Remarks by John D. Hawke, Jr. Comptroller of the Currency Before a Conference on Financial E-Commerce Sponsored by The Federal Reserve Bank of New York February 23, 2001 New York, New York Among the many things technology has changed are the ways we think and talk about technology itself. The term "electronic banking," for example, once referred to ATMs and direct deposit. Today it generally means banking online, through personal computer and over the Internet. That’s the brave new world of banking in the 21st century -- and one of the key subjects of this timely conference. It’s taken a fair amount of self-discipline not to get swept up in the e-banking enthusiasms of recent years. It seems only yesterday that the conventional wisdom held that bankers who were unable to offer customers a full range of products and services over the Internet might as well turn in their charters. In fact, some analysts argued that, in order to take full advantage of the new medium, banks would have to develop Internet banking apart from traditional banking operations. It was expected that the Internet’s low operating costs, compared to the large costs associated with maintaining branches, would allow banks to charge lower fees and offer higher deposit rates. The Internet would provide the convenience of banking wherever and whenever the customer chose to use the service. And the ability to gather and process valuable customer information over the Internet would allow Internet-savvy bankers to tailor and market services to individual customer demands and to respond rapidly to changing market circumstances. Yet so far the evidence has not supported the prediction that banks with traditional branch networks would be unable to compete successfully with more agile Internet-focused banks. The most successful Internet banking operations have been those that operate as part of an existing traditional bank, while Internet-only banks have been having difficulty growing and generating profits. Increasingly industry analysts have begun to question the case for a pure Internet strategy. Of course, we should always be cautious about drawing sweeping conclusions about events that are still unfolding. We’re very much in the early stages of Internet banking, and confident pronouncements of what the future holds should be treated with skepticism. Nevertheless, I think it is worth reflecting on recent market developments and how, as regulators, we should react to these developments. In that spirit I want to address several questions today: ? What has the Internet’s impact actually been on the banking industry so far? ? Where will it take the industry in the near future? ? What special risks -- individually or in combination -- does e-banking present to a safe and sound banking system? Some of these questions are impossible to answer with any precision, and the hazards of the crystal ball are well known. But, with all the appropriate cautions and caveats, I will venture a few educated guesses on the impact of the Internet on the banking industry and discuss my views on how we should approach regulatory policy and supervision given the large uncertainties as to future developments. A Status Report on Internet Banking -- and Some Musings on the Future In discussing Internet banking, we should begin by differentiating between pure Internet startups, on the one hand, and traditional banks that have embraced the Internet as an additional delivery channel, on the other. Popular impressions to the contrary, only about two dozen banks and thrifts operate as Internet-only (or Internet-mainly) institutions. Of that group, five are national banks chartered and supervised by the OCC. At the end of the third quarter of last year, those five banks held assets totaling $1.4 billion -- a drop in the bucket, relatively speaking. As I’ve already mentioned, these primarily Internet banks have not yet made significant inroads into the markets of traditional banking organizations, and, generally they are finding it challenging to generate profits and growth. What kinds of obstacles have pure Internet banks encountered? Customer concerns about online security and privacy, unfriendly web sites, unresponsive customer service, and the simple fact that you can’t deposit or cash a check online -- all of these have been impediments to the success of an Internet-only strategy. Another important factor is the enormous promotional cost of building a customer base to critical mass from scratch -- particularly when traditional banking services work extremely well and are relatively inexpensive for most consumers. This may explain the very high percentage of newly opened Internet banking accounts that lie fallow. By one estimate, in 1999 nearly 50 percent of all banking accounts opened with Internet startups were inactive. As a result, some Internet-primarily operators are now retrenching, adopting cost- saving measures and shedding customers who add nothing to the bottom line. Fees are rising, premiums are shrinking, and the attraction -- along with the rationale -- for Internet-primarily banking seems less and less obvious. While it’s clear that to date Internet banking has not overwhelmed traditional banking, this should not be interpreted to mean that Internet banking is a bust. In fact, Internet banking has become an important factor in the industry over a very short time. For any number of reasons, many banks and virtually all of the biggest banks have an Internet presence and others are coming to the same conclusion almost every day. As 2001 began, 37 percent of all national banks were offering transactional online banking -- nearly twice as many as were offering it only 15 months earlier. Today most of the very large institutions offer Internet banking, with OCC economists estimating that approximately 90 percent of all customers currently bank at institutions offering Internet banking. That’s to say that while it is estimated that only about 13 percent of U.S. households currently use the Internet to bank, a very large percentage of banking customers could easily do so if they believed that the service was superior to traditional channels. We need to remind ourselves that the Internet banking "era" has really just begun. As recently as 1997 only about 100 banks and thrifts offered banking over the Internet. Since then, as I’ve mentioned, the rate at which banks have "gone online" has been rapid, especially compared to the early phases of other technology-based banking services such as automated teller machines. Further, many banks, including some of the nation’s largest institutions, see the development of online services as a major component of their business and marketing strategies. These institutions are investing very significant resources in upgrading their technological capabilities and in acquiring the human resources to effectively utilize those capabilities. Interestingly, we’re finding a strong generational correlation among Internet banking users. It’s perhaps to be expected that Internet banking