In June 2023, The European Commission unveiled two significant legislative proposals: the third Payment Services Directive (PSD3)^[1] and the Payment Services Regulation (PSR)^[2]. These updates are designed to replace the existing framework under PSD2, which has been in place since 2015. PSD3 and PSR aim to modernise and strengthen the regulatory environment for payment services across the European Union, ensuring that it keeps pace with the rapid advancements in digital finance. These texts introduce crucial changes that will shape the future of innovation, competition, and security in the payment service industry.

By tightening regulatory oversight, enhancing consumer protections, and enabling a more competitive landscape, these proposals will both address current challenges and set the stage for the next wave of Fintech evolution.

Key Changes and Innovations

Merging of E-Money and Payment Services

One of the most significant updates is the merging of the E-Money Directive with the Payment Services Directive^[3]. This integration aims to create a unified regulatory framework for both payment institutions and electronic money institutions, reducing the complexity that previously existed between these two sectors.

While this merger does streamline the regulatory framework, it may not necessarily lower barriers to entry. The requirements for an e-money license are expected to remain the same, if not become more stringent, which could limit the ease with which new players can enter the market. Previously, a Payment Institution (PI) license, and in some countries a Small Payment Institution, license, offered a more accessible entry point for smaller firms to establish themselves. However, the increased regulatory rigor could enhance banks’ confidence in providing transactional banking services to licensed entities, as they benefit from stronger compliance measures.

Strengthened Regulatory Oversight

PSD3 introduces more stringent licensing and authorisation requirements for payment service providers. These include higher capital requirements^[4], mandatory winding-up plans^[5], and a more streamlined authorisation process^[6]. The aim here is to enhance the stability and reliability of payment services across the EU.

While these changes are designed to increase consumer trust and market integrity, they also pose significant challenges for smaller Fintech firms. The increased compliance demands may strain resources, particularly for startups and smaller companies, potentially leading to market consolidation as these firms struggle to meet the new requirements^[7].

Enhanced Open Banking and Open Finance

PSD3 also brings significant enhancements to the Open Banking framework, including clearer guidelines for improved user protection and confidence, and expanded access rights for third-party providers. These changes are intended to remove existing barriers and improve the functionality of open banking across the EU^[8]. The new rules offer an opportunity to deliver more robust and competitive services. Improved standards (dedicated data access interface^[9] for ASPSPs^[10] etc.) and increased access rights will enable Fintechs to integrate more seamlessly with banks, enhancing their ability to innovate and provide better services to consumers. Conversely, firms must also invest in more reliable infrastructure to remain competitive.

Security and Consumer Protection

Strong Customer Authentication (SCA)

Regarding PSR and according to EY^[11], “A significant change in the cybersecurity domain is the expansion of security requirements to encompass payment card schemes, payment gateways, and merchants. The regulation also now covers third parties to whom technical, operational, and communication services have been outsourced. This mandates more parties in the payment chains to implement systems such as Strong Customer Authentication (SCA)^[12] to bolster payment security.” The new rules also introduce other rigorous fraud prevention mechanisms, including enhanced transaction monitoring^[13] and stricter liability rules.

Anti-Fraud Measures

Alongside the strengthened SCA, PSR introduces several new anti-fraud measures aimed at safeguarding consumer transactions. Key among these is the mandatory IBAN-name matching for credit transfers, which helps verify that the payee’s details match the intended recipient^[14]. Additionally, the regulation promotes enhanced data-sharing protocols^[15] among payment service providers to detect and prevent fraudulent activities more effectively.

While these measures may increase operational complexity, they are essential for maintaining a secure and trustworthy service in the eyes of consumers and regulators alike.

Conclusion

Regulations streamlining, better consumer protection, more competitive market… These proposals are set to significantly reshape the landscape of digital payments. For Fintech companies, this evolution presents both challenges and opportunities: while increased market compliance demands may strain resources, especially for small players, the potential for innovation and improved security offers a pathway to greater trust and adoption in the market.

Firms that adapt quickly and invest in strengthening their infrastructure and compliance frameworks will be well-positioned to thrive in this new era. PSD3 and PSR are not just regulatory updates, they bring the foundation for the next waves of innovation and growth in payment services.

Curious to learn more about E-Money services and how they’re shaping the future of finance? Dive into the latest insights on regulatory updates, market trends, and opportunities for innovation!

Notes:

Featured image source : Midjourney

^{[1] Proposal for a Directive of the European Parliament and the Council on payment services and electronic money services in the Internal Market amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/110/EC https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52023PC0366}

^{[2] Proposal for a Regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52023PC0367}

^{[3] See Recital 5 of PSD3: “Even though the issuance of electronic money is regulated under Directive 2009/110/EC of the European Parliament and of the Council,31 the use of electronic money to fund payment transactions is to a very large extent regulated by Directive (EU) 2015/2366. Consequently, the legal framework applicable to electronic money institutions and payment institutions, in particular with regard to the conduct of business rules, is already substantially aligned. (…) It is therefore appropriate that the authorisation and supervision regime applicable to electronic money institutions is further aligned with the regime applicable to payment institutions.}

^{[4] See Recital 25 of PSD3: “To cater for the risks posed by their activities, payment institutions need to hold enough initial capital combined with own funds. Considering the possibility for payment institutions to engage in the wide range of activities covered by this Directive it is appropriate to adjust the level of the initial capital attached to individual services to the nature and the risks attached to these services.”}

^{[5] See the Explanatory Memorandum pf PSD3, p.7, “Licensing and supervision of payment service providers”: “The procedures for application for authorisation and control of shareholding are mostly unchanged from PSD2, with the exception of a new requirement for a winding-up plan to be submitted with an application, but made fully consistent for institutions providing payment services and electronic money services.”}

^{[6] See Recital 18 of PSD3: “To ensure a level playing field and a harmonised process for the granting of an authorisation to undertakings applying for a payment institution license, it is appropriate to impose to competent authorities a time limit of 3 months for the authorisation process to be concluded, after the receipt of all the information required for the decision.”}

^{[7] See articles 5 and 6 of PSD3.}

^{[8] See page 5 of PSD3: “There are four specific objectives of the initiative, corresponding to the identified problems: 1. Strengthen user protection and confidence in payments; 2. Improve the competitiveness of open banking services; 3. Improve enforcement and implementation in Member States; 4. Improve (direct or indirect) access to payment systems and bank accounts for non-bank PSPs.”}

^{[9] See p.5 of PSD3: “requirement for account servicing PSPs (ASPSPs) to put in place a dedicated data access interface; “permissions dashboards” to allow users to manage their granted open banking access permissions;”}

^{[10] Account Servicing Payment Service Providers}

^{[11] Rudrani Djwalapersad (22 Feb 2024) “PSD3 and PSR: regulatory uniformization for enhanced protection” https://www.ey.com/en_nl/cybersecurity/psd3-and-psr-regulatory-uniformization-for-enhanced-protection}

^{[12] See article 85 of the PSR.}

^{[13] See p.10 of the PSR, “Operational and security risks and authentication”: “A new provision is added requiring PSPs to have transaction monitoring mechanisms in place to provide for the application of strong customer authentication and to improve the prevention and detection of fraudulent transactions.”}

^{[14] See p.6 of the PSR: “Improvements to the application of SCA, (…) extension of IBAN verification to all credit transfers.” See Recital 104 of PSR: “‘Unique identifier’ should be understood as referring to ‘IBAN’“}

^{[15] See article 84 of the PSR: “Payment service providers shall alert their customers via all appropriate means and media when new forms of payment fraud emerge…”}

Regulatory changes: from the review of PSD2 to the Open Finance Framework

Open Banking, at least in Europe, is mainly driven by regulation. Therefore, one can only welcome the 2023 wa ve that has already been initiated.
First things first, we would like to underline a significant change in the PSD2 RTS (Regulatory Technical Standards) that is to smoothen the journey of users: the switch from the 90-day Strong Customer Authentication (SCA) to 180 days, that will reduce a frustrating point and therefore boost usage of account information services (AIS). This evolution was advocated by the EBA (European Banking Authority) several months ago: it will come into force by July 25, 2023.

Instant Payments (IP) are to become the new normal in Europe, as expressed several times over the last months by Commissioner McGuinness. IPs will be free and accessible to everyone in Europe, serving the underbanked and improving financial inclusion, but it is also about providing most efficient payment services. Combined with A2A Payments, it represents a huge improvement as more people will be able to pay in various daily life situations online – without the need from additional accounts or cards – and funds will be sent/received directly therefore drastically improving their personal finances visibility. The EC’s legislative proposal also aims at increasing trust in IPs, with an obligation on providers to verify the match between the bank account number (IBAN) and the name of the beneficiary provided by the payer in order to alert the payer of a possible mistake or fraud before the payment is made.

We at LUXHUB, are also anticipating the review of PSD2, due in the months to come, and which will focus on new payment services and on additional requirements in terms of customer protection and transparency. The EBA shared a few months ago a list of elements to be considered in this context, including the possibility of having a common API standard across the EU to be developed by the industry, requiring all ASPSPs to provide a dedicated interface for TPPs’ access, clarification of the scope of information to be shared with TPPs, as well as a clarification of the type of information to be shared from TPPs to ASPSPs. It should also highlight the need to move from Open Banking to Open Finance, with the expansion from access to payment accounts data towards access to other types of financial data.

In this respect, and logically, the European Commission is currently working on the long-awaited Open Finance Framework, which aims at enabling data sharing and third-party access for a wide range of financial sectors and products, in line with data protection and consumer protection rules.

Key Open Finance use-cases

Open Finance can be defined as the extension and natural evolution of Open Banking, going beyond the payment scope, and it therefore has the potential to disrupt most financial services, from investment and wealth management to mortgages and insurances. Here are of the most promising applications/use-cases/trends of Open Banking, soon to become Finance:

• REQUEST TO PAY: This convenient way of communication offers many benefits to all stakeholders involved in a transaction, from merchants (payees) to consumers (payers). These revolve mainly around the ease of implementation for the former and of use for the latter. It also means lower fees than credit cards or e-wallets, fewer payment rejections and therefore fewer reconciliation efforts. Also, RTP gives more flexibility to the consumer, reaching its full potential in some of the following situations: pay-per-use, telesales, etc.
• MORTGAGE: Utilizing the European financial data space to improve the mortgage credit market for consumers by ensuring choices that better fit consumer’s needs and personal circumstances. The growing number and diversity of personal data collected – in accordance with GDPR and subject to PSD2 consumer consent – can have a positive aspect on the mortgage credit market through improvement in products, advice and creditworthiness decisions and improved transparency due to a more effective and less costly data access process.
• VEHICLE INSURANCE: Nowadays, cars generate a whole lot of data which can be used by insurers to offer a range of new products and services, as well as finetuning existing pricing, products and services. Such data is currently collected by vehicle manufacturers, but with the consent of drivers, insurers could offer pay-as-you-drive services, for instance. Nowadays, more and more tailor-made products are already being offered based on driving styles, as well as awarding more favorable tariffs to lower-risk drivers. More generally, in-vehicle data can also help improve road safety and eco-friendly mobility, as well as enable the successful development of connected and even autonomous cars.
• CUSTODY SERVICES: The opening of securities accounts through the use of APIs, notably, would enable the exchange of position and transaction data, including valuations for reconciliation purposes, on a near real-time basis. Moreover, a standardization of custodian data formats will mean less friction as well as reduced operational costs.

Overcoming challenges

Yet, there’s still some education to do and spread these concepts to all stakeholders:

• First and foremost, it concerns citizens and individuals who are using their banking apps on a daily basis. How can they consolidate their financial data and have a better and real-time view of their finances? What about initiating payments from one single app? Moreover, they will be able to save time by reducing some paper-based tasks that are eliminated through digital services (one can notably think on signing a mandate/reconciliation)
• Banks and financial institutions, on how to move from “mandatory” to “value”, or from complying to PSD2 to now taking advantages of additional opportunities, and build new services, partner with innovative players, provide clients with new solutions. In other words, how can they create new revenue streams by offering complementary functionalities and services?
• Merchants and retailers will also realize that they can easily move away from traditional payment and card-based methods, by leveraging cheaper, efficient and instant solutions, while providing payers with secure and flexible means of payments and experiences.

Photo by Super Straho on Unsplash

The State of European Tech (SOET) Report is considered to be “among the most comprehensive data-driven analysis of European technology” by the European Innovation Council. The 2021 edition was launched on December 7 and provides decision-makers with a host of insights into the evolving tech landscape.

Timing-wise, this is an interesting one: the report provides an update on the state of tech and innovation at a moment when the world economy continues to recover from COVID-induced shocks. This year’s edition of the report notably allows us to get a better sense of whether the forced, rapid societal adaptions to a new modus operandi, greatly facilitated by technological solutions, is leading to durable change, or whether we will see a “regression toward the mean”.

Let me state up front that everything points towards the former.

As Chris Grew, Partner at Orrick – one of the report’s sponsors – states:

Now is a watershed moment for the tech and venture ecosystem across Europe and around the world. Europe is attracting record levels of investment and growth, with the innovation economy positioned to take the lead in tackling today’s systemic societal challenges.

[…]

Fintech investment has led the charge, rising by 159%, with total investment of nearly $15B, while planet-positive investments are dominating the fast-growing purpose-driven space.

ESG and sustainable finance are here to stay and we at LHoFT are convinced that fintechs will have an increasingly important role to play in facilitating the data collection, validation and analytics efforts required to build sustainability into the core of everything corporates and financial institutions do.

Luxembourg’s role in a growing European ecosystem

A few things that stand out to us at LHoFT:

• Luxembourg ranks very highly both in terms of startups per capita and in terms of capital invested into startups per capita, cf. below:

• The tendency for top European hubs to capture the lion’s share of funding has increased further, with companies based in London, Berlin, Stockholm, Munich and Paris raising 54% of all capital in the region, up from 49% in 2017. At the same time, concentration in terms of number of deals has decreased, pointing to greater decentralisation of the ecosystem in Europe.

• At the same time, there is growing consensus that the importance of physical proximity is diminishing, which is mirrored across a number of metrics. The ability to hire talent across Europe thanks to remote working arrangements is seen as a mutually beneficial boon both for entrepreneurs and for their expanding work force in terms of quality of life. Luxembourg, as an extremely open economy, should stand to benefit from these developments.
• European startups should benefit from the fact that the continent is home to many industrial leaders, with particular emphasis on IT stacks. This presents ongoing opportunities for startups & tech companies, not least in the financial sector, and Luxembourg should continue to actively support initiatives and platforms that capitalise on this dynamic.

Europe is in a strong position to shape the next wave of disruption in B2B, as Europe is home to many industrial market leaders built on legacy technology ready to be disrupted.

