THE SUMMER BOOK

DON’T MISS OUT ON PAYMENTS WHILE AWAY!

INCLUDINGTHE FAMOUS

PAYMENTS CROSS WORD PUZZLE!

2

The summer has arrived! Temperatures rise, people go on holi-days, focus shifts. It is the time of the year that things slow down. You finally have the time to reflect on things, to get new inspira-tion, to build new connections and to generate new ideas for the future. As innovation experts in Payments, Digital Identity and E-Business, it would be against our DNA not to facilitate you in this process.

We have bundled our latest blogs in this Summer Book to inspire you and help you create new insights during the summer. More-over, these blogs are meant to stimulate debate about the most interesting market developments – and the questions they raise.

Are you back and are you inspired? We greatly encourage you to get in touch whenever interested in, or incentivised by the con-tents of this book. We wish you a fantastic summer holiday and look forward to hearing from you!

Don’t miss out on Payments while away!

Shikko Nijland

Foreword

Shikko Nijland is co-owner and managing partner of Innopay

GET IN TOUCH

3

PSD2 ‘Access to Account’ (XS2A): time to get real about banking API business strategies 4

How to benefit from PSD2? Four strategic XS2A options for banks 7

Moving forward with PSD2 XS2A 11

The fruit basket… an e-commerce conversion killer 14

Virtual Bank Accounts: more than a reconciliation tool 16

EBA proposing pan European APIs: possibly a ‘GSM for payments’? 19

How can your organisation benefit from cryptocurrencies? 21

Secure Pay: immediate action required by Internet Payment Providers 23

Should my fridge do 3D Secure or become a PISP? 25

SEPA: are we ready to reap the benefits? 27

The Payments Cross Word Puzzle 32

Get in touch... 34

Table of Content

4

Mounaim Cortet and Douwe Lycklama on 06/10/2015

PSD2 ‘Access to Account’ (XS2A): time to get real about banking API business strategies

European lawmakers have reached an informal agreement on a revised Payment Services Directive (PSD2) on 5 May. The agree-ment comes after trilogue negotiations between the Commis-sion, the European Parliament and the Council of Ministers. Fol-lowing the technical work thereafter a final compromise text of the PSD2 was published on 2 June. These developments further pave the way for realization of the most debated part of PSD2, i.e. the provisions for third party ‘access to account’ (XS2A).

The final text still needs to be approved by the Council. Hereafter it will be submitted to the European Parliament for a vote in first reading, and to the Council for final adoption around September 2015.

Although key security concerns regarding XS2A are formulat-ed in rather abstract terms, it is clear that ‘third party access’ is going to happen in some shape or form. It is up to the European Banking Authority (EBA) in London to develop their ‘Regulatory Technical Standards (RTS)’, on the basis of which market actors (banks and third parties) are supposed to implement XS2A.

The key message of this blog post for banks (and third parties) is that PSD2 XS2A is not ‘just another regulation’ requiring only an operational and compliance approach. PSD2 XS2A can be consid-ered an accelerator for technology driven disruption of incum-

Mounaim Cortet is a consultant at Innopay

GET IN TOUCH

5

bent banks by flexible and innovative service providers that target not only the payments value chain, but every single ‘piece’ of the universal banking model. These innovative players threaten to capture revenues long taken for granted by incumbents. This development of digital transformation will disrupt the complete banking sector as we know it today and will require incumbents to adapt their business and operating model.

APIs for banking executives: accelerating digital transformationPSD2 and the draft regulatory technical standards on security, authentication and communi-cation to be developed by the EBA to enable account access by ‘third parties’ triggered a live-ly discussion on Application Programming Interfaces (APIs [1]). APIs are foreseen to allow all Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs) to connect to Account Servicing Payment Service Providers (AS PSP) in a secure and effective manner.

APIs are not new: In the past decade APIs have become the de facto paradigm for sharing data, and have enabled organizations that hold large amounts of data to become platforms for third party innovation. Large platforms such as Google, Twitter and Facebook offer APIs to third parties, e.g. for login or for initiating messages. In the payment space PayPal has pi-oneered external APIs since 2010 on the basis of which a whole new ecosystem flourished.

Now, amplified through PSD2, external APIs are becoming a pan-European business topic for bankers. With these APIs customers will have more options to interact with their bank, next to usual online and mobile banking applications. Put differently, driven by XS2A, APIs will open up banks’ ‘Pandora’s box’ (i.e. account and associated data) through dis- and re-in-termediation by so-called Third Party Providers (TPPs).

PSD2 XS2A is not about payments only. Also account information is in scope, enabling big data business models for banks and TPPs. Also lending could become integrated in real time

Figure 1: PSD2 XS2A adding more bank account interaction options for customers (i.e. payers and payees)

6

commerce transactions offering a whole array of opportunities (due to better risk assess-ment and management). This is why PSD2 XS2A has impact across traditional banking silos, making it a top management priority for decision makers in both retail and commercial banks.

Bank boardroom questions are divers and cover various topics. A sample is provided in the table below:

Topic Sample questions1. New revenue sources & busi-ness models

• How to stay relevant for our customers?• Do we want to be a third party provider (TPP) ourselves?• What new transaction services do we (fore)see?• How are we going to monetize our API business strategy?• How are we going to improve our digital time-to-market?

2. IT landscape • How will we realize the necessary IT changes? Make, buy or share?• How to implement efficiently given our legacy IT landscape?• Are we able to realize any cost savings?

3. Compete or collaborate

• Is it possible to create a bigger market for transaction services through collaboration with bank and non-bank service providers?

• How to shape new partnership business models?

The key message of this post is that PSD2 XS2A is not ‘just another regulation’ requiring only an operational and compliance approach. Top management in banking is strongly challenged on vision, decision-making and execution capabilities for at least the coming five years. As a result, XS2A is accelerating the trend of digital transformation in banking that is driving fur-ther unbundling of the universal banking model.

