Innovation in Financial Services: A Regulator’s Perspective - Deputy Governor Ed Sibley

Speech delivered at University College Cork

Good morning ladies and gentlemen. I am delighted to be here today at University College Cork (UCC) to discuss innovation in financial services. Thanks to Professors John O’Halloran, Philip O’Reilly and Thia Hennessy for the invitation to be here today and talk with you. 

UCC plays a vital role in education, research and entrepreneurship, both locally here in Munster and further afield. There is a thriving hub of innovative activity here, which contributes to and shapes wider ideas and practices. Within Cork itself, I know there is an ever growing ecosystem of collaboration between start-ups, larger firms, academia and government agencies all tying in together to advance innovation.

Innovation in financial services has the capacity to bring many benefits for consumers, the economy and society in general. It is essential to the effective functioning of a competitive economy. However, here is where a challenge lies for financial regulators. Innovation is good, but not all innovations are good, and not all good innovations are done well. So regulators and supervisors need to:

• not get in the way of ‘good’ innovation;
• seek to prevent or limit innovations that are detrimental to the goal of well functioning financial services and markets; and
• ensure that the associated risks are well-managed.

These are important topics for the Central Bank.  So, today, I will cover:

1. The role of the Central Bank regarding innovation in financial services;
2. The Central Bank’s approach to innovation;
3. Innovation in financial services; and
4. Foundations necessary to successful innovation in financial services.

The role of the Bank regarding innovation in financial services

The Central Bank’s mission is to serve the public good by safeguarding monetary and financial stability and working to ensure that the financial system is operating in the best interests of consumers and the wider economy. 

The Central Bank’s aspiration is for a functioning financial services system that sustainably serves the needs of the economy and its consumers. This requires functioning and trustworthy financial markets and firms.  It also requires that the financial system and firms operating within it are resilient – this resilience being a fundamental aspect of protecting consumers.

As part of its wide mandate¹ the Central Bank is responsible for the regulation and supervision of financial services firms.  Through this work, the Central Bank serves the public good by: 

1. strengthening resilience of the financial system so that it can withstand shocks and crises;
2. ensuring the best interests of consumers are protected so they can have confidence and trust in the financial system;
3. effectively supervising those regulated firms and markets that can pose a threat to financial stability to ensure they are well managed and financially sound. This includes regulating and supervising the conduct of individual firms.

Technological change is disrupting the landscape of financial services. The competitive landscape is changing, with new entrants, new business models, a race by incumbents to invest in developing the necessary capabilities, and in many cases the potential for a fundamental disruption in the value chain of traditional financial services firms and sectors. Moreover, it is becoming ever more evident that data, and the harnessing of it, is the new currency of this new digital age (World Economic Forum).

Developments in technology have, for example:

• exponentially increased the proliferation of data and the speed with which it can now be analysed and processed;
• enhanced efficiency and productivity of employees by freeing up time from manual processes;
• changed customer expectations of functionality; and
• increased outsourcing of technology services, including cloud storage. 

If the current pace of change is anything to go by, the future is a vast unknown where only those able to adapt at pace will be able to survive. Indeed, it is arguable that there is no part of the traditional financial services value chain that cannot be done better, smarter and more effectively. 

Technology can also offer significant benefits for the consumers of financial services products and services. Innovation can empower consumers, giving them better choice, value and information to ultimately enhance their capability to manage aspects of their day to day lives, including of course, their finances.

In my role, I welcome opportunities for the financial services system to better serve the needs of the economy and its customers, but I am also mindful of the risks (Sibley, 2019).  For example, risks relating to:

• strategy, change and execution;
• the inappropriate use of technologies;
• information asymmetries and data protection;
• cyber security; and
• operational resilience.    

The pace of change, together with the borderless nature of technology, requires an appropriate level of caution to be taken, through financial services firms taking risk-based approaches to strategic and business initiatives.  Financial services firms need to make informed choices about where and how they are going to adapt and make sure that the associated risks are understood, considered, and measured as they make changes to their processes and business models.

For incumbent firms, the Central Bank considers these issues in a number of different ways, working from the top down through the lenses of strategy, governance, oversight, risk management, and so on; and from the bottom up focusing on the management of the technology itself, and the broader topic of operational resilience.    

The Central Bank also aims to keep abreast of the emerging trends brought about by technological innovation so that we can identify, understand and manage the risks these changes present. While today I will speak about financial innovation, digital transformation and disruptive technology, it is important to stress that the rules and principles of regulation and supervision apply to all the firms we regulate, regardless of the technology they deploy.  Our focus rather, is to ensure that where innovation facilitates new and better solutions, it does so in a framework which does not prevent regulators from meeting their mandates and strategic responsibilities.