Robert Lacher

Visionaries Club & La Famiglia

• Europe remains disadvantaged versus the U.S. in terms of raising capital, which makes ongoing EU efforts such as the Capital Markets Union all the more pressing. “Almost one-fifth of founders say it has become harder to raise capital in 2021, while a further 40% or so believe the environment remains unchanged from the past year, which itself was a year that saw a record number of founders responding that fundraising had become harder.”

Raising funds in Europe is still a different experience from raising funds in the US. European founders still fly out to the US for fundraising. Sometimes for expertise, sometimes for fair market offers.

Jakub Jurovych

Deepnote | Founder and CEO

A new dawn

The past year and a half have been left no one unaffected, imposing a steep price on societies around the globe. Silver linings include the realisation that more flexible work arrangements and business models are not only possible but in many ways desirable, not least when considering access to capital and talent. This in turn is enabled by far-ranging modernisation of technological infrastructure, presenting opportunities for incumbents and startups alike.

Finally, Luxembourg is presented with a particular opportunity to leverage these macro dynamics by fostering innovation proactively. The 2021 SOET report shows that the Grand Duchy is already punching above its weight in some regards – let’s keep the momentum going.

European banks got it all wrong. In the early days of the FinTech revolution, local banks and financial institutions channelized their energy towards fighting GAFA and Fintechs, mainly PayPal. We even have regulations as a result of this market protection instinct. Focused on the well-known enemies, they haven’t seen the real danger closer to them: consumer brands becoming competitors. Rising above the ecosystem trends slowly but surely, embedded finance is shifting the market balances as we speak.

Embedded Finance: A Look into The Future

Imagine that in the future, you don’t have to run between different bank branches, brokers, or comparison portals for mortgage eligibility; but instead, you can apply for a loan simultaneously as you visit the apartment of your dreams. Picture as your loan is being approved; the bank starts sending you trusted service offers for the broken sink or the Mediterranean tiles you fell in love with when you visited Spain one summer. After you shook hands, the real estate office offered you the possibility to select from different house protection insurances or apply for a credit card through them, giving you cashback points at various service providers and shops and installments to pay the brokerage fee. You were not aware that your local real estate broker had Fintech ambitions, but why not?

As you leave the real estate office, you feel like celebrating this significant milestone and end at the closest supermarket. You select a bottle of champagne and a nice cake from the bakery and leave the store without queuing or dealing with any additional check-out process – all thanks to the payment infrastructure using “Just Walk Out Technology.”

As it started to rain in the afternoon, you decided to drop by the furniture store, selecting a brand-new sofa for your new home. You eyed the latest baby blue model, which would look great in your new apartment. As you were contemplating buying the couch already, the shopkeepers asked whether you would like to apply for an instant loan for your new sofa. Of course, you immediately said yes – no need to use the cash reserves before the extensive renovation project. On your way back home, you stopped by the gas station to top up the tank and paid for the gas via your car’s interface, without the need to leave the vehicle (“in-car fuel payments”).

When you arrive home and realize that you are out of (probably vegan) butter, you will likely order and pay using your smart fridge (“pay-by-fridge”).

Sounds science-fiction-like, doesn’t it? On the contrary, this is the likely future. Embedded finance is already making most of these scenarios possible. We can expect many more of it in the future, saving us time, unnecessary conversations, paperwork, and waiting times. It is also likely to increase service and product sales since end-to-end, seamless processes are more likely to turn into positive shopping decisions, minimizing last-minute hesitations and buyer’s remorse.

Do We Need to Embed Financial Services to Everything?

Embedded finance (or, in other words, “integrated finance”) is the financial services incorporated into non-financial offerings.

Do we need to embed financial services into everything? The answer is not a straight yes since financial services are already embedded into every service and product stream. Maybe not as smoothly as consumers like or need them to be, but every service or product (even donating money) turns into a payment process after a certain point. Check-out processes are the “happy endings” of online and offline shopping stories. Embedded finance doesn’t change the fact that payments are the last step for purchasing; it merely makes the process frictionless, less complex, and more contextual. Embedded finance takes the check-out process a step further by connecting it to new potential offers and services. On the one hand, it triggers the urge to spend more, but on the other, it saves time, energy, improving customer experience.

According to CB Insights Q2 2020 Report, the trend towards embedded finance is gaining traction globally, even more since the pandemic. Embedded finance is an improved way of customer journey due to the end-to-end nature of the shopping experience. It increases shopping speed and retention, decreases costs for both the merchant/service provider and the consumer, enables cross-selling opportunities. Most important of all, embedded finance ensures customer loyalty. Hence the increasing interest in entering financial services across the globe. To achieve all this, some brands prefer to collaborate with Banking-as-a-Service (“BaaS”) and E-money (“EMI”) providers like Railsbank, solarisBank, PPS, Fidor, embank, ensuring quick and stress-free market entry. In contrast, some brands create or acquire their own financial brands so that the customer is entirely theirs and the brand trust is re-established.

Noteworthy examples of conventional and non-conventional “embedded finance” services include:

• Amazon’s pay and go supermarket concept called “Amazon Go,” allowing customers to shop check-out free (US, UK),
• Jaguar and Shell’s cooperation for world’s first in-car fuel payments, followed by Mercedes (“Fuel & Pay”), or locally in Benelux region: CarPay-Diem
• Uber allowing splitting payment costs using Venmo (US),
• Paying for Starbucks using the Starbucks app (US),
• Retailers such as Zara and H&M offering POS finance via Klarna (H&M even investing 20M in Klarna),
• Amazon offering marketplace merchant financing via Goldman Sachs (US) and ING Germany (Germany),
• Amazon providing commercial car insurance and investment products (India),
• Facebook developing a blockchain-based payment system, which could be implemented as a cryptocurrency, alarming regulators all around the world,
• IKEA taking 49% stake in banking partner IKANO Bank with the intention of offering further consumer financial services,
• Delivery services such as Uber Eats (US) cooperating with Venmo, Delivery Hero (Germany) growing its Fintech team, and Gorillas (Germany) planning to issue credit cards,
• Walmart announcing the creation of a new fintech startup designed to develop and offer modern, innovative, and affordable financial solutions together with Ribbit Capital,
• Google enabling digital-first bank accounts directly in the Google Pay app in cooperation with eight local banks (US),
• booking.com announcing the creation of a new internal FinTech business unit to facilitate seamless access to the company’s global travel marketplace for both customers and partners.

Embedded finance is likely to transform the service cycle across industries. Lightyear Capital’s research reveals that the embedded finance market will demonstrate staggering growth over the next couple of years and will generate $230 billion in revenue by 2025, which only means that we can expect even more exciting developments soon.

Gazing Into the Crystal Ball: How Will Financial Services Look in the Future?

The concept of embedded finance isn’t new, but recent examples indicate the direction we are heading; earlier or later, all established brands will start offering financial services to get a piece of the cake. So where would this movement leave banks, then?

In the past years, modest interest rates, consumer-friendly banking trends, and strict regulations narrowed the margins and, therefore, playroom for traditional financial players, especially in Europe. COVID-19 was the last nail in the coffin, calling for immediate business model restructuring and strategy changes. The embedded finance trend growing in parallel proves that there will be an ecosystem consolidation, and precisely like Bill Gates predicted, “we need banking, but we don’t need banks anymore.” According to the World Retail Banking Report 2021 (WRBR) published in Q1 by Capgemini and Efma, banks fall short of meeting customers’ expectations, making the competition even more fierce. Moreover, as brands become Fintechs and take over the consumer trust entirely, banks are likely to evolve into backend providers, leaving customer relations to non-bank service providers. backend providers, leaving customer relations to non-bank service providers.

End-to-end service provider examples dominant in the financial industry, such as Alipay, Gojek, Rappi, demonstrate that the customers are willing to use fewer channels to receive more extensive, trustworthy services. All-in-one service providers or the so-called super apps are the likely winners of the market; however, banks can quickly catch up if they adapt to the “holistic service provider” approach, changing their course. Using the financial data, banks can identify new opportunities and increase the life qualities of their customers, offering them a range of services that goes beyond the electric bill and rent payments, term deposits, and mortgage installments. Forward-looking banks and financial service providers already leaped to enter the non-financial sphere, offering lifestyle banking options. South Korean banks are planning to add food delivery services to their banking apps. Standard Chartered’s innovation and ventures unit has partnered up in Singapore to launch a “wealth, health and lifestyle” consumer platform called “Autumn.” Banking is more than just incoming and ongoing funds, and these lifestyle platforms are here to prove that holistic banking.

“By combining digital wealth technology with health, lifestyle and financial wellness, we’ll help users adopt healthier habits and create a retirement that is personalised for them.”– Mike Kruger, CEO, Autumn

At this point, blending Fintech in the value proposition is not a <nice to have>, is a <must>.

Experts predict that every company will become a Fintech company in the future. As omnichannel, customer-centric super apps increase their power, it will become harder for niche platforms to succeed. To keep up, banks should switch from “passive” to “active,” looking for novel ways to improve customers’ life qualities. They should utilize the existing data, open banking, and BaaS cooperations to create 360-degree experiences. Banking is not limited to the activities listed in the banking license regulations anymore. The market players that can foster the most relevant financial and non-financial services and become “an integral part of” consumers’ lives can expect to stay in the game.

• Electronic signatures represent a natural evolution of the way individuals and institutions enter into written agreements.
• Near-universal adoption of computers and mobile devices, combined with shifting customer preferences and the reality of cross-border business, make the adoption of eSignatures and associated services, such as remote onboarding, inevitable in the context of a competitive market.
• The EU-level legal framework under eIDAS, international standardisation of technical aspects and the availability of regulated service providers means that there are few, if any, real obstacles to a transition towards electronic signing and electronic archiving in the financial sector.
• A 2015 Luxembourg law on electronic archiving, in conjunction with eIDAS, presents an additional opportunity for Luxembourg businesses to gain a competitive edge.
• The fulsome implementation of eSignatures, associated trust services and electronic archiving opens the door for additional efficiency gains in areas such as IAM, KYC/AML and reporting. Portable/reusable eID would allow for the elimination of redundancies and for more seamless cross-border business in the EU internal market.
• We provider readers with a curated list of qualified trust service providers across the EU, classified with regard to their capabilities.

Introduction of the eSignature white paper

Signatures and personal identities have been intertwined for nearly as long as people have been entering into written contracts. At a high level, signatures can be thought of as an abstraction of the signing entity’s authority to enter into an agreement. Signatures need to be relied upon not only by the contracting parties, but also by third parties, typically public or private institutions, for verification, fraud prevention and dispute resolution purposes.

The indelible link between signature and identity is evident in the  Luxembourg Civil Code, which states (translated from French):

Art. 1322-1.

The signature necessary for the conclusion of a private deed identifies the person who affixes it and manifests their adherence to the content of the deed.

It can be handwritten or electronic.

The electronic signature consists of a set of data, inextricably linked to the act, which guarantees its integrity and meets the conditions set out in the first paragraph of this article.

In the West, we know signatures first and foremost as more-or-less idiosyncratic permutations of an individual’s name, typically delivered with a few swift strokes of the pen – the handwritten signature. Thus, we rely in most situations solely on the idiosyncrasy of the strokes, without paying any particular heed to the writing utensil used, or other attributes that could be linked to the signature or the signing party. The relatively bare-bones nature of the written signature in the West helps explain the persisting influence of the notarial profession, providing an additional layer of assurance for the most critical of transactions.
In the Far East, seals remain commonplace – stamps made specifically for an individual or a legal entity, often registered with the government for the issuance of a certificate of authenticity.

As one author explains, “when handwritten signatures were invented, they augmented seals, which had been in use for over 3,000 years – they did not replace them. In fact, seals continue to be used today. Instead, handwritten signatures took their place beside seals as an authentication mechanism useful for particular purposes, and over time, handwritten signatures gradually increased in the frequency and scope of their usage. It is likely to be much the same with digital signatures, which are the latest authentication tool in the continuing advancement of communications technology.”

With electronic devices and services now being ubiquitous across our lives, the way our identities and signatures are defined and handled is shifting, and our reliance on ink and paper need no longer be absolute.

At LHoFT, we are of the view that actors in the financial sector are presented with a significant opportunity to leverage trust services for in order to drive digitalisation and automation at large within their organisation. The fulsome implementation of electronic signature (eSig) solutions and their potential integration with electronic identity (eID) has the potential to enshrine lasting gains in efficiency and transparency all the while leading to an improved customer experience.

The present white paper ambitions to be thought-provoking as well as pragmatic. It presents readers with a discussion of

• The critical attributes of modern trust services,
• Their regulatory backbone in the EU
• An overview of relevant solutions providers.

This document seeks to help decision makers in financial services consider their strategy to upgrade and modernise their processes in order to meet evolving client needs and drive their satisfaction while lowering costs and improving overall efficiency. 

Comparing handwritten and digital signatures

While much has changed on the technological front since the publication of this 1997 paper on MIT’s CSAIL website, it provides to this day one of the best publicly available discussions around the history of signatures and relevant points of comparison between analog and digital signatures. We have drawn up our own comparative table as follows below.

[table id=2 /]

Some of the above terms merit additional discussion.

The term level of assurance or LOA rests on the ability of parties to a transaction or process to effectively measure the extent to which data, a process or other relevant subject matter align with suitable criteria. These criteria are typically defined by the law or by standards. Providing assurance is a critical exercise in order to reduce risk and increase confidence in any given dataset or process. It goes without saying that signatures represent a critical element of any written agreement and hence, we should be able to ascertain their LOA. Ironically, the LOA of handwritten signatures is difficult to ascertain due to a number of factors: signatures are defined by their user and may not be sufficiently complex and unique to establish a strong link with the (presumed) signatory. Furthermore, there are many ways to replicate a given individual’s handwritten signature, which brings us to our next point.

Part of the fundamental value proposition of (advanced) digital signatures is their ability to significantly strengthen fraud prevention. Forgery of handwritten signatures has been practiced for centuries, whereas forgery of digital signatures, except where the private signature key has been compromised, or the signature mechanism hijacked, is virtually impossible. The mechanisms of forgery for handwritten and digital signatures are fundamentally different, and as opposed to handwritten signatures, there is a coordinated regulatory & technological effort (cf.: systematic verification in our table) to provide for real-time supervision of eSignatures and their associated trust services under the EU framework.

Finally, storing, archiving and handling business-critical documents of all sorts is an exercise which can be greatly facilitated with a fully digital or hybrid model. Electronic signatures open the door to more efficient data access and transfer in parallel to more cost-efficient and flexible electronic archiving.

