronically extracted and stored by the creditor in back office systems) but the original must be retained in case of dispute. This adds another layer of complexity (and cost) to the value chain. In the case of the SEPA B2B scheme, the debtor bank must also be provided with a copy of a signed paper mandate. What is more, the dematerialised mandaterelated information must be transmitted to the bank by the creditor each time the customer is to be debited. Supporting paper mandates is expensive: a conservative estimate is that a mandate costs around 3 (assuming 0.75 to send it to the customer, 0.75 to have it returned and then 1 for manually processing the paper). This totals 2.50 but at least one national utility company claims that there is also a 20 percent rejection rate for the first collection to be taken into account, leading to a delay of collection, a repetition of the whole process, and then a second collection attempt. How the benefits of MyBank Mandates compare to other e-mandate types There is more than one type of electronic mandate. Fraunhofer IAO identified broad categories in the white paper E-Mandate Solutions for SEPA Direct Debit Opportunities for Banks, Creditors and Service Providers : 10 two-corner models (where only the creditor and the debtor are involved), three-corner models (where the debtor bank is involved in addition) and four-corner models (where both the debtor and the creditor bank are involved 10. Renner, Thomas, Maximilien Kintz, Falko Kötter, Jan Finzen. E-Mandates for SEPA Direct Debit Opportunities for Banks, Creditors and Service Providers. Stuttgart: Fraunhofer- Institut für Arbeitswirtschaft und Organisation IAO, December 2013.

7 January 2015 / Page 7 in addition to the debtor and the creditor). MyBank is based on a four-corner model in which all four parties of the debit chain are informed in real time of the request and the response sent between the creditor and the debtor as shown in Figure 3 below. All electronic mandates remove the physical printing, storing and dematerialisation costs Figure 3: Fulfilment of key requirements by two-, three- and four-corner modelbased solutions (Source: Fraunhofer IAO) and ensure an immediate validation of the mandate. This is important when the service cannot be delivered until payment confirmation is received and speeds up the delivery as well as the collection of funds. For consumers, MyBank Mandates make SEPA easier, safer and more effective. By signing a MyBank Mandate through their own bank, they no longer have to deal with the complexity of dealing with paper. Account details are automatically provided by the account servicing bank, therefore all the customer needs to do is to approve them and the electronic mandate will be created. The account details will never be exposed outside of the customer s own banking portal throughout the entire process, unlike paper or less secure forms of electronic mandates and the customer will never be asked to enter them anywhere. Customers will be given the opportunity to print or otherwise save the mandate electronically, just as one would for other types of online transaction confirmations. A customer never needs to register for MyBank or create new accounts or passwords as all approvals are completed via existing online banking platforms. MyBank supports the creation of electronic mandates in line with the SEPA B2C and B2B schemes. Mandates can be initiated (created), amended or cancelled via MyBank. Where MyBank Mandates and other fourcorner models add additional value is that the level of validation is much stronger as it is given via the debtor bank. There is therefore little or no risk in respect of unauthorised transactions, which carry a mandatory 13- month refund period. This means that conversion rates are strengthened through the use of e-mandate types involving strong authentication of the debtor via his or her own bank. MyBank Mandates also give the merchant assurance that the debtor s account is open and reachable for SEPA Direct Debits. If an account is not open for the collection of SEPA Direct Debits or not reachable for some other reason, the merchant will be notified in real time when the attempt to create the mandate is made, i. e. before the purchasing process is completed and the merchant tries to collect the funds. Which other e-mandate services MyBank will deliver aside from standard SDD Core e-mandates MyBank Mandates supports an additional service called SDD02, which is an electronic mandate that allows consumers to waive their no-questions-asked refund right. This service will be introduced in October 2014 in response to the strong business need expressed by a diverse range of creditors. Creditors from different industries have made it clear that in circumstances where goods have already been consumed or their delivery is otherwise irreversible, they are unwilling to run the risk of refunds with regard to properly authorised transactions. As a result, some creditors today cannot offer online direct debitrelated services. They have to resort to more