[1] API is a technology concept that allows software applications to communicate without human intervention. An API specifies: mechanism to connect to the software, what data and functionality is available, and a set of rules (standardization) that other software applications have to follow to access data and functionality

Interested?

MAIL MOUNAIMORIGINAL BLOG

7

Mounaim Cortet and Douwe Lycklama on 06/26/2015

How to benefit from PSD2? Four strategic XS2A options for banks

In our previous blog we discussed what the strategic implications are of PSD2 ‘Access to Account’ (XS2A) and identified ten strate-gic questions this poses for banking execs. We argued that PSD2 is not ‘just another regulation’ requiring operational compliance only. Rather it should be perceived as an accelerator for API [1] driven disruption of incumbent banks by innovative third party providers (TPPs)[2] and other types of Fintech companies that target every single ‘piece’ of the universal banking model. Ampli-fied through PSD2, APIs are becoming a pan-European business topic for bankers requiring incumbents to adapt their business and operating model to remain relevant in the digital era.

This blog will elaborate on the strategic options for banks to re-spond to PSD2 XS2A. From our work in the past two years with the European Banking Association (EBA), Open Transaction Alli-ance (OTA), various banks and payment providers on the topic of PSD2 XS2A, we found that banks face two key strategic choices:

1. Positioning in the value chain: banks either compete for cus-tomer relevance(by becoming a TPP) or focus solely on providing account access and let TPPs offer compelling services to (their!) customers;

2. Breadth of transaction services portfolio: banks either of-fer a limited, basic portfolio of payment and information services

Douwe Lycklamais co-owner and founding partner of Innopay

GET IN TOUCH

8

through APIs or extend to also cater for other types of transactions ‘beyond payments’, e.g. advanced payment and information services, digital identity services and lending.These two fundamental choices result in four strategic options for banks as depicted in the figure below. Note that these options are not mutually exclusive, as banks could evolve from one scenario to the other based on the choices made regarding positioning and product port-folio.

Figure 1: Four generic strategic options for banks resulting from PSD2 XS2A

The table below provides a brief description of the available strategic options for banks.

Strategic option Description1. Mitigate What: This option illustrates the minimal action required by banks, i.e.

the bank focuses on PSD2 compliance and ‘opens up’ through APIs to the most limited extent possible to enable TPPs to execute payment initiation and account information services.

Impact: banks will need to cooperate with TPPs conform and limited to the PSD2 and the Regulatory Technical Standards (RTS) to be de-veloped by the European Banking Authority (EBA). Separate commer-cial partnerships and agreements with TPPs for value added payment initiation and information services could be developed to offset the capital, compliance and operating costs that banks will incur as a result of PSD2 (i.e. further elaborated in option 3 and 4).

9

2. Compete What: Same as option 1 (i.e. ensure PSD2 compliance), but banks add an offensive strategy by also offering innovative (basic) payment initia-tion and information services to compete with other TPPs.

Impact: the bank’s apps become preferred solutions for customers, through which access to other account servicing banks could be estab-lished to initiate payments and obtain access to account data. Banks will compete heads on for customer relevance with established play-ers in the e/m-commerce payments landscape and players offering personal finance management services. Banks will need to reconsider their existing distribution and operating model to effectively compete with nimble TPPs.

3. Expand What: Same as option 1 (i.e. ensure PSD2 compliance), but banks fo-cus on developing and exposing APIs that go beyond basic payment and account information services.

Impact: Banks will be put in a position to seize new revenue stream opportunities by leveraging account information. Digital Identity, for example, offers a new revenue source for banks by monetizing ‘Know Your Customer’ (KYC) and ‘Anti-Money Laundering’ (AML) informa-tion as well as personal attributes of customers. The services are, of course, to be offered with consent of the customer, who receives more ease of use and convenience in return when transacting in the digital context. Banks need to prepare their internal organization (across si-lo’s!) to effectively work together and deliver such services.

4. Transform What: Same as option 1 and 3, but banks also focus on pursuing a ‘bank as a platform’ strategy to enable third parties to build applica-tions and services around the financial institution based on open APIs. Banks become a complete digital player, competing and collaborating for customer relevance in payment and information services.

Impact: The bank acts as a platform for facilitating financial services of others, e.g. peer-to-peer lending, KYC services, risk and payment services. This will require banks to collaborate with Fintech players to accelerate adoption and market growth of transaction services. Banks provide the reach, trust and scalability, while Fintech players are key in building customer centric user experiences that drive conversion. Banks will need to determine new partnership strategies and define business models to effectively monetize its API platform.

Key question for banking executives now is: what strategic option suits my bank best? The choice for a strategic option will have significant consequences for a bank’s future business and relevance. Making the ‘right’ strategic decision will require banking executives to (re-)consider their future ambition, desired position in the value chain and accompanying trans-action portfolio. As Fintech companies are moving at a rapid pace incumbent banks need to

10

Interested?

MAIL DOUWEORIGINAL BLOG

strategize fast to retain their market power through a resilient digital, API driven business strategy.

Defining the business case for each strategic option and determining your strategy moving forward requires a solid understanding of regulatory, technological and business considera-tions. Contact us to discuss the opportunities.

[1] Application Programming Interface (API): technology concept that allows software applications to communicate without human intervention. An API specifies: mechanism to connect to the soft-ware, what data and functionality is available, and a set of rules (standardization) that other soft-ware applications have to follow to access data and functionality

[2] In the PSD2 these players are referred to as Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs)

11

Mounaim Cortet and Douwe Lycklama on 07/10/2015

Moving forward with PSD2 XS2A: a forced marriage of convenience between banks and TPP’s?