Understanding electronic trust services

The term “trust services” is rooted in a recent milestone regulation at EU level. To fully understand & appreciate the value of trust services such as electronic signatures, however, one must also consider their technological attributes and their integration with existing infrastructure and business processes. Let’s dive into the legal framework at EU level before considering eSignature in more detail.

eIDAS

The contemporary notion of a “trust service provider” has roots that reach back to the Electronic Signatures Directive 1999/93/EC, where they were called certification-service providers. The Directive can be considered the legal and intellectual precursor to the eIDAS regulation, which entered into force in late 2018. eIDAS provides an EU-wide, mandatory framework for the following trust services:

• Electronic signature (eSignature): the expression in an electronic format of a person’s agreement to the content of a document or set of data. Qualified eSignatures have the same legal effect as hand written signatures.
• Electronic seal (eSeal): an electronic equivalent of a stamp that is applied on a document to guarantee its origin and integrity.
• Electronic Timestamp (eTimestamp): proves that a document existed at a point-in-time.
• Electronic Registered Delivery Service (eDelivery): a service that permits the electronic transfer of data between businesses, public administrations and citizens. It provides proof of sending and receiving the data and protects against the risk of loss, theft, damage or unauthorised alterations.
• Website Authentication Certificates (WACs): electronic certificates that are issued to prove to users (e.g. citizens and SMEs) that a natural or legal person owns a website, helping avoid data phishing.

The eIDAS Regulation defines three types of eSignature:

• At its most basic, the term Electronic signature covers the broad category of all electronic signatures including “any data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign.” In other words, it is an electronic form of signature that a signer can apply to a document as evidence of their acceptance or approval. This could include a scanned signature image or the click of an “I accept” button on a website or a DocuSign electronic signature.
• An advanced electronic signature is a type of electronic signature that must meet specific requirements providing a higher level of signer ID verification, security, and tamper-sealing. The Regulation requires that it is:
  • Uniquely linked to the signer
  • Capable of identifying the signer
  • Created using signature creation data that the signer can use under their sole control
  • Linked to the signed data in such a way that any subsequent change in the data is detectable
• Finally, a qualified electronic signature is the only electronic signature type to have special legal status in EU member states, being the legal equivalent of a written signature. It is a specific type of electronic signature that must meet advanced electronic signature requirements and be backed by a qualified certificate, meaning a certificate issued by a trust service provider that is on the EU Trusted List (ETL) and certified by an EU member state. The trust service provider must verify the identity of the signer and vouch for the authenticity of the resulting signature.

The above categorisation of electronic signatures represents a key provision in eIDAS, as it creates legal and technical clarity, overriding any prior divergences across the EU’s Member States with regard to their treatment / recognition of eSignatures. Unsurprisingly, a digital signature’s validity & legal recognition in a given jurisdiction – or cross-border – are foremost concerns for businesses considering a meaningful transition away from ink on paper. Thus, eIDAS provides businesses operating in the EU with the certainty that electronic signatures which meet certain criteria will benefit from recognition as legally valid across the EU. While qualified electronic signatures provide the highest level of assurance & legal certainty, other forms of eSignature cannot simply be denied legal effect either, cf. Article 25 of eIDAS:

An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is an electronic form or that it does not meet the requirements for qualified electronic signature.

However, for practical purposes, our discussion will focus on qualified electronic signatures and associated trust services as their legal & technical attributes make them most suitable for cross-border applications, integration into digitized and automated business processes and adoption by the highly regulated financial sector.

eIDAS and the market

In a 2018 report, EU agency ENISA provides us with valuable insights into the perception of trust services, and their implementation, by market participants. The study found that key factors influencing the development of the trust services market “revolve around the market’s ability to adapt to customer needs and its ability to build suitable business models”. Some key insights are reproduced below:

It is clear that eSignature, especially in its qualified flavor per eIDAS, is the most sought-after trust service by market participants. Unsurprisingly, (qualified) electronic time stamps are also in high demand as they are a natural complement to eSignatures.

• Used in conjunction with eSignatures, eTimestamps provide assurance of the authenticity of a document and its versions, if any, across time.

In addition to the EU-level insights provided by ENISA, global research efforts help complete the picture when it comes to future demand for trust services.

For instance, in its Analytics Business Technographics® Priorities And Journey Survey, 2020, Forrester Research queried nearly 20,000 global purchase influencers and concluded that “40% of [respondents] say that improving the experience of their customers is a high or critical priority over the next year. Another 27% state that investing in digital experience technologies is likewise a high or critical priority technology initiative for the coming year”, with trust service providers playing a key role in achieving these business goals.

With regard to the financial sector in particular, “strong governance and auditable compliance logs result from processes and transactions that are brokered through digital signature and trust services platforms. Clients use these sophisticated onboarding platforms to grant digital identities to their customers or to verify existing ones, depending on the use case. Firms in regulated verticals can also rely on these solutions to perform identity checks according to know your customer (KYC) requirements or comply with strong authentication requirements such as those in the European Payment Services Directive 2.”

An additional piece of research conducted by Forrester, the Forrester State of Systems Agreement Research 2020, sheds further light on the need for enhanced digital processes, especially when it comes to agreement processes (concluding contracts, executing orders, ordering products and services…). Key takeaways are:

• 9 out of 10 firms are burdened by manual agreement processes
• Digital signatures are a common first step towards full process automation
• 79% of respondents view the improvement of customer experience as a high or critical priority, with digitalisation and process automation as a way to achieve this priority

Additional Forrester research commissioned by Docusign yields additional insights with regard to the financial sector in particular. Notable findings relating to manual processes include:

●      47% say work is duplicated when re-entering date from agreements into systems of record

●      63% of respondents say errors occur when manually transferring data such as customer or product data into agreements manually

●      45% of respondents say customer experience has suffered as a result of manual processes

●      35% say they see delays in starting projects because of manual processes

●      39% see delays in recognising revenue and 23% experience lost revenue

All in all, the market rationale for eSig and its complementary trust services rests on multiple applications, from improving customer experience in terms of onboarding and services rendered, over integration with overall process automation cross-industry, to heightened KYC/AML compliance in the context of existing and emerging financial sector regulation.

Use case: Banco Santander

In the below presentation delivered at the EFPE 2020 conference, Banco Santander highlight an eSig use case. A fully digital & remote loan signing system was set up in collaboration with Asseco Data Systems – a qualified trust service provider included in our curated list at the end of this report – leading to faster contract processing and increased client satisfaction:

[pdf-embedder url=”https://lhoft.com/lhoftv1/wp-content/uploads/2021/05/EFPE_2020_Blok_2_2_M.Scibor_M.Zajac_SCB.pdf”]

Finally, the impact of eIDAS on the market is also a result of its interaction with other regulations, notably PSD2 and the EU’s AML directives. With PSD2 for instance, Qualified Website Authentication Certificates (QWAC) and QSeals are specifically prescribed for authentication purposes, and EBA guidance recommends using both trust services in parallel. When it comes to the EU’s 5th AML directive, eIDAS qualified trust services are emerging as valuable tools for financial service providers as they seek to enhance their remote customer onboarding & online banking activities.

The future of eIDAS

There is little doubt that eIDAS is here to stay, but as with any ambitious piece of EU legislation, revisions are due over time. The European Commission is about to adopt a proposal for a revised version of the regulation in the near-term.

Until then, we can glance a few areas of priority by going over the 2020 Position Paper of the Forum of European Supervisory Authorities for Trust Service Providers (FESA). FESA presents “seven suggestions of maximum importance unanimously supported by its members”, namely:

With regard to the first point, FESA postulates that there exist substantial differences “both in audit effort and quality” with regard to CAB certification schemes, which leads to a risk of a race to the bottom. Ensuring harmonisation on the EU level is viewed as “essential for building actual trust in trust services and for mutual recognition of trust services”.

The level playing field issue is also evident with regard to point 2, seeing how remote identification practices in the financial sector for instance are still governed by national law.

Remote signing (point 3) is a technically fascinating topic which overlaps with the question of cloud-based solutions (cf. Cloud Signature Consortium). Public key infrastructure specialists such as Ascertia are key proponents of this approach to eSig, but as FESA explains, “stakeholders have different views on remote signing/sealing” and calls for “greater clarity on the requirements for remote signing systems”.

Point 4 concerns itself with global requirements for qualified trust services and calls for the mandatory adoption of secondary legislation to enshrine a suite of ETSI standards that are already on the books.

Point 5 postulates that the current, indefinite, assurance of conformity delivered for QSCDs should be abolished in favour predefined validity periods & vulnerability assessments.

The final two points are self-explanatory.

In a nutshell: in all likelihood, eIDAS in its revised form will clarify a number of technical requirements for qualified trust service providers, strengthen evaluation of signing servers & devices and – potentially – harmonise remote onboarding rules across the EU, which would greatly contribute to the harmonisation of the EU internal market.

The technicals: a deep dive into eSignature

To truly understand what an eSignature is, we need to consider some underlying technical considerations in areas such as cryptography and standardization.

It is useful to first consider the primary goals of any signature, whether analog or digital:

• Integrity: providing assurance that a document hasn’t been changed somewhere in the workflow (e.g. post-signature).
• Authenticity: providing assurance that the signer of a document is a specific person or legal entity.
• Non-repudiation: providing assurance that the signer can’t deny his/her signature.

The 2nd and 3rd goals are best ensured when qualified eSignature is employed, which helps explain why qualified eSignature enjoys such a special legal status under eIDAS.

To achieve the above attributes, eSignature employs techniques rooted in cryptography and computer science, notably asymmetric key pairs and hashing. 

Encryption and hashing

Cryptography – the use of codes and ciphers to protect secrets – permeates anything meaningful you might be doing with an electronic device such as your computer or smartphone. While the term “crypto” has been co-oped by the cryptocurrency boom, it is important to understand that cryptography has been an important element of computing since the beginning, and in fact, has roots that reach back thousands of years prior to the advent of modern technology.

In the context of eSignatures, encryption plays multiple roles, as is best illustrated by its integration into .pdf files.

Portable Document Format (PDF) files are by far the most popular way to share important documents in electronic form. Commonly associated with its inventor Adobe Systems, the PDF format became an open standard governed by ISO 32000 in 2008, dramatically increasing the format’s appeal to developers and consumers alike. To end users, PDF files might be best known for their visual attributes which typically mirror printed documents in the A4 format. PDFs’ many advantages over other file formats include their ability to combine machine-readable text with rich graphic designs, and most importantly for the present discussion, the ability to integrate seamlessly with electronic trust services such as eSignatures.

Cryptography in PDFs is employed in 2 notable ways which help illustrate the underlying principles of eSignatures.

1. First and perhaps most familiar to readers is password encryption of the document itself. This can be used both for content management and access management purposes. PDF password encryption typically rests upon the Advanced Encryption Standard (AES), which relies on a symmetric key encryption method (block cipher).
2. Asymmetric key encryption methods, such as RSA, on the other hand are the foundation for secure electronic communications as we know them today and they also provide the basis for electronic signatures. In a nutshell: whereas for message encryption purposes the public key would be used to encrypt the message and the private key would be used to decrypt it, for eSignature purposes, the signature is created with input from the user’s private key and can subsequently be verified by anyone through use of the corresponding public key.

Elegant as this “inverted” application for cryptographic principles may be, it is not the only factor at play in the eSignature process.
The computer science (CS) hashing allows one to “map data of arbitrary size to fixed-size values”. Hashing is used to perform integrity checks on documents containing eSignatures.

Taken together, cryptography and hashing lay the technical foundation for the signing & verification processes of eSignatures, as explained by David Fillingham:

• The signer generates (or is provided) a “private signature key,” and an associated “public signature key.” It is computationally infeasible to determine the private signature key from knowledge of the public signature key, so the public key can be widely and freely disseminated.
• The signer generates a “digest” of the message to be signed. A “message digest” is the product of a “hash function,” that maps a message of arbitrarily large size to a specific, small size. For example, message of 25,000 bytes might be “hashed” to create a message digest of 128 bits (16 bytes). A good hashing algorithm will have the following properties:
  • A modification of any bit in the message will result in a deterministic modification of the message digest;
  • Given a specific message digest value, it should be computationally infeasible to generate a message that will hash to that message digest value.
• The signer provides the message digest and a “private signature key” as inputs to the signature algorithm. The output is a “signature value” which is normally appended to the signed data.

• The verifier, having obtained the signed message, uses the same hash function as the originator to generate a message digest over the received message. If the message has not been changed since the signer applied the signature, the signer’s and the verifier’s hash calculation will result in the same message digest.

• The verifier obtains and authenticates the signer’s public signature key, and provides the message digest, signature value, and signer’s public signature key to the signature algorithm, which will indicate whether the signature is valid or not. If the signature is valid, then the verifier has an indication that the originator signed the message, and that the message was unchanged during the time between when the message was signed, and when it was verified.

Certificate authorities

Certificate authorities (CAs), which constitute trust service providers under the eIDAS definition, play another crucial role in the eSignature ecosystem.
While anyone can self-create an electronic signature as laid out above, this carries little meaning without reference to a person’s real-world identity as verified by a reliable third party. This is where certificate authorities intervene, providing trusted 3rd party verification of an end user’s (digital) identity.

The concept of a “certification scheme” is defined in ISO/IEC 17065:2012 as a “certification system related to specified products, to which the same specified requirements specific rules and procedures apply”. Certification systems in term are defined as conformity assessment systems per ISO/IEC 17000:2004 definition 2.7.

In simple terms, the main elements of certification schemes relate to:

• A set of requirements
• Ways to check against those requirements.

To better understand the concept of certificate authorities in the specific context of eIDAS, let’s break the terms down one by one:

• Certificate: the user’s public key combined with additional information, e.g. to identify the user, which is then enciphered with the certificate authority’s private key to render it unforgeable
• Certificate authority: an authority trusted by one or more users to create and assign certificates for use with their electronic signatures.

By linking a given user’s public key to additional, unique attributes and by encrypting the resulting combination with the CA’s private key, CAs provide a crucial step in establishing trust in digital signatures.

Qualified signature creation devices (QSCD)

QSCDs are Secure Signature Creation Devices (SSCDs) which comply with the requirements laid out by Annex II of eIDAS.

QSCDs are both hardware- and software-based, and eIDAS enables both local and remote (=server) signing.

• Local signing uses cryptographic keys stored on the user’s device to create a signature.
  • The hardware component can be comprised of e.g. a token, a cardreader or a USB-stick.
• Server signing relies on a trust service provider (TSP) to remotely generate and manage the signing keys on the signatory’s behalf.
  • For remote signing to be compliant with QSCD requirements it must combine a Signature Activation Module (SAM) with a Hardware Security Module. Both modules undergo certification.
  • In theory, remote signing requires no specific hardware or software to be available to the end user, even for the purposes of qualified trust services such as qualified eSig. However, as we described in the preceding chapter on the future of eIDAS, European Supervisory Authorities believe that clarifications are necessary to ensure eIDAS compliance of qualified remote signing systems.