The Central Bank’s approach to financial innovation

The Central Bank is proactively seeking to understand and anticipate how innovation is changing financial services provision.  We consider this from financial stability, monetary policy, payments system, prudential supervision, market conduct and consumer protection perspectives. We need to understand the threats to the sustainability of existing business models, how technology is driving change to them, the business models of potential new entrants and the wider implications for the financial services system and consumers of financial services and products.

Supervision of existing firms

The Central Bank is responsible for the prudential and conduct regulation and supervision of regulated firms. Our prudential supervisors seek, in part, to ensure that regulated firms have sustainable business models and that they are well run, appropriately governed, have effective risk management and control functions and effective cultures. In this way, we can increase the financial resilience of the system and individual firms, a fundamental aspect of protecting consumers.

The Central Bank has significantly enhanced the intensity and intrusiveness of its supervision of IT related risk across the financial services sector.  Identified issues are required to be resolved through risk mitigation programmes and we will continue to issue thematic findings from our work to highlight areas for improvement for all firms so that their foundations are sufficiently strong to effectively manage the technology risks. Where necessary we have used our powers to sanction failures and required the use of third parties to help drive improvements.  

Innovation Hub²

The Central Bank of Ireland launched its FinTech and innovation engagement initiative in 2018. A key feature of this initiative is the Central Bank’s Innovation Hub, launched in April 2018 to facilitate open and active engagement with the FinTech sector.

The Central Bank’s engagement with innovation, of course, pre-dates the establishment of the Innovation Hub. Many functions across the Central Bank have long been engaging with innovating entities to understand new technologies and new ways in which financial services are being designed, developed and delivered. However, as the impact of new technologies becomes more pervasive and the appetite for engagement with the Central Bank stronger, we sought to further enhance and coordinate this engagement.

The Innovation Hub enables regulated and unregulated entities engaged in innovation to contact the Central Bank with questions on navigating the Irish regulatory landscape. At the same time, it provides us with the opportunity to become better sighted on relevant technological developments and innovations.

With the Innovation Hub, firms who otherwise might not have known how to contact us now have a direct way to do so. We have had over 150 engagements to date. In these engagements, we have found that approximately 40% of firms that engage with our Innovation Hub are at an early stage in their development. These firms in particular see the benefit in having a dedicated point of contact at the Central Bank.

We have found so far that most firms place great value in coming in to the Bank to demonstrate their product/service, both to increase awareness among supervisors and to get a better sense of our approach to authorisation and supervision. Firms also often contact us with questions on the authorisations process and regulatory framework, though smaller start-ups are more interested in the regulatory perimeter and what activities require authorisation.

This is important as the earlier these firms are sighted on the potential regulatory considerations of their solutions, the more likely they are to grasp the responsibility compliance with regulation entails. Such interactions will ultimately lead to better outcomes for consumers.  While much of this information we provide is publically available on the Central Bank’s website, we have found firms appreciate the opportunity to discuss the process directly with the Bank. Providing this accessibility to the Bank was one of the motivations for establishing the Innovation Hub and as such it is been good to see it function as intended.

For the Bank, these interactions help to build on our base of existing knowledge of innovative activity in financial services and to help us to identify trends in the market.

EU and International Policy Fora

Technological innovation is often cross border in nature. It is important that the Central Bank is engaged in relevant international policy discussions. We participate in multiple innovation focused workstreams of the European Supervisory Authorities (ESAs) (European Banking Authority, 2019). For example, we are a member of a recently created working group which is looking at how AI is used in financial services. Similar groups we are involved in are looking at cloud outsourcing, cyber risk, and crypto assets.

The European Commission has set up a forum of European Financial Innovation facilitators, where we gather, along other national competent authorities, to share learnings and engage in dialogue to better shape policy. The next Commission will also establish a dedicated unit focused on financial technology. The new unit will be tasked with developing policies and rules on crypto assets and cybersecurity. It will also have a role in ensuring the EU is prepared to handle large technology companies increasingly engaging in financial services. The establishment of this new unit shows the level of importance that the European Commission will place on technological innovation in the near future.

The Central Bank welcomes the new Commission’s strong FinTech focus. Through our engagements at the ESA’s and the ECB/SSM, we look forward to engaging with our EU peers on issues including the potential development of EU legislation on crypto assets, including so called stablecoins and the potential move towards a direct supervision model for cloud service providers.

Internationally, we engage in fora such as IOSCO’s FinTech Network, themselves carrying out important work on developing securities regulators views on ethics in AI, Regtech and blockchain.

