Abstract
Technological innovation in Korea holds great potential for the deepening of its financial system, that could lead to an increase of product offerings and lowering of transaction costs. Korea’s financial sector legal framework, particularly the recently announced open banking initiative and anticipated amendments to the legal frameworks for electronic financial transactions and use of personal data, will play a key role in shaping the direction of innovation and competition in the financial sector. The already highly modernized and digitally connected state of the Korean financial sector will amplify the impact of these changes to market structure and competition. Korea’s fintech experience illustrates that even within an already highly technologically advanced, efficient, and inclusive financial sector, significant benefits can still be reaped from innovation in financial services.
Executive Summary1
Technological innovation in Korea holds great potential for the deepening of its financial system, that could lead to an increase of product offerings and lowering of transaction costs. Korea’s financial sector legal framework, particularly the recently announced open banking initiative and anticipated amendments to the legal frameworks for electronic financial transactions and use of personal data, will play a key role in shaping the direction of innovation and competition in the financial sector. The already highly modernized and digitally connected state of the Korean financial sector will amplify the impact of these changes to market structure and competition. Korea’s fintech experience illustrates that even within an already highly technologically advanced, efficient, and inclusive financial sector, significant benefits can still be reaped from innovation in financial services.
Technology-driven changes to payments and customer relationships may have far-reaching implications for financial stability, especially when catalyzed by Korea’s approach to adjusting the legal framework that is designed to facilitate innovation and competition. New fintech entrants might improve efficiency and customer choice in payment services, enhancing customer experience such as by reducing transaction costs, providing greater transparency with simpler financial products, and enabling tighter controls over spending and budgeting; at the same time, new risks could arise in time, such as increasing interconnectedness and complexity in the financial sector, the introduction of greater operational risk, and negative impact on the profitability of incumbent banks.
Changes in market structure are already becoming evident. The successful entry of large technology companies in the payment services market is beginning to alter the market structure, together with adjustments to Korea’s legal framework under the authorities’ multi-prong work plan to facilitate innovation, affecting the degree of concentration and competition. The authorities should closely monitor changes to market structure and act promptly to ensure orderly and coordinated roll-out of their work plan’s components of accelerating financial innovation.
Korea’s commitment to furthering the objectives of innovation, modernization, and competition is in the right direction. Its proper development and risk management would help Korea build a system where incumbent banks and new fintech entrants compete alongside each other in the payment services value chain. A close watch is also required on heightened operational risks and changes to the market structure that result from the parallel initiatives to adjust the legal framework, as well as their negative impact on the viability of incumbent banks’ business models.
Korea: Key Recommendations
C = Continuous; I = Immediate (within one year); ST = Short Term (within 1–2 years); MT = Medium Term (within 3–5 years)
H= High; M= Medium; L=Low.
Korea: Key Recommendations
| # | Recommendations and Responsible Authorities | Timing* | Priority** |
|---|---|---|---|
| 1 | Foster certainty and market confidence in the full implementation of the “open banking system,” including the formulation of its legal foundation, by giving heightened attention to the increased security and operational risks such as those that accompany the increased sharing of data and growing connectivity among diverse market players (see ¶42, FSC) | ST | H |
| 2 | Take a coordinated and gradual approach that prioritizes stability with regard to introducing the “open banking system” and relaxing the legal restrictions for electronic financial transactions and the usage of personal data, with regular assessment of financial sector impact (see ¶45, BOK, FSC, and FSS) | C | M |
C = Continuous; I = Immediate (within one year); ST = Short Term (within 1–2 years); MT = Medium Term (within 3–5 years)
H= High; M= Medium; L=Low.
Korea: Key Recommendations
| # | Recommendations and Responsible Authorities | Timing* | Priority** |
|---|---|---|---|
| 1 | Foster certainty and market confidence in the full implementation of the “open banking system,” including the formulation of its legal foundation, by giving heightened attention to the increased security and operational risks such as those that accompany the increased sharing of data and growing connectivity among diverse market players (see ¶42, FSC) | ST | H |
| 2 | Take a coordinated and gradual approach that prioritizes stability with regard to introducing the “open banking system” and relaxing the legal restrictions for electronic financial transactions and the usage of personal data, with regular assessment of financial sector impact (see ¶45, BOK, FSC, and FSS) | C | M |
C = Continuous; I = Immediate (within one year); ST = Short Term (within 1–2 years); MT = Medium Term (within 3–5 years)
H= High; M= Medium; L=Low.
Introduction
1. This note covers technology-driven changes in the Korean retail payments market, facilitated by the authorities’ adjustments to financial sector law that aim to foster innovation. While competition between fintech companies and incumbents is evolving, innovation has taken root in the Korean market for payment services and money transfers. In Korea, 41% of fintech companies belong to the payment sector, and the number of registered electronic financial service providers now stands at 144 as of November 2019, compared to 67 in 2014.
2. Leveraging on Korea’s advanced financial and data infrastructure, a growing number of individuals are using payment applications provided by major Korean technology companies, namely: Samsung Pay, offered by Samsung Electronics; KakaoPay, offered by popular messaging application Kakao (with over 44 million active users in Korea as of June 2019, accounting for more than 90% of Korea’s mobile messenger market); and Naver Pay, offered by Korea’s leading web portal and search engine Naver (with over 50 million monthly active users in 2018). To date, financial institutions have responded to fintech developments largely through cooperation with fintech companies (namely, using fintech to improve their existing services and operating systems).
3. Korea is actively undertaking legal initiatives with the policy goal of fostering innovation and encouraging new market entrants in the local retail payments market. Under Korea’s strict, precisely-worded rules-oriented legal system for electronic financial transactions, only activities that clearly fall within a recognized legal category may be undertaken. As this could constrain innovation, the authorities have undertaken targeted efforts to loosen legal requirements in the area of payment services (e.g., removal of the accredited certificate requirement) (see Box 3).
4. Korea has also introduced an “open banking system.” It is anticipated that this new market structure will bring about fundamental changes to the Korean legal and institutional framework with the goal of promoting fintech innovation and competition. A prescriptive approach to open banking is being adopted, requiring Korean commercial banks to open their payment network to fintech payment service providers and other commercial banks upon customer consent, with the goal of enabling customers to use a single service provider to access account information or initiate payments from their accounts at different banks. A cap on fees charged by banks is also included. The authorities’ announced aim is to create a competitive financial ecosystem and build greater interlinkages between fintech companies and banks.2 The resulting institutional framework, accompanied with the to-be-introduced legal basis, has the potential to materially alter the dynamics of competition and the financial market structure, amplified further by the authorities’ parallel initiatives to clarify and relax the legal frameworks for electronic financial transactions and use of personal data. Such impact will have far-reaching consequences in the already highly modernized and digitally connected state of the Korean financial sector.
5. Technology-driven change in the Korean financial sector, catalyzed by these legislative initiatives, may place earnings pressure on Korean banks, which are already feeling the impact of low interest rate and aging related shifts. Outlook for earnings is also under pressure driven by almost identical banking business models. Incumbent banks may find it increasingly difficult to respond quickly and competitively to the successful entry of large technology companies into payment services and heightened market competition, which could reduce the resilience of banks by affecting their profitability or by reducing the stability of their funding.
6. As a policy matter, a critical area of uncertainty is the potential impact of these shifts on financial stability. An evolving issue will be how the business models of fintech start-ups and the legislative initiatives to foster innovation may alter the deposit and liability base in the Korean banking system. The multi-pronged legal initiatives announced by Korea have the potential to drive competition with efficiency gains and consumer benefit. At the same time, the greater sharing of data and growing IT connectivity among diverse market players could potentially introduce an expanded set of operational and reputational risks.