With Fintech companies moving rapidly incumbent banks need to strategize fast to retain their market power through a resilient digital, API driven business strategy. In our previous blog we dis-cussed how banking execs can benefit from and respond to PSD2 ‘Access to account’ (XS2A). Incumbent banks are confronted with two fundamental choices in this regard; 1) Positioning in the val-ue chain, and 2) Breadth of transaction services portfolio. These two choices result in four strategic options that banks could pur-sue to react to PSD2 XS2A; Mitigate, Compete, Expand and Trans-form.

In this article we elaborate on the benefits and implications of collaboration between banks, innovative third party provid-ers (TPPs)[1] and other types of Fintech companies. While the four individual XS2A strategies we defined are indispensable for banks there is also a collaborative standardization and interop-erability dimension to PSD2 XS2A. This needs to be considered due to the two-sided nature of the payments market. Collabora-tion is essential to mitigate the risks surrounding XS2A, such as market fragmentation of innovative payment services for payers and payees, varied security standards, reduced trust and slow(er) market growth.

Innopay contributed to a recently published opinion paper in

Mounaim Cortetis a consultant at Innopay

GET IN TOUCH

12

which the European Banking Association (EBA, not to be confused with the Authority) laid down its vision to avoid such market fragmentation. Key element in realizing its vision is the creation of the ‘Digital Customer Services Interface’ (DCSI), i.e. an API[2] layer on top of the existing SEPA and cards payment infrastructure to facilitate interoperability on a pan-Euro-pean level between banks and TPPs. This is depicted in the figure below.

Question that rises is why would banks and TPPs should partner (apart from the regulatory push)? The simple answer is that they need each other to make attractive applications and services for payers and payees. This in turn will accelerate adoption of innovative services and market growth, contributing to top and bottom-line growth. Put differently, banks pro-vide the trust, reach and scalability, while TPPs and other Fintech providers deliver seamless user experiences that add value and drive conversion.

In particular, in the EBA thinking the DCSI allows banks to offer online, real-time services for payment initiation, account information and digital identity in various contexts (i.e. B2B, B2C and C2C). For this purpose, interoperability with TPPs is key, as it will allow banks to offer their reach and Anti-Money Laundering (AML) and Know Your Customer (KYC) expertise to TPPs. It could also enable banks to benefit themselves from a TPP’s innovations by engaging in a strategic partnership. Put simply, the DCSI is a possible way forward to accelerate the digital economy whilst having the potential to enable banks to comply with PSD2 in a cost effective manner.

In summary, the development of PSD2 XS2A is yet another trigger for banking executives to get real about banking API business strategies. While at board level there are still many strategic questions in need of an answer (see blog 1), banking leaders are challenged on ade-

Figure 1: Digital Customer Services Interface (DCSI) enables real-time interopera-bility between banks and TPPs

13

quate and timely decision-making regarding the bank’s future strategic value chain position and product portfolio (see blog 2). Next to a banks individual strategy, collaboration with industry peers, TPPs and other Fintech challengers is key to avoid the all-important risk of market fragmentation that all two-sided markets face. The future of banking starts today!

Understanding the implications on future business models and partnership strategies for banks and TPPs in a continuously evolving digital economy is not an easy task. Contact us to discuss the opportunities, threats and roadmap for your organization.

[1] In the PSD2 these players are referred to as Payment Initiation Service Providers (PISPs) and Account Information Service Providers (AISPs)

[2] Application Programming Interface (API): technology concept that allows software applications to communicate without human intervention. An API specifies: mechanism to connect to the soft-ware, what data and functionality is available, and a set of rules (standardization) that other soft-ware applications have to follow to access data and functionality

Interested?

MAIL MOUNAIMORIGINAL BLOG

14

Vincent Jansen on 06/17/2015

The fruit basket… an e-commerce con-version killer

In my series on “every day products that play a key role in today’s world of e-commerce” (See also: my fridge) here’s a short note on how my fruit basket prevents instant e-commerce conversion.

Let me illustrate what I mean by way of a real life example.

Last Sunday morning, just before my kids woke up, I thought it was a good time to finally move my car insurance to another com-pany. I sat down with my laptop and coffee at my kitchen table and just minutes later, I found the best deal.

The insurance company’s website looked crisp and offered a small form that asked me for some of my personal details and for relevant information about my car and current policy.

So far, so good. But this is where the fun stops.

I’m asked to download and print a contract, sign it, add copies of my ID document and a recent bank statement, envelope all this and walk to the mailbox. But hey… no need for a stamp (hurrah!).

With the best intentions (after all I spend some time filling out the form and it would be a shame to consider that a waste), I print the form and sign it.

By then I need my ID and a bank statement. My passport is prob-

Vincent Jansenis Principal and Digital Identity lead at Innopay

GET IN TOUCH

15

ably in my suitcase upstairs and my driver’s license sits in my wallet that I seem to have mis-placed. My bank statements are filed in some closet that I only open to put new stuff in, not actually find things.

This is when my two year old daughter decides to wake up and I have to attend to her needs, so I put my printed documents where I put everything papery that I need to give a place in-stantly… in my kitchen’s fruit basket.

The next day, while in a train, I browsed through my wallet (yes, I found it) and saw my driver’s license. I really should make those copies…

And this is where the process ends. The momentum is gone, I forget about it, I never made the copies.

A few weeks later I just dispose of the printed sheets all together. After all, what was really wrong with my current car insurance? Is it really that bad that it’s worth this hassle?

You may call me lazy or fickle, but I bet you a decent bottle of wine this is what’s preventing e-commerce business in many cases: small disruptions in the customer process that lead to real loss in conversion.

And if I’m exaggerating a little, that’s just to make my point: there’s an easy solution to all of this... Just make sure nothing ever (ever!) ends up in my (or anyone else’s for that matter) fruit basket.

