What's Next for Payments Regulation in Europe

[Music] hey we have mrs doris ditzer head of digital finance payment services and cyber security of the federal ministry of germany doris is responsible for including the development of strategies with respect to fintechs digitalization of the financial markets and cyber security she is also responsible for regulatory issues in the field of payments such as psd2 ifr uh the regulation on crypto assets or dora digital operational resilience act besides doris although virtually peter carstens who works at the european commission hi peter peter is advisor on technical technological innovation digital transformation and cyber security at european commission directorate general for financial stability financial services and capital markets union he has led work on the european commission's fintech action plan and co-chairs the european commission fintech task force hi peter welcome to you both and i am gonzalo perez de larco director of government affairs at american express it would be a pleasure to discuss with you today although the title of the panel is what's next for payment regulation in europe i think the title should be what's not next for payment regulation in europe um last year we've been witnessing a kind of massive shake-up and disruption in what will be the payment regulation everything seems to be open for debate and a big change big changes are are to come very soon peter around 15 years ago uh the eu started legislating on payments with the first payment service directive and also with the inter gmt regulation the main objective at the time was to set the ground for uh digital payments or online payments and also to tackle some competition problems that uh the eu was facing in uh the payments landscape today although most of the problems of these regulations have not been completely solved as for example the level playing field competition transparency or consuming choice the debates have already started to to change and to reshuffle all this payment regulation what are your views on uh on this regard and shouldn't we try to fix existing problems and avoiding them to be repeated before trying to change everything well thank you very much gonzalo for this question um i would say that we always like to look forward uh rather than look backwards but of course you have to take account of what happened in the past and learn from the past in order to do your best for the future now if you look at eu payments regulation to date what it does is it regulates payment services and the institutions providing those services it tries not to regulate the technology we just look at is it a payment service yes then it's regulated it's not a payment service then it is not regulated or not covered by payments regulation while we do not aim to regulate technology it is true that payments regulation in the eu to date regulates payment services involving funds and funds that means in legal terms that means central bank money commercial bank money electronic money so those are the payments transfers in those in official currency really are the payments that are regulated now the aims and the motivation for this regulation are manifold between competition aims security and trust consumer protection transparency but and this is often forgotten by people who comment on european legislation one of the most important elements and criteria for our regulation is the eu single market the fact that we need to have common standards across the 27 eu member states so that services can be provided freely across borders and so we we have legislation that tries to have harmonized rules across the eu on matters of competition consumer protection transparency security and so on now you refer to mistakes from the past and that sort of begs the question as to well is the glass half full or is it half empty i'm an optimist and i think that when it comes to payments legislation the glass is definitely half full or more than half full but i truly admit that it's not completely full um we would like to fill the glass completely but that takes some time but if you look at what has been achieved interchange few levels have been regulated and gaps have been set because companies themselves weren't producing or the market wasn't producing an equitable outcome um we've actually we have assured to provide services in the payments view across the eu liability rules for unauthorized transactions have been set um [Music] the legislature has chosen that authentication should be done at a strong customer authentication level so to factor authentication um data sharing has been assured through application programming interfaces rather than screen scraping so an obligation on payment service providers to share data with payment initiation providers and account information service providers so quite a lot has been achieved already and therefore i say that the glass definitely is half full rather than a half empty now we have to bear in mind that payments are a highly profitable or can be a highly profitable segment of the financial activity or of uh to stay within this convention the blockchain activity but we also see that companies that um what we call a goose with golden eggs try to sort of um get more profits out of it and they and by doing so they may well kill the goose with golden eggs and we're trying to to avoid that by having rules of the road that are equitable now looking forward um i expect uh but although i can't predict the future but i expect that european payment rules will be extended to new forms of payments or payments involving other transfers and transfers in funds and if and when the european commission gets around to making proposals on this and that will be a matter for uh next year second half at least um at that stage of course the commission will also take into account some of the disadvantages or the perverse effects or the things in existing legislation that may not have worked exactly as intended or as planned we will then of course try to also address those shortcomings that will have been identified the evaluations for that are just starting now so i can't really say at this stage uh what the extension of the scope of the legislation would be nor what would be the problems that we would uh would seek to address for that we will do a full consultation and a full impact assessment thank you thank you peter the european union is currently debating the regulation on marketing crypto assets um it's a a look at the future on what will need to be regulated uh very soon but when we think of the psd2 the payments directive 2 and the implementation of strong customer authentication