by ALEX LARSEN, CFIRM, Institute of Risk Management (IRM) & President, Baldwin Global Risk Services
According to Reuters: “Japan’s financial regulator said on Friday it had ordered all cyrptocurrency exchanges to submit a report on their system risk management, following the hacking of over half a billion dollars of digital money from Coincheck.”
Whilst the whole premise of blockchain technology and crypto currencies revolves around it being essentially unhackable, the exchanges that trade these currencies are vulnerable. The introduction of system risk management (which we assume to be risk management of the software/operating systems and servers) checks is a step forward for the cryptocurrency space although it only covers one area of exposure linked to the cryptocurrency market.
History of incidents
Crypto currency has been a booming market with increases in some major coins in the high 1000’s of percent over the last year. This rise, coupled with a lack of regulation, has seen the crypto currency world being hit with a number of negative incidents from Ponzi schemes to fraud, scams and hacking incidents.
Bitconnect, which as of writing of this article, is trading at roughly $8.60, a huge fall from its height of over $300 a month ago, is an example of a potential major Ponzi scheme which has lost $2.4 billion worth of value over 10 days.
The subpoena by US regulators of crypto exchange Bitfinex and its relationship with Tether is another concern to the crypto currency market with many claiming Tether to be a scam. Tethers are tokens backed by US dollar deposits, with each tether always worth one dollar. These tokens should be backed by dollars but thus far the company has yet to provide evidence of its holdings to the public and has not had any successful audits as of yet.
There have also been a large number of Initial Coin Offerings (ICO’s), used to raise money for startups by issuing tokens/coins, which have raised vast sums of money only for the owners to disappear with all the money, whilst others have been less deliberate but have been just as devastating to investors. A cryptocurrency called Tezos, raised $232 million last year, but suffered internal power struggles which has left the project in disarray.
This brings us to the current concern in Japan of cyber attacks of exchange platforms. Cyber attacks and hacking attempts of exchanges have been frequent with Bitfinex, coinbase and kraken amongst others having been closed down for days at a time during 2017 due to a number of hacking attempts. It is the successful hacking incidents which are the most worrying however, with successful hacks such as MT Gox, which cost almost 350 million and two attacks on Youbit which led to it’s bankruptcy. The most recent coincheck hacking was worth 500 million, a record, and it is this which has caused Japan to act.
Last year, China took a definitive stand on regulation on crypto currencies which sent shockwaves through the market. Some feel it was perhaps heavy handed with ICO’s being banned, bank accounts being frozen, bitcoin miners being kicked out and nationwide banning on the internet of cryptocurrency trading related sites. Others however believe that it has been a positive step, and has encouraged other governments to take regulation seriously and hopefully take a more balanced approach. It certainly isn’t in the interest of governments to stop ICO’s, which provide many positives including innovation, but they should certainly regulate them from a consumer protection, taxation and organised crime standpoint.
Implementing regulation also removes uncertainty for investors as well as the companies who are involved in ICO’s. Uncertainty is the source of many risks and often a negative certainty is better than uncertainty as it allows a focus within set parameters.
It’s important to remember that too little regulation doesn’t offer protection and too much stifles innovation.
How to regulate
There are a number of ways to regulate cryptocurrencies and the following are just some examples:
1) Framework for ICOs
New ICO’s are currently not subject to much in terms of regulation globally. One of the problems is determining how they should be treated with some being considered securities. As a fund raising vehicle, there could certainly be a framework that lays out key requirements of an ICO such as a company needing to be registered in order to issue a token, transparency in terms of individual members of the registered company as well as perhaps introducing a few requirements that regular IPO’s require such as implementing risk management. Currently in USA, ICOs are expected to adhere to Anti Money Laundering (AML)/Know Your Customer (KYC) practices.
2) Regulate exchanges
Exchanges, which is where much of the transactions take place in terms of trading coins, is a logical area of focus when it comes to regulations
South Korea’s financial services commission for example, has stated that trading of cryptocurrencies can only occur from real-name bank accounts. This ensures KYC and AML compliance. According to the FSC, the measures outlined were intended to “reduce room for cryptocurrency transactions to be exploited for illegal activities, such as crimes, money laundering and tax evasion,”
Regulators should focus on regulation that encourages transparency and minimises anonymity.