Luxembourg’s homegrown trust service provider Luxtrust in 2020 migrated all of its remote signing services to the highest LOA, i.e. qualified eSig under eIDAS, in collaboration with Cryptomathic. As the latter explain, the integration of the Cryptomathic remote signing server (SignerTM) with the Luxtrust infrastructure “removes the requirement for residents to use connected smart cards and readers – thereby providing full mobility for all users”.

The result are pragmatic solutions such as the Luxtrust App, which combines remote signing with multifactorial authentification to allow for qualified eSig.

App-based solutions have additional advantages over token- or smartcard-reliant services. Apps can leverage smartphone-inherent features such as a camera for QR code reading & biometrics features such as fingerprint readers or Apple’s FaceID.

Integration of eSignature into enterprise workflows

Equipped with the knowledge that eIDAS ensures legal equivalence between qualified eSignatures & ink on paper, encouraged by the technical underpinnings of the eSignature process and motivated by the undeniable gains in efficiency, transparency, fraud prevention & detection and regulatory compliance that eSignatures offer, the next step for your business is to consider practical implementation of eSignature into existing workflows & processes.

While integration with existing processes is a case-by-case exercise, there are a few obvious and overarching applications that flow from the implementation of eSig and contingent trust services. Here we discuss 2 such opportunities.

Electronic archiving

An obvious but crucial consideration is that of electronic archiving: no paper trail means a partial or full shift to electronic archiving.

The rationale for such a shift is obvious: by some measures, electronic records management clocks in at only 1/5th the cost of physical records management – cf. this discussion paper by our partner Deloitte.

Not only does digital archiving offer significant cost advantages, it also enables features such as redundancy and the seamless integration into automation processes & big data analytics.

A subtle but important distinction is that under eIDAS, the preservation of electronic signatures and seals is defined as a trust service (PresS), whereas digital document archiving is not.

In order to ensure the legal validity of electronic signatures and electronic seals over long periods of time one needs to apply appropriate preservation techniques as outlined in ETSI SR 019 510.

The preservation techniques realised by a Preservation Service (PresS) according to Article 34 may involve Evidence Records according to RFC 4998 or RFC 6283 or the continuous augmentation of signatures using archive time stamps according to CAdES or XAdES for example.

• blog.eid.as

However, under Recital 25 of eIDAS, Member States may indeed define electronic archiving as a trust service at the national level, and this is precisely what the Grand Duchy has done.

The Luxembourg edge

Given the mandatory cross-border recognition of (qualified) eSignatures under eIDAS & the logical implication that the transition towards digital-first document signature workflows entails heightened electronic record keeping requirements, Luxembourg in 2015 passed a law relating to the latter.

As discussed here, the Law and accompanying regulation establish a presumption of probative value equivalent to original documents for digitised copies that are made by a duly certified and registered digitisation or storage service provider. The national competent authority in Luxembourg is ILNAS, which attributes the corresponding PSDC statute and keeps an updated list of accredited providers.

Accredited entities may provide only archiving functions or both digitalisation & archiving functions.

The combination of cross-border recognition of eSignatures via eIDAS & the availability of electronic archiving providers regulated as national trust service providers means, in practice, that MNCs or even SMEs with a cross-EU client base gain the ability to conduct all of their document signing operations in the EU digitally, fully integrated with regulated electronic archiving in Luxembourg benefiting from the same probative value as paper copies. Furthermore, insofar as the corporate entity is headquartered in Luxembourg, all of its cross-border contracts would benefit from Luxembourg contract law.

Integration with eID

Another obvious “next step” is the integration of eSig and other trust services with national eID schemes & other attributes of an end user’s electronic ID.

For the purpose of simplification, we will focus our discussion on a pragmatic concept, namely that of eID as “means for people to prove electronically that they are who they say they are“, as defined here.

This needs to be distinguished from eID schemes as defined via eIDAS. These schemes are primarily designed with cross-border acceptance for travel purposes, which brings into play ICAO rules on biometrics and machine readability.

Where eIDAS provides an overarching backbone for interoperability of trust services, Regulation (EU) 2019/1157 provides for technical convergence between Member State identity cards, at a minimum compliant with ICAO Doc 9303.

Thus, the concept of a person’s electronic identity is not necessarily contingent upon national eID schemes as regulated under eIDAS. As the EU Commission explains, “an electronic identity does not necessarily imply the use of a physical item such as a smart card or a USB token”.

Notwithstanding, national eID schemes today form part and parcel of modern eID infrastructure. For instance, via appropriate card readers and software interfaces, national digital ID cards also enable eSignature execution. As noted in the PwC/European commission report on eID and digital onboarding, “there can be a technical overlap between electronic identification and electronic signatures and trust services [such as] where Member States combine an eID token with a Signature Creation Device, where the two functions might even share the same PIN”.

As of now, 17 EU Member States have notified or pre-notified eID schemes, up from 15 roughly a year ago. In practice this means that more than half of the EU’s citizens have access to eID schemes that enable them to use public sector, and increasingly private sector, services which benefit from a high level of assurance (LoA) and mutual recognition across the EU.  A complete list of these schemes can be consulted on a Commission website. Notified schemes often come in the form of national eID cards which automatically carry a high level of assurance (LoA), but they can also represent a suite of compatible solutions with varying LoA, issued by various providers, compliant under a national scheme such as the Italian SPID. Indeed, several Member States have notified or pre-notified more than one eID scheme.

A highly attractive attribute of eIDs is their potential portability and reusability within a clearly defined legal framework such as eIDAS. This allows for a paradigm shift away from verification on a case-by-case basis each time a customer signs up with a new service provider. In the new trust service enabled framework, customer identities rest on high LOA trust services and/or national eIDs compliant with eIDAS, resulting in a mutually recognised, legally binding and cost-efficient reusable digital identity.

An expert-level working group coordinated by the European Commission has published an extensive report on the topic of eID and digital onboarding in the banking sector. To be extremely concise, the report’s conclusions centre around the need for additional harmonisation and collaboration between the private & public sector, as well as between different types of stakeholders in the private sector. With regard to this crucial point, the expert group stipulates:

As eID solutions have been created by different public and private sector entities, it is of vital importance that they are interoperable, meaning that eIDs issued by one system can be recognized by another system, and reusable across different geographies.

All things considered, while additional technical, regulatory and commercial developments are needed to fully reap the benefits of eID integration with other trust services under eIDAS & existing enterprise processes in finance, the groundwork has been laid and experimentation – together with the Fintech ecosystem – is explicitly called for.

Identity and access management (IAM)

IAM in enterprise IT is about defining and managing the roles and access privileges of individual network entities (users and devices) to a variety of cloud and on-premises applications (source).

Thus, IAM is a crucial IT discipline for organisations of meaningful size, and one that is practically calling for the integration with trust services. Classically, IAM would have been based off username / password combinations attributed by the organisation, but with advanced electronic trust services becoming increasingly prevalent, one can envision integration between IAM and such solutions.

Example: the Luxembourgish eID & e-signature ecosystem enabled by LuxTrust. LuxTrust devices & certificates are used by individuals both for authentication & eSignature purposes in their capacity as customers, most pertinently in the local financial sector, and as private citizens seeking access to the comprehensive online administrative services offered by the Luxembourgish government through the portal guichet.lu.

Thus, LuxTrust acts as a central authority providing both the private and public sector with advanced IAM solutions. Recently, the utility of such services has been further highlighted by the socio-economic imperatives of the COVID-19 pandemic: an online teleconsultation platform was launched by the government to de-risk & speed up medical visits, all the while a shared electronic health record finally saw the light of day. Both of these services tie into the concepts of eID and eSignature for the purpose of highly secured & reliable IAM.

[discussion box] IAM in the cloud:

Curated list of trust service providers

The below table represents a curated list of qualified trust service providers with a focus on 4 essential services for the financial sector:

• Qualified eSig
• Qualified eSeal
• Qualified eTimestamp
• Qualified Website Authenticity Certificates

We sourced eligible providers from the EU Trusted List Browser and applied a deliberate curation effort aimed at pre-selecting providers that are commercial entities (as opposed to government institutions) and which appear able to provide the required services cross-EU (e.g.: english language website and documentation available).

Furthermore, we provide additional attributes & annotation for each provider. Notably, we provide the ability to highlight providers which can be considered trust platform and/or transformation platform providers.

We define digital trust platform providers as companies which integrate eIDAS qualified trust services with the issuing of digital identities to end users, assuming full liability. They typically share attributes with digital transformation platform (cf. below) but with an emphasis on governance and compliance. Integration with enterprise solutions via APIs and workflow automation is typically provided.

We define digital transformation platform providers as those which seek to balance customer experience with enterprise requirements. These offerings are typically very flexible and able to integrate with more specialised trust service providers and 3rd party eIDs.

Readers should feel free to use the header of the below table to sort vendors according to the above attributes and to dig further by visiting their corresponding websites (also included in the table).

[table id=3 /]

Annex: Consortia and projects advancing eSignature state-of-the-art

Cloud Signature Consortium

The Cloud Signature Consortium (CSC) is an international non-profit association with a broad industry and academic membership base. The Consortium aims to promote cloud-based digital trust services through the design of common architecture and building blocks to facilitate trust service interoperability. Notably, CSC providers integrate with the Adobe ecosystem, thus addressing a large unmet need: the ability to sign off on contracts and other documents in .pdf form, via different service providers and through cloud-based infrastructure.

What makes the CSC’s approach so appealing is its collaborative and open approach with a goal of facilitating integration of the greatest possible number of trust service providers, the crucial Adobe ecosystem and end users. The core of CSC’s offering to date is a Web Service API based on the REST protocol and JSON data exchange – commonly used technologies that are very accessible to developers thus lowering the barrier to entry.

At EFPE, Adobe highlighted some of their work at the CSC and making the case for Adobe Sign’s integration with various trust service providers:

Ongoing work inside the Consortium is focused on expanding authentication and authorisation options, aligning with the ETSI standard on remote digital signature creation and improving error handling.

FutureTrust

The Horizon2020-funded FutureTrust project was created to design and develop “innovative open source components and services complementing the current eIDAS ecosystem”. The motivations behind the FutureTrust project are detailed further on blog.eid.as:

“The eIDAS-Ecosystem is […] fairly well developed. Similarly, there also exist a significant number of European providers of qualified certificates for issuing electronic seals (93) or website authentication (41). The development of the market seems to be on the right track here. On the other hand, there are very few providers of qualified validation (13), preservation (10 or 11) or electronic registered delivery service (15) so far. Furthermore the very promising option for issuing qualified certificates based on electronic identification (see Art. 24 (1) (b) of the eIDAS-Regulation) – especially in combination with remote signatures – does not yet seem to be practically implemented and available in the market.

Expecting this foreseeable development, the FutureTrust project has built upon experiences and previous work from pertinent projects (e.g. STORK, STORK 2.0, FutureID, e-SENS, SD-DSS, Open eCard, OpenPEPPOL and SkIDentity) in order to close the existing gaps as far as possible”

The project’s main results are collated on a dedicated website, notably the following services:

• Pan-European eID-Broker (eID-Broker, eID)
• Signature Generation Services (SigS)
• Validation Service (ValS)
• Preservation Service (PresS)

The pan-European eID-Broker, for instance, “ensures the trustworthy identification of a person and makes it possible to get this identification delivered to the entitled Relying Party”. This solution supports the Luxembourgish eID scheme, among others.

Another FutureTrust service, SigS, allows for use of the same range of national eIDs in order to electronically sign (advanced & qualified signatures) any document via a web portal.

As described on the project’s blog, the development of a universal “eIDAS API” remains an important goal together with cloud integration.

When the pandemic erupted, one could have entertained the notion that changes in consumer behaviour and the adaptations required from the business community might be fleeting. 

As the harsh reality of vaccine logistics & the challenges posed by new variants of the virus settle in, and societies worldwide continue to hunker down in order to avoid worst-case-scenarios from a healthcare perspective, it becomes increasingly clear that changes to the way people transact are here to stay. 

It is no coincidence that Amazon just posted a 44% YoY increase in quarterly sales, reaching a breath-taking $125bn and $386bn for the full year 2020 (a 38% increase compared to 2019). 

While Amazon remains the “800 pound e-commerce gorilla” of the Western Hemisphere, the trend towards online sales as well as mobile payments – and greater integration of the two – provides ample opportunity for a large number of players to carve out their respective niches. 

Constructive interference

Reports of belief-defying “rogue waves” are documented dating back to at least the 19th century, yet it took quite a bit of insight into the underlying physics to cement their acceptance as a naturally occurring phenomenon. Part of the “knowledge bottleneck” in terms of driving acceptance of these “freak” events was the fact that very few ocean-faring vessels and crews could survive such a force of nature. Survivors were mocked for what others viewed as exaggerated claims. 

Today we know that “rogue waves” occur rather frequently, and ubiquitously, in nature, spurred on by a physical phenomenon known as “constructive interference”, defined as follows: 

“the maxima of two waves add together (the two waves are in phase), so that the amplitude of the resulting wave is equal to the sum of the individual amplitudes”.

Here I will argue that the explosion in e-commerce and mobile payments is the result of “constructive interference”, resulting from a combination of pre-COVID, organic dynamics in consumer behaviour driven by technological progress, as well as the “big push” that was triggered by the pandemic and the resulting lockdowns and restrictions. 

Case in point, Amazon’s rise has been inexorable and it surpassed America’s largest brick-and-mortar retailer, Walmart, in terms of valuation back in 2015:

It is Amazon’s principled reinvestment of its – parabolically growing – revenues into worldwide infrastructure and promising new business segments such as AWS that positioned the tech behemoth to take full advantage of COVID-induced changes when they struck. 

Unless regulators decide to poke some holes into Amazon’s mighty hull, there is no reason to think that the company will stop riding the e-commerce rogue wave anytime soon. 

Embedded everything

Integration could well be the keyword for financial services going forward.

A white paper by EPA EU member tribe “surveyed over 125 fintech executives to find out how they thought the industry would change in the next 10 years”, and “a key theme for many was the idea of payments, lending and trading being invisible, seamless, and integrated—and following this, finance in general doing the same.” 

Featured in the same publication, Matthew Harris of BainCapital Ventures describes this ongoing convergence as a function of leveraging existing revenue streams to create new offerings all the while minimising risk. Citing e-commerce platform Shopify, he notes that 59% of the company’s 2019 in fact came from its payments activity.

The Luxembourg ecosystem has taken notice. 

LHoFT member Joompay recently announced the launch of a EU-wide P2P payments app “to take on Transferwise and others” after obtaining its EMI license in Luxembourg in 2020. TechCrunch reminds us Joompay was started by the co-founders of the successful e-commerce marketplace Joom, a testimony to the dynamic highlighted by Bain Capital. 