7. To promote the smooth and orderly introduction of fintech in Korea, this note identifies critical issues arising from fintech business models and Korea’s initiatives to promote innovation, as they relate to financial stability. In undertaking this analysis, this note has drawn on the work of the FSB, BIS, and BCBS, as well as the IMF’s and World Bank’s jointly launched Bali Fintech Agenda (Box 1).3 It is based on the information available at the time it was completed on December 18, 2019.
The Bali Fintech Agenda
In October 2018, the International Monetary Fund and the World Bank Group launched the Bali Fintech Agenda, a set of 12 policy elements aimed at helping member countries to harness the benefits and opportunities of rapid advances in financial technology that are transforming the provision of banking services, while at the same time managing the inherent risks.
The Agenda proposes a framework of high-level issues that countries should consider in their own domestic policy discussions and aims to guide IMF staff in their work and dialogue with national authorities. The 12 elements were distilled from members’ own experiences and cover topics relating to enabling fintech; ensuring financial sector resilience; addressing risks; and promoting international cooperation.
The Bali Fintech Agenda informs the FSAP’s analysis of fintech developments in Korea and their implications for financial stability, in particular those on:
Monitoring developments closely (Item V), specifically with regard to the impact of technology-driven change, fueled by the “open banking system” and multi-prong legal initiatives to facilitate innovation, on the stability of the overall financial system; and
Modernizing the legal framework to provide an enabling legal landscape (Item VIII), particularly regarding the importance of sound legal frameworks to support trust and reliability in emerging payment products and services.
Evolution of Retail Payments and Primary Drivers
A. Fintech and Emerging Payment Services
8. The starting point for Korea’s current wave of financial innovation is an already highly technologically advanced, efficient, and inclusive financial sector. Defining features of the retail banking sector include great financial institution depth and a saturated credit card market, high smartphone penetration, and customer eagerness to embrace cutting-edge technologies (see Figure 1). Korea’s transition toward an inclusive, modern retail payments market began decades ago in the wake of the Asian financial crisis, during which the authorities promoted electronic payments as a part of an economic policy package (e.g., introducing a system of a 20% deduction of annual credit card payments form taxable income and obliging merchants to accept credit cards). Additionally, Korea is the first country to commercialize the 5G mobile network, a superior data infrastructure that enables the faster handling of data in higher capacity. Paired with the seamless connectivity of this world-leading telecommunication infrastructure, Korea’s advanced smartphone industry has provided a fertile environment for mobile payment services to thrive.
Korea: Retail Financial Services Sector and Cross-Country Comparisons
Citation: IMF Staff Country Reports 2020, 280; 10.5089/9781513557069.002.A001
Source: World Bank Global Findex Database 2017.9. The convergence of Korea’s advanced financial and information technology sectors has led to the emergence of new payment services provided by large non-bank technology companies. These fintech developments in payment services have leveraged Korea’s hardware expertise (e.g., Samsung Pay’s use of magnetic secure transmission for offline payments, biometric authentication, and Knox security solution, discussed further in Box 2). In particular, new easy payment and simple e-money transfer services leveraging Korea’s foundational technology infrastructure systems have gained significant traction.
“Easy payments” are payments initiated by smartphones to purchase goods or services, both online (e.g., on e-commerce websites) and offline (e.g., in brick-and-mortar stores), relying on existing third-party infrastructures (e.g., credit card systems) for back-end processing and settlement. On the customer front-end, providers of such service verify the user’s pre-stored credit card information and use convenient authentication measures via the smartphone (e.g., password or biometric authentication such as fingerprint recognition). According to the BOK, easy payment services were used an average of 3.92 million times per day in 2018, an increase of 87.5% from 2017; the average daily volume totaled KRW126 billion ($89 million USD), up 86.2%.
“Simple e-money transfers” are payments initiated with smartphones where the user first loads a prepaid value (e.g., by credit card or via account transfer) to generate an electronic currency balance with the service provider, then may make payments or transfers using this electronic currency balance. Unlike easy payments, simple e-money transfers are processed and settled on a system proprietary to the service provider in balances of electronic currency. According to the BOK, in 2018 that the average daily volume of simple e-money transfers increased 194.1% to KRW104.5 billion ($92.13 million USD), with a 102.5% rise in the number of daily transfers to 1.41 million.
A large share of the Korean population uses applications offered by non-bank service providers, most of which are major Korean technology companies, to more conveniently make payments via these services (see Table 2).
Korea: Top-Rated Easy Payment Services
Korea: Top-Rated Easy Payment Services
| Company (Industry) | Name of service | Launch |
|---|---|---|
| 1. Kakao (online social media company, Korea’s leading instant messaging application) | Kakao Pay | Sep. 2014 |
| 2. SK Planet (internet platform company, including e-commerce) | SK Pay (formerly Syrup Pay) | Apr. 2015 |
| 3. Shinsegae (department store franchise) | SSG Pay | Jul. 2015 |
| 4. Naver (internet content service company, Korea’s leading web portal and search engine) | Naver Pay | Jun. 2015 |
| 5. Samsung Electronics (electronics company) | Samsung Pay | Aug. 2015 |
| 6. NHN Entertainment (information technology company) | Payco | Aug. 2015 |
Korea: Top-Rated Easy Payment Services
| Company (Industry) | Name of service | Launch |
|---|---|---|
| 1. Kakao (online social media company, Korea’s leading instant messaging application) | Kakao Pay | Sep. 2014 |
| 2. SK Planet (internet platform company, including e-commerce) | SK Pay (formerly Syrup Pay) | Apr. 2015 |
| 3. Shinsegae (department store franchise) | SSG Pay | Jul. 2015 |
| 4. Naver (internet content service company, Korea’s leading web portal and search engine) | Naver Pay | Jun. 2015 |
| 5. Samsung Electronics (electronics company) | Samsung Pay | Aug. 2015 |
| 6. NHN Entertainment (information technology company) | Payco | Aug. 2015 |
10. Although non-financial technology companies may compete with banks for the customer relationship in providing payment services, they still largely depend on banks. For easy payment services, the reliance on banks by service providers is direct, for processing and settlement of each payment transaction. For simple e-money transfer services, customers of service providers must have a bank account or debit card to channel money into and out of the provider’s network; the provider holds the funds received from customers in a pooled bank account in its own name, to be debited when customers redeem their electronic currency balances. For such settlement between accounts at different banks, providers of simple e-money transfer services also rely on banks for their direct access to the interbank settlement system.
11. The popularity of payment services offered by large technology companies marks a shift from a previously bank-centered Korean payment services market. Various electronic payment services are provided by non-bank companies, with new technologies such as biometric authentication and location awareness now being applied in financial services. These service providers generally work in partnership with banks to provide easy payment services and simple e-money transfers (see ¶10). However, the innovations of today can be differentiated from cases of past innovations in the Korean financial sector (e.g., ATMs and automated banking services) which were driven by financial institutions. Rather, it is non-financial technology companies that are leading the current wave of financial innovation in payment services, driven by their attention to customer awareness and preferences (see Box 2).
New Drivers of Innovation in Financial Services: Case Study of Samsung Pay
In August 2015, smartphone manufacturer Samsung Electronics entered the mobile payment services market with the launch of Samsung Pay. Leveraging its hardware expertise to incorporate NFC and MST technologies, Samsung developed an offline payment model that allows users to make payments via a linked credit or debit card by placing smartphones near legacy card terminals.