1) Tax Laws
Clarity needs to be brought into the tax laws in terms of when investors should pay capital gains. The USA has been quite quick to ensure that crypto-to-crypto transactions are now taxable and not just crypto to Fiat currency transactions. This is not the case in the UK however, where things are less clear and will become even more so, once crypto currencies start to introduce dividend like behaviour.
2) Reserve requirements of exchanges
Most banks and stock exchanges are required to hold a certain amount in reserves in order to survive any major downturn or crash. This should most certainly be the case for crypto currency exchanges too especially considering the volatility which sees crashes of 60% several times a year with some crypto currencies falling 90% before recovering. This is also known in part as systemic risk which could be what the Japanese financial regulator defines as system risk.
3) System risk management
As we have seen from this Japan story, one way of ensuring more protection and reliability is by ensuring there is regulation around system risk management on exchanges. There should be minimum requirements protecting against hacking, phishing and other cyber related attacks. The requirements could be scaled against value of the exchange, number of users or number of daily transactions.
It’s important to note that much is being done to reduce the risks of hacking incidents such as the concept of a decentralised exchange. This would essentially be a crypto currency exchange on the blockchain, much like the crypto currencies themselves. This would reduce hacking significantly and whilst it is not currently practical, it could be the standard of the future.
The Crypto Currency market gets a lot of negative publicity and much of this could be rectified if there was more self-regulation. It would also reduce volatility within the market and bring about positive change. This refers to both exchanges and ICO’s alike.
The Japan Blockchain Association (JBA) for example has established self-regulation standards which includes the use of cold wallets amongst its 15 crypto exchange members (of which Coincheck was one of them) and are now looking to strengthen the standards further following this recent incident.
Risk Management in the Crypto Currency Space
Risk Management, as with all organisation’s, plays a vital role in meeting and exceeding objectives whilst providing resilience and stakeholder confidence. Exchanges and companies that are raising/have raised ICO’s should ensure that Risk Management is part of their business. Identifying risks and opportunities, assessing them and implementing response plans should be standard. Cyber risks, reputational risks, operational risks, system risks and strategic risks should all be considered and prepared for, which would minimise market disruption and reduce the likelihood of financial ruin. At the very least they owe it to the investors who have funded them.
For investors, with volatility so high, the rewards are great but so are the risks. Investors should ensure that they only invest what they can afford to lose, do their due diligence on their investments which includes understanding the technology, the team and look for a prototype rather than a wild concept. Additionally, investors should always be on the lookout for phishing scams and suspicious emails.
Finally, even the most optimistic investor should at least consider that cryptocurrencies are a speculative bubble that could burst.
How payments can help streamline operations and boost customer satisfaction in the vending industry
By Darren Anderson, Business Development Manager, Self Service, Ingenico Enterprise Retail
The COVID-19 pandemic has had an astounding impact on the payments industry, causing cash usage to plummet as contactless and card-not-present volumes soared. Of course, this phenomenon was not unforeseen by payments professionals, who had predicted such a movement away from cash, but not at the speed the virus guidelines facilitated. In fact, due in part to the hygiene perks of contactless payment methods increasing its adoption, 50% of customers think that cash will disappear completely at some point in the future.
The unattended market was ahead of the pandemic in terms of contactless alternative payment method (APM) adoption, and it continues to upgrade its offerings to suit a wider range of industries. Nevertheless, the pain point for vending operators is that they’re often not sure exactly how these technologies work, or how to implement them. And with payments offerings constantly evolving, it’s becoming harder for vending operators to know which solution would be the best fit for their business.
As such, one easy way for vending operators to ease this load is to partner with a knowledgeable payments advisor who can not only provide the best solutions for their business, but guide them through the process and any need-to-knows. It’s also important to investigate the payments trends across the vending market, what the future might bring and what vending operators need to know about newer payments technology and the value it can bring to their unattended retail business operations.
Vending through the pandemic
Coronavirus has impacted the unattended market in various ways. In some cases, vending machine use has decreased as a result of lower footfall and closed premises. However, the nature of vending being self-service, for many it’s just been a case of upgrading systems to meet new guidelines and hygiene recommendations to start boosting their usage again. As cash usage decreased over the course of the pandemic, cards and APMs stepped in to provide a host of benefits, and as customers use and enjoy these seamless technologies, they are fast becoming the preference.