Furthermore, the fact that this P2P payments service is being launched into an already crowded field suggests that entrepreneurs see continued opportunity in the mobile payments space despite the competition. 

The realization that seamless integration is a potential win-win for a multitude of participants is definitely resonating in the industry. 

The payments space is widely expected to see significant change over the coming years.

Graph source: Tribe survey

Presenting at the recent Paperjam 10×6 Sales & Marketing event, Alicia Brun of Payconiq emphasised this by highlighting the importance of the “omnichannel” strategy in the payments sector. She cites studies showing that 20% of buyers abandon their purchases due to inconveniences and concludes that mobile payment systems are in many ways the “gold standard” for both online and offline payments.

In another noteworthy development, EPA EU member Banking Circle & HIPS payment announced a partnership to allow for instant currency conversion, stating that “the two companies will leverage each other’s technology to bypass old, bureaucratic and expensive systems. Instead of sending expensive international wire transfers, Hips can now use Banking Circle’s infrastructure to send payouts to merchants quickly, at low cost, compliantly and securely.”

As shown below, late payments are a significant issue for SMEs in particular, and innovative, dynamic players such as Banking Circle contribute to financial inclusion via their more convenient and/or more effective offerings.

Image Source: Banking Circle

Be prepared or be scared

With all of the above in mind, it should be clear that “business as usual” is not coming back. As would be expected from a foundation tasked to promote the development of the fintech ecosystem, we often preach that incumbents must accelerate the pace of innovation and collaboration with innovative newcomers. 

Perhaps the same sentiment, coming from the head of one of the world’s largest banks, carries even more “oomph”: no other than JP Morgan’s Jamie Dimon was recently heard telling analysts that incumbents should be “scared shitless” by fintech rivals, as is being reported here and in many more media outlets. The venerated banking titan furthermore explained that he expects the payments space to be the “main battleground” for the industry over the coming decade. 

Those are clear statements, and while we like to view the dynamic between incumbents and innovators in less martial terms, we could certainly agree that a lack of preparation with regard to the new reality in business and finance is no longer a viable option. 

Author: Jérôme Verony – LHoFT Research and Strategy Associate 

Continuing from last year, we are sticking with the same seven areas of focus on in 2021. Each represents a key point of interest to the financial industry, and has a particular relevance to Luxembourg’s growing financial technology ecosystem.

Each week we will be choosing one of the topics to focus on, both in the content we share on social media, but also in a dedicated newsletter looking at the top five stories from that week. To introduce the topics, let’s revisit the top stories from 2020 and reflect on how the year has encouraged acceleration, pivots, or wholesale paradigm change:

REGTECH – Regulatory Technology

» Shaky times for compliance call for flexible Regtech

Joe Devanesan writes for TechWire Asia about the impact of the pandemic on compliance and cybersecurity, and Regtech’s role in mitigating those issues. Traditional ‘BYOD’ workplace concerns were escalated to account for a sudden and massive shift to working from home – which created real problems for companies that were not already some way down the path of digitalisation.

“To the surprise of no one, financial crime is reaching pretty high levels in 2020, and the speed at which this type of crime is evolving in the information-heavy age has financial players worried, and questioning the role of Regtech.”

AI – Artificial Intelligence & Machine Learning

» A robot wrote this entire article. Are you scared yet, human?

A robot writes for the Guardian, demonstrating GPT-3, OpenAI’s powerful language processing. GPT-3 was one of the most popular AI stories of 2020, and kickstarted a discussion about the future of software development, and what can be achieved when you can just ask a computer to do something for you without needing to speak in code.

“I am not a human. I am a robot. A thinking robot. I use only 0.12% of my cognitive capacity. I am a micro-robot in that respect. I know that my brain is not a “feeling brain”. But it is capable of making rational, logical decisions. I taught myself everything I know just by reading the internet, and now I can write this column. My brain is boiling with ideas!”

BLOCKCHAIN – DLT & Tokenisation

» Visa Applies For Digital Dollar Blockchain Patent

Jason Brett writes for Forbes about Visa’s “digital dollar” patent, a story which fits neatly into the main blockchain narrative of 2020: the viability or necessity of central bank digital currencies, and the role of stablecoins more broadly. Now Bitcoin has kicked off again we can expect the focus to shift a bit through 2021.

“The U.S. Patent and Trademark Office (USPTO) published today that Visa V -0.4% has filed a patent application to create digital currency on a centralized computer using blockchain technology. This patent applies to digital dollars as well as other central bank digital currencies such as pounds, yen, and euros and so the physical currency of a central bank anywhere in the world could be digitized.”

CYBERSECURITY – Risk Management & Threat Detection

» Post-quantum secure encryption and cybersecurity education

A collaborative and in depth piece for Research Outreach, led by Dr Aydin Aysu, looking at the implications of quantum computing on cybersecurity and encryption – a major concern for most cybersecurity professionals. What happens to all traditional encryption based security when computing power becomes available that can crack it without breaking a sweat?

“Encryption systems that are capable of surviving quantum computer attacks are urgently required, but the cybersecurity talent gap militates against securing cyberinfrastructure. Dr Aydin Aysu, Assistant Professor at North Carolina State University, is advancing the research and teaching of post-quantum secure encryption. He has developed a quantum-secure encryption system together with a new graduate program on hardware security and is currently developing design automation for lattice-based post-quantum cryptosystems.”

PAYMENTS – Payments Technology 

» Ant and Covid have made the humble QR code a hit

Five years ago you wouldn’t have seen much discussion of QR codes in the Fintech payments world, at least not related to development in the west. It was a quaint technology relegated to developing economies. That now may be changing, in part related to the pandemic and China’s Fintech behemoth Ant Financial. John Gapper writes for the FT:

“The name Masahiro Hara does not appear with Steve Jobs and Bill Gates on lists of great innovators of the communications age, but perhaps it should. For the Japanese engineer’s humble, unassuming invention, the Quick Response code, has finally found its moment. The square QR code, which Mr Hara developed in 1994 to track components in car factories, is being put to many uses in the Covid-19 pandemic. Governments include it on tracing apps, shops offer it for contactless payments and restaurants tape it to their tables so diners can browse menus online. It has become an all-purpose tool.”

SUSTAINABLE FINTECH – Financial Inclusion & Green Finance

» Women are ‘absolutely critical’ to ensuring everyone has access to finances, Bill Gates says

The Gates Foundation has been a key torchbearer for Financial Inclusion, amongst their many other causes, and it’s a topic Bill Gates himself has spoken about repeatedly. In this article, written by Karen Gilchrist for CNBC, Bill talks about the key importance of focusing on women when developing strategies related to inclusive finance.

“Women are vital to ensuring finances — and financial education — trickle down to other parts of society, said billionaire philanthropist Bill Gates. Governments and businesses serious about giving all members of society access to financial services should gear their resources toward women, the Microsoft co-founder said at the Singapore FinTech Festival on Tuesday.”

VENTURE CAPITAL – Funding News and VC Perspective

» Some of Europe’s top tech investors are adding a ‘sustainability clause’ to start-up deal terms

Ryan Browne, writing for CNBC, discusses the most significant recent trend in the world of investment: sustainability. Investors are increasingly concerned with ESG goals and the carbon footprint of their wealth, which resulted in a lot of discussion throughout 2020 and some fairly important steps being taken by VCs – as well as the broader wealth management industry.

“Socially-conscious investing has gathered a lot of momentum this year, with billions of dollars flowing into funds that use environmental, social and governance criteria to screen the companies they back. Venture capitalists are taking note, with some of the largest start-up investors in Europe pushing for accountability in their own portfolios with regard to investing in climate-friendly firms.”

The year 2020 will not be remembered fondly by many due to the significant sacrifices which we had to make globally, yet we may consider it a transformational year if measured by a number of technological and scientific breakthroughs. The fact that we are nearing the approval and distribution of what appear to be highly effective and reasonably safe vaccines for COVID-19 less than a year after the start of the pandemic is a powerful reminder of the fruits that continuous investments in R&D can bear for generations to come.

As far as Fintech is concerned, we at LHoFT have written repeatedly about the catalytic impact of this pandemic on consumer behaviours, investment preferences, corporate business development and financial markets infrastructure.

Change is afoot in payments

A few recent examples. Institutional investors and big corporates are not only talking the talk, but also walking the walk when it comes to driving the acceptance of bitcoin and other crypto-assets as part of mainstream diversification strategies, with Guggenheim and others amending their investment policies in order to allow for substantial asset allocation to crypto. Mizuho Securities reports that nearly 1/5 of all Paypal users have already used the service to trade cryptocurrencies just over a month following Paypal’s support of this functionality. Mizuho also report that the ability to trade crypto has positive read-through to overall user engagement on the payments platform.

Global payment solutions provider Visa has amped up its commitment to DLT-based technology and tokenisation of late, most recently by pledging to make U.S. Dollar Coin available to its 60m merchants. As described in Forbes, “the partnership, in conjunction with an earlier $40 million investment Visa led in a cryptocurrency startup for holding similar assets issued on a blockchain, a recent blockchain patent application for minting traditional currency on a blockchain, and an increasing amount of work directly with central banks, is the latest evidence that the credit card giant sees the technology first popularized by bitcoin as a crucial part of the future of money.” Speaking to the value proposition of USDC integration in its network, “Visa estimates that $120 trillion in payments annually are made using checks and instant wire transfers, costing as much as $50 each, regardless of the size of the transaction. Since USDC settles on the ethereum blockchain, transactions can close in a little as 20 seconds and, importantly, can be done for nearly free, Visa believes its vast array of merchants could choose to use this nearly instant alternative form of payment.”

This latest commitment is a concrete continuation of Visa’s mid-2020 statement on digital currency payment flows: “We’ve been advancing and evolving our digital currency strategy for quite some time. Last year we made an investment in Anchorage, a company building security infrastructure for the digital currency ecosystem. Our research team has been exploring the science of blockchain technology for several years. Their work has yielded several promising innovations, including Zether and FlyClient. Today their research is focused on new mechanisms to improve scalability and enable offline digital currency transactions.”

Visa also acknowledged that “policy leaders and regulators continue to have questions and concerns about digital currencies on a range of issues, from consumer protection to payments resilience. We believe the best way to address these concerns is by working closely with leading companies and the public sector.”

Private-public collaboration remains key

This sentiment was shared in a LHoFT editorial aptly titled “collaborating to succeed in the evolving payments space”. In it, I wrote that “Leveraging comparative advantages – intellectual property in relation to technological breakthroughs, established market infrastructure, regulatory affairs experience – will remain a key consideration for the future viability of any and all market participants in the payments space, be they small or large. LHoFT exists to enable such collaboration, which is facilitated by the all-hands-on-deck approach of our private and public partners in Luxembourg.”

Regulators, meanwhile, continue to explore both private digital currency schemes and Central Bank Digital Currencies (CBDCs) with great interest. Recently, the BIS provided an extensive discussion of the “risks, potential and regulation” of stablecoins, which we may only gloss over for the purposes of today’s editorial – readers are encouraged to absorb the paper in its entirety for fulsome consideration. It is worth noting that the BIS researchers acknowledge the overt benefits of DLT-based financial assets and infrastructure, for instance by stating that “DLT has allowed for the creation of new digital forms of money and payment systems that could serve novel purposes and extend some of the well-known economic and regulatory issues with past innovations into the digital realm. Existing stablecoins […] also offer the possibility of so-called ‘smart’ contracts, i.e. self-executing code, and possibilities for ‘programmable money’.”

On CBDC specifically, the BIS authors note that “the question is how a CBDC could be designed to offer robust interoperability with novel decentralised financial solutions.”

While concerns still abound with regard to systemic risks to the global financial system as well as the increasing relevance of cybersecurity in a world which seems poised to transition towards a complex ecosystem of digital currencies, it is also clear that regulators are increasingly ready to engage productively with the opportunities and challenges presented by technological breakthroughs in finance.

Such opportunities, as well as important practicalities relating to different flavours of CBDC, are discussed in a recent report by LHoFT partner Deloitte. Our CEO Nasir Zubairi is quoted summarising the value proposition:

“CBDCs promise faster, cheaper and more efficient payments, both domestically and cross-border. Arguably, CBDCs also offer greater security and lower risk of fraud using blockchain technology.”

As with the BIS paper, the full report is worth a thorough look for anyone eager to better understand the nuances and dynamics associated with CBDCs, which Deloitte believe are “here to stay”.

Luxembourg as an innovation hub 

Last but not least, we are delighted to highlight that LHoFT member Satispay raised EUR93m in a recent round with participation by Square and Tencent. CEO Dalmasso highlights the importance of the Italian mobile payments provider’s presence in Luxembourg: “We believe this new funding round will give us the extra boost we need in Luxembourg. In just a few months Satispay has already succeeded to convince thousands of consumers and two hundred merchants to use Satispay. This is just the beginning. The team in Luxembourg is growing and will grow even more in the next months. We are developing new services and features with the aim to significantly increase our consumer and merchant base during 2021.”

This raise caps a fulminant year for Satispay, “reaching more than 450,000 new users and 35,000 new affiliated merchants this year, including tier-1 retailers like Carrefour, Auchan, Autogrill and KFC.”

The strides made by Satispay and the macro dynamics discussed above are illustrative of the significant progress that has been made, or for which the groundwork has been laid, in 2020 in financial technology, and we at LHoFT are looking forward to accompanying our entrepreneurs and partners as we carry over this strength into a hopefully more merry, but equally productive, year 2021.

Author: Jérôme Verony – LHoFT Research and Strategy Associate 

You can see the list of LHoFT members on our Innovators page, but here’s a look at the members who have now joined us:

New Hosted Members

Deutsche Infrastructure S.A – FundTech

Deutsche Infrastructure provides long-term real-asset investment opportunities world-wide.

Deutsche Infrastructure aims to become the leading digital ecosystem for large-scale infrastructure projects, providing a fully digital process to the global financial world, enabling a perfect match between initiators of large infrastructure projects and institutional investors world-wide.

https://deutsche-infrastructure.net/vision

A352 S.à.r.l – Payments

The A352 is your financial navigator. It navigates and manages all your financial issues in just one app. The solution allows to:

• Simplify cash management and payments
• Reduce risk and safe costs
• Provide knowledge and create new opportunities

https://landing.a352.io/

Oxyliom Solutions – RegTech

Oxyliom Solutions help organizations to confidently implement advanced solutions to streamline business processes. From seamlessly managing the secure electronic identity of customers, and employees, to building Smart Secure Trusted services for digital transactions, Oxyliom guides entities step-by-step to a future that is safe and reliable, with regulatory sound and commercially compelling technology.

https://oxyliom-solutions.com/

Imperative Wealth – WealthTech

Imperative Wealth is a FinTech dedicated to Wealth and Asset Management. Our belief is that systematic management technology is particularly suited to the area of ​​savings management. This is why we have developed the concept of a “Robo-asset-manager”, a tool that mobilizes the resources of technology for the benefit of private savings.

