The shape of future regulation

The Indian financial ecosystem has evolved at a different pace from developed countries such as the US and the UK. In the US, evolution has been completely market-driven with digital solution providers and big tech taking the lead to develop new innovative products and business models. On the other hand, in the UK, the introduction of Open Banking Implementation Entity (OBIE) by the Competition and Market Authority (CMA) paved the way for adoption of open banking architectures across the ecosystem. In India, the path for digital disruption has primarily been determined by market forces driven by customer requirements. However, digital disruption has been equally fuelled by the government and its thrust on public digital infrastructure.

Customer demand is pushing innovation, leading to new business models through collaborations between banks and digital solution providers. But regulators have to maintain a fine balance between encouraging that and ensuring customer protection.

The fast-paced confluence of technology and finance has enhanced the complexities that regulators have to deal with. As technology/API providers only act as enablers to the financial institutions in most cases, they are not required to obtain specific licences and are out of the regulatory purview. The regulatory lines become blurred, especially when technology players front-end the transactions while operating in collaboration with a regulated entity. For example, in a collaboration between payment solution provider and a bank in India, the former provides all banking products to the customer through the bank. Further, the payment solutions provider also acts as a holistic service provider (including banking solutions) to the customer and also indirectly providing liquidity facility to its customers, which is under the purview of RBI.

The RBI has expressed its concerns over the entry of big technology firms into the financial markets. In its Financial Stability Report (July 2021), the RBI has cited three main concerns with respect to such firms. One, is their presence in multiple lines of businesses (including non-financial), making it difficult to regulate their potential to become dominant players in financial services and network effects, due to which these players can achieve scale and thereby enhance systemic risks.

Two, is the loans being provided through digital apps, with lack of transparency on who the lender is and coercive recovery methods followed by some apps. The RBI, in its June 2020 notification on online origination of loans, has mentioned that the responsibility of compliance and adherence to fair practices code lies solely with the regulated entity, irrespective of the source of loan origination. Further, in August 202223, the RBI notified key rules with an aim to protect customer interest, such as establishing standard practices on responsible pricing through the mention of an annual percentage rate (APR) and setting up of a nodal grievance redressal officer to deal with digital lending related issues The RBI also stated that the transactions across the loan lifecycle shall be executed directly between the licensed entity and borrower without any pass-through account of any third party.

Even in the developed markets, such as the US, a similar model is followed, with the responsibility lying completely with the regulated entity. However, many large digital solutions providers in the US have applied for banking licences with the regulator to

23 In November 2021, the Working Group constituted by RBI submitted a report on ‘Digital Lending including lending through online platforms and mobile apps’. In August 2022, the RBI notified the rules/regulation for immediate implementation basis the recommendations of the Working Group report operate on an independent basis. Square Financial Services – a payment solutions and financial solutions provider based in California received its industrial banking licence24 to operate in the US in June 2020. In March 2021, Revolut, a digital solutions provider headquartered in London, UK, also applied for banking licence for its operations in the US

In the UK, many digital financial solution providers have already received banking licences, with the first license granted in 2015. Atom Bank, Monzo Bank and Starling Bank – all based in the UK – started their journey as digital solutions providers, but received banking licenses from UK Prudential Regulation Authority (PRA) during 2015 and 2016. In January 2021, Revolut also applied for banking license in the UK.

It is possible that different central banks around the world also look to regulate emerging consumer products, such as BNPL, which have been enabled due to the collaboration between big tech, digital solutions providers and licensed providers.

The UK government, for instance, released a consultation paper in October 2021 focussed on the regulation of the BNPL products. It stressed the need to standardise BNPL agreements and processes, as many customers are unaware about the exact nature of the product and interest rate charged. Further, other aspects, such as merchant discount rate (MDR) charged by the third-party lenders, the repeat transactions/BNPL option provided to consumer once on-boarded by the digital solutions provider, creating clear demarcation between BNPL, and other shortterm credit options were also under the focus in the consultation paper.

The RBI’s Working Group on Digital Lending, in its November 2021 report, too has suggested tighter norms for BNPL, suggesting that they be treated as a part of balance sheet lending, if not in the nature of operational credit by merchants. Such transactions are currently not reported to the credit bureaus, as they do not fall under the definition of credit and are more in the nature of deferred payments at a zero per cent interest rate to enhance customer engagement.

The limits of compliance: While the onus of compliance and supervision lies with the regulated entity, any such entity can undertake oversight of the policies and processes of its technology partners only within the scope of collaboration between the two entities. For example, a technology player can be engaged in distributing multiple products across different regulated financial entities. Further, the entity may also offer other services, which do not require banking or NBFC licence. In case of products such as embedded and checkout finance, the digital platform’s primary business, i.e. retailing of products on a web platform, does not require any regulatory licence. Hence, the compliance by the regulated entity can only be ensured at the activity level.

Infrastructure of digital solution providers: Robust digital infrastructure and cybersecurity are critical to ensure uninterrupted and reliable service to the customers. In the past, the RBI has imposed penalties on regulated entities, which have experienced frequent system outages. In case of collaborations through open architectures, the regulated financial entity has to ensure the robustness of its partner’s infrastructure, systems and processes.

From a regulatory perspective, this represents a peculiar situation, as the regulators are responsible for protecting customer interest, but most digital intermediaries/technology firms are outside the regulatory purview. At the same time, any laxity on the part of the digital intermediary, technology partner

24 Industrial bank in the US is a insured state-chartered bank that is a, industrial loan company or any other institution that is excluded from the definition of bank in the Bank Holding Company Act; the industrial bank is not subject to supervision by the Federal Reserve Board and/or API provider engaged with a regulated entity has direct repercussions on the customer experience as also the potential for customer data and privacy getting compromised.