Samsung Pay has grown quickly in Korea, where a large portion of the population uses Samsung’s smartphones. In April 2019, Samsung announced that Samsung Pay had surpassed a total of 14 million users and handled more than KRW40 trillion ($34 billion USD) in accumulated transaction volume in Korea. In 2018, the service accounted for 80% of the offline easy payment services market in Korea.
Samsung has attributed the popularity of Samsung Pay to its approach to addressing three key areas of customer preference:
Ease of use: To make a payment using Samsung Pay, users merely swipe their smartphone in a certain way, select among pre-linked cards, authenticate by, e.g., scanning their fingerprint, and hold the smartphone near the payment terminal.
Ubiquity: By incorporating NFC and MST technologies to be compatible with most existing merchant card reader terminals (even older magnetic-stripe terminals), Samsung Pay was accepted widely among merchants without any need for them to update systems or install new readers.
Security: Samsung Knox, pre-installed in most Samsung smartphones, is a security solution that segregates sensitive data and implements additional authentication controls for access. Additionally, Samsung Pay uses tokenization for transactions (i.e., similar to card transactions with EMV-chips, rather than transfer sensitive card information through the card network to authenticate a transaction, a code that is unique for the transaction is generated and that one-time-use code is used to authenticate and authorize that particular transaction).
12. Korean technology giants are at the forefront of payments innovation. Unlike the idea of “fintech” (focused on improving financial services by leveraging technology), the concept of “techfin,” a term coined in 2016 by Chinese e-commerce giant Alibaba’s founder Jack Ma, is centered on large technology companies that find improved ways to deliver financial services as a broader part of their service offerings. By offering payment services, a technology company can let users stay within its platform and better serve user needs. For example:
Kakao, the operator of Korea’s most popular messaging application Kakao Talk (see Table 2), was an early pioneer of easy payment services and simple e-money transfers. Kakao Pay, launched in 2014 (with a $200 million USD investment from Ant Financial in 2017), allows the broad Kakao Talk user base to conveniently make payments directly through the messaging application using linked credit or debit cards or balances in Kakao Pay money. Kakao Pay users numbered 30 million in August 2019, and as of the first half of 2019, its easy payment service handled more than KRW22 trillion ($18.45 billion USD) in accumulated transaction volume in Korea. Users may also make payments offline through Kakao Pay’s QR code functionality, with payment details communicated through a Kakao Talk message. Additional Kakao Pay features include remittance services, the ability to send invoices, and fraud detection services.
Naver is an internet services company (see Table 2), with a core business of operating search portals, including shopping searches, and a shopping platform that hosts online malls. Its launch of Naver Pay in 2015 integrates its online shopping operations with easy payment services, allowing users to stay within the Naver application to search for goods, pay for e-commerce transactions, monitor their purchases, and track shipping. Naver Pay users can also accumulate loyalty points and use simple e-money transfer services to send value to other users.
B. Impact on Incumbent Banks
13. Korea’s banking system is concentrated, with the six large banks commanding 70%-80% of the system’s loans and deposits.4 These institutions include Kookmin Bank, Shinhan Bank, KEB Hana Bank, Woori Bank, Industrial Bank of Korea, and NongHyup Bank. Within the highly modernized and digitally connected Korean financial sector, these banks have been pioneers in developing banking applications to provide financial services (namely, bank account queries and transfers) on web-based and mobile banking platforms. Such online financial services have been steadily growing (see Figure 2), with web-based banking and mobile application banking accounting for 87% of bank account queries and 53% of all bank account transfers in the fourth quarter of 2018.
Korea: Steady Growth in Customer Reliance on Online Banking
Citation: IMF Staff Country Reports 2020, 280; 10.5089/9781513557069.002.A001
Source: BoK.1 Inquiry services include account inquiries related to financial transactions such as deposits, loans and credit card transactions, and inquiries about funds transfers, interest rates, foreign exchange rates and checks.2 Financial transaction services include deposits, withdrawals, and funds transfers.14. Incumbent financial institutions in Korea have responded to technology-driven developments largely through cooperation with fintech companies. Financial institutions have expanded their digital teams and established dedicated departments to discover and nurture promising fintech companies, mainly for purposes of improving their existing services and operating systems (e.g., to automate internal processes). Financial institutions are also serving as incubators and operating fintech innovation labs (see Table 3), providing mentorship and consultation to small fintech companies that lack know-how in developing business models and navigating through complex legal issues (e.g., intellectual property law). Incumbent Korean financial institutions are also an important source of capital for fledgling startups in Korea. For example, in April 2019 Shinhan Financial Group signed a memorandum of understanding with the “fund of funds” management firm Korea Growth Investment Corp to foster investments in fintech startups; it is expected that the two entities will identify promising early-stage fintech companies, help them achieve scale, and create a pool of funding, including funds from Shinhan.
Korea: Financial Institutions Operating Fintech Innovation Labs
Korea: Financial Institutions Operating Fintech Innovation Labs
| Financial Institutions | Lab | Launch |
|---|---|---|
| KB Financial Group | KB Innovation HUB | Mar. 2015 |
| Shinhan Financial Group | Shinhan Futures Lab | May 2015 |
| KEB Hana Bank | Fintech 1Q Lab | Jul. 2015 |
| Woori Bank | Wibee Fintech Lab | Expanded to Dinno Lab, Apr. 2019 |
| NongHyup Bank | NH Digital Innovation Campus | Expanded Apr. 2019 |
| Industrial Bank of Korea | IBK Fintech Dream Lab | Nov. 2015 |
| IBK 1st Lab | Sep. 2019 | |
| Hanwha Life | Dreamplus 63 Fintech Center | Oct. 2016 |
| DGB Financial Group | DGB Fium Lab | Jun. 2019 |
| Busan Bank | BNK Fintech Labs | Oct. 2019 |
Korea: Financial Institutions Operating Fintech Innovation Labs
| Financial Institutions | Lab | Launch |
|---|---|---|
| KB Financial Group | KB Innovation HUB | Mar. 2015 |
| Shinhan Financial Group | Shinhan Futures Lab | May 2015 |
| KEB Hana Bank | Fintech 1Q Lab | Jul. 2015 |
| Woori Bank | Wibee Fintech Lab | Expanded to Dinno Lab, Apr. 2019 |
| NongHyup Bank | NH Digital Innovation Campus | Expanded Apr. 2019 |
| Industrial Bank of Korea | IBK Fintech Dream Lab | Nov. 2015 |
| IBK 1st Lab | Sep. 2019 | |
| Hanwha Life | Dreamplus 63 Fintech Center | Oct. 2016 |
| DGB Financial Group | DGB Fium Lab | Jun. 2019 |
| Busan Bank | BNK Fintech Labs | Oct. 2019 |
15. As a policy matter, the authorities have encouraged cooperation between incumbent banks and fledgling fintech companies. The authorities are of the view that through collaboration with established financial firms, new fintech companies with a small customer base can test the marketability of their innovative services and build up recognition among consumers. Under the authorities’ “designated agent system,” fintech firms could partner with banks and offer their services to customers on a test basis for up to two years, with the goal of advancing innovation in financial services and consumer benefits. Under this approach, the partnering bank outsources tasks to fintech companies, and the fintech companies offer services to customers as agents of the bank. At the end of the two-year test period, a fintech company with a successful offering could either sell the service to the partner bank or continue testing operations on a standalone basis provided the authorities determine that the service offered by the company meets the selection criteria for “innovative financial service” (in accordance with application and designation process stipulated in the Financial Innovation Support Act; see ¶20).
