Micro‐prudential regulation

On the micro‐prudential side, regulators want to ensure that individual institutions are safe and well run. For banks, for example, the major prudential requirements are that:

• they hold sufficient capital to be reasonably certain that depositors and other senior liability holders don't suffer any losses in case of distress
• they hold sufficient liquid assets to be reasonably certain they will be able to repay obligations when they come due
• they competently assess, manage and mitigate all risks they face, including operational risks.

The last point includes business continuity planning. It is important that a bank failure does not interrupt the business for their customers. So even if a bank is in the process of winding down it must be possible for their customers to participate in the payment system, up to the point where their accounts can be transferred to a viable entity.

For players other than banks, the prudential requirements are very similar when their particular circumstances are taken into account. For example, for insurance companies all of those points apply. For funds, the main prudential requirements are that they have adequate risk management processes in place, that assets are properly segregated and are in particular not commingled with the management company's own assets, and generally that the fund's operations are safe. Finally, for payment systems and other infrastructure items, operational risk and in particular business continuity tend to be the most important requirements.

A key purpose of micro‐prudential regulation is to protect the customers of the business. This means that there is a priori no lower size limit below which it becomes less important: whether a bank is established in a single small town and serves a few hundred customers out of a single branch or whether it is a large national bank serving tens of millions of customers does not matter in this respect, as every single customer should be protected to the same level by micro‐prudential regulation. Regulation is meant to be proportionate; however, in many cases, the small banks have simpler products and processes, so the regulatory burden can be lighter.

There is an important carry‐over of this into the Fintech space: even if a start‐up has only a few thousand customers, to the extent that the start‐up offers products or services that are only offered by regulated entities, and unless it has been clearly agreed otherwise both with the customers and the regulators, those customers can expect the same level of protection as if they were a customer of one of the regulated businesses. It is therefore crucial for a Fintech start‐up to understand the regulations that apply to their regulated competitors. Also, for early‐stage Fintech companies there is a real risk that companies cease operations, so regulators expect contingency plans in place that allow for an appropriate level of business continuity.

Macro‐prudential regulation

Macro‐prudential regulation is about protecting the interconnected system as a whole, not individual players. Size matters here: macro‐prudential regulators will usually ignore an institution that has only a few thousand customers—or even a few ten‐thousands of customers for that matter—and similarly they are likely to ignore individual start‐ups if their business volume is insignificant in the overall scheme of things.

There are, however, a number of exceptions to this general rule. For example, in some cases there are many small players that are similar to each other or share resources, eg small credit unions serving local communities. Regulators will look for systemic risk among those, as well as single points of failure like centralised data or payments infrastructure. A similar example from the start‐up world would be bitcoin mining: even if miners were not as concentrated as they are now, systematic regulators would look at what could make the system fail, eg a reliance on mining pools, or central servers used to update the mining software, or coordinated attacks.

Also, growth and growth potential matters: in the old world of bricks and mortar finance, things changed slowly. This is different in the modern environment where markets can grow from insignificant to systemically important within a few years—see for example the development of CDS and securitisation markets in the early 2000s. We have not seen that in Fintech yet, but it has the same potential of massive growth when their service offerings become popular. Whenever there is massive growth, macro‐prudential regulators are worried, often with good reason.

For banks, the most important considerations are size and interconnectedness.

After the crisis, the Financial Stability Board has decided to identify Globally Systemically Important Banks (G‐SIBS), later renamed to Globally Systemically Important Financial Institutions (G‐SIFIs) that would be subject to enhanced supervision and increased capital requirements. It is usually not the core lending businesses that cause the regulators to worry about the systemic importance of the banks, but it is more their securities and derivatives trading businesses and how they connect to their peers.

Whilst banks are on top of the list when it comes to systemic risk considerations, they are by no means the only ones on it. Systemic regulators oversee all important parts of the financial infrastructure, for example the clearing houses, the major payment systems, and stock and derivatives exchanges. If systemic regulators pay attention to specific Fintech players in the next couple of years, then this is probably in that area rather than in areas like lending. For example, if start‐ups are directly or indirectly connected to a major interbank payment system then the regulators will want to be comfortable that the start‐up's systems are either secure enough or well enough insulated from the system not to be able to wreak havoc under any circumstances.

The toolkit of macro‐prudential regulators is mostly analytic—they collect and analyse data, and if they have specific concerns they ask for specific reports, or for stress tests under scenarios they are worried about. In their active toolkit they can ask institutions that they are systemically important to hold larger amounts of capital, and in severe cases they can also request that positions that they consider excessive are reduced in an orderly manner. Another important tool is living wills and resolution plans: for companies that are considered systemically important there must be a detailed plan as to how they can be wound down without risk to the overall financial system. It is similar to a business continuity plan but much more detailed, and it is created in close interaction with the regulators.