How? Well, if only I could have used some sort of eID to prove who I am and sign the contract. Because I’m always buying stuff, I keep my online banking token close and my mobile phone is just as always in my pocket. Both would have worked for me.

Also, I could easily have picked up the process where I left off, if I was able to make a photo of my driver’s license with my phone while in the train the next day.

These are just two examples of the many building blocks out there that will help you prevent losing conversion and customers. When chosen carefully, these building blocks can add real value to your customer process by making it more seamless.

I’d like to find out together what best fits your customers’ needs.

Interested?

MAIL VINCENTORIGINAL BLOG

16

Ivo Luijendijk and Pieter Nijs on 06/19/2015

Virtual Bank Accounts: more than a reconciliation tool

Virtual Bank Accounts are hot. They offer corporates the same advantages as extensive physical bank account structures, while eliminating the costs of opening and managing accounts. And they can help corporates bring back their number of physical bank accounts, at least theoretically, to one, centralised account, thus taking away the need for (expensive) cash management products, such as notional pools. In this blog, we discuss two commonly offered Virtual Bank Account-solutions that are often mixed up: Virtual IBANs and Virtual Accounts. We also dive into the foremost opportunities that Virtual Bank Accounts offer to corporates and banks.

Corporates have been aiming to centralise their cash- and trans-action management for years, both to optimise their working capital and to decrease their administrative burden. Recent de-velopments have made such centralisation easier in both Europe (SEPA) and the rest of the world (other ISO 20022 formats, such as CGI-MP). As the most important incentive for holding decen-tralised, physical bank account structures has now become one of financial administration, the call for Virtual Bank Accounts in-creases. Banks have started to answer, with both Virtual IBAN- and Virtual Account-propositions.

Virtual IBANs are bank-issued dummy International Bank Ac-

Ivo Luijendijk is Senior Manager at Innopay

GET IN TOUCH

17

count Numbers that reroute payments to another, real IBAN – and into this IBAN’s under-lying physical bank account (as depicted in Figure 1). From a client’s point of view, Virtual IBANs look and function exactly like real IBANs. Whenever he or she pays to a Virtual IBAN, however, his or her funds will end up in the corporate’s physical bank account to which the Virtual IBAN is associated. A corporate can hold numerous Virtual IBANs and reroute all payments made to them to the same physical bank account. Moreover, it can use Virtual IB-ANs to identify the purpose of the payment made. A corporate can in fact allocate a Virtual IBAN to each of its clients, so that client X is the only one paying to Virtual IBAN X. This facil-itates straight-through reconciliation and greatly reduces administrative costs.

Figure 1: Virtual IBANs reroute payments to a real IBAN

Most banks offer Virtual IBANs in parts of Central and Eastern Europe, where the largest straight-through reconciliation rate gains are to be made because of these regions’ limited tradition with Direct Debit products. Deutsche Bank and UniCredit are among those offer-ing a Virtual IBAN reconciliation tool in Western Europe.

Virtual IBANs will help corporates increase their reconciliation rates, which improves the Days Sales Outstanding and increases the working capital available. It will also eliminate manual reconciliation effort needed, and allows companies to rationalise the number of ac-counts receivable bank accounts held. Virtual IBANs, therefore, are a serious step towards centralisation. But Virtual Accounts go much further.

Figure 2: Master Account funds are allocated without segregating them

Virtual Accounts are administrative ‘subaccounts’ of one physical bank account, often called the ‘Master Account’ (as depicted in Figure 2). The Master Account is part of the bank’s ledg-er, and all of a corporate’s cash is in this account. Under the Master Account, corporates can open, close, and modify as many Virtual Accounts as they need, and organise account hierarchies to their liking. Cash can be earmarked as belonging to a Virtual Account, so that corporates can allocate funds without segregating them physically. A typical corporate could choose to open Virtual Accounts per business unit, per client, or for incoming and outgoing transactions – but also at different levels for all of these purposes. Virtual Accounts do not have or need IBANs: as it is the only physical bank account left, all transactions take place on the Master Account. Based on variables such as the counterparty bank account and remit-tance information, these transactions are also earmarked as payments or collections relat-ed to a certain purpose, and allocated to the corresponding Virtual Account. This facilitates

18

straight through reconciliation.

Barclays and BNP Paribas are among those banks that offer Virtual Accounts to corporates. Both banks, interestingly, focus primarily on the receivables reconciliation benefits of Virtual Accounts, and only secondarily on benefits brought about by allocating funds without segre-gating them physically. One explanation could be that offering multi-entity Virtual Account hierarchies is still in its infancy.

While Virtual Accounts are potentially beneficial to any corporate that uses physical bank account structures for its financial administration, potential benefits of Virtual Accounts are greatest for corporate groups – and this is where opportunities lie. If a group or a holding of corporates can centralise its cash, liquidity otherwise trapped in complex bank account structures can be freed – improving available working capital substantially. Moreover, and because all transactions take place on the Master Account, multi-entity Virtual Account hi-erarchies will enable the Master Account-holding entity to Pay On Behalf Of (POBO) and Collect On Behalf Of (COBO) Virtual Account-holding entities – thus facilitating corporate groups to also centralise their transaction management. Add to that the ability to hold an intercompany loan administration, virtually, and to calculate internal interest, and one has a great in-house banking proposition – offered by the bank! Such proposition could even be an alternative for notional cash pooling, which will become a lot more expensive under the Basel III framework.