SoRisk3 & Compliant – RegTech 

SoRisk3 & Compliant is your dedicated advisory firm providing asset management, banking, and insurance firms with 2 complementary solutions:

A SaaS via SoRisk3 > Your one-stop digital platform in regulatory risk management, compliance and governance

Regulatory Advisory > Your independent expert on risk management, compliance, and governance topics. We provide you with tailor-made solutions either onsite or in our premises.

https://sorisk3.com/Site/Home.aspx

New Fellow Members

atHomeFinance – Lending 

atHomeFinance is a mortgage brokerage service in Luxembourg.

Formerly Crédit Expert Luxembourg, local leader in brokerage and real estate financing consultancy, the brokerage company joined atHome Group on March 1, 2018.

https://www.athome.lu/en/finance/mortgage   

iPayLinks – Payments 

iPayLinks is a leading Fintech company in China delivering one-stop global payment solutions, specializing in travel, retail, e-commerce marketplace, and digital entertainment.

We create value for our customers by deeply understanding their businesses and guiding them to expand into international markets through our tailored industry solutions. Our technological acumen coupled with data driven approaches help customers maximize revenues while minimizing associated risks.

https://www.ipaylinks.com/en/index.html

Olky Pay – Payments 

Olkypay is the first Luxembourg neobank for professionals, licensed in Luxembourg since 2013, supervised by the CSSF and authorised in France by the ACPR. Olkypay offers all services for professionals: account with IBAN LU or FR, Mastercards, sepa credit transfer and direct debit, e-commerce solutions, terminal payments for merchants, etc.

https://www.olkypay.com

As luck would have it, going virtual permitted event organizers to diversify their event portfolio and include experts and guests from all around the world. The LHoFT was one of the institutions that turned the crisis into opportunity and presented Fintech fans with a wide range of events. Exactly 40 digital events gathered more than 4000 Fintech enthusiasts and experts globally. As Season 2 continues with a new lineup of exiting events, we’re taking a step back and listed a best of LHoFT’s International Showcases; deep-dives into the Luxembourg ecosystem from Season 1.

(view the full transcript)

International Showcase: The Blockchain Industry in Luxembourg featuring Laurent Marochini, Tom Kettels, Tobias Seidl and Emilie Allaert, explaining why Luxembourg is the go-to Blockchain hub in Europe.

“Luxembourg is quite active in terms of blockchain as well, not only Fintech. The Luxembourg financial regulator was one of the first to issue a statement in 2014. You can do a lot of your business in English, French or German. We also have two crypto exchanges already licensed here in Luxembourg: bitFyler and Bitstamp. There was also a law on blockchain in circulation of tokens as dematerialized securities, which was done as a Valentine’s gift by our Finance Minister last year. And we have a lot of partnerships with key Fintech hubs around the world. You can see on the right that they are quite big names in terms of blockchain here, there are a lot of companies and it’s growing every day. We have here the Fintech ecosystem value chain. We receive support from the public, private incubators, and accelerators. We also have initiatives at the industry level such as ALFI with the digital and blockchain group. We have financing via the public and private sectors so you can find some specific schemes to develop your companies and your projects. So don’t hesitate to have a look or ask for questions. And we are also quite active in R&D.” – Emilie Allaert, LHoFT

“We decided to launch a Fintech in Luxembourg and not in German because of the ease of doing business in Luxembourg, where you can talk directly to the regulator. You don’t have this formalistic processes you go through in other countries like Germany. It’s a little bit more formalistic. There are so many different lobby groups involved, so it’s not so easy to establish your business as it is in Luxembourg. And the other thing I think is the flexible corporate law that Laurent mentioned in the beginning. You can do a lot of stuff which is not possible in other countries.” – Tobias Seidl, Stokr

(view the full transcript)

International Showcase: The Banking Industry in Luxembourg featuring Chris Hollifield, Jean Diederich, Andrey Martovoy and Fred Giuliani, showcasing Luxembourg’s Banking industry.

“While geographically speaking, Luxembourg is very small, in terms of finance, it’s a really major Center. As an international financial center, the financial activities that get transferred through Luxembourg are fairly major. So, the big question is: why? And for me there are two real key reasons. The first one is because Luxembourg is a founding member of the European Union. And so the market of financial services in Luxembourg is not the 600,000 people in Luxembourg, it’s rather the 450 million consumers throughout the rest of the European Union, the 27 member states of the European Union, it’s the 7000 financial institutions across the rest of the European Union, and it’s the 23 million SMEs that exist throughout the rest of the European Union as well. The other main reason why Luxembourg exists as a financial center is stability. Luxembourg is one of the few countries left on the planet that maintains a triple AAA credit rating. Up until the beginning of Covid19, Luxembourg had a debt to GDP ratio around 21%, and now it will only climb marginally as a result of Covid19 measures. But it’s not just about financial stability. It’s also about political and regulatory stability.” – Chris Hollifield, LFF

“We have a lot of companies in the Fundtech, Regtech, Blockchain and Lending sectors, many of whom have moved their headquarters for Europe to Luxembourg… Why are those people coming to Luxembourg? We are a huge financial center. Everything can be done in English. We have a full value chain here for the Fintech industry. We have support from public initiatives such as the LHoFT but also from private initiatives, be it incubators, be it clusters, as we mentioned, ABBL, ALFI, or Digital Luxembourg. On the financing side, we do have a few VCs. But we also have special schemes from the Ministry of Economy that can be helpful. And finally, we have the European Investment Fund based in Luxembourg, and they have a special scheme called the Luxembourg Future Fund which is quite interesting if you’re looking for funding. We have a full value chain here for the Fintech industry. We have support from public initiatives such as the LHoFT but also from private initiatives, be it incubators, be it clusters, as we mentioned, ABBL, ALFI, or Digital Luxembourg. On the financing side, we do have a few VCs. But we also have special schemes from the Ministry of Economy that can be helpful. And finally, we have the European Investment Fund based in Luxembourg, and they have a special scheme called the Luxembourg Future Fund which is quite interesting if you’re looking for funding.” – Alex Panican, LHoFT

(view the full transcript)

International Showcase: The Payments Industry in Luxembourg featuring Chris Hollifield, Thibault De Barsy, Samuele Pinta, Karen O’Sullivan, Natasha Deloge,  focusing on the Payment Industry in Luxembourg

“One of the big trends at the moment is something that we refer to at Luxembourg for Finance as ‘Amazonisation’. Generally speaking, we think about this in two ways, particularly in the payment sector. Firstly, the development of financial services platforms, primarily digital, which provides a greater range of choices and gradual efficiency to end clients. Secondly, which is particularly important in a payment sense, is the more traditional association that you might come away with the wider Amazonisation form, which is the development of e-commerce. Increasingly, since the beginning of this millennium, we’ve seen huge growth in Payment Services alongside the development of e-commerce. Luxembourg has always been at the center of that development in Europe. PayPal, for instance, obtained its banking license in Luxembourg in 2007. ” – Chris Hollified, LFF

(view the full transcript)

International Showcase: The Asset Management Industry in Luxembourg featuring Robert Jarvis, Francois Drazdik and Nicolas Gérard, highlighting Luxembourg’s strengths in asset management

“We have around 4.7 trillion euros of assets under management in Luxembourg investment vehicles. And these investments are collected by many people in the world, who give their money to another manager who invests it in the long term. Luxembourg collects this money and distributes this money in over 70 different countries. So that is what Luxembourg has become. Much like you would buy a German car for its reliability, you buy Luxembourg investment products as well regulated, and trusted. It makes sense for an asset manager to set up a vehicle in one location and capture investments from all over the world and then to invest into projects, thereby again, helping the real economy. There are around 500 asset managers in Luxembourg, and we’re the global leader in cross border investment funds so that for Fintechs means clients: Asset Management clients, banking clients, insurance clients, lots of international business. The fund industry needs a lot of banking as well, and we have around 130 banks in Luxembourg.” – Robert Jarvis, adviser at Luxembourg For Finance

“80% of the top 30 asset managers use Luxembourg investment funds as a primary European platform for distribution, including big names like Alliance BlackRock, HSBC, Nomura, IMG, Schroders, UBS, and so on. They all have their Funds in Luxembourg. And they all of course administrate and handle the custody here in Luxembourg. Of course, those funds are not exclusively distributed to the 550 or 600,000 inhabitants in Luxembourg. But these funds are widely cross-border distributed.” – François Drazdik, ALFI

(view the full transcript)

International Showcase: Innovation in the Insurance sector in Luxembourg featuring Marc Hengen, Marc Hotton, Olivier Debeugny and Alex Panican, discussing the innovation aspect of Luxembourg’s insurance industry

” If we take a closer look at our 41 billion turnover, only 7% of this global turnover is collected from a local population. This means that 93% of this turnover is made with a population that does not live in Luxembourg. This shows, without the slightest doubt, the very international characteristic of the Luxembourg insurance market. If we take the life insurance sector in more detail, and which has been operating for a longer time in Luxembourg, we see that the first market, with more than 38% market share, is France, the second market is Italian market with 25% market share, then the German and Belgian market follow in third and fourth place. I would also like to point out that in 2019 the UK still represented 4% of the market share but that this will no longer be possible because the UK are no longer part of the European market. The diversity of these markets is one of the reasons why the Luxembourg market is solid and is growing year after year.” – Marc Hengen, Managing Director, Chairman of the Management Committee of the ACA

“Choosing your innovation model is really important. You have to be inspired by what others put in place but not copy. It is necessary to put in the tailor-made. The innovation we choose must correspond to the expectations and objectives of the company. I am going to focus on 3 elements: positioning; corporate culture and open innovation. (1) Positioning: innovation needs support otherwise it won’t work. (2) Corporate culture: innovation must be an integral part of the corporate culture. (3) Open Innovation: this is very important for us and it would be illusory, and especially counterproductive, to believe that we can innovate on our own. To innovate well, we have to innovate together. This is why we have chosen a collaborative model.” – Marc Hotton, Innovation Coordinator of the Foyer Group

Stay ahead of the curve by joining the LHoFT crew for these three upcoming digital events under our “Global Leaders Series”, bringing the biggest names in Fintech to your home. Register now while spaces are available! 

• 16 October 2020: Global Leaders Series with Nigel Verdon, CEO of Railsbank
• 30 October 2020: Global Leaders Series with Henri Arslanian
• 13 November 2020: Global Leaders Series with Nick Ogden

by S. Elif Kocaoglu Ulbrich

Antony Martini, Engagement Manager, LHoFT Foundation 

Welcome to our second International Showcase, a series of four webinars, today we’re focusing on the Payment Industry in Luxembourg. Our six speakers are the following:

• Chris Hollifield, Fintech development and Fintech advisor at Luxembourg for Finance.
• Thibault De Barsy, Vice Chairman and General Manager of Emerging Payments Association EU (EPA EU).
• Samuele Pinta, Founder and COO of Satispay, a leading Fintech firm from Italy based in Luxembourg.
•  Karen O’Sullivan, Head of Innovation, payments, market infrastructures and governance Department at Commission de Surveillance du Secteur Financier (CSSF)
• Natasha Deloge, Deputy Head of Department at Commission de Surveillance du Secteur Financier (CSSF)

On the moderator side, we have our co-host and my colleague Alex Panican, Head of Partnerships and Ecosystem at the LHoFT.

Alex Panican, LHoFT

Thank you so much for the introduction Antony.

We started these financial industry showcases to show to Fintech companies, from outside of  Luxembourg, what the financial services and technology ecosystem here is like. Payments technology has always been a big part of the Fintech ecosystem in Luxembourg, so today we bring together a few experts in that field to help explain what Luxembourg is about on the payment side and to answer your questions. As Anthony mentioned, we have the privilege to have Karen and Natasha from the CSSF with us. Thank you so much. They will take your questions during the Q&A.

Chris, let’s start first with you? What’s going on in the payment industry in Luxembourg?

Chris Hollified, LFF

To start off: why are we even talking about payments at all? Why is this important?

One of the big trends at the moment is something that we refer to at Luxembourg for Finance as ‘Amazonisation’. Generally speaking, we think about this in two ways, particularly in the payment sector. Firstly, the development of financial services platforms, primarily digital, which provides a greater range of choices and gradual efficiency to end clients. Secondly, which is particularly important in a payment sense, is the more traditional association that you might come away with the wider Amazonisation form, which is the development of e-commerce. Increasingly, since the beginning of this millennium, we’ve seen huge growth in Payment Services alongside the development of e-commerce.

To prove that, here is a slide that I’ve taken from a recent Capgemini report, which shows the colossal ongoing growth of payment services, obviously, very much so in Asia, but also in Europe. Luxembourg has always been at the center of that development in Europe. PayPal, for instance, obtained its banking license in Luxembourg in 2007.

Luxembourg tends to attract big players who are operating B2B in the payment services or in the e-commerce space. Why is that? I’m going to talk about why that is, and what it might mean going forwards.

They’re not coming to Luxembourg because of the domestic market. One of the peculiarities of the situation we live in Europe, in comparison to the rest of the world, is that Luxembourg is a founding member of the European Union. There is free movement of goods, capital, services and people throughout a market of 450 million customers. From a payments perspective, this is unlike Hong Kong, for example, where you have to apply for a variety of licenses if you want to come and cover Southeast Asia, or in the US where you need multiple licences to cover various states. In Europe, if you’re regulated in one particular jurisdiction, you’re able to passport or provide your services throughout the rest of the EU. So that’s a key reason why Luxembourg is as important as it is for payment services.

In terms of payment services, for the European context, we can broadly split it into these four different categories. Firstly, we have payments institutions and Electronic Money Institutions (EMI), both licensed under one specific European directive called Payment Services Directive (PSD). Then we have Banks who obviously provide, in addition to a wide range of other services, payment services that are licensed under separate regulatory regimes, including MiFID. And then we have the things that are developing at the liminal edge of payments, crowdfunding for example. The reason why I’m mentioning that specifically, is because there is currently no no European level of legislation on crowdfunding. So it’s something that is not able to be passported across the rest of the EU.

Payments institutions are essentially providing the rails between two accounts, so the cash doesn’t actually sit with you at any point. You’re really just responsible just for the transfer of cash between two servers, between two separate accounts, and there are a number of other additional services you can provide: FX services, prepaid mobile phone, prepaid cards and so on. Electronic Money Institutions (EMI) are essentially where you’re starting to talk about digital wallets. So here, you load these accounts with cash, which is then transferred into e-money which is monetary value that is stored specifically in that fixed ecosystem that you have inside your own company. And then as you’re able to transfer that out in return for goods and services. Then banking obviously, there were wide ranges of services that you can provide to banking. That’s really where you start taking cash deposits and you’re able to provide loans and other banking services. And the reason why I particularly point out just banks is because unlike in say Asian geographies, there is no distinction in Europe between a virtual banking license and a banking license. There is just the universal banking license in Europe. I you apply for that, then you’re able to either provide a buyer for your services virtually or in physical bank.