would appeal to younger people who have grown up around computers. What one might not expect is that older folks and retirees would be among the most enthusiastic customers for e-banking services. Yet surveys show that the older generation is spending more time with the Internet and email, and is increasingly comfortable with the idea of conducting financial transactions online. Many of these people are less mobile than they once were, and they welcome the opportunity to pay bills, transfer funds, and monitor their accounts from the comfort and safety of home. It’s the middle-age folks -- people who have grown up with conventional banking -- who have been least inclined to make the switch so far. They don’t necessarily see the Internet as offering them significant new value. Indeed, as I’ve already argued, the cost savings that middle income consumers can expect to receive when performing basic banking services over the Internet are unlikely to be very large. This suggests that any breakthrough in consumer usage of online banking may depend on the development of new and better services, rather than on reductions in the price of standard banking products. On the other hand, even relatively modest transaction cost reductions will be very attractive to business customers that handle a large volume of payments and receipts. Thus, there is a compelling economic case for significant growth in demand for Internet banking services by banks’ business customers, and to the extent this demand grows, banks that remain on the sidelines may risk losing business customers to competitors with more aggressive Internet strategies. The impact of the Internet on the banking industry is not simply a question of how many bank customers will check balances, transfer funds, and pay bills via the Internet. Fundamentally, the business of banking involves the collection, storage, transfer and processing of information assets, and the Internet is an incredibly powerful and efficient tool for handling these processes. It is impossible to predict precisely all the ways in which this tool will be used for banks and their customers. But it is possible to say with confidence that eventually the Internet will change the nature of banking services. We can already see changes taking place. Traditionally, small, start-up firms, for which little information is available to evaluate creditworthiness, are unable to secure financing from formal credit markets, including banking. Often entrepreneurs have to seek funds from relatives, friends, or private credit markets. Technological advances in data collection, data management, and financial engineering have improved the ability of potential creditors to assess the creditworthiness of these borrowers and to price the risks associated with them. As a result, the range of businesses that can obtain loans through financial institutions is expanding rapidly. Another example of how the Internet can fundamentally change the business of banking is illustrated by its impact on the "finder" function of banks. Banks have traditionally brought together parties who then negotiate and complete transactions between themselves. In the past, because of limitations on communications and information technology, this "finder" function was of limited utility. However, with the development of the Internet, the finder function empowers banks to play a central role in electronic commerce. The OCC recognized this important development in our Fleet decision, which concluded that national banks can act as finders to offer commercially enabled Web site hosting services to their merchant customers. The bank-hosted sites serve to bring together buyers and sellers -- a technologically advanced expression of the finder function. The challenges for regulators Regulators have an important role to play in the new world of Internet banking -- a role that goes well beyond determining whether a particular online banking activity is permissible under existing law. We’re also responsible for ensuring that both the novel and more generic risks associated with Internet banking are properly understood and managed by the bankers we supervise, and properly provided for in our supervisory policies and practices. Regulation can be a powerful spur to innovation -- or a formidable obstacle. In the case of the OCC, we have long taken the view -- going back to the days of the first electric adding machines --- that technology is a positive force capable of delivering significant benefits to banks and their customers. That’s the conviction from which our policies flow -- and not just those relating to Internet banking. Our aim is to encourage innovation rather than stifle it, and while circumstances may occasionally force the adoption of new rules and restrictions, we believe that regulatory self-restraint is most likely to produce the best results for all concerned. There are several ways in which the development of Internet banking generates potential challenges for regulatory policy. First, Internet banking -- and developing technology more generally -- is changing the structure and function of financial institutions. Our existing regulatory framework has evolved as a series of specialized responses to the rise of specialized types of financial institutions, but technology, among other factors, is rapidly blurring these differences. Second, Internet banking may raise either new public policy concerns or cast existing concerns in a new light -- the privacy issue, for example. Third, Internet banking challenges traditional methods of safety and soundness supervision by changing the nature and scope of existing risks, and possibly by creating new risks. Finally, the nature and scope of technological change may require authorities to rebalance their emphases on regulatory rules and industry discretion. Technology makes it increasingly desirable and easy for some institutions to offer a wider range of services. Improvements in the ability to integrate financial products and more efficiently market and cross-sell are major advantages of the online environment. But the wider the range of services offered by banks, the more intricate becomes the task of identifying which lines of business banks are engaged in, and the more difficult it becomes to coordinate supervision among functional supervisors. Yet regulation also has a prophylactic function. Innovation is inherently risky, and it’s the responsibility of regulators to help bankers manage that risk and preserve the safety and soundness of the banking system as a whole. Internet banking involves some of the same risks that are common to all bank activities. Avoidance of credit concentrations, funds management, capital adequacy, contingency planning, internal controls -- the rudiments of good banking practice apply with equal force whether banks operate online or not. And I can assure you that our supervision expects no less rigor in minding these fundamentals from those that do. But it’s also important to recognize that Internet banking