If banks get it right, PSD2 can help banks retain their large customer base by offering newer, practical services their customers today expect. GDPR could mean a world of new opportunities for banks, like strengthening customer trust, delivering greater customer satisfaction and enhancing brand image. Only well-planned and proactive preparation with the right tools will make the difference between the success and failure.
However, aside from PSD2 and GDPR seeming to be contradictory, what constitutes sensitive payment data is vague. This creates an interpretation challenge for banks. Knowing what data is extremely sensitive and the extent of customers’ contest will become crucial. Questions arise, such as: for how long has the customer given his consent? To what data does it extend? Which party should obtain customer consent? More importantly, when customer information is exposed, dissected and analysed, how does one remain compliant to GDPR’s strict privacy rules?
The ability to dissect data at granular levels while being flexible enough to restrict conditional elements from being shared is a huge challenge banks and their IT departments will have to face if they want to be compliant to both PSD2 and GDPR.
These questions boil down to an even larger one: how can our financial services provider thrive in such a complex regulatory environment?
Data management struggles
Sharing customer data with third parties, as directed by PSD2, is a great in theory but challenging for financial organisations realistically carry out. Banks have to deal with legacy systems, operating in silos and current IT practices, which makes data management even more difficult. GDPR only adds to the challenge as banks have to know the source of every single bit of data they hold in their systems.
Furthermore, the right to erasure (article 17 of GDPR) require a good handle on customer data in order to be able to delete specific information on request. The right to data portability (article 20 of GDPR) means businesses need to move, copy or transfer data easily from one database, storage or IT environment to another.
Any Financial Services organisation will need the ability to access and analyse the data of any transaction at any time. As part of regulatory audits, banks will have to summon up specific customer data very quickly and they will have to understand what that data means in the broader context of their payment history.
Data protection and privacy will be a particular challenge for companies who weren’t as prepared ahead of GDPR. At worse, it could mean an overhaul of the entire IT system. Businesses will have to detect and report data breaches within 72 hours once the breach is found to avoid being fined. Should a breach be detected on a Friday, this could mean working on weekends for some banks.
All Financial Services organisations will have to demonstrate true digitalisation. These organisations need to provide context-specific offers to the customer, which is helped further by Open Banking, as they will be able to track data from other banks catering to the customer.
To seize this type of opportunity, organisations will need to be capable of customer-centricity and building their own marketplace economy.
Placing the customer, not just rules, in the centre
Banks cannot have a narrow view and see regulations as checkpoints to be ticked off in order to be compliant, neglecting the wider picture, if they want to thrive.
GDPR and PSD2 are not contradictory. In fact, they both have the exact same objective. Both regulations want to push organisations towards customer-centricity in order for business to adapt to faster to the digital age and the rise of the platform economy. In the post-GDPR era, efficient data management is key in order to provide services tailored to their customers’ need.
This calls for a system or platform flexible enough to dissect very specific data that is within the scope of client consent, while restricting conditional elements from being shared. A granular level of data management will truly push banks toward customer-centricity.
This is crucial, as going beyond simple compliance and handling customer data with efficiency and transparency will go a long way to rebuild customer trust. The benefits of GDPR can be reaped when financial organisations can convince not only regulators, but also customers, that their data is truly protected. A greater understanding of the customer, the product and the price point requires better management of tangible and intangible data in order to better meet expectations in the post-GDPR world.
Reviewing data management processes to make them more efficient can directly lead to enhanced customer loyalty, which will come about by creating better deals for customers through the use of all the data held by a bank. This data can help create unique revenue models and pricing solutions adapted to the customer’s needs and spending patterns. These value-added services are sure to generate increased customer satisfaction.
Concerning the data security element of GDPR, organisations need to go beyond simply applying a turnkey cyber security solution. Businesses will need to keep internal records of data protection and show regulators and customers alike what has been done to keep their data safe. An audit log of public, private and personal APIs being accessed will need to be kept in order to keep track of any access to customer data.
The multiplication of RegTech solutions might seem like good news for businesses looking to avoid fines and immediate consequences of non-compliance. However, it often presents a short-term solution to a long-term, more nuanced problem. Banks need to manage their data in a way that puts customers at the centre.
Being customer centric enables these organisations to reap the benefits this year’s new regulations entail.