Several legal challenges will need to be faced before banks can offer their own Virtual Ac-count-based in-house banking propositions. For example, under SR15 of the Financial Ac-tion Task Force Recommendations, which serve as an international standard for anti-money laundering and counter-terrorist financing measures, corporates are obliged to assess and mitigate the risks that may arise in relation to the use of new or developing technologies for both new and pre-existing products. Banks will need to decide whether a Customer Due Dil-igence procedure is required at a Virtual Account-holding entity level, and how rigorous this procedure is, as their Master Account-holding clients can now open accounts for entities that are not necessarily clients of the account-servicing bank. Before such issues are tack-led, banks can start offering single-entity Virtual Accounts propositions. Or they can steer a middle course, combining reconciliation with corporate group centralisation through in-tegration of Virtual IBANs with the in-house banking software that their most centralised clients do already own.

Doing nothing is no longer an option. Virtual Bank Accounts will be a guaranteed feature of the banking landscape of the future. And with banks opening up their systems under the pressures of both legislation (PSD2) and technology (API economy), non-bank players will undoubtedly offer this feature if banks do not. Innopay has been actively involved in devel-oping Virtual Bank Account-propositions and is ready to help banks develop and implement their own. We also help corporates realise the full benefits of both Virtual IBANs and Virtual Accounts.

Interested?

MAIL IVOORIGINAL BLOG

19

Douwe Lycklama on 05/15/2015

EBA proposing pan European APIs: possibly a ‘GSM for payments’?

During the last EBADay in Amsterdam the Euro Banking Asso-ciation laid out quite a bold vision on how to fix the challenge of connecting ‘fintech & banks’ for better pan European innovation, while creating a win-win-win for payers, payees, incumbent & challenger financial players and society at large (through an ac-celerated growth of the digital economy as a result).

Opinion paper90 sec summary movie

How: re-using the banks’ end-to-end pan European trust for in-cumbent fintech solutions so payment, information and sign-up transactions can be done easier.

The result: reduced fragmentation in the space of innovative pay-ment solutions, while maintaining the superior functional prop-erties of innovative solutions which create ease of use and high conversion in digital commerce.

Key element in realising the vision is the creation of the ‘Digital Customer Services Interface’ (DCSI), which can be regarded as a pan European API, offering ‘inclusive access’ (or ‘integration layer’) on top of the regulated (SEPA) infrastructure. The DCSI should also provide the pan EU interoperable bridge to existing ‘access methods’ such as online banking schemes, direct banking

Douwe Lycklamais co-owner and founding partner of Innopay

GET IN TOUCH

20

APIs and other methods of connecting payers and payees.

This vision potentially also envelops:

1. The need for XS2A compliance in an elegant way by putting the consumer in control of their sensitive data for all sorts of use cases

2. The need for a real time pan European customer experience, as part of creating in-stant funds transfer in the clearing and settlement domain

3. The extension of scope towards information and digital identity servicesThe call to action of the EBA opinion paper is towards the whole of the incumbent and challenger financial players for creating such APIs.

Looking forward to your views!

Interested?

MAIL DOUWEORIGINAL BLOG

21

Gys Hough on 05/13/2015

How can your organisation benefit from cryptocurrencies?

More and more senior executives are asking Innopay how to use or benefit from cryptocurrencies. As the sensationalism regard-ing the currency aspects, such as price fluctuations and its po-tential for financing criminal activity, inevitably dies down, the business interest has shifted towards the application of crypto concepts for more practical use cases.

Cryptocurrencies are still a fast developing and nascent phenom-enon: in what forms it will manifest in the next decade remains to be seen. Nonetheless, depending on what is important to your organisation, you can borrow concepts from cryptocurrency to improve your processes and performance. Currently we ask our clients three questions to start assessing crypto’s short term po-tential for their business:

1. Is the efficient transfer of value important to your business?The transfer of value is a broader term that we use to guarantee the transfer of ownership of non-monetary assets such as deeds, securities, copyrights or even fractional ownership of artworks in addition to monetary payments.

When an organisation’s business model is heavily dependent on being able to receive or execute international value transfers and

Gys Houghis a consultant at Innopay

GET IN TOUCH

22

record these transactions in an irrefutable manner, the peer-to-peer or unmediated nature of cryptocurrency value transfers hold considerable advantages, especially regarding cost and speed. Seeing that is unprofitable for banks to maintain direct nostro accounts between less traded currency pairs (for instance the Mozambican Metical and Turkish Lira) cost and speed advantages are compounded when the payment is done between more exotic curren-cy pairs.

2. Does your organisation undertake many trust-related expenses?Trust-related expenses such as security, governance, auditing and bookkeeping represent a major business expense. Cryptocurrencies’ distributed consensus ledgers enable the so-called automation of trust because they require no custodianship to record one version of the truth.

With the use of these ledgers many trust related structures, procedures and their related costs can decrease. Similarly, the benefits of cross-organisational co-operation can also be achieved in a more efficient manner seeing that less trust related structures have to be in place before separate parties can transact. For example, when two organisations that had no interaction before want to transact large amounts, then a trusted third party would need to be hired to perform escrow services. By means of using cryptocurrencies, the same result can be achieved without the trusted third party. Escrow is the most straightforward example but other, more complex, applications are in development.

3. Are your processes paper processes in digital form or actually automated?Few companies make the distinction between the actual automation of their processes and the digitization of their paper processes. This digitization of paper process, or so-called de-materialization of processes, does hold value. However, these processes necessitate organi-sations to maintain separate and distinct infrastructures and processes to execute small var-iations of the same process. This eventually leads to clunky legacy infrastructures that are not conducive to innovation. All the previously mentioned advances and innovations of cryp-tocurrencies in combination with additional ones, such as multi-signature wallets and smart contracts can lead to actual automation breakthroughs in cumbersome processes such as documentary exchange.

ConclusionIf you answered yes to any of these questions it means that significant overlap exists between your organisation’s core processes and the areas where cryptocurrencies show promise. If so, it is worth your while to explore and learn more about cryptocurrencies to see what gains can be made in procedural efficiency. Initially it might be overwhelming, but you will benefit by joining the growing group of organisations that are competing for first mover advantages in this new and exciting field.