Capability    

As I noted earlier, the rules and principles of regulation and supervision apply to all firms we regulate, regardless of the technology they deploy.  However, changes in this deployment do bring risk and complexity.  Furthermore, innovation typically moves faster than regulation – and there are numerous examples of innovative approaches to circumvent the spirit of regulation. 

As a knowledge-based organisation, how we gather and analyse the data we receive from firms has become a critical part of the work we do. Part of this is making sure that the data we receive is accurate and reliable. For example, in the context of MiFID II, our Market Surveillance Team is proactive in engaging with supervised firms on the accuracy and completeness of data submitted (Hodson, 2019). Once we have this data, our ability to analyse it is becoming an increasingly important part of our engagement, providing us with better quality insights into the activities of the firms we supervise.

As outlined in our Strategic Plan 2019 – 2021 (PDF 1.3MB)^, we recognise that analysis of data and information is a core competency for the Central Bank. It is a priority to continue to develop our data analytics capabilities and related technology infrastructure.  We are taking action to ensure that we have the appropriate resources, skills and knowledge to be best placed to meet our commitments to deliver an effective, intrusive, analytical and outcomes focused approach to regulation and supervision.  

Innovation in Financial Services    

Technological innovation can take many forms, from digital transformation to market disruption. Digital transformation can be a catalyst for disruptive innovation but often, successful digital transformation initiatives result in improved internal efficiencies, and keeping pace with market needs rather than market disruption. Moreover, it is estimated over 90% of all business models recombine already existing ideas, concepts and technologies (Gassmann et al 2014). New innovations are therefore likely to consist of slight variations of something that has existed before rather than radical change.

There is no part of the traditional financial services value chain that cannot be done better, smarter and more effectively. Through the Central Bank’s Innovation Hub we have seen many firms which are focused in on just one particular aspect of financial services provision and sought to bring improvements to this aspect. They do this largely by developing platforms which add an extra layer between back-office and front-end systems.

These platforms can facilitate transactions, unlock insights and generally improve the sharing of data across the value chain by, in part, automating previously manual processes. They can take the form of retail models, such as mobile phone based savings apps, and institutional models, such as web based risk management dashboards.  

Across a wide range of sectors, we are seeing the impacts of technology change.

Insurance

In insurance, we have seen firms developing models to offer on-demand insurance. These firms are focusing on a specific issue, such as providing employees in the gig economy with micro-duration insurance coverage for the length of their shift. In this way, the consumer can avoid unnecessary additional expenses while still gaining the coverage necessary. While currently narrow in focus, looked at through the lens of the predicted growth in the sharing economy combined with mobile technology, on-demand insurance is an example of a new model with potential growth in the sector.

In the entities we supervise, one of the key technologies driving innovation in insurance is telematics and wearable technology. These enable consumers to use internet-connected devices such as in a person’s car, home, or their watch and bracelet to transmit data which the firm can use to tailor and price their policy offerings more accurately (Cronin, 2017). For the consumer, these technologies have the potential to reward their good behaviour with lower premiums. From a firm’s perspective, the real time customer data can lead to a more accurate pricing of risk. However, data is being collected and stored in non-traditional manners. The onus is on institutions to have adequate safety nets in place to protect consumer data. Additionally, there is a responsibility to use it to get the best outcome for all stakeholders – to not to use the advantages of the data to the long-term detriment of customers.

Another potential impact technology could have on insurer’s business models is the potential for cyber exposure to disrupt the property and casualty line of business. We note that whilst insurers have a high degree of awareness of cyber risks, a recent EIOPA survey found that only 5 of 39 insurance groups stated that cyber risks are explicitly excluded from the property and casualty policies offered. Technological changes will affect both how insurance is offered, and what is insured.

Payments

We have seen large technology firms become increasingly active in the payments markets. With their deep and vast user base, all digitally connected, these firms promise to offer faster and cheaper online payments systems to compete with current operators. Consumer needs are helping to drive this change as they have increased expectations around the speed of decision-making, electronic marketing and digitised distribution channels. Again we see data analytics is playing a role. Payments related data can offer valuable insights to consumer behaviour which while beneficial for firms, can come with risks to consumers for example around the potential for misuse of this data, and how it is shared and stored.

In addition to our own work in monitoring and managing these risks, at EU level the debate on how to approach tech firms expanding into financial services is a live issue. As mentioned, the new European Commission is mandated to come up with an approach on tech firms; we have been and will continue to contribute to this discussion.