and how complicated it was to get so many different actors involved payment service providers schemes merchants consumers and also the timelines that uh the regulation uh set in order to implement all these uh legislative package we also tend to think that sometimes uh this legislation is not fully uh in line with reality there is taking into account these elements what could be improved ahead of future debates on a revision of psd2 or also how could we avoid having a legislation to that could become a burden that could potentially kill innovation yes um thank you thank you for the question um um of course we are always thinking about how to get better um but uh i think we should not forget that psd2 with its two major points the access to to payment account data and the strong customer identification was back then a kind of of revolution and it was kind of a revolution or also perceived by by the by the fintechs because it was the first time european legislation dealt with the access to data outside the gdpr and this is something which became by now a kind of role model for for other for other legislators and especially for discussions in other cross-sectoral legislation even on commissions level so if we look at the current digital markets for example um it's all benefiting from somehow from the experiences and and the drafting we made back then with psd2 so just having in mind that phd2 was kind of innovative legislation back then however to come back to the strong customer authentication um i would like to stress four points we already see that from customer authentication has led to a decrease in fraud and that is good for the payments market that's the first thing the second thing is um of course we know it's a complex issue with many actors involved as you mentioned however the timeline was i would say very clear from the beginning and it also took into account the possible complexity of technological adjustments and and workflows because we had the direct respect in 2015 we had an implementation period until 2019 and then and it got extended and prolonged by the ebay until the beginning of this year so in total we are looking back on six years time in which the implementation of ca could have been taken place and i can i can tell from the negotiation back then in 2013-14 that it was it's not a surprise for anyone that this legislation would come up at one time at one point however we also perceived that the willingness to engage in this topic and to implement really differed between the different market players as well for many reasons and also for good reasons and that that is why i would say of course we have to learn from the past nerve law of course we have to look uh what could be adjusted maybe in future and the the review of the pc2 peter just mentioned it is the exact place where this will happen and of course we have then also to look which worked which could be improved uh and how we can take innovative means of authentication into account and promote them as long as they secure an equal level of of um of payment security thank you dodis but wouldn't you think that maybe [Music] instead of uh doing what the commission or commissioner members have tried to do in the past which was uh with p2 to define very clearly how that two-factor authentication uh should be developed and what were the elements that should be taken into account in order to fulfill the process if a less burdensome process based on the final outcome that is to lower the fraud levels and to guarantee the security of payments was set maybe providing a bit more of flexibility to companies to reach this final goal wouldn't that have helped to avoid having a legislation that from a technological point of view maybe today to 2021 is already a bit old compared with what was uh drafted in uh or published in 2015 and how to avoid like design these very same kind of issues uh being repeated with mika where we are trying to uh prepare the ground for something that is not fully controlled and that will also be evolving and developing very very uh fast in time if you look yes um i i see your point uh if you look at the psd2 and and the corresponding um legislation uh you can see that the commission and of course the legislator the european tried to already back then take that into account because it's like it it's a two well that uh two um two ways of sea which are included or which are possible at the moment of on the one hand we have the strong custom authentication with two factors however technologically speaking it's left to to its left to the market how they fulfill the two factors so we have their kind of technological flexibility already um second we also have a transaction analysis which could be taken into account uh with regard to card payments and this is a kind of um so to say um principle-based regulation where you you're free how to you reach the fraud um or how how you reach your fraud level or bring down your fraud level if you reached it and you make this analysis you're already today free to to uh um to be excluded from the sea so this this approach is already included in the current legislation and it already leaves some flexibility to the market how they fulfill it however um of course with new technological possibilities and new innovation of course further measures are taking into account and could be included in a revision i think we would be open for it thank you doris peter i wanted to ask you a question on digital id um digital id was first developed like some years ago by legislation now it's due to be reviewed in the end when we think about sca double factor authentication and the fact of guaranteeing that who's behind a payment is who says to be there we can tend to think that this strong customer authentication would be a kind of initial step for what could be the one of the main uses of a digital id um do you think that we will manage to get the level of harmonization within the u to make digital id work we will get a common standard that will make it visible [Music] well the short answer to that question is i hope so whether we'll get there remains to be seen now if you think about identification or ultron gamification you have to think also about well why do financial institutions payment institutions other institutions need to identify their customers and they're really two reasons two users for identification the first is authentication and you already refer to that so they need to authenticate transactions and therefore they need to know whether the person using the payment instrument the person at the other side of the line being online is actually authorized to conduct a transaction