Example: Current accounts versus money market funds

A current account is an account whose main purpose is to allow the owner to participate in the country's payment system—cards, cheques, transfers, ATMs—and to hold the funds necessary to do so. Many money market accounts allow for exactly the same benefits, albeit with a number of important differences:

• bank deposits are protected by deposit guarantee schemes; money market funds are not
• deposits are general liabilities of a bank that uses the funds for their overall balance sheet; money market funds are invested in specific high‐quality and highly liquid assets
• deposit accounts usually benefit from an overdraft facility, avoiding payments to bounce; money market funds don't.

Many of the securities that money market funds invest in are either banks' short‐term debt, or asset‐backed securities that in turn serve to finance loans. Therefore, overall the picture is very similar: customer deposits serve to finance loans to other customers, either via a bank balance sheet, or via asset‐backed securities. Also, if money market fund investors expect to be bailed out by the government—as they have been in the financial crisis—they might not care about the lack of deposit protection.

From a regulatory point of view banks and funds are very different, as they are subject to very different regulations. For example, banks have very strict guidelines on how much capital they have to hold against their lending, whilst there is no such requirement for funds. Also banks will be expected to contribute to some deposit protection fund, either ex‐ante, or ex‐post when an event has actually happened. This constitutes a regulatory arbitrage, as what is economically essentially the same product is provided with a very different level of regulatory requirements.

Example: Savings accounts versus gift cards

Now let's look at another common product, the gift card. Here a customer has purchased a card that can be used to purchase specific products, and/or in specific stores. In some cases the restriction might be significant, eg it might allow one only to purchase, say, music, or smartphone apps. However, there are less restrictive cards, eg those issued by department stores, that might give access to a large range of goods, including food and other everyday items. Those cards are almost as useful as cash, or as a pre‐paid debit card.

Now regulators have a dilemma: on the one hand they do not want to regulate retail stores that issue gift cards if they are genuinely used as such and the amounts involved are not too high. However, to the extent that the gift cards become more like cash—and possibly represent significant value—regulation can become more important, for example in the AML/CTF space.

Regulating products

To conclude this section, it is often difficult to design product‐based regulation. In the example above we have seen that some funds and some gift cards can look very similar to deposit accounts; however, not all funds do, and neither do all gift cards. It would be good to be able to apply the equivalent of duck typing—it walks like a duck, and it quacks like a duck, so it must be a duck—but whilst regulators often try to do so, it is not always possible:

First, the nature of law makes it difficult to write regulation on a functional or product level because there is the tension between making the law unambiguous and predictable, and making it flexible enough to allow for variations around a theme when the market offers products that are similar in nature, but different in important details, in particular also in the legal form.

The question is often where to put the boundary, as can be seen in the gift card example: there is a spectrum of design choices, and on one side of it—say not transferrable, can only be used for very restricted purposes, possibly a time limit—it is almost certainly not electronic money, whilst on the other side of it—say card‐based, and accepted in a wide variety of stores—it almost certainly is, as the difference to a regular pre‐paid card is very small.

Legislating this is hard, especially ex‐ante: it is usually possible to look at existing products and services and then write legislation that sorts them correctly into those where it should apply and where not. However, once the legislation is written, new products can be designed that end up on the wrong side of the boundary, either deliberately—a process often referred as regulatory arbitrage—or by chance, in which case existing legacy regulation can and does impede the development of innovative products and services.

An attempt to solve this dilemma is to go down the route of principles‐based regulation which—as opposed to classic rules‐based regulation—is meant to allow for more regulatory flexibility. In practice this is not a dichotomy but rather two opposite ends of a continuous spectrum, as principle‐based regulations also have some hard rules, just fewer of them, and vice versa. Principles‐based regulation can solve some of the issues, but it comes at a cost: for example, there is less regulatory certainty, and regulators become more powerful so regulatory capture and even corruption can become more of an issue.

Second, apart from the nature of law there is a more mundane issue, that of organising regulation (in this context, see also Figure 2.2 for a graphic presentation of the financial services segment on the products/institutions grid, and Figure 2.3 for an illustration of how regulators are traditionally organised). When regulating a firm, it is both important to understand the nature of the firm as a whole and what is happening at the detailed product level. Therefore the regulatory team has to pull in both product specialists and people who have a high‐level view. This is easy if the organisational structure of the regulator mirrors the organisational structure of the industry it regulates: for example, traditionally there will be a banks team, an asset management team, and an insurance team. Within the banks team there will be specialists for lending, payments, and deposits and they'll work together to get an overall view. However, more recently we have seen both fund‐based checking accounts and dedicated payment institutions, so suddenly the payment specialists also have to work on the fund side, and might even need their own department.

This might not seem overly complicated at first sight, but the issue is that the nature of Fintech means the business models are deconstructed and reconstructed in a different manner at scale, and the emerging companies do not fit any longer into mutually exclusive boxes. Regulating this is a challenge, because the regulatory organisation has to follow what is happening in the markets. To some extent regulators will be able to operate with multidisciplinary teams. However, it is well known that matrix reporting structures (two reporting lines) are difficult to operate, and cube or hypercube reporting structures (three or more lines) are even worse.