Technology is also contributing to the declining use of cash. In Ireland, this trend is happening more rapidly than in many other countries. This, when looked at together with technology firms’ activity in payments, and also the increasing development of crypto assets, points to a rapidly changing payments market, one where the future looks markedly different to the present. These changes have led to increased calls for a Central Bank backed digital currency. Being a member of the Eurosystem, we are actively engaged in this debate.

Banking

Regarding banking, threats to incumbents are coming from two broad categories: challenger banks and other business models.

• Challenger banks are digital only offerings with a low cost base and, being free from the constraints of legacy infrastructure, they can more easily leverage the benefits of mobile technology and cloud computing. These firms promise to enhance customer experiences such as enabling easy account opening and servicing, and to adapt more quickly to changing consumer demand than incumbents.
• Other business models include those arising from open banking, which offers the possibility of the creation of entirely new business models, leveraging banking data to offer new services, such as personal financial management and data aggregation platforms.

These innovations in banking have highlighted some of the fees that banks have traditionally relied on as a key source of revenue and created the possibility that banks could lose their relationships with customers and end up providing ‘back end’ banking services.To keep apace, there is therefore a need for Irish banks to substantially invest in their technology and data capabilities. Many banks are still using outdated and fragmented IT systems which do not yet provide the foundations to effectively manage the technology risks.

We have also seen examples of start-ups developing AI based loan origination platforms for lenders to SMEs. These use open banking solutions to pull data from the company’s bank account, feeding the data through a rules based risk engine designed together with the institution. Such platforms tell the credit institution the likelihood of the loan application meeting their own approval standards, thus promising to improve efficiency and customer experience. For firms who utilise technologies such as robo-advice, big data analytics, and AI interactions with consumers, there are opportunities for cost reductions and delivering of efficiencies and also the potential for cheaper products and accessibility for customers.

However, there are also risks for consumers where AI is concerned. Bias can creep into algorithms. AI systems are trained on data and if this data contains biased human decisions or if the data suffers from selection bias, then the AI output may be problematic. For example, Joy Buolamwini at MIT working with Timnit Gebru found that facial analysis technologies had higher error rates for some ethnic groups and particularly for women within those groups, potentially due to unrepresentative training data (Buolamwini et al 2018). Such risks have implications for how AI is used and the Central Bank is cognisant of these potential negative impacts on consumers. We welcome the announcement from the new European Commission, highlighting that it will propose a focus on a regulatory framework for AI and look forward to working with our European peers on this important area.

Investment firms    

For investment firms, the implementation of robo-advisory services represents a fast-growing trend within the investment advisory industry. An ESA Discussion Paper on automation of financial advice (ESA 2015) predicts that robo-advisors will grow exponentially leading to a rapid change in the current landscape. While current robo-advisory implementations are in their infancy and focused on wealth management, assets under management are expected to reach USD 1 trillion globally by 2020 (OECD 2017) as firms expand this offering to include a much larger proportion of the customer asset holding. Consequently, this will also include providing advice on refinancing, credit cards, and insurance among others.

Given their high reliance in providing investment recommendations and managing portfolios the risks these services present should not be underestimated. As a forward looking supervisor, the Central Bank has to ensure the risks are mitigated with firms having strong internal governance arrangements and oversight of the algorithms, ensuring their transparency, accuracy and robustness. For consumers, we need to ensure these services maintain the suitability of investment advice provided and avoid mis-selling.

The foundations of sustainable innovation

Customers requires firms’ systems and data to be available, reliable and secure. This is also important for financial stability reasons. Firms must strive to minimise the frequency and impact of issues and have an ability to recover quickly from them.  Operational resilience is therefore critical. 

No matter whether financial services firms are well established or seeking a new authorisation, they need to ensure:

• the IT risk management and IT security arrangements are sufficiently robust;
• IT assets are actively managed, including through risk assessments to adequately understand the threats and vulnerabilities to them;
• systems and processes that support business services, including all the third-party relationships, are understood and being actively managed;
• IT risk profile is understood and consistent with risk appetite; and
• IT strategy is aligned with the business strategy.

Good governance means boards adequately considering their use of data and technology in their interactions with their customers so that these align with their stated values.  Particular attention needs to paid to the following:

Culture

The amount of data available on the average consumer is growing exponentially. When this is tied with developments in analytics capabilities and behavioural studies, this can lead to real customer benefits, with greater insights for example on their spending habits and income flows. However, on the other side, this can result in ever growing information asymmetries, raising ethical considerations on how data is used. 

The Central Bank’s expectation is that banks’ operating models are more than technology and innovation driven. As outlined by my colleague Grainne McEvoy (McEvoy 2018), the greatest risk to consumers comes not from technological developments, but from the culture of the firms in charge of the technology.