and therefore you need to identify that person with authentication methodologies but the second reason why you need to identify why you need an identity is because institutions financial institutions in particular but pretty much all what we call obliged entities under antibody laundering legislation need to know their customers they need to know who they're dealing with so that they can also verify for suspicious transactions and stop and report these transactions where necessary now so that those are the two reasons for identification the second question and now you come to the question of harmonization well identity what is an identity and also that is divided into two aspects first is the item identity attributes what constitutes someone's identity is it someone's name is it someone's date of birth is it the place where they live the places where they have lived is it their gender or some other feature or is it all of these elements together and member states do not see eye to eye on this certain member states will for example use a physical address as the individual as an identifier others would not in certain countries gender um can only be binary in others there are more than there's more than two categories and so on so what cons the attributes of identity are for the time being not harmonized the second is how do you certify for identity so how do you demonstrate that a person has these attributes they need to have or they claim to have we have a legal framework called itis which was done which dealt with certification of identity for public use for public users for executive users and the commission is in the process of revising this so that it can be used also for other users at the same time in our upcoming review of our anti-money laundering legislation and i'm really sort of giving a bit of a sneak preview here the commission is considering whether or not to also harmonize identity attributes so that we have a common standard across the eu of what constitutes someone identity for the purposes of anti-money laundering because the biggest challenge which we see is that it is currently very difficult if not impossible to onboard customers remotely and across borders because the standards for identification for know your customer under aml rules are all national and all vary they pursue the same objective the same aim but what constitutes an identity both in its attributes but also in how you certify it so both the ml legislation and the identity legislation varies so we will make an effort to to harmonize that this is a highly highly sensitive issue so i'm not certain uh whether we will succeed because to harmonize this we will need to come to an understanding among the 27 member states of what constitutes identity and if you think about it this is easier said than done thank you thank you peter indeed it would be an incredible development to have some organization in aml so if eid helps to uh to manage to at least getting close to that that would be amazing as we were saying at the beginning europe is currently discussing all that has to do with payments so all the feature of payments is on the table last year we saw different strategical plans that were proposed and under public consultation now we have the open debate on this new proposal for legislation on dota mika others are about to come potentially a review of psd2 strategy and retail payments and probably some legislation on instant payments were those where do you think the eu or europe as a region is heading to and uh are we getting prepared for something hopefully we are prepared for something um uh well yes um i think um all the measures and all the plans and such strategies you just mentioned um which the commission presented last year do show two things in my view first of all um they show the strategic importance of payments uh which is more and more perceived as an important infrastructure for european integration and it also shows uh the growing political importance of the payments issue and and a common and integrated european market and i think these two two points um that is something which which developed during the last years for a long time payments was kind of left to nurse so to say um more or less and now during during the last years we discover how important payments is for an economy but also for ump market and that we discovered to be it more and more like an important infrastructure which is important to to preserve and i think the especially uh the retail payment strategy of the commission with its detailed and very ambitious plan shows the importance the the commission also pays to to to to to the whole topic uh and for me it shows that we are heading to further integrated and competitive market in europe if you look at the retail payment strategy we have very important measures there and we have a very ambitious timetable also um uh in there uh which was the main focus as you mentioned instant payment is probably of one of the next infrastructure or infrastructure layers next to direct debits and and and credit transfers uh when it comes to the payment transactions uh we have the quest you just discussed with peter the id someone told me if you solved uh if you solved the identity you always you also solve payments in a way so there is a close uh connection between these two things they can profit from each other very highly and and then of course we we have the whole uh the whole issue of open banking and uh and access to infrastructure as i mentioned at the beginning psd2 was then back then um perceived as a revelation in this regard and we if we look at the digital markets act as a cross-sectoral legislation it also um really uh do a lot to to could also be of great benefits for for the open banking initiative yes while the openback is certainly uh i would say one of the most important outcome of psd2 if we manage to get to it but as we could see with apis at the main problem that this lack of standardization or harmonization makes it very difficult to uh to well to get to it within this uh right like 27 uh member state and it's the same problem that's what we're also seeing in other regulations that are coming that uh or eid domain the use of the id if if there's no standardization or harmonization we will still be struggling but well linked to this [Music] peter we saw in the past that when the eu debated on gdpr on data protection the eu more or less sets the ground not only in our region but in everywhere else in the world so that was the common standard on data protection and privacy that had been debated and set do you think that we could see something similar today with all these debates on