Case Studies, A. Litan Research Note 1 April 2003 First Data Learns to Manage Online Merchant Risk Selling accounts and payment processing to online merchants represents First Data's fastest-growing market. The enterprise had to quickly change its processes to manage the risk and rapid growth of this clientele. Core Topic Financial Services: Financial Services Architectures and Emerging Technologies Key Issue What architecture models and technologies will enable FSPs to adapt to major industry trends such as straight-through processing, the real-time enterprise, corporate performance measurement and risk management? In the late 1990s, First Data's Merchant Services division (FDMS) found itself in the middle of the Internet "bubble." It was surrounded by a quickly growing Web merchant population that needed merchant accounts and payment processing, also known as merchant acquiring. Online merchants also needed help mitigating their chargebacks and fraud risks, which are at least 12 times higher on the Web than in the physical point-of-sale (POS) world. First Data was no stranger to merchant acquiring. By early 2000, it already had 44 percent of the U.S.-based merchant acquiring business and more than 2 million merchant customers. However, the tools that it and its competitors used to acquire and manage physical-world merchants were unsuitable for the high-growth, high-speed Web, where most merchants were startups with little, if any, credit history. To become a market force in online merchant acquiring, First Data needed to retool and develop processes that mitigated risk and maximized growth opportunities of this new market. POS transactions were growing by 2 percent to 3 percent a year; mail order/telephone order (MOTO) was growing at 5 percent to 8 percent a year; but Web transactions were almost doubling in the late 1990s, and are still growing at 20 percent to 25 percent a year. FDMS could not afford to miss the growth opportunities of the Web. To take advantage of the opportunities, it had to: Quickly ascertain the financial viability of an online merchant, so that FDMS incurred minimal risk if the merchant went out of business. Reserve enough merchant funds in FDMS accounts, so that it could cover debts to the merchant's customers in case the merchant went out of business and was unable to fulfill orders after a customer had made payment. Gartner Reproduction of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice.
Keep the level of online fraud at the merchant sites low, so that the fraud would not put the merchant out of business. That would leave FDMS responsible for settling any paid orders that were left unfulfilled. Problem: FDMS, like its competitors, had built its merchant acquiring and risk management processes for the physical world. They were inadequate in such areas of the online environment as: Merchant boarding. In the POS world, a merchant that accepts credit/debit card payments completes a paper application from an acquiring bank (normally the bank with which it already does other banking business). The approval process from submission until deployment typically takes up to fifteen days and involves several due diligence checks performed by FDMS risk management staff. The checks generally include a review of the owner's personal credit report, commercial reports and bank/trade references. Once merchants establish their accounts, they are paid for credit/debit card transactions in one to three days, and pay a discount fee to First Data for guaranteeing the payments and funds. In the online world, these processes don't work. Internet merchants that are building their businesses from "scratch" typically put everything together at the same time for their Web sites. This includes obtaining their server certificates (typically from VeriSign), merchant identification and account numbers, communication links to payment gateways and transactions processors, and back-end accounting and information systems. Without merchant accounts to process payments, their businesses cannot get started. Online merchants, working on "Web time," expect quick decisions on their applications to process payments within hours, and rarely want to wait more than a day or two. Underwriting. In the POS world, merchants generally have historical credit data from prior business years. They also have physical-world locations and assets that can be verified by First Data's risk management staff. In the anonymous online world, retailers are often startups with no business credit history or physical store locations and assets that can be verified during the underwriting process. Monitoring. Online companies sometimes grow their sales at double-digit rates or greater, forcing First Data to implement new business rules to ensure that adequate funding levels are reserved all along the transaction stream. In this way, if a merchant goes out of business, each party involved in a transaction gets paid on transactions still in transit. Typically, First Data releases funds from card issuers to POS 1 April 2003 2
merchants with a one- to three-day delay, in effect creating a reserve to ensure the integrity of the banking system. However, fast-growing online retailers can often use up a week's reserves in one day as they ramp up sales. To handle rapid sales growth, First Data needed more-effective monitoring processes to ensure that adequate funding levels were reserved for these merchants. First Data's processes that monitor fraud in the POS world also had to be modified for the online world, where fraud patterns are different. Objective: To effectively acquire and manage online merchant accounts, FDMS needed to develop and implement new systems and processes that: Enable online merchants to apply for and receive merchant accounts, if they qualify, within 24 hours. Assess and assume the risk of online merchants, many of whom have little or no credit history. Enable First Data to effectively and safely manage the growth of online merchants without incurring unacceptable financial risk. Proactively prevent fraud for online merchant Web sites that use First Data's interconnections to the banking system. Approach: FDMS tackled its objectives by: Merchant boarding. As an acquiring processor, First Data assumes financial responsibility for the accounts of the merchants it underwrites. First Data does own a bank in Colorado First Financial Bank that houses the funds for several of the merchants it underwrites, but more prevalent are its relationships with a handful of domestic banks that form the basis of the FDMS bank alliance strategy. For example, FDMS has partnership alliances with Chase Merchant Services and Wells Merchant Services, and each of these alliances has its own credit policy and underwriting criteria. However, when most smaller online merchants sign up for merchant accounts and services, First Data becomes a "onestop shop" for them, providing merchant accounts primarily through its Card Services International (CSI) subsidiary, as well as providing processing and other Web-payment-related services. First Data's presence in the smaller, moredependent merchant marketplace grew rapidly when it completed its acquisition of CSI in mid-2002. CSI leads the market for acquiring and servicing higher-risk merchants for the MOTO market and increasingly for the Internet. FDMS is integrating CSI technology into the rest of its operation. 1 April 2003 3