8 January 2015 / Page 8 costly payment methods, which ultimately affect the consumer as well hence the creation of SDD02, which remains a SEPA Core mandate and is not an independent scheme. The same type of waiver already exists as part of the SEPA Direct Debit B2B Scheme. Indeed, some users (debtors) of the SDD Core Scheme are not individual consumers at all, but businesses. This is primarily due to: differences across legislations regarding how to define micro-enterprises; choices made by businesses to use the SDD Core Scheme to benefit from its wide reach. As consumer trust and consumer rights remain paramount, the following guiding principles have been embedded in the MyBank rules: Consumers must be made explicitly aware that they are waiving their unconditional refund right; Consumers are not obliged to choose MyBank SDD02; The consumer s bank is responsible for checking that received SDD02 Debit collections match received and confirmed SDD02 mandates; All consumers always have the right of refund if they are wrongly debited (unauthorised transactions). The European Payments Council approved (but did not launch) a separate scheme to meet this challenge in The topic was also discussed by the SEPA Council. It is expected that the new Euro Retail Payments Board will examine the topic as well. It is possible that the PSD2 (scheduled for 2016/2017) will bring about a change in the regulations. In the interim, existing legislation (e.g. PSD article 62, paragraph 3) already enables con- sumers to waive their refund right under certain conditions. Whilst these discussions continue, MyBank is launching the SDD02 service to cover the immediate market need in line with the PSD and without interfering with the statutory refund rights provided under consumer law. How MyBank Mandates will support business-to-business e-mandates The importance of business-to-business transactions in the European economy should not be underestimated. SEPA Direct Debit Core mandates are intended for B2C (business-tocustomer) use. The SEPA Direct Debit B2B Scheme has been specifically created to cater for businesses that wish to debit other businesses for their goods or services. The SDD B2B Scheme is broadly similar to the SDD Core Scheme. However, processing times are shorter (payments are submitted on the day before the intended settlement) and debtors have no right to avail themselves of an eight week no questions asked refund right. This is clearly indicated as such on the mandate at the time of approval. SEPA B2B mandates have been specifically constructed in order to take into account the needs of the business-to-business sector, especially in relation to settlement timelines. Today, banks need to check with the debtor that they agree to be debited before each collection, as there is no refund right. With MyBank Mandates, this will no longer be necessary as the mandate will be electronically authorised via the debtor bank, leading to significant cost and time savings as well as to a significant decrease of the risk that collections get rejected because the debtor bank was not notified of the SDD B2B mandate in time. What value MyBank can deliver beyond payments and mandates MyBank can easily be expanded from credit transfers and mandates to identity services.

9 January 2015 / Page 9 With the support of MyBank and at the request of consumers holding an account, the banks of these consumers can respond in real-time to requests from merchants, utility companies or public authorities with positive confirmation or negative feedback. The request can be one of three types: a request for confirmation (e.g. Is the account holder a resident in France? ); a request for information (e.g. What is the postal address of the account holder? ); a request for consent (e.g. Does the account holder agree to be bound by the contract? ), replacing the handwritten signature on a contract. Increasingly, governments allow online declaration of taxes (and many other services). The relevant public body may create its own authentication system, but this is expensive and complex. A confirmation from a bank that the citizen currently trying to declare taxes has successfully logged in via strong authentication and confirms their identity is a powerful way to leverage existing services. This function already exists in a number of countries (e.g. Tupas Identification Service 11 in Finland and Bank- ID 12 in Sweden), where the government pays the account-holding PSP for each confirmation. 3. Confirmation of legal identity for customer due diligence The confirmation of these requests, which are instructed by the account holder and delivered by the account holder s payment service provider (PSP) is extremely valuable to merchants, utility companies and public authorities because a trusted third party is confirming or supplying the information. Examples for such requests are for instance: 1. Age verification: Ordering alcohol from an online supermarket or retailer The supermarket is not allowed to sell alcohol to children, they have no way of knowing whether the customer ordering alcohol is over 18, beyond their own declaration that they are. A confirmation from the bank of the customer that the customer is over 18, along with the payment, would provide certainty. 2. Confirmation of identity: declaring taxes to a public authority Certain services (e.g. credit cards, mobile phone contracts) require that subscribers prove their identity when they subscribe. The phone company has a legal obligation to record and store the name, surname, passport number, date of birth, city of birth or similar details. Today, this involves the physical scanning and sending of documents via postal mail before the service can be used. If the subscriber s bank under the instruction of the subscriber confirms to the service provider the person s identity details, as required by the legislation, the service provider can cut down on paper, close a sale more quickly and activate the service immediately. 4. Confirmation of consent: signing a contract While discussions around digital signature continue and there are differences 11. For further information refer to the Federation of Finnish Financial Services (FFI) under For further information:

10 January 2015 / Page 10 across jurisdictions concerning what constitutes a digital signature, this is an area that is being harmonised, and it is clear that the strong authentication mechanisms used by banks to take instructions from their customers will also be valid for showing that customers have given consent to enter into contracts. A subtle feature of this authentication is that in some cases, the mechanism allows the consumer to stay anonymous. For the confirmation of a (legal) identity (case 2 and 3 above), the bank responds with a simple yes or no to a log-on request the bank is not passing on details about the person to the third party, which does not need to know the real name, real address, or anything about the customer, but they may receive this information inadvertently when credit card details are handed over. mation as if from the cloud, but with the bank level security and trust. Why banks are particularly suited for providing e-identity services Banks as regulated entities, as part of Anti- Money Laundering (AML) and anti-terrorist financing measures, are given specific obligations to verify the real identity of every account holder. These obligations are called Know Your Customer (KYC). In practice, this means that everybody who opens an account must go through a process where the bank sees the applicant, sees their government-issued identity documents and confirms that the two match. During the application process, a bank typically collects a lot of information for practical and regulatory reasons, e.g. name, date of birth, address, country of residence, government identity document number, and then creates an account. Some of these services may improve the check-out process as much for the consumer as for the retailer, bringing benefits in convenience and increasing conversion rates, e. g. when confirming a delivery address: there are cases, especially when ordering via phone, where having to enter a delivery address is tedious and prone to error. It is possible to set up a service where along with the payment message, the bank will also provide the delivery address. Of course, this relies on customers having at least one (and maybe more) accurate delivery addresses set up with their PSP. Similar services could be provided at the request of the consumer with the provision of passport numbers (for booking airline tickets), billing addresses or other static information. While this service may seem to require a lot of organisation for something that is fairly trivial, it should be noted that other payment methods, like PayPal, offer it. Also, in the digital future, there will be a backbone set of service providers required to provide authentication services, provide address and personal infor- On top of this, banks typically give an online and/or mobile access to that account, which includes the provision of confidential information or personalised tokens that only the account holder and the bank know, or personalised objects that only the account holder has. From then on, the account holder can identify (authenticate) himself or herself to the bank. The security access often enables the consumer to make payments, and so the security systems in place are very strong to protect the customer and to protect the reputation of the banks; these security systems also have to comply with increasing regulatory and supervisory requirements. The key results are that the account-servicing PSP: has proof of an individual s true identity; already stores other ancillary data about the individual; has issued secure mechanisms to al-

11 January 2015 / Page 11 low customers to authenticate themselves remotely. This means that the PSP is in a position to confirm to a third party, on the request of their customer, the identity of that customer. Opening up identity services in a structured way, by involving their own PSP, which already holds the data, allows consumers to protect their data by giving third parties access only to what is needed in a given context rather than to a whole package of bundled data. There is enormous potential in building digital authorisation and authentication services around identity. The demand from consumers and businesses for digital services grows, as do fears about data handling and security. The European regulatory push is further opening the market, and supporting the need for new solutions. While many types of players from governments to telecom providers to internet giants to specialist identity solution providers are trying to find the magic formula, it is possible that the best candidates to succeed are banks, as they hold five key assets: They are trusted by the regulators and the consumers; Their ability to create networks that can link every consumer in Europe with every merchant in Europe; Their rich and accurate repositories of consumer data; processes where e-identity is relevant (ordering, due diligence checking, invoicing, mandate creation). The costs of building such a solution from scratch are enormous. The costs for banks are small as most of the components are already in place. The only piece that is missing the piece MyBank supplies is the service infrastructure to connect the banks together and to allow safe and controlled access to the account. Providing this access will become a regulatory requirement with the PSD2 Access to the Account provisions, which will require PSPs to give third party providers access to information on the availability of funds. It is a small additional step to ensure that this access supports identity services. The amount that a merchant or government is willing to pay for an identity transaction is generally much higher than the value they will pay for a simple payment transaction. Banks can charge higher rates than other contenders due to the breadth of reach and data they can provide and the premium bank-certified quality. An Innopay report based on Eurostat figures states that there are currently 225 billion authentication transactions per year ( , social media, e-commerce, e-government). E-commerce and e-government alone account for 5.5 billion transactions. 13 Assuming a value range of 10 cents to a euro for a transaction, the market could be worth 3 billion to 5 billion a year for that sector alone. The potential upside of getting this right is difficult to quantify due to the exponential growth coming from: Their existing, trusted and secure au- Growth in number of users interacting thentication systems; online or via mobile channels today only 50 percent of Europeans use the Their control of the payment process internet. 14 and ability to integrate this into other 13. All figures taken from: EBA Working Group on Electronic Alternative Payments. Opinion Paper on Digital Identity: From check-out to check-in. Version 1.0, 13 th May 2014.

12 January 2015 / Page 12 Growth in number of transactions per user only 40 percent purchased online in Growth in number of services available today, many consumers would be happy to sign up to an insurance policy with an e-signature, instead of waiting for a paper form to arrive in the post, signing it, and returning it by post, but the service does not exist. Firmly rooted in the four-corner model, based on communication between the PSPs of the parties involved in an online transaction, MyBank is the key that secures customer accounts and keeps their data safe. It is at the same also the key that unlocks the value of this account by enabling a range of services that make interaction in the digital world both easier and safer. John Broxis Managing Director PRETA S.A.S. Finally, these figures only look at Europe, rather than the global industry. In conclusion, the size of the global market for online identity and trust services by 2020 could be so large, as to be unquantifiable at this point. How MyBank unlocks value in the digital space The multi-channel, multi-currency and multipurpose potential of MyBank allows consumers and businesses to safely make payments. But it also puts MyBank and its users in the position to support online trust services, such as confirmation of identity, confirmation of consent to enter into an agreement, confirmation of information, such as age. 14. All figures taken from: EBA Working Group on Electronic Alternative Payments. Opinion Paper on Digital Identity: From check-out to check-in. Version 1.0, 13 th May See above.