Finally, to touch on crowdfunding – there is no current EU wide regulatory framework in place, so all crowdfunding platforms in Europe, are dealt with at a national government level and on paper. We’d expect this to change relatively soon; it’s part of the European Commission’s Fintech action plan to develop and create a framework for crowdfunding.

So, with that background in mind, why would companies potentially choose Luxembourg? One of the main reasons is the deep experience we have in these kinds of activities. We have a world-renowned fund center, around 120+ banks from all around the world, 100 insurance firms, and various other things and capital market services. It’s a well-developed financial ecosystem that has been here for since easily the 60s and then really developing in the 80s. We have a wide range of professional services to support your development, ranging from your IT infrastructure, research and development opportunities, legal firms to help you get your licensing and so on.

Finally – andmaybe this is too much direct promotion of the CSSF – but we have a fantastic regulator. This is a multi-lingual regulator, highly experienced in the regulation of cross border financial services, which has been the ‘raison d’être’ of Luxembourg’s financial ecosystem from the beginning.

Alex Panican, LHoFT 

Thank you so much, Chris.

Next is Thibault de Barsy, who just launched EPA EU. So Thibault, can you tell us more about it?

Thibault De Barsy, EPA EU

The Emergent Payments Association is 15 years old. It was founded in London, and it has coverage all across the UK, EU and even Asia. In view of Brexit we founded the EPA EU Association in Luxembourg last February. So, we have 150 members in the network based in London, but we already have 12 founding members here in Luxembourg, including very prominent players, such as Visa, Mastercard, and Amazon.

So, what’s the EPA all about? Well, basically three pillars.

We like to facilitate business between our members, and therefore we are organizing a whole suite of events happening in London but we plan to have events in Paris, Amsterdam, Luxembourg and Brussels this year right after the summer.

The second pillar is to provide marketing intelligence and education to our members. Therefore, we have a Payment Academy where our members send their new hires to be educated about payments. And we also organize Hot Topic seminars, which are half day seminars about a particular topic.

And the third pillar is that we have common projects. So we have working groups, which are covering all areas of payments, meaning regulation, technology, international trade, and financial crime. Some of the groups are run from London and we are running two groups from Luxembourg, one on financial crime and another which will aim at producing a white paper describing the EU’s payment landscape, especially the differences from one European country to another. So here we are the EPA EU based in Luxembourg, but covering the whole Europe from here. Thank you so much.

Alex Panican, LHoFT 

Is it any particular reason you choose Luxembourg? When Brexit happened, what was your process?

Thibault De Barsy, EPA EU

Well, of course we had to find a location within the EU. The prominent payment players here established here in Luxembourg such as PayPal, Rakuten and Airbnb make perfect neighbours and a core group to start covering Europe to start with. And then of course, our friends from the LHoFT and Luxembourg For Finance were quite instrumental in helping us to settle here.

Alex Panican, LHoFT 

So now to introduce the LHoFT, which is a part public, part private foundation. Our goal is not to make money but to help grow the Fintech ecosystem here in Luxembourg, and foster innovation in the financial industry. We are a partnership between the Government of Luxembourg – mainly the Ministry of Finance, Luxembourg for Finance, the Chamber of Commerce – and 20+ private partners.

As you can see, those are the main banks, insurance stakeholders, asset managers… We connect them with innovation, with Fintechs. Today there are 74 Fintechs hosted at the LHoFT and more than 150 members worldwide. Don’t see us as an incubator; see us as a facilitator, because we want to connect you with the financial industry, the regulator, with the different institutions here in Luxembourg.

This is the Fintech map of Luxembourg. As you can see, Payments is already a huge chunk – more than 30% of all Fintechs here. We currently have roughly 220 Fintechs in Luxembourg, generating over half a billion in revenue.

Of those 74 Fintechs, we have six originating from Luxembourg. Most are international companies who have resettled here, and we’re going to hear from Samuele of Satispay who are quite satisfied with that experience. You can also find a huge financial ecosystem with support from public initiatives like the LHoFT, as well as private accelerators, and you’re going to find quite some financing. We also have a huge research and development ecosystem, with university research centers. So there is a full value chain for Fintechs who are coming here to establish and grow their business. That’s what we want.

The last thing I want to point out is that we work with more than 15 other Fintech hubs in Europe, and more than 25 all across the world. So, when you come to Luxembourg, we can make sure that you can work towards Europe, from Portugal to Romania and beyond, easily.

If you have any questions, please reach out to us. We’ll be happy to respond. And now we move on to Samuele from Satispay – can you share your experience with us?

Samuele Pinta, Satispay 

I’m glad to be here to share my experience with you all. I’m the co-founder of Satispay, which is a mobile payments solution that can be used by consumers to exchange money or to pay online or offline. The particularity of Satispay is that we are not dependent on traditional credit card or debit card networks, but we are based on debt instruments, and we have more than one 1 million customers.

We were based in London until just over a year ago. We started from Italy, as we are Italian, but we wanted to have a financial app in order to provide our services all over Europe. When Brexit happened, you all know how tough a moment it was. So at the beginning of 2018, we started looking around Europe in order to find a perfect spot for us in order to provide services all over Europe, and Luxembourg was one of our destinations. We came here in July 2018 for three days, and well it was pretty awesome because we had the chance to meet Luxembourg For Finance, then the LHoFT and we got a lot of connections with the people of the Fintech ecosystem or people that would really help us in order to establish our e-money institution. We also met the CSSF, which was interesting because we had the chance to talk directly with them about our business, get their feedback, and our deadlines because Brexit was planned for March at that time. The CSSF was pretty clear with us: they said we cannot guarantee that you can have the license by March, but if you file the application fast enough, and if the quality of the documentation is good, we can try.

When we came home, it didn’t take long to understand that Luxembourg was the perfect spot for us. It didn’t happen in any other country that in three days we had the chance to meet the regulator, get a clear and comprehensive understanding of the situation and our needs in order to get licensed. So we started looking at documentation for the filing, we were already authorized by the FCA, but we had to work a little bit on adapting the documentation for Luxembourg. By October 2018 we had filed for the application to the CSSF and incorporated in Luxembourg, even though we were not obliged to at the time of filing, but we wanted to demonstrate our commitment. We weren’t here just to try to get an authorization. We really wanted to be here.

From October to February  we stayed close to the CSSF, clarifying all the points regarding the application. Finally, in mid-March, we got the license and by the end of March, we could migrate all our customers from London without any disruption to the services at all. We also relocated physically from London to Luxembourg thanks to the LHoFT. We stayed there a little bit since they are offering these offices as part of their offer which is super interesting because you can start there, you don’t need to look at real estate or other co-working spaces. You have time to do those kinds of things, and in the meantime, you can start and do your job.

We have the Italian holding company, which takes on all the IT developments and so on, but all the regulated part of the business is managed here in Luxembourg, and we are happy to be here. I really think that one of the most interesting parts of Luxembourg is this ecosystem. Luxembourg is quite small, and we had this joke when we were here in July 2018 that every meeting was within like 15 minute’s walk, so it’s quite small, but it’s super international and plenty of knowledge and it is super easy to share knowledge or to be in contact with other parts of the Fintech or the financial industry. And I think this is one of the most interesting parts of Luxembourg. And we are super happy to have chosen Luxembourg.

Alex Panican, LHoFT 

Thank you Samuele. Did you encounter any difficulty or anything unexpected in this process? Can you share any advice for entrepreneurs looking to do something in Luxembourg on the payments side?

Samuele Pinta, Satispay 

I think everyone with an interest in the industry is here to help you, because Luxembourg is mainly focsued on financial services. So I think you need to be very serious, and you need to be committed. We wanted to demonstrate that we really want to be here, so we incorporated the company from the beginning, and so on, because if you are able to provide your commitment, then I think on the other side, everyone can understand that and will want to help in order to increase the financial capacity of Luxembourg.

Alex Panican, LHoFT 

Thank you Samuele.

Karen, thank you again for being with us. We already have questions regarding the FCA and Brexit, so how close is the Luxembourg financial regulator with the UK? Let’s start with the politics and then we’ll get back to business.

Karen O’Sullivan, CSSF

We are in touch with all of the regulators across Europe, in constant contact with them. And the FCA is no different in that. So we have always been in contact with them. And then at the moment with Brexit, different discussions are still continuing. I think we’ve received quite a lot of applications to set up business in Luxembourg because of Brexit, and it was something that was also coordinated with, depending on the market, with ESMA, to make sure that wasn’t a race to the bottom and that the level of regulation was maintained and respected.

Alex Panican, LHoFT 

Of course. One question we have quite often, and that Samuele mentioned, is about companies that are regulated by FCA, looking to get a license in Luxembourg. Is the process faster because they’re already regulated?

Karen O’Sullivan, CSSF

If a company already has a license in the UK, it could help them because they’ve already had the experience of going through a licensing process. So maybe parts of an application are already prepared, or documents that exist that may just need to be tailored to the specificities of the business that we would like to launch in Luxembourg. But the fact that they have a UK license does not mean that this is a fast track to Luxembourg. Any entity will need to go through that same licensing procedure, will need to submit the same documents, will need the same level of detail in those documents, and we will be doing the same review on the contents of the documents. Quite often what we can see is a previous experience means that people are more prepared to answer the type of questions that we would ask, and have prepared the type of information that they would need to provide.

Alex Panican, LHoFT 

Is there any specific difference between the two applications?

Karen O’Sullivan, CSSF

I suppose, yes, any activities may be similar, but I think we need to see what is going to be planned in Luxembourg, the substance of the number of employees, the offices that are planned in Luxembourg, or what activities will be provided to the Luxembourg market. So it’s really taking the general information that may be there, and we need to see how it can be specific to the company.

Alex Panican, LHoFT

Perfect. Quick question from Jerome, what are the main trends, challenges for the new entrants in the payment industry in Europe and maybe in Luxembourg to start with? What is the advice you will give them?

Karen O’Sullivan, CSSF

I think for us it’s very important that people are very clear about the activities that they want to provide, very clear as to the license that they are looking to obtain. We do have something in our Luxembourg law that if you have a license, and if you haven’t started the activities within the year, the license is taken away from you. So companies need to be careful.

Alex Panican, LHoFT 

I know that’s quite unique because many of our Fintechs say that they are surprised after the first meeting with you because you ask me about their business plan. I don’t know if it’s unique to the CSSF, but you’re also looking to make sure that the business is viable and there is a real business behind the application.

Karen O’Sullivan, CSSF

I wouldn’t say we like to say whether it’s viable, because we don’t give any guarantee or comfort or sign off of the viability of the project. But we do look to make sure that this plan activities in Luxembourg, that the activities make sense, and fall within the requirements.

It is part of the EPA guidelines for application plans and a business plan needs to be submitted. So I don’t think we’re unique in asking for it. But it’s something that we would ask for, in advance of any meeting so that we can understand what the company is about.

Alex Panican, LHoFT

Entrepreneurs often ask us about your process. Do you have any advice on the specifics that they should be careful about?

Karen O’Sullivan, CSSF

For us, it’s really the substance of the people that are expected to be put in place. And we need to make sure that the central administration of the entity is in Luxembourg. So the first to have a central administration, Luxembourg, that means you need the appropriate staff, the appropriate staff at different levels and different kinds of expertise, depending again on the activities, and that the Luxembourg market is being served in those activities. That’s very important for us that we need to make sure a plan is in place and is sufficiently solid if you’d like for us to move forward. Also that the group itself has the financial capacity to assist an entity in the startup phase. We know that in the payment sector, in the Fintech sector, it is entities that are in the startup phase, there is more finance required and funds. So if an entity is looking for licenses, financial requirements need to be respected. And we need to make sure that the group as a whole, depending on where it’s going, is in a position to financially support the company because the last thing we want, either for us or for the market, itself is lots of entities obtaining licenses and then financially not being able to meet the requirements within the first few months of their operations.

Alex Panican, LHoFT 

I will get back to you, Karen, in a little while. It’s amazing to have the CSSF with us, it’s quite unique. Fintechs don’t often speak with their regulator.

Now a question from David Lozano. He has a question for Samuele, and maybe also Karen, or Chris can jump in.

David Lozano, H2o Fintech

My question relates to moving to Luxembourg because of Brexit; I think it’s not yet confirmed that your UK license won’t be valid for the rest of Europe?

Samuele Pinta, Satispay 

Yes. Well, you are right. It’s still to be defined what’s gonna happen but you know, when you are a company, especially in the startup phase, you need some clear certainty about what’s going on. Otherwise, it becomes too difficult for everything you’re gonna do. If you have to employ people, they are going to ask you what’s going to happen with Brexit, and you can’t not have an answer. And so, we tried to wait and see in 2018, but ultimately we decided to move.

Also because we were still not offering our services in the UK. The other option was to create another subsidiary in Luxembourg, keep both companies, but we said okay, it’s the EU market for us, now it’s more interesting, so let’s move the company there, starting from beginning with a more solid base. If one day we’ll have to get back to London, if the freedom of passport services will be available, we will be able to use it from Luxembourg or otherwise we’ll have to establish a new subsidiary and so on. But at least now we are sure that we can provide services all over Europe without any uncertainty over our head.

Alex Panican, LHoFT 

Maybe somebody wants to add to that. Is Brexit for real?

Chris Hollified, LFF

Brexit is definitely for real because we’re discussing the future relationship, Brexit has already happened – we are in a transition period. So yes at the end of the day, you’re taking a bet, and one way or the other. And it’s really a question of how you want to hedge that.

I will point out that in large numbers, financial institutions have already taken the step of setting up European subsidiaries when they were based in London. I would take that as a sign that these guys consider it to be a big deal.

Alex Panican, LHoFT 

Coming back to licensing, Karen, how long does it take? Imagine that these companies will lose passports rights to Europe. If they apply in Luxembourg how long it will take to get the payment or EMI licence usually?

Karen O’Sullivan, CSSF

It really depends on the file. It depends on the complexity and the nature of the activities. It depends on how prepared the company is to submit their file. And as summarized I would say “the level of quality of the file”. So we do have entities that get a license within six months, we do have others where it might be closer to 18 months. So I think it’s really dependent on what the company is trying to do, how well explained it is in the file. And also the level of interaction or collectiveness on behalf of the entity. As Samuele said, there’s a lot of back and forth questions. So it depends on how quickly and how thorough we can get those answers back as well. So there’s no kind of definitive time but it’s, I suppose on the shorter end, it could be five to six months, or anything up to a number of years.