Interested?

MAIL GYSORIGINAL BLOG

23

Douwe Lycklama on 02/19/2015

Secure Pay: immediate action required by Internet Payment Providers

On 19 December 2014 European Banking Authority published the ‘Final Guidelines on internet payment security’. These guide-lines cover generic security ‘best practices’ in the area of general control & governance, risk assessment, incident monitoring/re-porting, risk control & mitigation and traceability. The most im-pactful part starts with section 6, on the topic of customer identi-fication and authentication.

The guidelines prescribe that per 1 August 2015 all Internet pay-ments will be required to be strongly (2 factor) authenticated. Customers need to be ‘positively’ identified, conform AML-alike requirements. So risk based approaches are not allowed.

Merchants, PSPs, acquirers and issuers will be confronted with a new reality. Current authentication (such as 3D Secure) will not be enough, because the obligations are extended towards direct debits and credit transfers. Also transactions originated by issu-ers outside of the EU need to be authenticated by acquirers and/or PSPs. The liability regime will shift to the ‘weakest link’ in the chain, per KC7.6 and footnote 22 of the ECB’s Security of Inter-net Payments Recommendations. The ECB and the national reg-ulators are responsible for regulating the Card Schemes, and will also be responsible for regulating the liability shift regime.

How does this affect today’s online payments business? Getting

Douwe LycklamaDouwe is co-own-er and founding partner of Innopay

GET IN TOUCH

24

clear answers from the authorities all over Europe is challenging, but our analysis leads to the following six points:

1. PSPs, acquirers and issuers are obliged to facilitate authentication or else they are li-able, provided the issuer provides authentication. Liability does not shift to the mer-chant when he chooses not to authenticate while the PSP is offering it. This is a change from today where the merchant is liable when no authentication is used.

2. The ‘weakest link’ is determined through a –still to be defined and developed- registry by the card schemes and a technical framework by the EPC.

3. PSPs and acquirers will have to force their merchants to implement authentication. Failing to do so, might eventually lead to merchants loosing their processing contract from European PSPs and acquirers. Merchants could move to non-EU service provid-ers.

4. Today’s 3D Secure is not enough because it is one factor and only covers Visa & Mas-terCard mainly, with very low issuer adoption rates. 3DS will be adapted to 2 factor authentication (2FA) in the coming years, but not in time for August 2015. EMV Co has publicly stated that its framework standard for V2.0 wont be published until end of Q1 2016, which means that deployed solutions may take many years to follow.

5. The national enforcement of these guideline strongly depends on the local authorities, often central banks or financial services regulators themselves.

6. Exceptions for 2FA exists for ‘trusted beneficiaries’ (white listed), within banks and low value payments as defined by PSD.

For sure PSPs, acquirers and issuers need to take this seriously. Next to the authentication requirements the guidelines contain requirements for general good security practices, which payment actors have to implement (most of them already have this) and document this to-wards the authorities as part of their ongoing compliance obligations.

As a general reflection: the adoption of digital identity methods is accelerated through the increasing regulatory requirements. Other regulations requiring digital identity solutions include PSD2, eIDAS, AML and General Data Protection. The 4th AML/CTF directive was just voted by the EU Parliament, and it has transaction monitoring and continuous KYC due diligence requirements.

We can expect more standardisation and interoperability in this space as we do not want to put up users with even more passwords and token issuing processes. Re-use of existing cre-dentials will be key, a.k.a. as ‘reach’ as we know it from the payment world.

Interested?

MAIL DOUWEORIGINAL BLOG

25

Vincent Jansen on 02/19/2015

Should my fridge do 3D Secure or be-come a PISP?

Or why we need to tokenise the bank account...Consider the following. It is a bit past 2020 and my fridge notices I have almost ran out of milk. And, thanks to some brilliant inno-vators, it immediately places an order for some more milk with my grocery store of choice. So far all is very clear and convenient.

But then it becomes fuzzy. When my fridge tries to pay for my milk several European regulations, directives and recommenda-tions, such as PSD2 and the EBA Guidelines on the security of Internet payments kick in.

Under PSD2 my fridge would be allowed to execute a payment from my bank account on my behalf only when it is a licensed PISP . My 2020 fridge can probably do a lot, but this seems a bit stretching.

Under the recently published EBA Guidelines on the security of internet payments all is fine as long as my card issuer or debtor bank is able to strongly authenticate me. Again my fridge is state of art, but entering challenges on my bank’s OTP device and cop-ying the response…?

So should my fridge be able to do a strong authenticated 3D se-cure transaction on my behalf, or should my fridge apply for a PISP license? Or is there an alternative?

Vincent Jansenis Principal and Digital Identity lead at Innopay

GET IN TOUCH

26

Of course my bank could implement an API that would allow fridges in general to act as user agents that could, within specified limits and with explicit consent, initiate payments on a us-er’s behalf. And while the banks are at it they could standardise such API industry and open it for coffee machines, laundry machines and why not… all kinds of user agents.

When setting up my fridge in 2020, I would then be able to use my fridge’s app to config-ure the payment service by initiating a request for an authorisation token for my payment account at my bank. I would then be redirected to my bank, where I authorise my fridge for payments to my favourite farmer for a maximum of 25 euros per month, which should cover my family’s monthly dairy intake. My bank would then issue an authorisation token express-ing those specified limits to my fridge.

My fridge can then use the token to initiate payments on my behalf and I can revoke or amend the token at any time I see fit just by logging into my Internet banking account. Very conven-ient, very secure, very transparent.

If banks help me out with my milk-buying problem in this way, they also solve a lot of other problems. But these banks should do this in a European fashion, something like the ‘digital version of SEPA’ or the ‘next chapter of SEPA’. Avoiding ‘many to many challenges and there fragmentation. I hope the EBA’s vision on Digital Customer Services Infrastructure will help banks start thinking in this direction.