FLDG arrangements: Certain digital solution providers provide a first loss guarantee up to a prefixed percentage on the loans generated and underwritten by them. This represents another area of regulatory concern. The solution provider, in this case, bears significant credit risk, but is not required to maintain any regulatory capital. The RBI’s Working Group on Digital Lending has recommended prohibiting licensed entities from entering into any arrangement involving synthetic structures, such as FLDGs, with digital solution providers.

Despite these material concerns, striking the right balance between innovation and mitigating risks would be imperative. It will not be possible to introduce a ‘one size fits all’ regulation for all digital solutions providers, given the wide range of services and solutions offered by them. At the same time, it is likely that certain steps to control systemic risk, due to products such as BNPL and FLDG arrangements, are put in place.

The RBI has been providing a platform to balance innovation, while also keeping in mind consumer interest through regulatory sandboxes25

APIs are the bulwark on which India’s strong digital financial system is being built. Most licensed service providers were initially slow to explore collaborations with API providers, which is understandable, given they are answerable to the regulator for any lapses. Nevertheless, there has been a rapid acceleration, especially since the pandemic.

Currently, service providers are, at best, at a moderate stage of adoption in their digitalisation and API journey. Larger players are leading the way. The pandemic has accelerated the process of building API capabilities among service providers, and we expect the traction to remain strong, as service providers intensify efforts to build new revenue streams and/or reduce costs.

While digitalisation and APIs have led to runaway growth in low-ticket size personal loans to credituntested customers, we have only scratched the surface, and more can be done to propagate financial inclusion. With several banks entering into co-lending arrangements with NBFCs, enabled by API integration, we expect to see rapid progress on this side too, over the next 2-3 years.

On the regulatory front, we foresee more digital solution providers applying for a licence from RBI and bringing in the requisite regulatory capital to lend comfort from a systemic risk perspective.

• Virtual current account

• Automating payables and GST filings

• Corporate credit card and instant loans (basis eligibility)

In this collaboration, the bank operates on open architecture to provide virtual current accounts to all the users, who are on-boarded on the payment gateway’s digital platform. The data from ERP software is synced with the platform on a regular basis. Further, basis the bills raised on ERP, automated payment is being carried through bank’s UPI switch. The bank then provides other products, such as working capital loans, unsecured MSME loans, and corporate credit cards through integration with the digital platform. The eligibility of the customers for the loan products on offer is decided by the bank by leveraging the data from UPI-based transactions.

The banks need to ensure seamless integration of all their product switches with the digital platform’s API. Since 2016, many API integration players have entered the market to help the incumbents with their APIs and aid integration with third party platforms. For example, in case of a car loan, API integration for verification of PAN details of customer, vehicle registration details, and analysis of bank account statement of customer will streamline the entire underwriting process.

•

•

The above ecosystem is a bank-led model with the digital platform collaborating with a small finance bank. In this model, the bank aims to leverage on the digital platforms’ expertise in providing superior digital experience to distribute its product suite. Further, the higher interest rates provided by the small finance bank compared to peers also provides the digital platform with favourable proposition to attract clients. The user also receives bank issued debit card. Further, the digital platform also provides investment facility in mutual funds through direct route. The platform does not charge any commission to its users for mutual fund investments.

Majority of the leading equity broking players and MF platforms have collaborated with players providing themebased investment products (investment product providers). A user can buy such investment products directly through the existing platform of his/her equity broking player/mutual fund platform. The same is being done through API of the investment product provider being integrated with investment platform providers’ platform. Therefore, all the new products provided by the product platforms are updated on investment platforms on a real-time basis. The distribution by such investment product providers is completely carried out through the digital medium. From the incumbent player’s point of view, the user will not be required to open a new account with other service providers to invest in such products and thereby, it helps the existing service provider enhance user stickiness and retention.

Banks/NBFCs/ MFIs

Tech-players providing video KYC and estamping solution

• Digital on-boarding of clients

• Online signing and stamping of loan agreements

With the RBI permitting digital on-boarding of customers through video KYC, several financial institutions have collaborated with players providing solutions, such as:

• Video KYC for on-boarding new customers

• e-stamping and e-signing solution for executing loan agreements digitally

The digital on-boarding solutions has helped incumbent players reduce operational costs. With video KYC, the time taken for on-boarding customers is also substantially reduced. Moreover, the need to open physical branches to expand geographical reach is also significantly reduced.

The above architecture is led by the digital solutions provider. The payment aggregator/digital solutions provider acts as a distribution platform to a small-finance bank, mutual fund house and digital lender. The product APIs of all the partners are integrated with the digital solutions provider. The KYC process of users is carried out by the partners.

• Payment and collections

• Account reconciliation

• Supply chain finance

A few private banks have published their APIs on the public domain. Therefore, business clients can integrate their ERP (enterprise resource planning) with the bank’s tech stack by leveraging the latter’s API banking ecosystem. The API solutions streamline process, such as payments, collections and provides other services, such as payment enquiry, account balance and beneficiary addition through integration with business ERPs. Further, the banks adopting the API banking ecosystem are able to capture the entire customer value chain of its business clients and build an integrated supply chain portal, where it is also able to offer working capital finance to the client’s vendors and dealers.