These developments have provided the opportunity for vending operators to embrace newer technologies which, although ultimately positive, can prove daunting if such retailers are not accustomed to working closely with payments. Fortunately, the vending market is in a great position to take advantage of new contactless technologies, being already low on human interaction and having 24/7 capabilities.
What’s more, the market can not only cater to consumers’ evolving needs, but it can also provide the flexibility and reliability that consumers are relying on as the world around them is changing. Many new technologies can also improve the general operations and management of vending, offering features such as easier on-the-go stock management and maintenance notification technology.
Keeping the consumer in mind
Consumers today want to enjoy the latest innovations and best-in-class customer experiences. These shoppers believe that self-service is a time-saver, and they also view cashless and contactless as faster and more seamless ways to pay – a fact which is reflected in the recent consumer demand for a wider variety of APMs. Customers now expect even more options to pay for their goods and services, from QR codes, to in-app payments and more.
Alongside the cashless trend, data-security and customer experience are two other factors driving the vending market evolution. With constantly evolving fraud developments in the online world, good security is more pertinent than ever, and has to be a central consideration to vending operators – as well as ensuring a seamless customer experience.
From a customer usage standpoint, mobile payments are becomingly increasing popular, as driven by the Gen Z market. According to our research, 63% of Gen Zers have said they would pay more for a mobile experience.
Trust and a good experience are also considerable factors across all customer groups, with 95% of customers claiming their loyalties lie with a company they trust, and 86% willing to pay more for a positive experience.
To appeal to ever-hungry consumers, vending operators need to provide the options they want. In the unattended market, this is relatively simple – not only do they provide a convenient and reliable method of payment for customers, but they also avoid face-to-face interaction. They can also supply a range of different products and accept a variety of payment methods to appeal to all customers, no matter their preference.
Using payments to drive revenue
Driving revenue is a two-pronged approach – you need to appeal to customers to keep them coming, and streamline operations to reduce overheads. In order to meet both parties’ expectations, it’s important to respond well to new vending challenges, taking note of the solutions that enable merchants to provide their customers with the payment methods they prefer.
Payments are complicated, so there’s no need to worry if you’re not hugely familiar with the offering out there, or unsure where to start – that’s where a payment service provider (PSP) can assist. With the expertise that a PSP brings, along with the technological solutions they offer, vending operators can improve customer journeys in all unattended environments.
Such technological solutions are flexible and can cater to specific business needs, while providing easy, quick, and secure payment methods that protect both the business and the customer’s personal data. They can also improve operational efficiency, increasing business performance with features such as real-time reporting and smart transaction management, to provide a best-in-class customer experience.
With smart devices, a secure gateway and advanced acquiring capabilities, PSPs can help vending operators design a flexible vending solution tailored to their individual and specific needs. To find out more about unattended retail and how your company can benefit from Ingenico’s unique expert knowledge, get in contact with Ingenico Enterprise Retail today at www.ingenico.com/smartselfvending.
ISO 20022 migration: full speed ahead despite recent delays, says new Deutsche Bank paper
Today, Deutsche Bank has released the third installment in its “Guide to ISO 20022 migration” series, which offers a comprehensive update on the industry shift to the de facto global standard for financial messaging: ISO 20022. This paper comes at a critical time for the ISO 20022 migration, with a number of changes to existing timelines and strategies from SWIFT and the world’s major market infrastructures having been announced this year.
The paper explores the latest developments, including SWIFT’s year-long postponement of the migration in the correspondent banking space. The decision meets industry calls for a delay and also provides ample time to build the new central Transaction Management Platform (TMP) – a core feature of SWIFT’s new strategy that will allow the industry to move away from point-to-point messaging and towards central transaction processing.
It also details the wave of action that has been seen by market infrastructures around the world – with many, including the ECB, EBA CLEARING and the Bank of England, announcing revised migration approaches.
“Now more than ever, with shifting timelines and strained resources, it is vital that banks and corporates alike do not view the ISO 20022 migration as just another project that can be put on the back burner,” says Christian Westerhaus, Head of Cash Products, Cash Management, Deutsche Bank. “The delays in the correspondent banking space, and across several market infrastructures, should not be seen as an opportunity for banks to take their foot off the pedal. The journey to ISO 20022 is still moving ahead at speed – and internal projects need to reflect this.”