Customer-centricity brings four key benefits:
- Reputational benefits: it will ensure customers their data is well-protected and showing transparency when dealing with customer data will increase trust. Avoiding brand image disasters like Equifax and becoming an example of a company making an effort and caring about the duties that comes with the custody of data could lead to immense reputationals benefits.
- Financial benefits: being customer-centric will improve customer retention and attract new customers. Knowing and tending to the needs of your customers will increase trust and customer satisfaction: while competitors are poorly managing their data and offering customers irrelevant offers, having the reputation of being an efficient, insightful business can bring immediate financial benefits.
- Preparation for an increasingly customer-centric economy: digital transformation is leading businesses toward an increasingly customer-centric economy. GDPR is an attempt to regulate this wave of change and make sure some businesses are not left behind. Preempting the intent of GDPR and being customer-centric ahead of the curve through impeccable data management could give businesses a competitive edge.
Although GDPR and PSD2 may seem to be contradictory in their requirements, both lead Financial Services organisations toward a much needed acceleration of their digital transformation process by rightly placing the customer in the centre.
Seven lessons from 2020
Rebeca Ehrnrooth, Equilibrium Capital and CEMS Alumni Association President
Attending a New Year’s luncheon on 31 December 2019, we played a game that involved predicting the world in 2020. Some of the questions included: would Uber become profitable? Would the three-decade bond rally finally come to an end? Would the US hit a recession?
Unlike any of our predictions based on a traditional approach to business and predicting, we now know that 2020 became the year where business, professional and personal plans were turned upside down, reshaped and put-on hold. The proverbial black swan had arrived.
As revealed in a new CEMS Guide to Leadership in a Post-COVID-19 World, to which I contributed, the COVID-19 pandemic has exposed deficiencies in the 20th Century vision of leadership, giving a rare opportunity to question the status quo.
So, what are the main lessons from 2020?
- Humans are enormously adaptive. This is not an extinction scenario. The world is getting used to dealing with global human disaster which may become a recurring event. Life continues guided by new parameters.
- No sector or country is immune to rapid change. Just as the leveraged finance and equity markets ground to a halt during the Global Financial Crisis, we have seen a disruption in the financial markets (including M&A) in 2020, including a significant redistribution of wealth between sectors; think tech vs airlines and the hospitality industry. When a market is disrupted it has secondary and tertiary effects such as less work for accountants, lawyers, financiers etc.
- Location is not as important anymore. The belief that finance staff need to be based in one of the financial capitals to be effective has been forever altered. Pursuing a career in finance from anywhere is becoming possible. However, it’s likely that over time, financial controls and human interaction will move the work model back towards the traditional office approach, as work is a critical sanctuary for people. While working from home may allow more time for family, chores and sports, it is mainly effective for people who already have their internal and external networks. For junior employees it presents a notable challenge as they may be forced to spend their formative years without a chance to really build their networks.
- Change is likely to be lasting. The opportunity for alternative finance and tech focused providers is enormous and 2020 will accelerate this shift. For example, many retail banks are providing rather poor customer service, blaming the pandemic. Even the most loyal customers will be heading elsewhere. For recent graduates and current students this is a major shift; future winners and key employers may not be names we are used to seeing in the headlines.
- There will be a spotlight on leaders with visionary strategy and understanding of the operations. 2020 showed many politicians and business leaders behaving like they were playing a game of snakes and ladders, rather than executing a thought-out strategy. The next wave of thoughtful leadership is urgently required.
- Collaboration leads to success. The definition of a pandemic is an infectious disease prevalent worldwide. A global problem requires a collaborative solution rather than each country and industry on their own. Quoting Steven Riley, professor of infectious disease dynamics at Imperial College London: “Once you have the knowledge and you share the knowledge, then you are able to take measures to push transmission much lower”. This principle is transferable to management education. In a world more complex than ever, investing in a degree is hard currency. Combined with the full global alumni network, corporate partners and schools, CEMS is capital that doesn’t depreciate.
- Resilience has become a watch word. Saint-Exupéry’s quote resonates with me: “If you want to build a ship, don’t drum up people to collect wood and don’t assign them tasks and work, but rather teach them to long for the endless immensity of the sea.” We are in a new paradigm – so prepare for the next change. For COVID-19, while we hope that the vaccine will soon upon us, the broader long-term positive challenge remains.