involves additional risks -- risks novel in kind or degree. Three areas seem especially relevant to Internet banking, The first of these is security. So far, only a handful of financial institutions have reported being victimized by online security violations. But as electronic banking becomes more widespread and complex, the need for banks to assess and manage security risks will become ever more crucial. Risks and threats in the digital world appear to mirror those of the physical world, but the fast pace of the Internet magnifies those risks. Consider a transactional fraud that by itself offers a minimal pay-off. Once this fraud is automated and repeated over the course of a day, for perhaps tens of thousands of accounts, it can provide an attractive incentive for criminals. We also need to consider how new products and services, such as account aggregation, may increase risk by centralizing information, thereby creating a richer target for attackers. Vendor management is another particular concern for Internet banks, many of which rely on third party service providers for advanced technology. Such relationships enable small banks to offer Internet banking to their customers, and can reduce cost burdens even for the largest banks. But this specialization and division of labor raises risk management issues. A handful of big service providers dominate the field, and if any of them were to experience problems, a large number of banks could be affected. Banks must therefore negotiate contracts that clearly identify bank and vendor responsibilities for addressing risks. Banks must also establish procedures to effectively monitor vendor compliance within these terms -- and develop contingency plans in the event that a vendor goes down. This can be especially important for vendors that are new and relatively untested in the marketplace, and for vendors that operate in industries less regulated than banking. The final area of supervisory concern centers on the cross-border implications of e banking. By its very nature, Internet banking defies geographic boundaries. Banks in one national jurisdiction can transact banking business with customers in other countries, without ever establishing a physical presence there. Indeed, once a bank goes on the Internet to offer its products and services, it cannot limit the geographic reach of that offering. Important questions are likely to be raised about which country’s supervisors have jurisdiction over remotely conducted cross-border offerings and transactions, and which laws within each country apply. In addition, some banks and service providers may choose to operate from countries in which the activities are unregulated or less regulated. Risk exposures to, and competition with, such entities may become increasingly important for banks of all sizes. An additional broad policy consideration is determining when to establish formal rules and when to allow financial institutions to develop their own non-regulatory approaches to managing new risks. Rapid changes in technology can render supervisory policies obsolete before they’ve even been implemented. Moreover, regulatory and supervisory policies could retard or distort desirable market developments. At the same time, relying on industry discretion poses risks of its own, and supervisors must carefully monitor industry behavior to ensure the continued protection of the public interest. Having identified these areas of risk for Internet banks, it may well be asked what the OCC is doing to respond to them. The first thing we’re doing, of course, is talking about them, here and at other forums around the country and around the world. Awareness of a problem is a first step toward dealing with it, and we want financial institutions to ask the right questions early on in the Internet planning process. To further assist in that effort, we’ve dedicated significant resources to the analysis of current and future e-banking trends. OCC economists and technical experts have been conducting extensive research in this area. Our examiners are undergoing extensive training to help them identify problems relating to banks’ online activities, and we regularly poll them to report on Internet activities in the banks they supervise. These data are the foundation for OCC’s supervisory guidance. For example, we are about to release an OCC bulletin that suggests ways to manage the specific risks associated with account aggregation. We will offer guidance on how banks involved in aggregation can avoid such business catastrophes as system intrusions and denial of service situations; how they should structure contracts with third- party providers; and how they can develop effective strategies to ensure that their activities in this area comply with all the relevant law, including the privacy provisions of the Gramm-Leach-Bliley Act. This guidance document and much else of value to the e- banking community are available on the OCC’s Internet banking web site. Much of the guidance we release is the outgrowth of our comprehensive collaboration with other domestic and foreign bank supervisors. Late last year, the OCC, as a member of the Federal Financial Institutions Examination Council, or FFIEC, released guidance that should be of real assistance to banks involved in relationships with third-party technology vendors, and, in cooperation with the other FFIEC agencies, we recently issued final guidelines for safeguarding customer information. The guidelines address the "security" side of the privacy issue. Existing mechanisms for coordinating bank supervision internationally have also been mobilized successfully to address cross-border e-banking issues. The Basel Committee on Bank Supervision has taken the lead in this area through the creation of its Electronic Banking Group, which it’s my honor to chair. The EBG, whose members represent 17 central banks and bank supervisory agencies -- including the Federal Reserve Board, the FDIC, and the Federal Reserve Bank of New York -- has been highly productive. We have conducted industry forums around the world and we are currently putting the final touches on a paper that provides guidance to banks on the management of risks associated with e-banking. We are also in the process of developing an issues paper addressing some of the challenges involved in the supervision of cross-border e- banking. In light of the developments I’ve discussed, in the industry and in the regulatory community, I believe that the best days for e-banking lie ahead. Over the next five years or so, literally millions of bank customers will be coming on stream for whom the Internet has been a way of life since childhood. It will be a challenge for the banking industry to be prepared for this coming boom. In short, the Internet holds tremendous promise for generating value for banks and their customers, and, with you, I look forward to learning more about what the future holds in this important area of the economy. This conference takes us an important step in that direction.