16. On profitability, however, Korean banks underperform their peers, and risks are rising from weakening economic growth. Outlook for earnings is under pressure driven by rising technology-driven competition in the financial services market, further catalyzed by initiatives to foster innovation), as well as business models with little differentiation and a low interest rate environment. Limited domestic opportunities to expand and an aging population are also beginning to put a downward pressure on earnings. Banks are moving offshore, and Vietnam, Thailand, and Myanmar have become important markets for Korean bank subsidiaries. Moreover, incumbent banks are facing rising costs to maintain market position amidst an increasing number of fintech competitors and competing products. This, coupled with modest cost savings improvements, will put a strain on the industry’s profit margins. Moreover, the introduction of an “open banking system” will give not only banks but also fintech companies new access to the interbank settlement system, with the policy goal of encouraging development of new payment services to make transfers between customer accounts at any bank (see ¶23 and Box 5) and promoting competition.
Institutional Setting
A. Legal Framework for Retail Payment Services
17. The responsibilities among financial authorities relating to electronic financial transactions are shared by the FSC, FSS, and BOK. The FSC develops and executes policies specifically aimed at the financial services sector, in tandem with its enforcement arm, the FSS. The BOK is responsible under the Bank of Korea Act for the management and oversight of the payment and settlement systems, with the goal of promoting the safety and efficiency of Korean payment and settlement systems as a whole. With respect to electronic financial transactions (including easy payment services and simple e-money transfers), the EFTA was enacted in 2006 (last amended May 2013) with the goal of “ensuring the security and reliability of electronic financial transactions by clarifying their legal relations and promoting financial conveniences for people and developing the national economy by creating a foundation for the sound development of electronic financial industry.” It establishes the scope of permissible electronic financial transaction services and provides the legal basis for the supervision of service providers. Additional laws (e.g., the Framework Act on Electronic Documents and Transactions, the Digital Signature Act, and the Issuance and Distribution of Electronic Bills Act) have also been enacted to govern electronic transactions; the Foreign Exchange Transactions Act covers foreign currency settlements.
18. Korea’s rules-oriented legal system for electronic financial transactions plays a key role in shaping the direction of its fintech innovation. Korea has witnessed rapid technological advancement, but these developments have been slow to reach the financial sector. Under the legal regime’s white-list approach, only activities or business models that fall squarely within a category that is explicitly recognized and licensable under the law are allowed to be undertaken, with a license. Categories of licensable activity under the EFTA, developed 10 years ago, are viewed by the market as methodical and formalistic. Although the legal regime provides legal clarity as to permissible activities (i.e., unless an activity or business falls squarely into a category explicitly permitted in the law, it is not allowed), the authorities have acknowledged that it poses challenges to fintech companies seeking to establish themselves in the financial market and introduce new business models or offer innovative services. Nevertheless, working within such a strict and precisely-worded legal regime, Korean private sector innovators have focused their attention to applying technology to payment services in order to remove frictions arising from the legal regime to create a better user experience (see Box 3).
Innovating Within a Rules-Based Legal Regime: Case Study of Kakao Pay
An overly rigid legal system focused on specific technologies can pose unnecessary obstacles to innovation. For example, Korea’s e-authentication policy had previously required financial companies to use specific technologies—i.e., an encryption system using ActiveX, an external plug-in developed by Microsoft—that must be downloaded by e-commerce customers to support identity confirmation and fraud prevention in connection with their online payments. The technology-specific certificate requirement had been widely criticized as a hinderance to the adoption of more advanced security technologies, as well as for stifling e-commerce activity at Korean websites by burdening users with system slowdowns, unwanted software updates, and vulnerabilities for malicious code.
Innovating within this rules-based legal regime, Kakao Pay was launched in September 2014 as a user-friendly alternative to what had become a burdensome online payment process. Kakao Pay was viewed as a game-changer for Korean retail payments: it did not interrupt the online purchase process by requiring users to install or update security programs under the certificate requirement. Rather, Kakao Pay partnered with a payment gateway LG CNS to provide easy payment services on a limited basis to its Kakao Talk user base for small-value online purchases, without the need to meet certification requirements. Instead of complex authentication procedures involving AcitveX, Internet users quickly and conveniently authenticate online transactions through their smartphones, such as via biometric authentication (e.g., fingerprint recognition) or password.
The authorities have taken measures to amend the law to remove frictions from outdated certificate requirement. The negative impact on Internet users seeking to make purchases on Korean e-commerce websites— driving Korean users to shop at foreign websites and repelling foreign users from shopping at Korean websites—led to the certificate requirement’s eventual abolishment in March 2015.
19. The protection of personal data in Korea is based on the Personal Information Protection Act and a number of sector-specific laws. The CIUPA governs the protection of personal credit information in the finance sector. Under that law, companies can use the personal information of customers only for the purposes for which the individual has consented; companies must also indicate whether the usage for which they are requesting consent is necessary or optional for their provision of financial services to the customer (e.g., if a company offering financial services is seeking to use personal information for purposes of offering add-on social media services, then that usage is not necessary for their provision of financial services and must be indicated as optional) and give customers the choice not to permit non-mandatory usage of their personal information. As a matter of practice, individuals in Korea choose to not permit such usage in the vast majority of instances.
B. Initiatives to Foster Fintech Innovation
20. The authorities have recently undertaken initiatives to facilitate fintech innovation, including targeted efforts to loosen legal requirements viewed as unnecessary obstacles. A sandbox was launched in April 2019 (with the entry into force of the Financial Innovation Support Act), under which fintech companies approved by the authorities are permitted to test new financial services subject to regulatory exemptions for up to four years. Other amendments to financial sector law that have been recently enacted with the goal of removing unnecessary obstacles to innovation, particularly obstacles to collaboration between financial institutions and non-bank fintech entities, include:
lifting the ceiling on ownership stake a bank may have in technology companies (15%, otherwise tighter restrictions and requirement to have management role in the company apply) and shortening of the review process;
allowing securities companies to provide certain payment services (which had previously been prohibited);
allowing financial institutions to store personal credit information and personally identifiable information on cloud-computing servers (such storage had previously been limited to “non-critical information” and excluded customer information); and
allowing securities companies and credit card issuers to send money abroad for retail customers up to a total of $50,000 USD per year per customer (previously only commercial banks could provide such services).
21. Going forward, the authorities intend to promote fintech innovation through further adjustments to the legal framework, with a view to supporting “Korea’s innovation-led economic growth.” The BOK’s policy approach to nurturing the fintech industry seeks to strike a balance between enabling fintech innovation (e.g., through the sandbox) and addressing risks (e.g., cyber risks). The FSC has announced a sweeping review of existing financial sector rules and administrative guidelines, with the goal of removing barriers of entry to financial services, encouraging “innovative challengers” to enter the market, and promoting competition between incumbent banks and new entrants. The anticipated measures announced by the FSC to ease requirements for providers of easy payment and simple e-money transfer services include:
allowing a small-sum credit function (currently, all balances with a service provider must be pre-funded);
increasing the deposit limit for balances with service providers up from the current KRW2 million ($1,800 USD), allowing such service providers to handle larger-value purchases; and
allowing service providers to handle foreign exchange payment transactions and provide higher loyalty discounts to customers who use their platforms (akin to the treatment of credit card companies).5
22. Korea’s legal framework for personal data appears on the verge of changing significantly under proposed amendments with the announced goal of better enabling a “fourth industrial revolution.” A bill to amend the CIUPA was proposed in November 2018 and is currently pending in the National Assembly, under which companies would be permitted to process, analyze, and store pseudonymized personal information (e.g., aggregated data that does not permit the identification of individuals without using, or combining it with, additional information) without individuals’ consent (the legality of which is unclear under current rules) for the production of statistical information, including for commercial purposes. The proposed amendments would also permit personal information, once collected, to be used in more circumstances without individual consent, provided that usage is sufficiently related to the original or main purpose and subject to meeting a certain level of encryption or other security process, to be further stipulated.
