Payments System Board Annual Report – 2006 Payment Systems Technology and Architecture
Over the past year, the Board has examined in some detail the architecture of the Australian payments system and the technology upon which it is based. The Board has focused on two related issues. The first is whether the development of payment products in Australia has been keeping pace with that abroad. The second is whether the bilateral arrangements on which a number of Australia's payment systems are based have implications for the pace of innovation in Australia.
The Board's interest in these areas reflects the important role that technology can play in the evolution of the payments system. The Board recognises that decisions about technology and product development are typically best made by industry; however, it is also of the view that there is a benefit to be gained from further public discussion and industry analysis of the way the payments system has developed, and how it might develop in the future.
Product Developments
Overall, Australia has a creditable record in terms of payment system innovation. It was one of the first countries to develop a national PIN-based EFTPOS system, it has a sophisticated electronic bill presentment and payment service, and Australian financial institutions offer extensive internet banking facilities to their customers. Australian consumers also have universal access to the ATM network, and financial institutions can provide cardholders with a single card that can be used for ATM, debit and credit transactions. By international standards, Australia has a relatively efficient payment system that meets the needs of most businesses and consumers reasonably well.
Notwithstanding this record, consumers and businesses in some other countries are now being offered a greater range of payment services, or more flexible services, than is generally available in Australia. Examples of these services include the ability to pay for goods on-line using a bank account in a secure environment; interfaces between payment and invoicing systems for businesses; and the application of chip technology to debit and credit cards.
‘On-line debit’
In a number of economies, including Canada, Germany, Hong Kong, the Netherlands and Singapore, consumers shopping on-line can choose a payment option that automatically links details of the transaction – the price and merchant's account details – to their internet banking facility. This option (sometimes referred to as ‘on-line EFTPOS’, although no card is actually used) allows a real-time, authorised payment to be made to the merchant, without using a credit card or scheme debit card. The process is relatively simple. Customers selecting the on-line debit option at the merchant's website are switched to their bank's internet website. They log in, in the usual way, and are automatically prompted to authorise the transaction. A message from the bank, confirming the successful transaction, is then relayed back to the merchant.
This form of payment offers benefits to customers and merchants. The customer is able to make payment from an account accessible by internet banking and does not have to provide account details to the merchant. The merchant is not exposed to the fraud risks associated with accepting credit cards on‑line and generally pays lower merchant service fees on these transactions. On-line debit also allows the merchant to sell goods and services to those consumers who do not have a credit card. (While scheme debit cards also allow on-line purchases to be made from a deposit account, their use raises the same issues as for credit cards, namely: confidentiality; merchant service fees; and fraud.)
In Australia, there is no widely available ‘on-line debit’ facility. This was noted by the House of Representatives Standing Committee on Economics, Finance and Public Administration in its report on the Reserve Bank's Annual Reports for 2005. The Committee encouraged industry to address this issue.
Business products
There have been a number of developments overseas which have improved the efficiency of electronic payments for business customers. In some cases, these developments have provided products that improve the interface between payment systems and business accounting systems. As a result, they are facilitating better opportunities for straight-through processing for business-to-business payments, and thus increased use of electronic payments.
In a number of countries, electronic payment systems have been updated to allow businesses to include additional information with each payment message. In the United States, for example, the Electronic Payments Network recently introduced a new message format that allows users to fill in 10 separate fields with information relating to the transaction. Similarly, as part of its move towards the Single Euro Payments Area, the European Payments Council has developed a standard for credit transfer payments that provides more than 60 remittance data fields, as well as up to 140 characters of ‘free text’ to enable automatic reconciliation by the beneficiary. And in the Scandinavian countries, there has been a move towards a common standard for electronic invoicing of business-to-business transactions, allowing businesses to issue electronic invoices and payment to be made without re-keying invoice details.
In Australia, the format of messages in the electronic payment system used for many business‑to‑business payments – the direct entry system – has remained largely unchanged since the 1970s. It allows only 18 characters for users to add their own supplementary information after critical details, such as account numbers and the payment value, are included. This constraint on the amount of additional information is one factor that helps explain the continued reliance of Australian businesses on payments by cheque.
The limited flexibility of the direct entry system has been raised by a range of business organisations in discussions with the Bank, and was discussed in a recent report by the Department of Communications, Information Technology and the Arts on the future of electronic payments markets in Australia.[6] The majority of businesses surveyed for this report indicated that they wished to make and receive more electronic payments, rather than use cheques, which they recognised as more expensive. Businesses receiving payments reported that the most significant issue they faced was that there was not enough information in the direct entry payments to reconcile accounts.