To put the process of acquiring new online merchants into one system, First Data developed its own virtual application that merchants can use to apply for accounts and related services. First Data linked the virtual application to the traditional and new information sources in the banking system so that FDMS could check merchant bank accounts and any financial history that could be established. FDMS also fine-tuned its risk parameters because it would not be making the typical phone calls and checks that are conducted for physical-world merchants. Assuming FDMS verifies that the merchant is a manageable risk, a decision is made on the application in less than 24 hours (many in minutes) and grants the merchant an account so it can accept card payments. Smaller merchants that carry higher risk pay much higher fees up to 5 percent (or more) of the transaction amount, compared to approximately 2.5 percent for large online merchants, and the lowest rates of 1 percent to 1.5 percent for the largest POS merchants. If a merchant application does not meet the required criteria, the virtual application program sends an e-mail notification to the credit department to manually check out negative information. In unusual cases, such as pre-revenue startups, the FDMS credit department contacts the new merchant's bankers, investors or venture capitalists to confirm their access to sufficient cash flow to support operations. Underwriting. To meet the urgency of online applications, it was necessary to provide automated underwriting approval at least for small accounts (usually less than $1 million in sales) based on meeting selective criteria that could be checked in real time by the FDMS credit department online. A perhaps-surprising number of merchants could meet these criteria, although how enterprises such as First Data make such decisions is considered proprietary. In the end, FDMS has to calculate how long to hold back transferring payments to the merchants to ensure coverage of transaction streams in process to account for rapid sales growth and unexpected cutbacks in operations. Monitoring. Even with FDMS' new risk-management processes, some e-tailers, like Priceline's WebHouse Club, grew so quickly with transaction volumes exceeding 10,000 per hour in just the fourth month of operation that they eclipsed a previous week's funding reserve in a single day. First Data had to constantly upgrade its monitoring capabilities to manage the funding risk without unduly penalizing the fast-growing startup by keeping too much of its capital tied up in the funding reserve. Proof that FDMS met this challenge came on 5 October 2000, when WebHouse Club announced that it no longer had access to 1 April 2003 4
sufficient capital to remain in business. In the ensuing days, tens of millions of dollars worth of in-transit transactions were settled to the satisfaction of all involved parties. Fraud control. FDMS has been aggressive in providing a suite of fraud control services to its online merchants. The enterprise offers standard fraud-prevention services, including Address Verification Scheme, Cardholder Verification Code checks, screens on shipping and billing, and various Internet addresses. In addition, FDMS offers Global Scan, which bases fraud scoring on transaction velocity and the geography of a specific machine or device, which it "fingerprints." FDMS is also designing what it calls a more-efficient authentication process than offered by Visa (Verified by VISA) and MasterCard (MasterCard SecureCode) by combining the authentication and authorization protocols into one message stream rather than two. FDMS can introduce innovative services more easily than many other companies in this market because it touches more than 44 percent of Internet acquiring volume, either on its own or through partners such as Chase, Wells Fargo and Paymentech, and, through card issuers that it processes transactions for, more than 50 percent of the volume on the issuing side. FDMS can send many transactions on a more-efficient path through its "on-us" network, where it directly manages processing for the issuing and acquiring sides. Results: FDMS' steps to support the online merchant community paid off. By year-end 2002, it was able to: Routinely turn merchant account applications around in minutes and board them as transaction accounts in less than 24 hours. Process 62,000 applications successfully between January 2001 and September 2002. Grow its online merchant base by 66 percent, compared to year-end 2001, through direct and partners' merchant acquisition and through its acquisition of CSI, which has approximately one-quarter of First Data's 200,000 online merchants. Lower the average cost of processing a merchant application online to less than $100 vs. an average of $700 for POS applications. Account for $2.8 billion of First Data's $7.6 billion revenue in 2002, and grew at an annual rate of 22 percent. Revenue from Internet transactions, which was 5 percent of the total 1 April 2003 5
transaction volume, represents about 7 percent of FDMS' total revenue. Critical Success Factors/Lessons Learned: To succeed in implementing new processes to support the rapidly growing Internet merchant channel, FDMS needed: A skilled cadre of risk and credit management staff who understood the unique risks posed by working with dot-coms, many of which "bombed" as quickly as they grew. Solid understanding of credit risk assessments, and how to perform them quickly within 24 hours with relatively scarce online information available. Strong partnerships with leading acquirers, such as Chase and Wells Merchant Services, creating a symbiotic and beneficial relationship in a growing channel. Good, solid technology and technical prowess, enabling FDMS to build new monitoring systems that enabled it to quickly change the business rules and risk management paradigm in a dynamic business environment. Acronym Key CSI Card Services International FDMS First Data Merchant Services MOTO Mail order/telephone order POS Pointofsale Bottom Line: The dot-com explosion was followed by the implosion of thousands of startup companies. As the largest card processor in the United States, First Data could have suffered financial loss if it had not kept up on the back end, constantly assessing risk and building out the tools and infrastructure to service a dynamic and risky e-commerce market. It proved adept at developing and implementing new processes and systems, which enabled its Merchant Services division to earn a profit in the new market without sacrificing the soundness of its business model and financial underpinnings. 1 April 2003 6