23. The authorities have also announced the roll-out in 2020 of an “open banking system,” with the announced goal of creating a more competitive financial ecosystem, building greater interlinkages between fintech companies and banks, and nurturing fintech to become a new growth driver. In February 2019, the FSC announced plans to open access to the existing bank settlement system to create a platform on which fintech companies and banks can develop payment products, specifically products that enable customers to access account information and to initiate payments from their accounts at different banks. The plan consists of a legal and institutional framework under which Korean commercial banks are required to open access to their settlement network, with a customer’s consent, to payment service providers licensed under the EFTA and other banks. The anticipated mandatory participation for commercial banks will remove their discretion in selecting partnerships with counterparties (e.g., fintech companies and other banks) and is intended to replace the need for individually negotiated bilateral agreements. Another key component of the plan is a uniform cap on commission fees charged to these service providers by banks, to one tenth of its current level (i.e., the current fee of KRW400 to 500 per transaction will be lowered to about KRW40 to 50 for large service providers, and KRW20 to 30 for small- and medium-sized service providers).
24. The authorities aim for the “open banking system” to serve as an infrastructure open to all licensed fintech companies and banks to access the systems of other banks in Korea. The Korean authorities are introducing the “open banking system” to facilitate the emergence of two new types of payments-related service providers.
The first type enables customers to more conveniently initiate payments from their bank accounts to the account of a beneficiary (e.g., a merchant or another individual), bypassing card payment systems (i.e., in which a merchant would request payment from the purchaser’s bank through a card network).
The second type provides information aggregation services for customers to pull together data from their accounts at multiple financial institutions (e.g., transaction histories and balances), giving a broad view of their finances in one consolidated place. Such dashboards can also serve as a platform for new services: analyses of spending habits, financial advice, and personalized advertisements or offers.
Providers of these two types of payments services can be licensed fintech companies or incumbent banks (together, Interface Providers); indeed, commercial banks in Korea may compete with new fintech entrants in providing these innovative types of interface services through the “open banking system.” From a customer’s standpoint, better, faster, more user-friendly interfaces can be offered by these two types of service providers for purposes of accessing the customer’s transaction information or initiating payments from the customer’s accounts with its various banks (the Backend Banks).
25. It is also expected that the “open banking system” will facilitate simple e-money transfer services provided by fintech companies. For licensed Interface Providers that provide simple e-money transfer services, the “open banking system” can be leveraged to more efficiently and at lower costs allow customers to generate an electronic currency balance via a transfer from their bank account, as well as to redeem their electronic currency balances via transfer to their bank account. As simple e-money transfers in that electronic currency move entirely between digital wallets of the Interface Provider, never making direct contact with Back-end Banks, those banks would be unable to track or analyze the individual transactions of their customers.
26. Earlier initiatives to lower barriers to entry for fintech Interface Providers met limited success. In August 2016, Korean banks jointly launched an “open API system” with the goal of facilitating the development of innovative financial services by fintech companies. APIs are protocols that allow different software programs to communicate with each other and share information directly. The “open API system” was introduced to enable small- and mid-sized fintech companies to develop services as Interface Providers and connect to a pool of Back-end Banks that included 16 commercial banks via a standardized set of APIs. By providing APIs using common standards, the “open API system” sought to remove the burden for fintech companies of having to develop their own APIs or manage a multitude of incompatible APIs to connect to Back-end Banks. However, challenges remained (e.g., access to the “open API system” was limited to only small fintech firms and subject to high fees charged by Back-end Banks of approximately KRW400–500 ($0.30–0.40 USD) per transaction).
27. Like the PSD2 in the European Union, the authorities have designed the Korean “open banking system” with the goal of fostering competition and innovation in payments services. The PSD2, among other key goals, is intended to provide the legal foundation for the further development of a better integrated internal market for electronic payments within the EU (see Box 4). In Korea, the FSC envisions that the “open banking system” will similarly grant licensed Interface Providers a new legal right of access to the account and transaction information held by Back-end Banks on their customers—whenever the customer consents for the purpose of receiving payment services from these providers. The authorities hope to facilitate market entry into payment services by removing the need for individually negotiated agreements between Interface Providers and each Bank-end Bank providing for such access.
PSD2 in Brief
The revised PSD2, which E.U. Member States were required to implement by January 2018, broadened and deepened the scope of payment services regulation. It repealed the PSD1, which predated the emergence of new payment service providers in the E.U., especially in online payments. These payment service providers were not clearly subject to PSD1 and potentially raised a number of risks (e.g., consumer protection, security, and operational risks). PSD2 addresses these new service providers by expanding the scope of the law to include them.
The PSD2 is also a legal framework specifically designed to foster competition and innovation in payments services. It uses two mechanisms to achieve these goals. First, it imposes limitations on transaction fees and stricter rules on refunds to lower transaction costs for consumers. Second, more importantly, it requires European banks to open their payment infrastructure and customer data to other banks and payment service providers. Specifically, it grants them a fundamentally new legal right of access to the account and transaction information held by banks on the banks’ customers—whenever the customer consents for the purpose of receiving payment services from these providers.
The PSD2 also requires compliance with heightened data security standards. It relies on new RTS to ensure SCA and secure communication. The RTS seek to, among other objectives, ensure an appropriate level of security for customers of payment services and payment service providers, as well as ensure the safety of customer funds and data. The technical requirements for SCA in particular aim to increase the security of payments and reduce the risk of fraud. The authentication processes of payment service providers must use at least two out of the following three factors:
Something only the user knows (e.g., passcode or PIN);
Something only the user possesses (e.g., smartphone);
Something the user is (e.g., fingerprint, facial, or eye scan).
For online payment transactions initiated through a payment service provider (which may be at a higher risk of fraud), service providers are required to use additional “dynamic” authentication processes to link the specific payee and payment amount to the transaction being authenticated (e.g., through the generation of a one-time authentication code). Taking into account the principle of proportionality, the RTS contains certain exemptions from these SCA requirements. Taken together, the requirements under the PSD2 are intended to reflect a balance of security and consumer protection, on the one hand, with innovation and user friendliness, on the other.
28. Operationally, there is a critical difference between the Korean “open banking system” and the PSD2 framework. The PSD2 framework contemplates a direct connection between a bank and a payment service provider or another bank at a customer’s request to initiate payments or access account information. In contrast to this direct access to customer accounts and transaction information held by Back-end Banks, under the Korean “open banking system” licensed Interface Providers connect to an already-existing interbank settlement system operated by the KFTC, through which they gain such access to Back-end Banks participating in the system. Specifically, Interface Providers route transaction information inquiries and process transactions through the KFTC-operated payment system, which connects to the relevant Back-end Bank, leveraging system processes and mechanisms already in place (see Box 5). The authorities intend for the “open banking system” to address the challenges currently faced by Interface Providers in obtaining comprehensive access to the established financial network, with the hope that this access would in turn promote competition in the financial sector (see ¶23).