There have been efforts to overcome some of the limitations of the current message formats. Financial institutions and other third-party providers offer services that ‘tag’ payments with an identifying code when it is passed into the direct entry system; this code is then used by the recipient to link the payment with related accounting information. However, there is no standardisation of this approach across the industry, and fully automated reconciliation processes are typically not possible.
The issue of upgrading the direct entry system to better serve business customers was considered by APCA in 2001. While it was agreed that enhancements to the message standard would represent an improvement to existing arrangements, most financial institutions concluded that there was an insufficient business case to justify upgrading the system at that time.
Chip and PIN developments
A third area where there has been significant change overseas is in the adoption of PIN and chip in card payment systems. PIN authorisation of transactions is used to lower fraud. Chip technology also reduces fraud, while providing a number of other benefits, such as the potential to consolidate payment and non-payment functions on the one card. Chip-based cards can also be adapted for contactless use, where information is accessed when the card is held close to the terminal, allowing faster transactions; contactless chip cards are, for example, already widely used in public transport systems. The use of chips also allows payment functions to be held on devices other than a card, including on mobile phones.
In Australia, credit card transactions are still authorised by signature, and most cards are issued with only a magnetic stripe.
Overseas, chip migration programs have been underway for some time, typically motivated by rising fraud costs. These programs have been promoted by the credit card schemes, which have developed a standard – referred to as the EMV (Europay, MasterCard and Visa) standard – for chip use in financial transactions. One of the means of promoting chip use has been the introduction of a liability shift, where an acquirer or issuer that has not implemented the EMV standard becomes liable for fraudulent transactions. For transactions between countries in the Asia‑Pacific region, the liability shift became effective on 1 January 2006.
Amongst European countries, the United Kingdom is particularly advanced in migrating to chip technology which satisfies the EMV standard; all cards are chip-based and domestic point-of-sale transactions are PIN authorised. In part, this progress reflects the co-ordination role played by a high-level industry forum, made up of senior executives from industry bodies, financial institutions, retailers and consumer groups. The forum determined how and when the changeover would occur and was responsible for overseeing the project and educating both the industry and public.
In the Asian region, Japan, Malaysia and Taiwan have the most advanced chip migration programs. Migration is complete for credit card systems and in the pipeline for other point-of-sale card systems. A number of other economies – Hong Kong, India, Indonesia, Pakistan, the Philippines, Singapore and Thailand – are expected to have migrated their credit card systems by early 2007.
In North America, the Canadian EFTPOS/ATM system, Interac, is planning to be able to process chip transactions by the start of 2007. In contrast, there seems to be little impetus for chip migration on either credit or debit cards in the United States.
In Australia, PIN authorisation of credit card transactions was first considered by the industry in 2001, when APCA was asked by the banks to co-ordinate an industry-wide project. Given that Australia had a nation-wide system in which cardholders were used to authorising debit card transactions with a PIN, it was thought that PIN authorisation for credit card transactions was a natural next step. However, the industry group eventually decided that there was no business case for proceeding, given the low level of credit card fraud in Australia. Since then, banks have spent considerable resources investing in a range of other anti-fraud initiatives, designed to detect unusual activity on accounts. These have been largely successful, with fraud levels on credit cards falling further since 2001.
Recently, the industry has again been discussing the possibility of moving to PIN authorisation of credit card transactions and the use of chip. Costs of upgrading to PIN authorisation are now substantially lower than in 2001 as many terminals have been upgraded to allow remote installation of software, and the industry is now revisiting the issue of PIN authorised transactions on the magnetic stripe technology. By the end of 2008, it seems likely that cardholders will have the option of authorising credit card transactions at the point of sale with a PIN.
Progress towards chip migration has also taken place. The pace of change is being accelerated as banks react to the change in liability for fraud that came into effect in Australia at the beginning of 2006. Prior to this change, issuing banks bore the cost of most fraud in the credit card system. The new arrangements mean that if an issuer has converted its cards to chip, but the terminal where the card is used has not been converted, the liability for fraud lies with the merchant's acquirer. This is encouraging both issuers and acquirers to speed up conversion in order to avoid liability for fraud. However, while individual banks have their own conversion programs, at this point there is no timetable for industry-wide chip migration in Australia.
The House of Representatives Standing Committee on Economics, Finance and Public Administration has taken a close interest in the benefits of chip and PIN technology and has encouraged the industry to implement PIN authorisation of credit card payments and to consider the widespread adoption of chip technology.
Australia's Bilateral Systems
The second broad issue that the Board has focused on is the reliance of Australia's retail payment systems on bilateral linkages and business arrangements.