crypto assets regulation would we be trying to guarantee some autonomy independence or trying to uh to tailor the scene for a big players or gaffa or others that could at some point play a big role in payments [Music] well in in digital in a digital area it's often said that the united states innovates asia copies and europe regulates now there is some truth in this so [Music] not because we have a regulatory zeal and we absolutely want to regulate everything that moves but the reason why we have european regulation very often is twofold one is to create a single market to have a common standard across our 27 member states and therefore you you need to develop law for this and the second is motivation is to preserve our values to set our values at a common level now harmonizing legislation so that there's a that are common standards for the single market across the 27 member states can be done at a high level of intervention or at a low level of intervention and that usually is a bit of a sign of the time and of the preferences of the legislator as to whether it's more interventionist or less interventionist and usually um discussions in the european parliament and in the council of ministers among the member states are a combination of marrying the more interventionist approaches of certain member states and the more relaxed lesser fair approaches of other member states and we strike a balance between those and that then becomes the regulation but of course we we want to set our values our common values in that regulation and that's for example what was done in gdpr and there's a very strong consensus across europe about the protection of privacy and so the standards were set at a high level because we wanted to preserve those values now there's a lot of talk recently about autonomy and strategic autonomy of the eu which is vital especially in the digital space but also in other areas but i'm not sure whether you can that you can actually regulate for autonomy you can't have a directive or regulation on european autonomy or to preserve european autonomy because the regulation that we are coming up with can be complied with by foreign operators as well and they can also benefit from it because it creates a single market and what we see is that foreign operators often are very good and often are better than european operators at complying with or taking advantage of european legal frameworks and that's not because they have better technology or they've got better services but because they look at europe as a whole they look at when when these large companies come to us come and speak to us they always take europe as a whole they have a european-wide perspective many if not most of the companies in europe when they come and see us they have more a regional or national perspective they say well look this is the way we do it in country x this is the way we do it in country why and we are thinking about maybe expanding to the neighboring country but that's about it so it's a question of business sense and perspective um and whether you look uh what do you see things big or when you see things uh small so i would say you asked question will we see more of this going um forward well gdpr is of course a standard uh which is being emulated globally we've seen this also in other areas for example in the area of genetically modified organisms also european regulation set the standard which was then emulated in many parts of the world and now we have a proposal for legislation on mika on markets in crypto assets and while there are a number of legal frameworks already around i think it's fair to say that the eu is the first major jurisdiction that is setting in place a regulatory framework for crypto assets that both ensures or aims at ensuring market integrity and consumer protection but also wants to enable the crypto asset industry and we believe that we will be setting a standard uh that will be um emulated in other parts of the world we definitely have a lot of interest in this proposal from all over the world and the same is true also for our proposal on digital operational resilience where also there we are saying well look in the in the current day and age technological resilience digital resilience is so important that you need to have common standards on this we have standards on economic and financial resilience in finance or potential supervision but when it came to operational resilience standards were a bit sort of uh a bit of a mix of uh specific provisions gaps and so on so we now want to set a comprehensive framework for this and also there we see a lot of interest from other jurisdictions so also there i think that um assuming the council and the parliament um will agree to both the dora proposal and the mika proposal in the perceivable future that both will become standards globally thank you thanks peter well i said that there's a very thin red line between not killing innovation and regulating you were referring to to gmos what we saw with the gmos regulation is how finally innovation left europe in this regard and europe is importing gmos from abroad and this is something that it's difficult to set the scene and the good balance between regulating and uh and letting innovation be but with uh with some standards and limits and this is something they may be something that uh we see with uh with now the development of instant payment um europe is pushing for eastern payment to having a common solution uh that would compete uh with other kind of digital payments as cards with this sponsorship or support of ep the european payments initiative [Music] but it seems that it will finally happen but it's not the first time that europe tries to uh to achieve such a goal uh it happened in the past with when they wanted to build a a common uh scheme for cards uh it didn't work what has chen now uh notice i would like to hear your views on it uh are we more engaged on finally having a property solution for europe or it will be another trial that uh who knows who it will end uh yes i think that is something to be answered after it's probably in times to come however um i think there are differences um oh but maybe to start i mean you mentioned epi the european payment initiative and this is an industry initiative by several banks and acquirers in different member states in europe which have set up an interim company now in brussels to to start business and this whole initiative of course as you said is welcomed by by many member states and by the european commission as well and um and um and is somehow in the beginning to to to where to start and and and operate what is different to the energy initiatives