Data after Brexit: How does the end of the transition affect GDPR?
By John Flynn, Principal Security Consultant at Conosco
The UK has officially left the European Union now that the transition period has ended on January 1st 2021. But this could raise issues with one of the biggest bugbears for many companies – the international transfer of personal data.
Businesses can relax, somewhat – GDPR, which took businesses months to get their heads around, is not being replaced. It will continue as the UK GDPR 2018, and will still be based on the criteria of the Data Protection Act of 2018. However, the UK will retain the right to change the UK GDPR as it sees fit in the future.
The main changes apply to those who receive data coming into the UK from Europe. Transfers from the UK to other countries can continue under existing arrangements.
We know it can be difficult to cut through the legal jargon, so we have simplified what you need to know to protect yourself and your data:
1 – Update your privacy notice
Most businesses do not have the correct clauses in place ahead of January 1st, potentially exposing their liability, should something happen to their data. All company privacy notices online will need to be updated to specifically state ‘UK GDPR’, as opposed to ‘EU GDPR’. You will also need standard contractual clauses in place, which cover both parties – those transferring and those receiving the data.
The Information Commissioner’s Office (ICO) has a list of what needs to be included in the standard contractual clause here. The ICO will remain the UK regulator for data protection, regularly liaising with each EU member state.
This also applies to Multi Corporate Groups who operate in multiple countries, who need to update their documentation and privacy notice to expressly cover the data transfers. The UK has applied for an adequacy assessment, which would negate the need for contractual clauses, however this has not yet been approved by the EU.
2 – Data privacy assessments
Any company which runs applications and software should always perform a Data Privacy Impact Assessment. This was also in the guidelines before, but these assessments are now more important for those who outsource their IT operations internationally.
For example, when using a service such as a cloud-based system, the company must be sure that its service provider adheres to UK GDPR and stores the data within the European Economic Area (EEA), or has a binding corporate agreement with the company, where data is stored outside of the EEA. You should also, as mentioned above, make sure that a contractual clause is in place.
3 – Review local legislation
Contracts should now have contractual clauses that specify the responsibilities of the data controller and the data processor. If you are receiving personal data from a country territory or sector covered by a European Commission adequacy decision, the sender of the data will need to consider how to comply with its local laws on international transfers. You should check local legislation and guidance in this case.
4 – Cyber Security health check
The ICO is increasing its capacity and efforts to crack down on data breaches, post-Brexit. Now is a great time for all companies to have a health check to understand their Information Security posture and GDPR compliance. Nobody wants to be caught handling data improperly and fined when it could have been prevented with education and training.
A gap analysis performed by an expert is money well-spent. It’s also a fact that companies that have cybersecurity and Information Security controls are not only able to better defend against attacks but are also far better placed to recover from an attack.
It’s important that all businesses – large and small – are properly preparing their data storage and transferring for the 1st January. ICO has been busy setting examples by fining large, high-profile companies for failing to keep millions of customers’ personal data safe.
It will continue to come down hard on the data breaches of personal identifiable information and special categories of data. The saying ‘prevention is better than a cure’ rings truer than ever this year, and you will thank yourself if you make the efforts to properly store your data now, and not when it’s too late.
2020 reflections and 2021 outlook
By John Hunter, Head of Banking and Fiduciaries, Finance Isle of Man
Reflections on the most surreal year
The Covid-19 pandemic has completely changed the world as we knew it, resulting in catastrophic loss of life and fears of a downturn hang over global economies like a sword of Damocles. In the UK, the new strain has further exacerbated the situation. As I am sure many have already said we are living in what could be called the most surreal times. People have been trying to cope with this “new normal”, by changing their lifestyles and evolving behaviours.
The Isle of Man responded swiftly to the pandemic by closing its borders and enforcing social restrictions which everyone respected and adhered to. Socially and culturally the Island demonstrated all the good things that come from living on a relatively small Island where community still means so much.
The Isle of Man’s financial services sector adapted quickly, seamlessly transitioning to working from home. The banks too adopted flexible remote working practices and continued to support clients around the world helping them navigate the challenging situation and making the most of any opportunities that arose.