Boards and senior management need to pay particular attention to not only ‘can we’, but ‘should we’, particularly in the use of customer data.  This is an area that we will continue to increase our focus on, to ensure that the people who lead the firms we regulate and supervise set the right tone from the top and create a culture that minimises the risk of misconduct.  

On a very practical level we have recently proposed a Senior Executive Accountability Regime (Rowland 2019) to drive better governance structures in firms which identify which individuals are responsible for what. Diversity can meaningfully contribute to improved decision-making, risk management and reducing the likelihood of group-think. We are therefore committed to bringing improvements in the levels of diversity across regulated financial services firms.

If innovation is to be delivered sustainably, it is essential to recognise that this cannot be attained without a culture and mindset to match and support it.  Research by McKinsey (McKinsey 2017) suggests that cultural challenges are among the major barriers to digital effectiveness across all industries.

Outsourcing

The Central Bank is strongly focused on outsourcing³ due to its extensive use across financial services firms. While it is possible to outsource a service, you cannot outsource the risk.  The responsibility and accountability for ensuring security and resilience of a firm’s data and services remains firmly with its board. 

Advances in cloud computing have been notable. Such technology has significantly changed how firms and companies work, facilitating streamlining of processes and infrastructure and also reducing costs. Recent years has also seen the increase of outsourcing to the cloud as a model.    

With all outsourcing arrangements, boards and senior management must understand that they are placing the resilience of their firm into the hands of a third-party and while they may be able to monitor the service during normal operation, when something goes wrong, they are reliant on someone else to fix it.

Risk Management

As firms take advantage of technologies and further embed them into their processes, it is important to highlight the importance of IT risk management. Digital transformation can, without proper oversight, increase vulnerabilities in firms’ IT operations, with increased risks around IT failures, outages and cyber attacks. IT risk management should be implemented as an enabler to a firm’s business model which is becoming more data centric and therefore requires better governance of data both in terms of quality and security. In managing these technology and IT risks, boards must firstly ensure they themselves have the skills and knowledge to meaningfully understand the risks they face and the responsibilities they bear.

This is outlined in the Central Bank’s Guidelines on Information Technology and Cybersecurity Risks (Central Bank 2016), where we stress how boards and senior management are ultimately responsible for ensuring operational resilience.  

Conclusion

I will conclude as I started. 

Innovation has the capacity to bring many benefits for consumers, the economy and society in general. It is essential to the effective functioning of a competitive economy. 

I am confident that UCC and its alumni will continue to play an important role in financial services innovation in Ireland. I am also hopeful that for its students, this will include spending part of their career contributing to the Central Bank serving the people of Ireland by ensuring that this innovation enhances how the financial services system serves the needs of the economy and its customers.  

Thank you for your attention.⁴

 __________________________

[1] See Central Bank of Ireland. “Explainer - What does the Central Bank of Ireland do?”

World Economic Forum. Big Data, Big Impact: New Possibilities for International Development

Sibley, Ed 2019. “Building financial resilience - Deputy Governor Ed Sibley” Speech delivered on 5 November 2019.

[2] See Central Bank of Ireland. “Innovation Hub”

European Banking Authority, 2019. “ESAs Joint Committee defines its priorities for 2020”

Hodson, Michael 2019. “Scanning the horizon: a regulatory perspective” Speech delivered on 13 June 2019

Gassmann, O., Frankenberger, K, & Csik, M. (2014 et al., 2014). The Business Model Navigator: 55 models that will revolutionize your business.

Cronin, Sylvia 2017. “Innovation and the use of digital technology, cyber risk as core disruptor and the importance of culture” Speech delivered on 27 September 2017

Buolamwini, J., Gebru, T 2018. Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification (PDF 1.02MB).

ESAS 2015. “Joint Committee Discussion Paper on automation in financial advice”

OECD 2017. “Robo-advice for pensions”

McEvoy, Gráinne 2018. “Culture and Consumer Protection – The Role of Compliance” Speech delivered on 8 November 2018.

Rowland, Derville 2019. “The Senior Executive Accountability Regime: Our Expectations of Firms” Speech delivered on 31 October 2019.

McKinsey 2017. “Culture for a digital age”  

[3] See Central Bank of Ireland “Conference on outsourcing”

Central Bank of Ireland 2016. “Cross Industry Guidance in respect of Information Technology and Cybersecurity Risks (PDF 796.55KB)”

[4] “With thanks to Steuart Alexander, Michelle O’Donnell Keating, Jason Kenny and Sam Benson for their support in drafting these remarks”