29. The authorities have indicated that they will monitor the impact of the “open banking system” on the stability of the overall financial system. With regard to the stability of payment services, the authorities highlight that transactions made through the open banking system are settled among Back-end Banks the next business day via payment netting by the BoK, and they emphasize that the settlement finality of such transactions among Back-end Banks is guaranteed by a relevant law. In addition, the authorities note that Interface Providers using the “open banking system” will be required to take out an insurance policy which covers a certain percentage of their daily withdrawal limits (on average 200%, with the prescribed percentage varying across Interface Providers based on their risk profile). With regard to security, the authorities have indicated that the relevant authorities will address vulnerabilities to the open banking system by creating security guidelines for users of the system, as well as through periodic reviews and testing.
30. The legal basis for the “open banking system” is currently in development. To address the instability and uncertainty arising from the lack of a legal foundation, the authorities plan to amend the EFTA, including to create a legal foundation for mandating Back-end Banks to open their systems to Interface Providers, requiring them to provide standardized APIs for Interface Providers, and prohibiting them from discriminating against Interface Providers in processing payments (through, e.g., differences in processing speed and queuing order). Amendments to the CIUPA are also pending to establish a legal foundation for the sharing of personal information involved in the account information services that the authorities intend for the “open banking system” to catalyze.
Main Findings and Recommendations
A. Key Trends in Technology-driven Change to the Payment Services Market Structure
31. Korea’s fintech development began with the unbundling of a range of financial services (e.g., funds transfer, loans, investment management) that were traditionally integrated offerings by financial institutions (see Figure 3). Particularly for payment services, customers may now choose between a variety of non-bank providers for faster and more convenient specialized services. As a result of this unbundling, the payment services market has relatively low barriers to entry and high competition for customer loyalty. Providers of easy payment and simple e-money transfer services have engaged in fierce marketing and loyalty campaigns to build customer awareness and increase the attractiveness of their offerings, with the market consolidating around a few popular applications (see Table 2).
Korea: Unbundling of the Korean Financial Services Industry
Citation: IMF Staff Country Reports 2020, 280; 10.5089/9781513557069.002.A001
Source: BoK.32. Because the starting point for Korea’s current payments innovation is an already advanced, efficient, and inclusive retail market (see ¶7), Korea’s growth drivers for payment services are different from other countries. For example, a key driver of the popularity of mobile payments in China was the lack of access to traditional financial institutions. Unlike other jurisdictions that have recently harnessed fintech innovation to leapfrog into new retail payments services, the starting point for today’s innovations in the Korean retail payments market is an already technologically advanced, efficient, and inclusive financial sector (see ¶7). As a result, in an effort to further distinguish themselves and expand their presence, certain Korean payment service providers have begun to expand their financial service offerings.
33. Entities that have gained market success offering a single unbundled strand of financial services (i.e. payment services) now seek to grow by evolving into platforms. Given the fierce competition within the payment services market, certain service providers, in an effort to distinguish themselves, have begun to expand their presence in the financial services market. For example:
After attracting a large customer base through competitive payment services, companies like Toss (which began with simple e-money transfers) are beginning to transform into financial platforms that serve as gateways for users to access a range of financial services, including in-house products (subject to any additional applicable licensing requirements) and those offered by other financial firms, through a single smartphone application (e.g., credit score management, loans, insurance plans, and investment services).
Kakao Pay is expanding beyond its core payment services into selling insurance products from various insurers (e.g., in July 2019 Kakao Pay acquired a controlling stake in start-up Inbyu, a technology-based insurance service platform).
In July 2019, Naver announced its intention to spin off Naver Pay and transform it into a full-fledge financial company offering a suite of services including accounts, stock investment and insurance, as well as recommending savings products offered by other banks.
Successful financial platforms that attract customers through a superior user experience (e.g., through more convenient processes) can gain market dominance not only in retail payments, therefore, but in the broader retail financial services market. Moreover, a financial platform approach could allow companies to offer payment services for free or low prices that generate losses, cross-subsidized by revenues from other platform offerings.
34. These market trends have implications for competition and innovation in payment services, which are increasingly viewed as a supporting pillar for the ecosystem of large technology companies rather than a standalone earnings generator. Within Korea’s competitive payment services market, revenue from commission fees are low and costs tend to be high for growth-stage companies seeking to quickly to build a network. Despite limited opportunities for profit in this service line, large technology companies nevertheless see commercial value in offering payment services: users stay within their platform, and they can better serve user needs. Naver Pay, for example, allows Naver to extend its offerings beyond functions like search and communication to actions like purchase and payments, increasing its presence in users’ day-to-day lives (see ¶12). In contrast, fledgling fintech companies seeking to enter the digital payments market in Korea face challenges in finding a commercially sustainable business model offering standalone payment services, however innovative and efficient they may be, in competition against large technology companies.
35. Data also plays an increasingly important role in retail payment services, with impact on the market structure. As more payment transactions take place on smartphones, Interface Providers are beginning to accumulate valuable data related to the spending habits and financial positions of their customers, which has traditionally been the preserve of banks.6 Data on customer spending and payment patterns can be used by Interface Providers to offer benefits to consumers (e.g., enhanced loyalty or rewards programs, detailed financial analysis services, and personalized financial consulting offerings) and value-added services to merchants (e.g., targeted marketing solutions and a broader range of distribution channels). Moreover, as simple e-money transfers gain popularity, especially facilitated by the “open banking system” (see ¶25), a growing share of retail payments activity would gravitate toward the proprietary systems of these Interface Providers in balances of their electronic currency.7 Back-end Banks cannot track individual transactions in the electronic currency of the Interface Provider, which occur entirely on the Interface Provider’s systems, reducing the visibility of Back-end Banks into customer transactions that they could otherwise monitor for linkages and risks (e.g., bank account transfers or card transactions), as well as hindering their ability to remain competitive in offering personalized financial products and basic service offerings such as credit to households.
36. Network effects among Interface Providers may be further catalyzed by the authorities’ parallel initiatives to relax the legal restrictions on electronic financial transactions and the use of personal data, together with the introduction of the “open banking system.” These parallel fintech initiatives point in the same direction toward facilitating the business models of Interface Providers that can nimbly leverage state-of-the-art technology: the adjusted legal frameworks permit Interface Providers to do more with personal data, under relaxed requirements for electronic financial transactions, and with powerful access to Back-end Bank systems.
37. Banks are facing increasing difficulty to maintain their current operating models as a result of technological change and changing customer expectations.8 Dynamics in the Korean financial sector will involve increasingly fierce competition among incumbent banks and new fintech entrants for the direct customer relationship,9 further stoked by fintech products designed to allow users to conveniently comparison shop across financial service providers. For example, Bank Salad from Rainist, a fintech founded in 2012, has 4 million customers and offers a smartphone app that serves as a convenient and user-friendly marketplace connecting users and providers of financial services (e.g., credit cards, deposits, savings, loans, insurance products, and pension plans), including customized recommendations based on a user’s financial assets and spending habits.
38. In the medium term, banks’ direct interaction with customers could be displaced by fintech Interface Providers that collect, accumulate, and use customer data to offer financial products better tailored to their income, spending patterns, and preferences (see ¶35). Such services are likely to become more common as consumers become comfortable with non-bank Interface Providers collecting and accessing their data, further facilitated by proposed amendments to relax the legal restrictions on use of personal data (see ¶22). While these developments could increase competition in payments services and benefit consumers, including by increasing market transparency, it could also reduce the “stickiness” of bank deposits, with possible implications for Back-end Banks’ cost of funding and stability.10
B. Potential Impact of Fintech Developments on Financial Stability
39. Fintech developments, catalyzed by the parallel legislative initiatives, are beginning to change the market structure in financial services, with possible impact on financial stability. The “open banking system” constitutes a paradigm shift (see ¶¶23–29), transforming the financial sector from a compartmentalized and bank-centric system to one that is open and competitive, but also with greater operational complexity and new interlinkages.11 Open banking is still in the early stages of implementation in most jurisdictions, and it is unclear how such frameworks will drive consumer demand and market developments.12 There could also be new implications for financial stability from the success of large technology companies in the payment services market,13 whose business models and payment services offerings would be even further catalyzed by the authorities’ relaxing of legal restrictions for electronic financial transactions and use of personal data.