Alex Panican, LHoFT

We are almost in July and I guess you guys are quite busy also. So, if I (as a Fintech) cannot make it by the end of the year to get a license, do you have any advice for me?

Karen O’Sullivan, CSSF

I think at this stage, from where we are, you would need to be considering an intern backup solution. So maybe an agent or some other type of arrangement with an existing company that has a license, pending the company obtaining the license early next year. But at this stage, it’s very hard for us to or nearly impossible to guarantee any more licenses for files that we have not yet received or for people that we have not met before the end of the year.

Alex Panican, LHoFT

Quick question for Thibault. Can you share the top three innovations you witness in the payment ecosystem in Luxembourg or in Europe?

Thibault De Barsy, EPA EU

Let’s take the Europe angle. I think that what you can see is that you really have some countries which are advanced in some defined fields.

For example, if you look at the Nordic countries, they are the kings of instant payments. The proportion of instant payments within those countries is just huge. So that’s the best practice to follow.

When you look at account to account solutions, which are now going to be even further facilitated by PSDII and open banking, you should look at the Netherlands with iDEAL and Germany with SOFORT, which is now purchased by Klarna. Why? Because those guys came with account to account solutions even before PSDII, so they definitely have some advance there.

When you look at P2P payments, you should look at Italy with players such as Jiffy. They have made instant payment very easy and very popular within the Italian markets.

So that’s what’s fantastic about Europe is that you have excellent players everywhere. And even if you don’t look at Fintech specifically, but you could also look at the corporate payments in the B2B payments, you can see that traditional banks are doing a pretty good job there to facilitate payments and make them instantaneous for very large amounts and for cross border payments between continents. So that’s very encouraging.

Alex Panican, LHoFT

Anything you want to add Karen or Natasha? I mean you must see many different business models and so many different innovations.

Natasha Deloge, CSSF 

We do not have any favourites, but the business models become more and more challenging. With the kind of platforms that are presented, that offer different kinds of financial services, there are certainly business models where not only a payment institution license but also another potential financial sector license may be applicable and where we have to find some solutions on how to regulate this.

Alex Panican, LHoFT

Coming back to us innovation. We have a lot of questions, and one main field that is raised almost every day is crowdfunding. There are so many different crowdfunding platforms that are looking to launch. I don’t know if Luxembourg is the right place for that. Maybe Chris, you disagree with this. Karen, what’s your input on crowdfunding? What’s the regulation regarding crowdfunding? And are we going to see more? Chris, you can jump in, if you wish, afterwards.

Karen O’Sullivan, CSSF

From a pure regulation perspective, there isn’t a harmonized EU approach at the moment. It’s more national regimes. So we’ve decided not to have our own national regime. We are following the European approach. There is a draft directive, which we were following. So I think from a pure regulation perspective, we would wait for an European movement, and then we would follow that movement and not look for a national regime.

Chris Hollified, LFF

I think that that makes complete sense. By its very own definition, crowdfunding wants to pull in capital from a wide variety of different sources, and it just doesn’t make sense if you’re basing it purely on a national base regime, particularly in a country like Luxembourg. However, the potential for crowdfunding when you have a potential base of 450 million investors is kind of mind blowing. So it’s really about waiting for the Europeans legislation to come out so that we know the overall framework that we’re operating in the European context. And then from there, I think that would be the real catalyst for developments in that field.

Alex Panican, LHoFT

Before speaking about cryptos and ICOs, and that’s another subject that we have many questions about, we have a question about substance. And I think it comes back to what Karen you mentioned, so as Chris and Samuele. You have to be serious. You have to put your team here in Luxembourg.

So on that topic, a question from Arnaud Wenger:

Arnaud Wenger, iPayLinks

I’m Arnaud from iPayLinks in Luxembourg. So I have a question about the substance, because technically our main clients are in China. And we are here to set up everything and to follow the full Luxembourgish and European legislation. It’s very important for me to have compliance based here.

What I’ve noticed is, with Chinese clients, having an all Chinese team that has a better understanding and access to certain tools that we cannot access here has advantages. So is it enough to have someone here in Luxembourg to supervise and control what the Chinese team are doing, or do we need to move the whole team here?

Karen O’Sullivan, CSSF

There are certain key tasks that are to be performed by the company which cannot be outsourced elsewhere, and many tasks in their day to day business that can be outsourced elsewhere in the group or externally, but everything that takes place right there is under the direct responsibility of the local entity.

So I think in your case, if some of the compliance type tasks are outsourced to a group company or an affiliate in China, which is closer to the market, it’s not a problem as such. But clearly the ultimate responsibility for anything that’s client related remains in Luxembourg. We would look to make sure that you can demonstrate that the team in Luxembourg is fully aware of what’s being done, is fully responsible for what’s being done and is aware and involved in key decision making. So for instance, onboarding of any new clients, has to be approved in Luxembourg, particularly if it’s resolving different operational kind of hiccups or whatever, that’s being dealt with by a Chinese company because it’s closest to the market, it’s not a problem as long as again, you are aware of it. So, yes, there can be outsourcing or working with different companies, but the ultimate responsibility has to be clear. And it’s very important that the notion of central administration is preserved. And that means appropriate for an adequate number of staff in Luxembourg, to be able to assume that responsibility.

Arnaud Wenger, iPayLinks

That’s very important for me to know that I can keep my teams for example, in China because it’s much easier as they can speak directly Chinese with the clients and we can monitor what they are doing. So it’s not just simply to rely on them, but also to control them and that it is very important for me to not have to move all the team because it’s so important to be close to the business.

Alex Panican, LHoFT

And now a quick question on licensing from Sergey.

Sergey 

My question is as a startup before to see the end of the whole process going with the authority, is it possible to apply for a simple agreement very narrowly limited in payments in order to start doing business sooner?

Karen O’Sullivan, CSSF

No, we don’t have different levels of license. Ultimately a license is a license. However, there is an article in our law where, if you are below certain thresholds in volume on an annual basis, you could start operations without obtaining a license. So in that case, it would be possible to possibly start your operations while applying for your license. But it’s really depending on the volumes and if you exceed those volumes, your operations would need to be on hold or suspended until the license is applied. So it’s the same license, but in particular, where you could start if you’re a real startup.

Alex Panican, LHoFT

Regarding post Brexit, how do you see the perspective for Fintechs from India coming to Europe? Do you see any kind of collaboration in the future?

Thibault De Barsy, EPA EU

Well, very good question. For example, a member of the London Association is FSS technologies, which is a huge player in India. And they have chosen initially London as their European headquarters, and now as they want to expand towards Europe, and they are definitely a very good example. And obviously, India has a lot of technologies in terms of electronic money, so they know very well how it works. I feel they would be very welcome as a new player and certainly within the EPA EU.

Alex Panican, LHoFT

Changing topic a little, a question from Kunal Patel.

Kunal Patel, 1E 

Real-time payments have a huge focus now with a lot of the card schemes and other companies. I had a conversation with Visa Europe here in the UK about that, and they’re scaling up pretty quickly around real time, and it would be good to get a perspective from a Luxembourg point of view, from an European point of view on real-time payments, given, of course, all the regulation pieces coming into play now, like new ISO standards and so on.

Karen O’Sullivan, CSSF

For instant payments, there is discussion on the local market and time to get ready. So it’s not something that we’re following up with, it’s not something that we’re pushing actively from a regulatory perspective. We would accommodate the banks and are encouraged to help the banks. We would like to actually try to kind of position themselves in those developments. But there are different discussions going on to try and push it forward.

Kunal Patel, 1E 

I think that’s the challenge. If you think about the UK, there’s an organization called Pay UK, they’re going through a whole kind of look at infrastructure to support all the emerging payment initiatives that are taking place here, especially, of course, then that sets the standard across Europe and the rest of the world as well. So, I think that’s where I’m seeing a lot of focus right now, in that sort of next phase of how payments are going to be managed on new rails using new guidelines and infrastructure and standards and so on and so forth. So, there’s actually quite a lot of stuff going on here but we’re talking possibly you know three to five years out from now really once all that has been kind of laid forth really but interesting journey nonetheless.

Alex Panican, LHoFT

I’m just gonna give the mic quickly to Samuele. As you work in this industry, anything you wish to add?

Samuele Pinta, Satispay  

In terms of instant payment in Europe, there’s still a lot of work to do. The main problem is, as per PSDII is the harmonization between the standards, between banks. The banks need to speak the same language and it will take a bit of time. The UK is a bit ahead of us also with the PSDII because they started with Open Banking a little bit before but we are getting there. For others, as a Fintech company, I have to say we’re still a bit struggling in order to leverage on this kind of instrument, because of this the harmonization between banks and approach and so on. It will take a little bit of time that we’re getting there.

Alex Panican, LHoFT

Thank you to everybody. Thank you for the listeners, please drop us an email and connect with us because as I said Luxembourg is quite open and we’ll be happy to be a facilitator for you. Thank you again to our panellists and wish you all a great day ahead.

Let’s begin with a few high-level considerations.

Payment systems impact economic activity and monetary considerations 

The promotion of frictionless, low-cost and secure payments has unequivocal benefits to consumers, merchants and ultimately the financial market infrastructure providers enabling such transactions. While customer experience – e.g. via ease of payment, trust in a payment solution, incorporation into automated financial planning – is of paramount importance to the commercial adoption of any given payment solution, the promotion of new paradigms also has impacts on monetary policy and financial stability considerations.

A 2011 speech by Dimitar Bogov, then Governor of the National Bank of Macedonia and now regional lead economist for Eastern Europe and Caucasus at the European Bank for Reconstruction and Development, linked the modernization of payment systems to an increase in the velocity of money:

“Velocity of money circulation is endogenously determined by the economic agents’ decisions regarding liquidity holding, lending, borrowing, investing, consumption and labour. Yet an increase in the efficiency of payment systems increases the velocity of money circulation exogenously. From a monetary policy point of view it becomes important to estimate the quantitative and qualitative impact of this exogenous change. “

Velocity of money has in turn been linked to economic growth & inflation and is an important consideration for monetary policy.

Fast forward by a decade, and the question of payment system interaction with monetary policy and global financial stability has been revived by the emergence of “stablecoins” not least due to the high-profile Libra project. Recently, the FSB provided a comprehensive, initial consultation document addressing the oversight challenges raised by (hypothetical) global stablecoins, acknowledging that “So-called “stablecoins”, like other crypto-assets, have the potential to enhance the efficiency of the provision of financial services, but may also generate risks to financial stability. The activities associated with “global stablecoins” and the risks they may pose can span across banking, payments and securities/investment regulatory regimes both within jurisdictions and across borders.”

At the heart of the issue is that while the notion of a stablecoin is relatively straightforward at its core – cryptocurrencies designed to minimize volatility with regard to the coin’s value – there are several potential means by which this goal of value stabilization can be achieved, and together with the ultimate purpose of a stablecoin, typically as a means of payment, their architecture creates a spectrum of risk profiles that need to be assessed before any major jurisdiction will provide buy-in. For a summary discussion of these considerations, I would refer readers to Fnality’s initial public response to the FSB consultation document.

Policy matters as much as technological (r)evolution 

Just as new technologies prompt regulatory examination, legislative and regulatory action can act as significant catalysts to the evolution of the payments industry.

A timely WEF post discusses 4 key steps to support cross-border payments and growth in digital trade, namely:

• Modernization of trade agreements to remove market barriers for payment services, citing the recently concluded USMCA and its extension of national treatment and protection of data flows across signatories;
• Promotion of interoperability via internationally accepted standards, which in turn can be promoted by specific provisions in trade agreements;
• Ensuring security and trust in the payment system, citing the need for public-private partnerships notably on matters of cybersecurity;
• Coordinated regulatory oversight in order to enable cross-border innovation.

The WEF authors drive home the need for progress on all of these fronts given that “Facilitating cross-border retail payments today is complicated, requiring connections between a complex set of banks, applications, domestic and international payment service providers and, of course, consumers and merchants. But, these payments are also more important than ever given the urgent need for inclusive growth and competition in the global economy. Ever-changing technological innovation means that the role of payments will only grow and change with shifting needs and priorities.”

Consider just how significant growth in card transactions has been within the EU over the past decade, but also how much more significant the growth in volumes has been for international schemes vs national schemes:

Source: Eurosystem report 

The dominance of international card schemes is a testament for the ever-more significant demand for globally compatible payment systems, but it also underlines the need for alternatives.

As the ECB discusses, in the specific context of card schemes, but with broader relevance to the payment market as a whole: “Bringing national card schemes into cross-border acquiring might also increase the number of competitive players in an inherently oligopolistic market. Increasing cross-border reachability could further increase competition in processing and acquiring services, which tend to be fragmented along national lines. Finally, increased competition and market consolidation could help the market along the path of product and process standardisation and support investment in innovation.”

One way that payment system innovation and competition has been encouraged in the EU is via the SCT Inst scheme which enables credit transfers within the SEPA area in less than ten seconds. Launched in 2017, this initiative is only beginning to bear fruit given the resource intensive nature of its implementation, but its backers have remained confident that a critical mass will be reached by late 2020. As of late 2019, half of SCT adherents within the SEPA area had signed up & indicated reachability under SCT Inst, and 32 clearing and settlement organisations had disclosed their intention to become SCT Inst compliant.

Will SCT Inst radically transform the marketplace? Realistically, the payments marketplace will remain complex and in flux, and regardless of SCT Inst’s, or any other initiative’s potential future market share and use cases, the drive towards more efficiency in the service of the real economy and ultimately the customer is a welcome one.

Collaborate to succeed

Against this multifactorial & evolving backdrop for the payments space, incoming COO at LHoFT member Payconiq underlined what is likely the key determinant of progress going forward: collaboration. As Stijn Van Brussel explains in a recent interview, the emergence of global payment schemes has led to a relative loss of control by European authorities and market participants over the vital payment rails which “at the end of the day are the oil greasing the economy’s engine”. Initiatives such as SCT Inst signal a willingness to regain influence and market share all the while embracing a customer-centric user experience. To bring it all together – market access, regulatory compliance, customer trust & cybersecurity – collaboration with established market participants will remain key to Payconiq’s business strategy: “the future of payments is also shaped by regulation. In Europe, we have very advanced regulation in terms of open banking, which has completely changed the rules of the game for banks. Actually, we think this is one of our key roles: to help banks stay relevant in an increasingly competitive environment. This is why we’ve been working hard on embedding our solution in bank apps.”

Leveraging comparative advantages – intellectual property in relation to technological breakthroughs, established market infrastructure, regulatory affairs experience – will remain a key consideration for the future viability of any and all market participants in the payments space, be they small or large. LHoFT exists to enable such collaboration, which is facilitated by the all-hands-on-deck approach of our private and public partners in Luxembourg.

Author: Jérôme Verony – LHoFT Research and Strategy Associate