The Guide also highlights the implementation issues on the migration journey ahead – most notably surrounding interoperability between market infrastructures, usage guidelines and messaging formats. This is achieved through a series of deep dives, case studies, and points of attention drawn from Deutsche Bank’s internal analysis.
“As this year has proved, nothing is set in stone, “says Paula Roels, Head of Market Infrastructure & Industry Initiatives, Deutsche Bank. “The ISO 20022 migration involves a lot of moving parts and keeping abreast of the latest developments is critical for banks and corporates alike. As the deadlines near, and the ISO 20022 story develops, this series of guides will continue to highlight key points for consideration over the coming years.”
The Psychology Behind a Strong Security Culture in the Financial Sector
By Javvad Malik, Security Awareness Advocate at KnowBe4
Banks and financial industries are quite literally where the money is, positioning them as prominent targets for cybercriminals worldwide. Unfortunately, regardless of investments made in the latest technologies, the Achilles heel of these institutions is their employees. Often times, a human blunder is found to be a contributing factor of a security breach, if not the direct source. Indeed, in the 2020 Verizon Data Breach Investigations Report, miscellaneous errors were found vying closely with web application attacks for the top cause of breaches affecting the financial and insurance sector. A secretary may forward an email to the wrong recipient or a system administrator may misconfigure firewall settings. Perhaps, a user clicks on a malicious link. Whatever the case, the outcome is equally dire.
Having grown acutely aware of the role that people play in cybersecurity, business leaders are scrambling to establish a strong security culture within their own organisations. In fact, for many leaders across the globe, realising a strong security culture is of increasing importance, not solely for fear of a breach, but as fundamental to the overall success of their organisations – be it to create customer trust or enhance brand value. Yet, the term lacks a universal definition, and its interpretation varies depending on the individual. In one survey of 1,161 IT decision makers, 758 unique definitions were offered, falling into five distinct categories. While all important, these categories taken apart only feature one aspect of the wider notion of security culture.
With an incomplete understanding of the term, many organisations find themselves inadvertently overconfident in their actual capabilities to fend off cyberthreats. This speaks to the importance of building a single, clear and common definition from which organisations can learn from one another, benchmark their standing and construct a comprehensive security programme.
Defining Security Culture: The Seven Dimensions
In an effort to measure security culture through an objective, scientific method, the term can be broken down into seven key dimensions:
- Attitudes: Formed over time and through experiences, attitudes are learned opinions reflecting the preferences an individual has in favour or against security protocols and issues.
- Behaviours: The physical actions and decisions that employees make which impact the security of an organisation.
- Cognition: The understanding, knowledge and awareness of security threats and issues.
- Communication: Channels adopted to share relevant security-related information in a timely manner, while encouraging and supporting employees as they tackle security issues.
- Compliance: Written security policies and the extent that employees adhere to them.
- Norms: Unwritten rules of conduct in an organisation.
- Responsibilities: The extent to which employees recognise their role in sustaining or endangering their company’s security.
All of these dimensions are inextricably interlinked; should one falter so too would the others.
The Bearing of Banks and Financial Institutions
Collecting data from over 120,000 employees in 1,107 organisations across 24 countries, KnowBe4’s ‘Security Culture Report 2020’ found that the banking and financial sectors were among the best performers on the security culture front, with a score of 76 out of a 100. This comes as no surprise seeing as they manage highly confidential data and have thus adopted a long tradition of risk management as well as extensive regulatory oversight.
Indeed, the security culture posture is reflected in the sector’s well-oiled communication channels. As cyberthreats constantly and rapidly evolve, it is crucial that effective communication processes are implemented. This allows employees to receive accurate and relevant information with ease; having an impact on the organisation’s ability to prevent as well as respond to a security breach. In IBM’s 2020 Cost of a Data Breach study, the average reported response time to detect a data breach is 207 days with an additional 73 days to resolve the situation. This is in comparison to the financial industry’s 177 and 56 days.