P.S. I might have oversimplified some things a little to make my point.

Interested?

MAIL VINCENTORIGINAL BLOG

27

Ivo Luijendijk on 01/30/2015

SEPA: are we ready to reap the benefits?

SEPA implementation at best a compliance effortIn early 2008, the European payments industry was set alight with the promise of pan-European payment possibilities, espe-cially with the introduction of cross-border collections with the SEPA Direct Debit. This would help companies in their (multina-tional) accounts payable and receivable administrations and also remove barriers for expanding their activities to other European markets.

Back to today. Now that the deadline and grace period (or second, ‘we really mean it this time’ deadline) for SEPA compliancy has passed, we see that Europe has reached the goal of standardised payment-related information exchange. We’ve all implemented the same formats (more or less), timelines and regulations and so compliancy to the new uniform products and message-types is achieved. But compliancy seems to be all that the European economy has strived for.

Why have so many European companies chosen such a defen-sive strategy for their SEPA migration? With so much potential for reduction of the cost of financial logistics, why haven’t organ-isations (and especially their treasurers) jumped at the chance to centralise their accounts payable and receivable administrations? Why spend so much money without touching any of the potential

Ivo Luijendijk is Senior Manager at Innopay

GET IN TOUCH

28

benefits? Three major factors seem to come into play here.

1. One mega-program at a timeAnyone active in the field of payments or finance knows that the amount of work needed to become SEPA compliant has been significant for corporates. The impact has been felt on IT (like file formats and system compatibility), operations (non-payment escalation, reconcilia-tion) and finance (higher working capital needs) alike.

2. SEPA hasn’t (fully) matured yet As the EU has stated in a report last year (in Economic analysis of SEPA, published by PwC January 16, 2014), SEPA is far from done yet. First off, the current state of SEPA is far from ideal. R-messages (being reject reasons for payment failure) are confusing, the timelines for international direct debit are too long and local legislation may still require local payments. Besides these wrinkles that need to be ironed out (and will be ironed out by the Euro Bank-ing Association’s SMART – SEPA Migration Action Round Table), the digitalisation and stand-ardisation of the value chain needs to be extended. Without these e-Invoicing, e-Mandates and e-Identity solutions, companies are faced with a cumbersome process to arrange the needed documents which, due to the required paper trail, requires a local presence. At least, this seems more preferable then the rather time-consuming (and uncertain) process of ask-ing your potential clients to print, sign, scan, and mail the contracts or orders to you.

All this will be launched in 2015 throughout Europe and then (hopefully) extended upon when the PSD2 comes into effect in 2017.

3. Let the banks evolve their offerings first Due to the (first) PSD, account & transaction fees have become completely transparent. Now that SEPA forms almost the entire transaction volume, organisations can start to see the effect that the mythical ‘Level Playing Field’ will have on the European banking commu-nity, with regards to pricing and added service. Treasurers may well be inclined to wait out and see what the new best-bank will be for them before they decide on whom to offer their payment volumes to.

Now is the time to reap the benefits of SEPADespite all these seemingly logical reasons for restricting SEPA implementation to just com-pliancy, any organisation looking for working capital or lower operational cost for payment processing would be well advised to start investigating the possibilities that centralised pay-ments can offer, as this solution offers a relatively easy way to improve liquidity within the organisation, which is needed for two very pressing reasons. First, due to the current eco-nomic climate and increasing regulation like Basel 3, banks are more reluctant (and expen-sive) to supply working capital.

In the report mentioned above, the European Commission calculated that the European economy can benefit from SEPA for a staggering total of approximately €227 billion in a one-time effect of credit lines and released liquidity. On top of this, there is potential gain of €22 billion yearly in improved IT & operations efficiency. However, as long as the European cor-porates don’t act on these, this potential will remain untapped.

SEPA compliancy in itself already had some effect of course, since the standardisation has improved operational efficiency for a part of that €22 billion, but the banks and the compa-nies of Europe need to adapt to the SEPA payments playing field before the one-time release

29

of the €227 billion can be accessed. As shown in Illustration 1, banks can definitely benefit from the (post-SEPA) standardisation. These ben-efits can be found in increased pro-cessing efficiency, especially if the use of the ISO2022 XML standard is implemented beyond SEPA. The need to support less formats and products reduces the cost per trans-action and operational complexity and risk.

But the real hay-day awaits for the (multinational) organisations in Europe, who can take ad-vantage of the improved service offerings of the banks, simplify their cash management and reduce their IT and operations needs. And the best part is, there is no need to wait for banks to adjust their offerings first now that the SEPA foundations are in place.

Organisations can challenge banks to adjust their offerings and (if needed) use specialised ‘Overlay’ service providers to take away the IT and operational friction that early adoption can cause. These Overlay service providers offer specialised solutions that by-pass technical obstacles for cross-border payments within the EU market. This way, reaping the benefits of SEPA can be a quicker and smoother ride.

Illustration 2 shows the main benefits of centralisation, being improved cash management and reduced cost of operations. As a rule of thumb, one can say that the one-time release of €227 billion is cash management implications is shown on the left and the yearly savings of €22 billion in processing optimisation is shown on the right. The remainder of this blog will describe what the cash management implications are, a follow-up blog will go into deeper detail regarding the IT & operations benefits.

Figure 2: Main benefits of centralisation of payments (Innopay 2015)

Figure 1: How to un-tap the potential of SEPA (Innopay 2015)

30

Simplified cash management saves costsCentralisation of payments (or rather, the accounts payable and receivable administrations) reduces the number of accounts needed and the complexity of the structures for managing the funds on those accounts. Illustration 3 shows that the amount of accounts and transac-tions needed to manage all the funds can well be halved by using the cross-border possibili-ties of SEPA optimally.