you mentioned and we saw before i think um what is probably similar is the economic dimension um of course payments are still as peter mentioned earlier a field where you can do business um what is different to back then is to other or to a former industry initiative is that i got the impression that the strategic importance of such an initiative is part of the business model so to say so so um also the market players are more and more aware of of the importance of having not only a domestic card scheme or not only a domestic payment solution but also engage in cross across border european ones from strategic uh business strategic um view and the the second point with us which is different to former times i would say is also the political awareness has changed it's higher than early or back then and that's goes to what i said um at the beginning um we we see that that payments itself is perceived more and more as a strategic and political matter um to to ensure as a kind of interest infrastructure to serve the economy and and therefore we are more and more aware that to have to have solutions on the market which operate cross-border within europe um is an important could um could importantly um add to to the existing market and to to the competition in its market if you look at the market on the market shares of cross-border payments in europe we still see and that is something you mentioned at the beginning beginning gonzalo that there are only a few major players on the market when it comes to cross-border payments and to add new new competitors to this market could could benefit and serve on all customers in the eu thank you doris i think that we'll need to wait and see how uh this evolves in the next coming uh years until finally uh this project uh becomes live uh we're almost running out of time but i wanted to ask you a last question on cbdc's on digital currencies because we were speaking about instant payments car payments the unsolved problem of the past but there's something that is coming apparently the the ecb will soon take the decision to uh to launch a digital euro the same thing is being studied in other regions of the world what do you think that would be the implications for cash and the current financial model of great institution as the main retail players maybe i don't know doris okay maybe i start and peter [Laughter] concludes yes i thought he concludes that working work sharing between member states and commission normally it's the other way around the commission starts and then the counter concludes um okay first of all i think that the egb work on the digital euro is a very important project um because uh we do not we do need and also in the european arts or to to the international developments we see it looking on china and in the u.s primarily but also other countries already started working here and um that is something we should be prepared uh the second thing is uh the easy work is still at the beginning at least that is our perception um and so there are still a lot of open questions and and depending on how you answer these questions this will affect uh the role of cash and this could reflect um the role of banks um but these are decisions which are not yet finally made we are still under considerations however i think what is clear is that a digital euro will not substitute any cash um cash will still be important it could be an addition to cash um as a legal tender and i think that is one of the main person purposes why why we are discussing a digital euro from the eset be a and not a private one it's a potential to be legal tender and depending on how you design such an euro of course the uh the existing system the existing banking system could be affected and i think i'm quite confident that the ecb will uh will take this into account and will propose or develop something which would include and which which could would include the role of banks and and would do anything that would not at least disrupt the existing system so to say uh but i think there's still a lot of questions to answer in this regard yeah but baby peter knows more well not that i know more about it of course we are discussing this with with the ecb i think it's unavoidable that there is uh due considerations given to a a digital euro and that is to do with the emergence of blockchain technology or distributed ledger technology more broadly and the emergence of private means of payment if you will your private currencies now if you look at existing payment systems um they are all basically systems of passing around commercial bank money and bank credit transfers and i'm pretty certain that if we didn't have these systems as they exist now and we have to start today with developing new payment systems we wouldn't develop them the way they are currently operating because all these payment systems have very complicated clearing and settlement systems behind the scenes is all very complex and a tokenized payment system that's based on blockchain technology has enormous potential of course there's many questions that still have to be answered but it is quite possible that blockchain technology will truly truly revolutionize the way payments operate and if that happens it is also important that there is public money on those blockchains that central bank money can be transacted on blockchains because if there is no central bank money available for transacting on blockchains it will be private money and we're not certain that that's a good idea in the economy as a whole because we believe that public money has a very important role to play in our economy if our economy moves more and more towards blockchain and i think that participants in european blockchain convention believe that that will happen then central banks need to be active in this field as well thank you very much thank you very much uh peter doris we are one minute to uh four o'clock uh i hope the audience uh leaves us with a clear idea on all the challenges that are on the table and all the discussions that are currently opened that will have something to do with the future of payments and of cbdc's a lot of questions but probably the following panel on cbdc's will be able to answer some of them so let's see and continue watching thank you for uh this hour it was a pleasure thank you very much thank you thank you thank you doris thank you peter thank you so much for being here today and sharing your insights we had time to cover some aspects that people are interested like payments uh cbdc's digital identity we cover a few things i don't know if we'll have something to be discussed maybe for another panel another day thank you once again