1

The Regulatory Framework of E-

Banking

David CarseDeputy Chief Executive

Hong Kong Monetary Authority8 October 1999

2

The “Age of the Internet”

Technology is now the single biggest strategic issue in banking

In particular, banks should be urgently reviewing the opportunities provided by the internet

Businesses that fail to meet the challenge of the internet will have a limited future

3

The challenge for the regulators

The regulatory framework of the HKMA is largely based on the more traditional frame of reference

Therefore we need to ensure that our framework continues to evolve and keeps pace with technological developments

We certainly do not want to stand in the way of innovations such as e-banking

4

The state of e-banking in Hong Kong

The HKMA separates e-banking into two streams:

» electronic money products, mainly in the form of stored value cards

» electronic delivery channel products

5

Stored value cards

Progress so far has been disappointing as far as bank-issued cards (like Visa Cash and Mondex) are concerned

This has been consistent with experience around the world - the product appears to be ahead of customer demand

Technological advance (eg combined credit, debit and electronic purse cards) may help to increase public acceptance

6

The Octopus card

This has been the real success story» 5.6 million cards in issue with 3.8 million

transactions per day Shows that there is real attraction in

Hong Kong for a technological innovation that is genuinely useful and convenient

» reflects the fact that the core use of the card in linked to a specific purchase (transport) that people have to make in their everyday lives

7

Electronic delivery channels

Increasing number of banks have introduced or are planning to introduce shortly transactional internet banking

Mobile phone banking is also very much a live issue

E-banking has the potential to succeed in Hong Kong because there is the supply, the demand and the infrastructure (physical, financial and, shortly, legal)

8

The implications for banks

The internet has enormous potential for the banks in terms of cost-saving and increased revenue generation through more effective cross-selling

But there are also risks» strategic» legal» operational» reputational» liquidity and credit

9

Strategic risk

“ Will the bank get it right?”» will it invest in the wrong technology?» should it be an innovator or a follower?» how should it cope with competition from low

cost entrants?» what should it do with the existing branch

network?» how does it retain customers as their power

to “shop around” is increased?» how can it build and exploit its brand name?

10

Operational risk

Although banks face all sorts of security risk day to day, the internet poses new challenges because of its open nature

Perhaps the biggest concern among customers and therefore the biggest barrier to customer acceptance of internet banking

11

Internet security arrangements

The security arrangements should have the following objectives

» restrict access to the system to authorized users

» authenticate the identity of the parties concerned

» maintain confidentiality of information in transit and ensure that it has not been modified

» prevent unauthorized access to the bank’s main computer system and data base

12

HKMA’s assessment of security

Based on the advice of industry experts, the HKMA believes that developments in internet security technology have reached the point where it is commercially viable to obtain adequate security for banking transactions

But this cannot hold good indefinitely Banks will have to strive to keep up with

technological developments to counter new threats to security as they arise

13

Legal risks

There are many aspects to this (eg legal recognition of digital signatures)

But an aspect of particular concern to HKMA is to ensure a fair division of loss-sharing between bank and customers

Our view is that customers should not be liable for losses from a security breach or system problem that is not caused by their own negligence

14

Reputational risk

The threat of damage to the bank’s reputation goes along with the other risks

» successful hacking of a system may cause bad publicity and undermine customers’ confidence in internet banking even if they suffer no loss

» system breakdown may also arouse public concern

Banks therefore need to adopt specific strategies to manage reputational risk

15

Banking risks

Internet banks face the same types of banking risk as conventional banks, but the risks may be heightened in some respects

» liquidity risk may increase if it becomes easier for depositors to transfer deposits at the touch of a button (the “virtual” run)

» credit risk may increase if the relationship with the customer becomes more distant and transitory, or if competitive pressures lower credit standards

16

Regulatory framework

Our supervisory framework needs to address the above risks

This is part of the general process of trying to determine that banks have in place adequate systems to measure, identify and monitor the various types of risk they face

E-banking poses particular challenges because of the pace of technological change

Will require us to improve our expertise, eg by hiring examiners with specialist IT skills

17

Regulation of stored value cards

Need to regulate in order to» protect consumers» safeguard the stability of the payment

system» possible contagion effect on other schemes if

something goes wrong with a particular scheme

Multi purpose cards are similar to the taking of deposits and the issue of bank notes

18

The main regulatory issues

Who should be allowed to issue stored value cards?

How can the potential risks to the payment system and cardholders be minimized?

» quality of issuers» security of the card» risk management policies and procedures» assets backing the stored value

19

Banking Ordinance

Issuers of multi-purpose cards must be approved by HKMA

Banks deemed to be approved Non-banks may apply to be approved

as a special type of DTC» service providers who want to issue limited

purpose cards Exemption for very limited purpose

cards (like Octopus)

20

Electronic banking

Regulatory approach is less specific and is still evolving

Banks should inform us in advance of their plans to offer an internet banking service and discuss the implications with us

Main concerns are» security (should be “fit for purpose” and

reviewed by independent experts)» risk management systems and internal controls

need to be subject to regular review» approach to the other types of risk described

earlier» contingency plans

21

The virtual bank At some stage we may be asked to

authorize a virtual bank that offers its services wholly over the internet

If it wished to take deposits in Hong Kong, it would need to have a physical establishment here

» provide a point of contact with the bank and place at which HKMA could inspect its books and records

Would need to have capital and liquidity like any other bank and strong parentage

Must have substance, not simply be a “concept”

22

Offshore internet banks

Such banks may try to attract HK residents to place deposits outside Hong Kong

» would not require authorization under the Banking Ordinance

But would breach the rules on advertising for deposits unless it complied with the statutory disclosure requirements

Problem is to know when a particular web-site is targeting Hong Kong

23

Offshore internet banks (2)

Hong Kong may being targeted if, eg» advertisements for service placed in local press» deposits taken in HK$» Hong Kong not on list of excluded jurisdictions

If so, one option will be to write to the bank (if respectable) and its home supervisor to ask it to comply with the Hong Kong rules

May also be possible to seek the cooperation of local ISPs

24

Offshore internet banks (3)

If the bank is not respectable and is based in an uncooperative centre, the situation would be more difficult to handle

The public needs to be very cautious about sending any money to such a bank

No form of regulation can replace the public being careful about who they do business with

25

Conclusions

E-banking is clearly the way forward for the banking industry and the banks in Hong Kong are well placed to capitalize upon this

The HKMA’s task as regulator is to help minimize the risks and to secure the benefits by providing an appropriate regulatory environment

This is an ongoing task which has only just begun