Moreover, with better communication follows better attitude – both banking and financial services scored 80 and 79 in this department, respectively. Good communication is integral to facilitating collaboration between departments and offering a reminder that security is not achieved solely within the IT department; rather, it is a team effort. It is also a means of boosting morale and inspiring greater employee engagement. As earlier mentioned, attitudes are evaluations, or learned opinions. Therefore, by keeping employees informed as well as motivated, they are more likely to view security best practices favourably, adopting them voluntarily.
Predictably, the industry ticks the box on compliance as well. The hefty fines issued by the Information Commissioner’s Office (ICO) in the past year alone, including Capital One’s $80 million penalty, probably play a part in keeping financial institutions on their toes.
Nevertheless, there continues to be room for improvement. As it stands, the overall score of 76 is within the ‘moderate’ classification, falling a long way short of the desired 90-100 range. So, what needs fixing?
Towards Achieving Excellence
There is often the misconception that banks and financial institutions are well-versed in security-related information due to their extensive exposure to the cyber domain. However, as the cognition score demonstrates, this is not the case – dawdling in the low 70s. This illustrates an urgent need for improved security awareness programmes within the sector. More importantly, employees should be trained to understand how this knowledge is applied. This can be achieved through practical exercises such as simulated phishing, for example. In addition, training should be tailored to the learning styles as well as the needs of each individual. In other words, a bank clerk would need a completely different curriculum to IT staff working on the backend of servers.
By building on cognition, financial institutions can instigate a sense of responsibility among employees as they begin to recognise the impact that their behaviour might have on the company. In cybersecurity, success is achieved when breaches are avoided. In a way, this negative result removes the incentive that typically keeps employees engaged with an outcome. Training methods need to take this into consideration.
Then there are norms and behaviours, found to have strong correlations with one another. Norms are the compass from which individuals refer to when making decisions and negotiating everyday activities. The key is recognising that norms have two facets, one social and the other personal. The former is informed by social interactions, while the latter is grounded in the individual’s values. For instance, an accountant may connect to the VPN when working outside of the office to avoid disciplinary measures, as opposed to believing it is the right thing to do. Organisations should aim to internalise norms to generate consistent adherence to best practices irrespective of any immediate external pressures. When these norms improve, behavioural changes will reform in tandem.
Building a robust security culture is no easy task. However, the unrelenting efforts of cybercriminals to infiltrate our systems obliges us to press on. While financial institutions are leading the way for other industries, much still needs to be done. Fortunately, every step counts -every improvement made in one dimension has a domino effect in others.
Death of the workplace friendship: study shows how remote working is eroding our meaningful connections with colleagues
Employee experience platform Perkbox’s research on 1,296 employees and 300 business leaders reveal 65% think the ‘new way of working’...
Half of UK’s finance sector confirms diversity should be more of a priority in the workplace, with calls for action across the industry
Almost half (45%) of Britain’s banking/financial services workforce think their employer could do more when it comes to diversity, according to a...
American Express and Amazon Business Launch Co-branded Credit Cards for Small Businesses in the UK
The co-branded Cards offer flexible benefits and payment optionality by allowing small businesses to decide between earning rewards or adjusting...
Go Global To Expand Your Revenue Stream
By Christian Spaltenstein, Managing Director, AFEX Americas Banking and financial operations have evolved immensely in the past few years. Innovation...
Local authorities and business networks play a key role in small business success, and must be protected during COVID rebuild
23% of UK’s top performing businesses have been supported by local enterprise partnerships and growth hubs Similarly, 30% of Britain’s...
What Does the FinCEN File Leak Tell Us?
By Ted Sausen, Subject Matter Expert, NICE Actimize On September 20, 2020, just four days after the Financial Crimes Enforcement...
Investment Roundtable: Live with Jim Bianco
With Q4’s macro picture still looking grim amid the return of exponential coronavirus waves in Europe and the U.S. and...
Equity markets react to a rise in Covid-19 cases, uncertain Brexit talks and the upcoming US election
By Rupert Thompson, Chief Investment Officer at Kingswood Equity markets had another choppy week, falling for most of it before...
October furlough changes – what you need to know
By Alan Price, employment law expert and CEO of BrightHR The Job Retention Scheme is coming to an end on...
Do we really need banks? Yes, but digital transformation industry-wide is vital
By Charley Cooper is Managing Director at enterprise blockchain firm, R3 The Coronavirus crisis has taught us that we are...