Although there is no substitute for face-to-face interactions, we all embraced web-conferencing platforms like Microsoft Teams and Zoom to stay connected with contacts around the world and build and nurture business relationships, whether it was with financial services firms or high net worth individuals looking to relocate to the Island.
Furthermore, a priority for the Isle of Man has been to reinvigorate the business and cultural ties with South Africa. In a normal world, we would have travelled to the country, held in-person meetings with businesses and industry representatives and talked about building on our wonderful historic ties. However, because of the scale and breadth of disruption we had to change all our plans! We hosted a virtual roadshow which comprised a series of webinars exploring why it has never been more important for South African businesses and individuals to choose the right jurisdiction for long term financial planning.
Looking ahead to the future
We are all hoping that the global rollout of vaccines will provide the pathway to some form of return to normality and all the things people are missing will be back. Like amidst all periods of immense turmoil, interesting, new possibilities have emerged such as the revolution in work culture and a renewed importance of being close to nature and green spaces is. And these possibilities can help reshape society for the better.
The global economic recovery and rebuild might seem further away in the current environment especially amidst the new lockdowns. But we are confident in the resilience of economies and are hopeful that different industrial sectors and governments working together would result in green shoots.
The financial services industry has an important role to play in getting the world economy back on its feet. It is a core component of the solution to continue facilitating the financing of corporates, as well as to develop sustainable finance and nurture digital technologies which have proven to be vital during the pandemic. The sector should continue its cooperation and collaboration with governments and regulators to ensure efficient capital flows and financial stability for businesses and individuals.
Banks too have a crucial role to play as they are instrumental to the effective transmission of monetary policies and stimulus packages. As mentioned in a report by EY: “Financial insecurity in the wake of COVID-19 will require banks to boost consumer confidence and help build a more resilient working world.”
We expect the Isle of Man’s financial services sector and banks to continue navigating the situation with resilience as they have been doing thus far and contributing to the global recovery process. Also, we truly hope this will be our busiest year ever (subject to our ability to travel), with an extensive global schedule of planned activity to promote the Island as an international financial centre of excellence and innovation. Personally, I had planned to be in South Africa for the British & Irish Lions tour, but regrettably, it might not take place and as such we will look forward to catching up with friends there as and when we can.
No doubt, there are significant challenges for the world ahead but as Albert Einstein said: “in the midst of every crisis lies great opportunity”. And it is this opportunity that we all need to work together to identify and make the most of. We are confident that in 2021 the Isle of Man will continue to support financial services businesses help their clients, employees, and the wider society through these surreal times. We are all in this together.
FSS and India Post Payments Bank AePS Partnership Advances Financial Inclusion in India
New Delhi, January 12th,2020: FSS (Financial Software and Systems), a leading global payment processor and provider of integrated payment products,...
Seven lessons from 2020
Rebeca Ehrnrooth, Equilibrium Capital and CEMS Alumni Association President Attending a New Year’s luncheon on 31 December 2019, we...
Over a quarter of Brits now have an account with a digital-only bank
The number of Brits with a digital-only bank account has gone up by a percentage increase of 16% Almost 1...
How fintech companies can facilitate continued growth
By Jackson Lee, VP Corporate Development from Colt Data Centre Services The fintech industry is rapidly growing and, in the...
BNP Paribas joins forces with Orange Business Services to deploy SD-WAN for 1,800 retail sites in France
Co-construction approach ensures business continuity during deployment BNP Paribas has chosen Orange Business Services to deploy an SD-WAN solution in...
2021 Predictions: Operational Resilience Takes Center Stage
Breaking down barriers between Risk and Business Continuity By Brian Molk, Fusion Risk Management What a year! Simply put, the global...
Five Workplace Culture Trends of 2021
5 January 2021 – 2020 – a year like no other – is responsible for driving organisational change, especially workplace...
The Impact of the Digital Economy on the Banking and Payments Sector
By Gerhard Oosthuizen, CTO Entersekt. New banking regulations, digital consumers, the eradication of passwords, contactless technology – these are just...
Be Future-Ready: The Case for Payments as a Service (Paas)
By Barry Tarrant, Director, Product Solutions, Fiserv Over the years, financial institutions have faced a myriad of changes in regulations,...
Mark Wright – No Longer an Apprentice
Just for context, you won The Apprentice and became Lord Sugar’s business partner in 2014 – you set up your...