Traditionally, payment systems have been categorised as either bilateral or centralised. In a bilateral system, institutions can participate either directly or indirectly. Direct participants exchange payment messages directly with one another, with each participant having a separate physical link to every other direct participant. In some bilateral systems, negotiations are also required with each direct participant about both technical details relating to the actual physical connection and business arrangements such as interchange agreements. Participants who enter the system indirectly do so as a ‘customer’ of a direct participant, who then directs their messages to other direct participants.
In contrast, in centralised systems, participants pass payment messages to one another through a central entity, often referred to as a ‘switch’. These centralised networks are structured so that each participant only needs one physical connection into the system, and there are no bilateral contracts between the participants.
With greater use of internet technology, the traditional distinction between these two types of systems has become somewhat blurred. It is now possible to have a hybrid system in which participants pass messages bilaterally over a private network. This allows some of the benefits of centralisation – only one connection into the network is required – but still maintains the structure that messages are passed directly between individual participants. Some centralised systems have also adopted internet technology, but still route messages through a central entity which forms part of the payment network.
In Australia, the EFTPOS system, the direct credit and direct debit systems and the ATM system are all bilateral networks, operating through a series of bilateral links and contracts between direct participants. (The credit card systems and the BPAY network operate under the centralised model.) This heavy reliance on bilateral systems is unusual by international standards. In other countries where bilateral systems have existed, for example in Canada and Finland, there has been a tendency for them to move to a hybrid model with a single point of entry to the network. Centralised systems though are far more common; examples include: the direct entry system, Voca, in the United Kingdom; Interpay in the Netherlands; and the Electronic Payments Network in the United States.
The Board recognises that bilateral systems may provide both benefits and potential challenges.
In some situations, bilateral linkages may be the quickest, and perhaps the only feasible way, to establish a particular payment system. If, for instance, it is difficult to get multiple institutions to agree to establish a comprehensive system, an alternative is for two institutions to agree to exchange payments and provide services to customers that have accounts with either of them. If a third institution subsequently wishes to join, it can then establish a link to each of the first two institutions. This can be a practical way for a system to expand, allowing tailored technical connections for each pair of institutions. Both the ATM and EFTPOS systems in Australia essentially developed in this way.
Bilateral arrangements can, however, pose some challenges once the system matures. After a bilateral system reaches a certain size, obtaining access can become more difficult and expensive than obtaining access to a system with ‘single point of access’ – any new institution must reach an agreement to exchange payment data with each of the existing participants. In Canada, concerns about access to the ATM/EFTPOS system, Interac, led to intervention by the competition authority. To satisfy the competition authority's requirements, Interac was upgraded to an internet-based network with access through a single standardised connection.
In addition to access, bilateral systems may be more difficult to renovate and update. Without an organisation focused on promoting and developing the network, it may be difficult for participants to agree on the technical details of any changes to the system as well as to commit resources to upgrade the system.
Internationally, some payment systems have addressed the challenge of fostering innovation by establishing two companies: a scheme, which agrees the operating rules for the system; and a for-profit organisation that physically operates the system. In the United Kingdom, this separation of roles was a key recommendation of the Cruickshank Report into competition in banking, and broadly similar changes have taken place in the ATM/EFTPOS networks in Canada and the Netherlands. In these countries, the ‘for-profit’ system operator has made changes to the infrastructure to promote the interests of the business; the result has been that each is now operating on a recently upgraded platform, which uses the internet to pass payment messages between participants (in the case of the bilateral business model in Canada) or from participants to the central switch or processor (in the case of Voca, the processor for BACS Limited in the United Kingdom, and Interpay in the Netherlands).
In Australia, upgrades to the ATM, EFTPOS and direct entry systems have been limited to individual efforts by participants. Some financial institutions have made bilateral agreements to move from the older style point-to-point connections to internet-based connections to exchange payment messages. Others, which offer services to indirect participants, have developed their own internet network for receiving messages. However, there is no industry-wide standard for the internet technology being applied.
As long as physical links between direct participants in the EFTPOS, ATM and direct entry systems remain bilateral, new entrants that wish to be direct participants in these systems must establish a number of connections before they can be fully operational. In the EFTPOS system, this process has recently been made more transparent and less complex by the combined effect of the Bank's EFTPOS Access Regime and APCA's EFTPOS Access Code. The Bank has encouraged industry to consider whether similar arrangements for the ATM network would be appropriate.
APCA and the Australian Bankers' Association are in the process of assessing the existing infrastructure and are considering whether current arrangements are able to deliver an internationally competitive payment service to Australian businesses and consumers. The Bank is looking forward to working co-operatively with the industry and participating in further discussions on these issues.
Footnote
Department of Communications, Information Technology and the Arts, Exploration of Future Electronic Payments Markets, 2006. [6]