40. Korea’s undertaking of a cross-cutting review of financial sector laws to reform those that might unduly or unintentionally hamper innovations that yield public benefit is admirable. Incumbent Korean banks might adapt and improve digital interfaces to better meet customer expectations (see Table 3); they may form partnerships with fintech companies to enhance their mobile platforms and increase the efficiency of their legacy banking processes (e.g., through technologies such as cloud computing, artificial intelligence, and data analytics capabilities). Fintech innovations also hold potential benefits for users of financial services, including by reducing transaction costs, providing greater transparency with simpler financial products, providing greater convenience and efficiency, and enabling tighter controls over spending and budgeting (see ¶9 and Box 2).14 In particular, it is expected that the “open banking system” will enable a wider range of financial services to access account information and initiate payments (see ¶24) which, in turn, it is anticipated will lower barriers to entry and enable innovation around new functionality (e.g., services for individuals to split monthly pay checks or connect debit cards among their accounts with multiple banks).15 Yet, growth in fintech innovation catalyzed by Korea’s parallel initiatives brings potential benefits but also risks and challenges to customers, banks, and the banking system.
41. In the short term, the “open banking system” and aspects of its implementation in Korea could introduce an expanded set of operational and reputational risks. Prior to the introduction of the “open banking system,” managing the risk of customer fraud, data breaches, and operational vulnerabilities within their systems was the responsibility of Back-end Banks, who had discretion in selecting partnerships (e.g., with fintech companies) and the ability to negotiate bilateral agreements with risk-mitigating provisions. The prescriptive requirements of the “open-banking system,” which are designed to replace the need for having direct contractual relationships between Interface Providers and Back-end Banks in place, render it more challenging for Back-end Banks to exercise oversight and monitoring over Interface Providers.16 The full participation of all 18 commercial banks in Korea in the “open banking system” means that a vulnerability in one Interface Provider could impact the broader financial system. The KFTC, which is positioned in the center of the “open banking system” (see Box 5), is charged with undertaking preventative risk-control measures (e.g., providing secure open APIs, screening applications to participate in the “open banking system” as Interface Providers, and detecting anomalies in customer activity). Nevertheless, while centralized data sharing via the KFTC under the “open banking system” brings many benefits, it also results in a “bigger surface area” for cyber-attacks against the financial system:17 as more data is shared with more parties, the possibility of a data breach increases and therefore effective data management will become more crucial. The KFTC’s experience in managing security risk and network operations is usefully leveraged in the “open banking system,” yet there is room for the system to be further strengthened.
The FSC’s Announced “Open Banking System”
Fintech companies can access the Korean “open banking system” as Interface Providers by choosing one “main” Back-end Bank to maintain their accounts and by executing an agreement with the KFTC. Banks may access the “open banking system” as Interface Providers, as well. Upon being granted access to the “open banking system,” an interface Provider can connect, via the KFTC-operated open banking platform system, into all participating Back-end Banks, with the ability to access to the account and transaction information held by Backend Banks on their customers upon consent of the customer.
Transactions among Back-end Banks, in connection with retail transfers between customers initiated through the “open banking system,” are settled on a deferred net settlement basis. When a customer uses an Interface Provider to initiate a transfer of funds through accounts at Back-end Banks, the instruction is routed through the open banking center to the Back-end Banks. The relevant funds are immediately credited to the beneficiary, and the obligations among all Back-end Banks are netted on the following business day and settled by BOK-Wire+. While the efficient use of liquidity under this deferred net settlement arrangement is an advantage, unsettled positions accumulate up to the designated settlement time---i.e., settlement among Back-end Banks is not final until the net position is settled.
In the medium to long term, the relevant authorities will consider allowing qualified fintech payment service providers direct access to the Korean retail payment system, including without relying on a “main” Backend Bank’s services. To be eligible for any such direct access, fintech payment service providers will have to meet certain requirements in financial soundness and digital capabilities, to be determined. The authorities acknowledge that granting such direct access to fintech payment service providers is a critical matter that will have a significant impact on payment and settlement systems and on the financial market more generally. As such, the authorities have indicated that the decision as to whether to grant such direct access and, in the event to do so, the formulation of requirements as to access will be determined after sufficient discussion between the BOK and other relevant organizations.
All 18 commercial banks in Korea are participating in a pilot roll-out of the system and opening access to customer accounts and transaction information. In October 2019, the authorities announced the launch of a pilot of the “open banking system” with the participation of the 18 commercial banks in Korea as Back-end Banks.1 Of those banks, 10 banks also participated on a voluntary basis as Interface Providers,2 with plans to expand such participation in mid-December 2019 to the remaining eight commercial banks3 and all non-bank fintech firms that have applied for such participation and been approved by the KFTC.
1 The 18 banks are: BNK Kyongnam Bank, Busan Bank, Citibank Korea, Daegu Bank, Jeju Bank, Jeonbuk Bank, K Bank, Kakao Bank, KDB, KEB Hana Bank, IBK, KB Kookmin Bank, Kwangju Bank, NH Bank, SC Bank Korea, SH Bank, Shinhan Bank, Woori Bank. 2 The 10 banks are: NH Bank, Shinhan Bank, Woori Bank, KEB Hana Bank, IBK, KB Kookmin Bank, Busan Bank, Jeju Bank, Jeonbuk Bank and BNK Kyongnam Bank. 3 FSC, Press Release, Open Banking Launched in Banking Sector, Oct. 30, 2019.42. In fully implementing the “open banking system,” including formulating its legal foundation, heightened attention should be given to the increased security and operational risks that accompany the greater sharing of data and growing connectivity among diverse market players (banks, fintech companies, infrastructures, and other service providers).18 In particular:
Incompatibilities in the operational processes of Back-end Banks among each other, as well as those that have legacy systems and Interface Providers with state-of-the-art methods, raise heightened operational risk in the “open banking system.”
Moreover, the role of Interface Providers as entryways to the systems of Back-end Banks increases the complexity of the financial system and the risk of loss in terms of managing third-party risk and ensuring operational resilience. Such interdependences could cause an operational failure (e.g., service suspensions) or cyber incident (e.g., a targeted attack on one participant in the system) to impact the activities of multiple financial institutions and potentially the broader financial system.
The increasing number of parties involved in processing financial information (see Box 5),19 the reliance on information sharing under the “open banking system,” and the trend toward simplification of authentication procedures in payment services (see, e.g., ¶9) tend to expand the channels and vulnerabilities that may be exploited.
The preventative security controls and threat detection measures for the “open banking system” managed by the KFTC could be complemented by a legal framework that addresses resiliency and continuity, with coordination among end-to-end participants (i.e., Interface Providers, Back-end Banks, and the KFTC, as well as end-users), in the event of a loss from disruption to operations or breach (e.g., clear requirements and procedures with regard to outage or breach notification, reporting, and information sharing). Legal certainty and clarity in the new open banking market structure with regard to loss allocation (e.g., rules calibrated to incentivize relevant parties to take appropriate action to minimize risk exposure for the system) would further enhance confidence in the system, its participants, and the financial market.