Eventually regulators will be able to find a new organisational structure that is both manageable internally and that fits their external environment—we already see the transformation happening, and initiatives like regulatory sandboxes and sharing of best practices are evidence for this. However, this will take time, and the regulatory structure will always lag behind the structure of the market. As long as the market is permanently playing with and transforming business models, the regulators forcibly will remain a few steps behind.

What this means in practice is, for example, that deposit takers will be regulated as banks, money market funds will be regulated as funds, and many gift cards will probably not be regulated at all. There will be some regulatory distortions, and regulators will monitor how important those distortions are. If they become too big—in a business‐volume‐weighted sense—regulators will try to address those distortions. However, this takes time, and in the meantime all those companies are operating and competing under the existing regulations.

Banking

One area where global harmonisation is very advanced is the banking sector, where the Basel Committee for Banking Supervision (BCBS; a committee made of international regulators) defines the so‐called ‘Basel Accords’. We are now into the third revision of those regulations, with the fourth one being work in progress.

Securities, markets and asset management

In other areas there is also some international harmonisation, but it is less strong. For example, in the securities, markets, and asset management space there is the International Organization of Securities Commissions (IOSCO). They provide technical guidance and advice in a number of areas related to the securities space. Some of the advice is more formal, the most important piece in this respect being the 38 Principles of Securities Regulation from 2010, which contains high‐level guidance on regulators and their interaction, auditors, rating agencies, issuers, investment funds, and intermediaries, and which has been endorsed by the G20 and the FSB. They also publish less authoritative staff working papers on topics of interest, for example the 2014 paper on the crowdfunding sector.

Insurance

In the insurance space, there is the International Association of Insurance Supervisors (IAIS). According to their own words, the IAIS is:

the international standard setting body responsible for developing principles, standards and other supporting material for the supervision of the insurance sector and assisting in their implementation. The IAIS also provides a forum for members to share their experiences and understanding of insurance supervision and insurance markets.

They are the author of the Insurance Core Principles document that sets out the 26 core principles of how an insurance company should be run, and that, at almost 400 pages in size, is closer to the Basel framework than the terse 10‐odd pages of the IOSCO 38 Principles document.

Banking and payments

On the banking side, there is the EU's implementation of the Basel Accords.

The currently active implementation is loosely referred to as Capital Requirements Directive 4 (CRD4), which consists of the Capital Requirements Regulation (CRR) and the Credit Institutions Directive (CID), both published in 2013. They in turn are based on the 2010/2011 Basel 3 Accord. Basel 4 is work in progress, but whilst there have been some publications at the Basel level there is little visibility regarding if and when this will impact EU legislation.

On the prudential side, another key regulation is the Banking Recovery and Resolution Directive (BRRD) of 2014, which deals with failing banks, and there are a number of conduct regulations on the consumer side, notably the Consumer Credit Directive from 2008 and the Mortgage Credit Directive from 2014. Also, the Deposit Protection Scheme Directive, which is in its second revision as of 2014, is important in this space.

On the payments side, there is the Payments Services Directive (PSD), which as of 2015 is in its second revision. There is also the Electronic Money Directive from 2009 that is covering things like pre‐paid payment cards. There is also the Cross‐Border Payments Regulation from 2009, which deals with the fees for Euro‐denominated cross‐border payments.

Insurance, pension, and fund management

On the insurance prudential side, the equivalent of the banks' Basel/CRD regulations is Solvency 2, ie the second revision of the Solvency Directive, published in 2009. On the pension side there is the Institutions for Occupational Retirement Provision Directive (IORPD) from 2003.

In the asset management space there is the Undertakings for Collective Investment in Transferable Securities Directive (UCITSD), which is in its fifth revision as of 2014 and covers retail‐focused mutual funds. There is also the Alternative Investment Fund Manager Directive (AIFMD), which covers alternative investments like hedge funds, private equity, and venture capital, and there is the Packaged Retail and Insurance‐based Investment Products Regulation (PRIIPR) from 2014.

Markets

The big directive in the markets space, covering market places, intermediaries, advisors, etc. is the Markets in Financial Instruments Directive (MiFID), which as of 2014 is its second revision, and which consists of the MiFIR regulation and the MiFID2 directive. The central entity under this regulation is the investment firm, which, like the banks and insurers, is one of the types of regulated entities with whom most end‐customers are most likely to interact.

There is also the European Market Infrastructure Regulation (EMIR) from 2012, which deals with clearing houses (aka central counterparties aka CCPs) as well as with trade repositories collecting trade data. Finally, there is the Market Abuse Regulation (MAR), which is as of 2014 in its second revision, and which replaces the previous MAD directive, and there is the Rating Agencies Regulation (RAR) from 2009 which deals with rating agencies.