A supervisory focus on fintech

In response to an increasingly evolving market, European Supervisory Authorities (ESAs) are keen to encourage the development of fintechs, but also determined to exercise appropriate oversight over innovative technology. Recent months have seen a number of important publications by the European Commission (EC), the European Banking Authority (EBA) and the European Central Bank (ECB). These all point towards a growing supervisory focus. Banks should be aware of supervisors' likely priorities and prepare for fresh challenges ahead.

The rapid growth of fintech has become a defining theme of European financial services as seen by the topic's significance at the Eurofi Seminar held in Sofia in April 2018. This burst of activity is also reflected in an acceleration of fintech investments and acquisitions by established European banks. Fintech-related announcements so far this year include Credit Agricole CIB's investment in blockchain specialist SETL¹, Santander UK's launch of blockchain-powered cross-border payments, and the news that BNP Paribas, Deutsche Bank, DZ Bank, Aareal Bank and NETS Group are joining the Frankfurt-based fintech hub launched by Plug and Play and TechQuartier².

In response to the growing industry dynamics, the last six months have seen an unprecedented flurry of publications by ESAs: the European Commission in its Action Plan, the EBA in its Roadmap and the ECB in its Guide to licencing. Each regulatory body wants to encourage the development of fintech, but at the same time to ensure this does not compromise key priorities such as data protection, consumer rights, market integrity or financial stability.

The next few months will pose new challenges for supervisors and banks alike. The EBA and ECB may have stressed the need for a proportionate approach to new technology, but banks can expect to face some searching questions about their fintech investments.

Based on the ECB Guide to licensing (PDF 274 KB) and the Basel Committee Sound Practices report (PDF 1.01 MB) we expect to see increasing supervisory focus in the below key areas:

Cyber risks. Banks will be required to demonstrate documented, approved and periodically reviewed controls over access management, incident management, network security and end-user computing.
Outsourcing risks (including cloud computing). Given the increased vulnerability to cyberattacks, supervisors will want to ensure that banks are exercising appropriate oversight over third party providers. That includes banks' own access and audit rights, as well as appropriate processes to inform supervisors in case of a material change in outsourcing agreements.
Business models. Banks will need to consider how fintech affects their business models, while supervisors will need to adapt their own business model assessment techniques to take account of the latest technological developments.
Internal governance. Supervisors will want to ensure that banks have the capabilities required to manage technological innovation. This includes hiring for appropriate skill sets (such as data scientists, mathematicians, statisticians), awareness at the board level, and suitable training.

Looking further ahead, the EBA's fintech Roadmap provides insights on how fintech supervision is likely to evolve during 2018 and 2019. Leveraging its newly established fintech Knowledge Hub, the EBA plans to:

Monitor the regulatory perimeter for fintech, including licencing and the use of `sandboxes';
Keep an eye on fintech trends, and consider their potential impact on business models and prudential risks;
Promote harmonised supervisory best practices around cyber security in credit institutions, investment firms, payment institutions and electronic money institutions;
Address potential consumer protection issues; and
Identify any potential money laundering risks associated with fintech and technology providers.

In short, fintech is rapidly moving out from 'under the regulatory radar' and is attracting growing supervisory scrutiny. The coming years are certain to see further changes as technology and risks evolve. Both banks and supervisors will need to increase their focus on fintech-related issues through joint initiatives and industry-wide platforms for knowledge sharing.