43. In the medium- to long-term, banks may find it increasingly difficult to respond quickly and competitively to the success of large technology companies, with their own sizeable loyal customer base, in the payment services market. Large technology firms can leverage their large existing customer base, brand recognition, and state-of-the-art technology to achieve scale rapidly across different business lines, including in financial services (in the Korean market see ¶¶2, 12, and 33); their significant financial resources and access to capital and funding at lower cost also set them apart from other providers of financial services.20 As noted by the BIS, the key features of big tech’s business models are (D)ata analytics, (N)etwork externalities, and interwoven (A)ctivities: the more users a network attracts, the more data big techs are able to generate, which helps enhance their existing services and, in a virtuous circle, attract further users (in the Korean market, see ¶¶2 and 35).21 In contrast, although commercial banks have large customer bases and offer a one-stop-shop for a range of financial services, to date they have not been as effective as big techs in harnessing the “DNA” feedback loop to offer innovative or customized retail payments services at scale.
44. Concentration risk may increase among Interface Providers if large technology firms gain significant market share, posing risks to financial stability. Incumbent banks in Korea are deepening partnerships with fintech companies to enhance their service offerings and improve the efficiency of their internal systems (see ¶¶10, 15, and 40). At the same time, those banks that are unable to develop successful user interfaces which appeal to customer preferences risk losing the direct customer relationship to Interface Providers, ultimately depending on them to channel financial products to customers.22 The resulting market structure for financial services may see a reversal in hierarchy, with rapid reduction of banks’ bargaining power vis-à-vis large technology companies that provide popular payment services. Bank profitability may also be negatively impacted, including in the following ways:
The loss of banks’ interaction with their customers to Interface Providers can result in loss of customer data and cross-selling opportunities for Back-end Banks, which become commoditized service providers.23 Moreover, the sharing of customer data under the “open banking system” with Interface Providers may further facilitate unbundling, with service providers increasingly offering specialized financial services that have traditionally been offered with other core banking products as an integrated package.
Customers’ improved ability to compare fees and charges may erode Back-end Banks’ income and funding.24 Interface Providers and financial marketplaces like Bank Salad are offering customers platforms to conveniently compare account rates and other banking services terms, drawing their attention to more competitively priced or better-value alternatives. This enhanced transparency encourages more frequent movement of retail deposits and may drive competition between banks, catalyzing deposit transfer activity and aggressive pricing on loan offers and deposit rates. While this can increase market efficiency, it can also affect customer loyalty and increase the volatility of deposits. Higher depositor churn may pressure banks to raise rates to acquire and retain deposits, putting pressure on profitability. As the depositor bases of banks become less stable and more susceptible to outflows, this in turn could lead to higher liquidity risk for banks.25
In Korea, these risks are, by their nature, forward-looking given that the provision of payment services by large technology companies is relatively nascent.
45. The initiatives to encourage intense competition in payment services, introduced in parallel to relax the legal restrictions for electronic financial transactions and the usage of personal data, would be strengthened by a coordinated and gradual approach that prioritizes stability. Together with the “open banking system,” initiatives to loosen Korea’s strict legal frameworks for electronic financial transactions and limitations on the use of personal data would in practice serve, with mutual reinforcement, to facilitate Interface Providers and “big data” business models built on scale (see ¶36). In such a market, growing as large as possible as fast as possible— including, potentially, at the expense of profitability and long-term sustainability—would become a paramount goal, introducing structural flaws. For example, Interface Providers that are first to achieve scale and enjoy network effects (e.g., through low prices and aggressive marketing activities) may crowd out promising new business models and technology applications, ultimately limiting customer choice in payment services.26 This may also result in high exposure among Korean Backend Banks to a concentrated handful of Interface Providers. The authorities’ legal initiatives would benefit from close engagement with the Korean competition authority and regular assessment of stability risks, particularly monitoring the effect of large technology firms’ activities in the provision of financial services on incumbent financial institutions’ ability to generate capital via retained profits.27 The potential for these firms to very rapidly achieve scale in financial services underscores the need for the authorities to stay vigilant of market developments facilitated by the mutually-reinforcing legislative initiatives, and their implications for systemic risk.
Recommendations
46. On this basis, it is recommended that the authorities:
Foster certainty and market confidence in the full implementation of the “open banking system,” including the formulation of its legal foundation, by giving heightened attention to the increased security and operational risks such as those that accompany the increased sharing of data and growing connectivity among diverse market players (see ¶42); and
Take a coordinated and gradual approach that prioritizes stability with regard to introducing the “open banking system” and relaxing the legal restrictions for electronic financial transactions and the usage of personal data, with regular assessment of financial sector impact (see ¶45).
The author of this note is Jess Cheng (IMF), member of the FSAP 2019 team led by Udaibir Das. The analysis has benefitted from discussions with the staff of the BOK, FSC, FSS, the Korea FSAP team, and reviewers at the IMF. The case studies described in this note do not indicate endorsement of the underlying technologies and business models. This note includes case studies for illustrative purposes. Their inclusion should not be construed as an endorsement.
See FSC, Press Release, Bank’s Financial Payment System to Be Open to Fintech Firms, February 25, 2019.
As noted in the Bali Fintech Agenda, different definitions of fintech have been used by international bodies and national authorities. As used in the Agenda, “fintech” describes the advances in technology that have the potential to transform the provision of financial services spurring the development of new business models, applications, processes, and products.
Fitch, Operating Environment of Korea’s Major Banks, 28 May 2019.
FSC, Press Release, Banks’ Financial Payment System to Be Open to Fintech Firms, Feb. 25, 2019.
FSB, BigTech in finance: Market developments and potential financial stability implications, Dec. 2019.
See id.
BCBS, Report on open banking and application programming interfaces, Nov. 2019.
BCBS, Sound practices: implications of fintech developments for banks and bank supervisors, Feb. 2018.
FSB, BigTech in finance: Market developments and potential financial stability implications, Dec. 2019.
FSB, FinTech and market structure in financial services: Market developments and potential financial stability implications, Feb. 2019.
BCBS, Report on open banking and application programming interfaces, Nov. 2019.
BIS, Annual Economic Report, Chapter III. Big tech in finance: opportunities and risks, Jun. 2019.
BCBS, Sound practices: implications of fintech developments for banks and bank supervisors, Feb. 2018.
FSC, FSS, KFTC, FSEC, Full-fledged Implementation of Open Banking, Dec. 18, 2019.
See BCBS, Report on open banking and application programming interfaces, Nov. 2019.
Id.
“Banks and bank supervisors will have to pay greater attention to risks that come with the increased sharing of customer-permission data and growing connectivity between banks and various parties.” Id.
“Assigning liability in the event of financial loss, or in the event of erroneous sharing or loss of sensitive data, is more complex with open banking, as more parties are involved.” Id.
FSB, BigTech in finance: Market developments and potential financial stability implications, Dec. 2019.
BIS, Annual Economic Report, Jun. 2019.
Such an outcome resembles the “distributed bank” scenario (i.e., fragmentation of financial services among specialized fintech firms and incumbent banks) and, in the more extreme instance, “relegated scenario” (i.e., banks become a back-office service provider for front-office customer-facing platforms, with banks providing the necessary licenses and maintaining deposits) described in the BCBS “Sound Practices – Implications of fintech developments for banks and bank supervisors.”
BCBS, Sound practices: implications of fintech developments for banks and bank supervisors, Feb. 2018.
Id.
Id.
“A further overarching consideration is that a small number of BigTech firms may in the future come to dominate, rather than diversify, the provision of certain financial services in some jurisdictions.” FSB, BigTech in finance: Market developments and potential financial stability implications, Dec. 2019.
Id.