The top half of the illustration shows an example of account pooling, used by the holding company to manage the ac-counts and performance of the various subsidiaries. These ac-counts are typically structured in a notional pool (and in this ex-ample, a multi-currency pool), where the individual accounts are considered as one, with re-gards to balance and interest calculations. Because of this structure, the individual results of the subsidiaries are still vis-ible (for instance for sweeping purposes) while debit interest in case of negative results of a subsidiary is prevented.

The blue arrows in this illustration show how a decentralised account structure for a multi-nationally operating company. The account receivable and account payable administrations are linked to local bank accounts, so periodically, the local finance department will need to transfer funds to the headquarters (be it manual sweeps, zero balancing or load balancing). The result is that the efficiency of the cash is left sub-optimal due to four effects:

• Cash is left unused on the local bank accounts;

• Local overdraft of the account will result in debit interest;

• Once transferred; cash will be in transit where it is neither local nor centrally available;

• Higher bank account & cash management costs.

And on top of this, the headquarter has less working capital available to fund it’s activities.

On the right, the green arrows show how local customers and suppliers settle their accounts to the centralised notional pool. Obviously this cuts out the extra layer of accounts and re-duces the time cash is left in between bank accounts. This reduces (or removes) all the ef-fects listed above.

Call to action: CFOs set to cash in on these benefitsIn conclusion standardisation, centralisation and consolidation equal €227 billion in a one-time release of funds. In times when money is expensive to come by, it seems a real waste to

Figure 3: Simplified cash management through SEPA (Innopay 2015)

31

let liquidity locked in unnecessary cash management structures. It’s up to the CFO to make this happen, but please let this short five-step plan help you get started:

• Step 1: Contact your CTO and create a project plan with finance, operations and IT specialists;

• Step 2: Determine the optimal potential for standardisation, centralisation and consol-idation, both inside and outside the SEPA region;

• Step 3: Set up a delivery roadmap and calculate the MVP (minimal valuable proposi-tion) for quickest return of investment versus shortest time to market;

• Step 4: Prepare the central organisation’s operating model for the extra responsibili-ties, include new external suppliers if needed;

• Step 5: Set up an implementation & consolidation plan for phased and controlled migra-tion of countries to the central organisation.

Let’s get to work!

Interested?

MAIL IVOORIGINAL BLOG

32

The Payments Cross Word Puzzle

Please see the next page for the questions, and fill in the above solution box with the letters from all blue boxes, in their respective order

Found the solution we’re looking for? Send your solution to info@innopay.com before September 1, and win a sunny surprise...

33

Horizontal

1. An administrative ‘subaccount’ of one physical

bank account is called a ... Account

2. To establish a trusted relation online, consumers

are in need of a ...

3. Kind of security code on the back of a credit card

4. Other word for two-factor (authentication)

5. Country that issued the first banknotes in 806 bc

6. Offline payment method (frequently used in The

Netherlands)

7. The process of determining whether the money

leaving an account matches the amount spent

8. Dutch stock market index

9. US bank

10. Payment In Advance

11. Third Party Payment Service Provider (abbrevia-

tion)

12. Upcoming EU regulation to improve the security

of internet payment s

13. European Banking Authority

14. The replacement of sensitive data with a unique

identifier that cannot be mathematically reversed

15. Globally still the most used payment method

16. Real Time Gross Settlement

17. Technology applied to financial services

18. New protocol for economic internet

19. Technique that allows for contactless payments

20. Global payment service provider

21. Three-party online payment solution

22. Market that PSD2 regulation applies to

23. Bank that makes the credit limit available to card-

holders

24. Seen as the world’s most successful money trans-

fer service

25. Technology behind bitcoin

26. Seamless integration of online and offline (pay-

ment) channels

27. Global payment service provider (PSP)

28. Swedish based payment method that allows to pay

after receiving your goods

29. American currency

30. The fee that the acquirer pays to the issuer in

four party schemes

31. Indian currency

Vertical

1. Virtual currency

2. Internationally agreed system of identifying bank

accounts across national borders

3. Largest online payment method in Russia (also a

search engine)

4. The process of determining whether someone or

something is, in fact, who or what it is declared to

be

5. Digital Customer Services Interface

6. With SecurePay the issuer is ... in case of fraud

7. Innopay monthly newsletter

8. Currency in Europe

9. The network of physical objects or ‘things’ 

embedded with electronics, software to enable

objects to exchange data with the manufacturer or

other connected devices

10. Technology concept that allows software applica-

tions to communicate (abbreviation)

11. Institution where you hold an account

12. European payments integration initiative

13. Provider of terminal solutions

14. A document that orders a bank to pay a sum of

money from a person’s account to the person in

whose name the document has been issued

15. Global message network in the payment infra

structure

16. Protocol used to transport payment transactions

from the payment terminals in shops to processing

systems

17. Party that will approve the final PSD2 text

18. European city where first Dutch guilder was made

19. In 1992 Eurocard and Eurocheque merged into

this organization

20. Handling transactions

21. Payment Service Provider (abbreviation)

22. Worldwide credit card corporation

23. Technical standard for smart payment cards and

for payment terminals

24. Know Your Customer

25. Largest Dutch online payment method

26. Online company that introduced one-click pay-

ments

27. Technology that allows a payment system to ope-

rate in an entirely decentralized way, without

intermediaries such as banks

34

Get in touch...

Mail usInnopay BVP.O. Box 756431118 ZR AmsterdamThe Netherlands

Contact usT : +31 20 6580651E : info@innopay.com

Find usW : innopay.comL : linkedin.com/innopayT : twitter.com/innopay

© 2015 Innopay. All rights reserved.

Or stay up to date on Payments, Digital Identity and E-Business by subscribing to the Innopay Innsider!