## wpiea2020075-print-pdf

## Source details

**Canonical URL:** [wpiea2020075-print-pdf](https://www.imf.org/-/media/files/publications/wp/2020/english/wpiea2020075-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2020/english/wpiea2020075-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2020/english/wpiea2020075-print-pdf.pdf.json)

---

### Motivation for analytical framework
- Fintech has prompted assessment of financial stability benefits and risks, particularly in payments, clearing, and settlements.
- Retail payment developments driven by cashless promotion, competition, financial inclusion, financial integration, and addressing correspondent banking relationship (CBR) withdrawals.
- Need to augment entity-based regulation with activities-based approaches; licensing regimes should be redesigned to bring new service providers, including fintech and Big Tech, within the regulatory perimeter where appropriate.
- Paper proposes a four-step analytical framework (steps may occur contemporaneously and promoting legal certainty applies throughout).
- Sections: identifying payment activities; licensing and designation; major risks and management; legal certainty; policy issues for central banks; conclusions.

### Step One — Identifying payment activities
- International experience groups payment activities into 6 groups:
  - (i) account issuance
  - (ii) electronic money issuance
  - (iii) domestic funds transfer
  - (iv) cross-border funds transfer
  - (v) merchant acquisition
  - (vi) digital payment tokens
- PSD2 (EU, 2015) defines payment services via 8 annexed activities and groups services into 8 categories (listed in source).
- Singapore PS Act (2019) defines 7 licensing categories (Part 2, Section 6; Part 1 of the First Schedule):
  - (i) account issuance service
  - (ii) domestic money transfer service
  - (iii) cross-border money transfer service
  - (iv) merchant acquisition service
  - (v) electronic money issuance service
  - (vi) digital payment token service
  - (vii) money-changing service
- Exclusions and exemptions exist (EU PSD2 Article 3 lists 15 non-applicable activities; Singapore PS Act Part 2, Section 13 exempts certain persons and lists non-payment activities).
- Big Tech payment business models — two settlement architectures:
  - overlay system (using third-party infrastructures)
  - proprietary system (using firm-owned infrastructures)
- Illustrative Big Tech offerings by payment service category (Y = offers, N = does not offer):
  - Account issuance — Google Pay Y; Amazon Pay Y; Facebook Pay Y; Line Pay Y; Apple Pay Y; Baidu Wallet Y; Alipay Y; Tencent We Chat Pay Y
  - E-money issuance — Google Pay N; Amazon Pay N; Facebook Pay N; Line Pay Y; Apple Pay Y; Baidu Wallet Y; Alipay Y; Tencent We Chat Pay Y
  - Domestic funds transfer — Google Pay N; Amazon Pay Y; Facebook Pay Y; Line Pay Y; Apple Pay Y; Baidu Wallet Y; Alipay Y; Tencent We Chat Pay Y
  - Cross-border funds transfer — Google Pay N; Amazon Pay N; Facebook Pay N; Line Pay N; Apple Pay N; Baidu Wallet Y; Alipay Y; Tencent We Chat Pay Y
  - Merchant acquisition — Google Pay N; Amazon Pay Y; Facebook Pay N; Line Pay Y; Apple Pay Y; Baidu Wallet Y; Alipay Y; Tencent We Chat Pay Y
  - Digital payment token — Google Pay N; Amazon Pay N; Facebook Pay N; Line Pay N; Apple Pay N; Baidu Wallet N; Alipay N; Tencent We Chat Pay N

### Mobile money and payments
- Mobile money features:
  - (i) transfers and payments using mobile phones
  - (ii) availability to the unbanked
  - (iii) distinct from mobile banking when phone is mere channel
- GSMA mobile money transaction categories (8): air-time top-ups; bill payments; bulk disbursement; cash-in; cash-out; international remittance between customer accounts; merchant payment; person-to-person transfers.
- 2018 global mobile money transaction values: large share from person-to-person transfers and cash-related activities (GSMA).
- Regulatory challenges:
  - MNO mobile money services have grown in systemic importance after light-touch treatment.
  - Risk-proportionate AML/CFT regulation used to facilitate inclusion without stifling innovation.
  - Partnerships (e.g., MNOs with micro-finance firms) may blur boundaries with credit activities, possibly requiring separate regulation.
- EU telecom operators under PSD2:
  - Payments for physical goods via telecom operator now within scope; exclusions narrowed to payments for digital services downloaded on a device, electronic tickets, or donations.
  - Exclusions apply only below thresholds: EUR 50 per transaction; EUR 300 per billing month. Telecom operators must notify competent authorities annually and are listed in public registers.

### Digital payment tokens
- Digital payment tokens are a novel payment method; stablecoins (crypto-assets linked to pools of assets) aim to address earlier crypto-asset limitations; global stablecoins (GSCs) could potentially improve cross-border payments.
- Regulatory concerns include: legal certainty; governance and investment rules; financial integrity; safety, efficiency, integrity of payment systems; cyber security and operational resiliency; market integrity; data privacy, protection and portability; consumer/investor protection; tax compliance.
- Crypto-assets may exhibit hybrid features (payments, stores of value, securities, commodities), creating potential regulatory gaps.
- U.S. considerations referenced: cash in circulation, reserve currency status of the US dollar, banking system robustness, availability of digital payment options.
- A few jurisdictions have initiated reforms addressing digital payment tokens as means of payment.

### Step Two — Licensing entities and designating systems
- Distinct regulatory roles:
  - Prudential supervision — targets PSPs.
  - Oversight — focuses on payment systems, critical service providers, payment instruments, and schemes.
- Licensing entity classification groups: (i) credit institutions; (ii) electronic money institutions (ELMI); (iii) post office institutions; (iv) payment institutions (PI); (v) national central banks.
- When institutions collect client balances (e.g., e-wallets), prudential supervision becomes more important.
- Global licensing statistics (BCBS survey across 19 jurisdictions):
  - Providing payments and value transfer services: 16 (Full Banking License), 7 (Limited Banking License), 19 (Other Financial License), 1 (No License)
  - Issuance / transfer of non-fiat digital currency: 6 (Full Banking License), 2 (Limited Banking License), 7 (Other Financial License), 12 (No License)
  - Providing clearing and/or settlement of payment transactions or transactions in financial instruments: 6 (Full Banking License), 3 (Limited Banking License), 16 (Other Financial License), 1 (No License)
- Licensing variation and threshold approaches: thresholds may separate licensing and registration; authorities may benchmark using metrics such as average daily e-money float and monthly average payment transaction values.

### Illustrative licensing thresholds (Box 3 examples)
- European Union:
  - Exemption if monthly average of preceding 12 months’ total value of payment transactions does not exceed Member State limit but no more than EUR 3 million.
  - ELMI exemption if average outstanding e-money does not exceed EUR 5 million; registration required in both cases.
  - UK: small payment institution (SPI) turnover not exceeding EUR 3 million per month; small EMI does not generate more than EUR 5 million average outstanding e-money.
- Singapore (three license types and thresholds):
  - License types: (i) standard payment institution (SPI), (ii) major payment institution (MPI), (iii) money changing.
  - SPI thresholds:
    - e-money float of up to SGD 5 million only (average daily balance over a year)
    - total transaction value up to SGD 3 million per month only (averaged over 1 year) for any one activity
    - total transaction value up to SGD 6 million per month (averaged over 1 year) for two or more activities
  - MPI required if:
    - e-money float is above SGD 5 million (average daily balance over a year)
    - total transaction value above SGD 3 million per month (averaged over 1 year) for any one activity
    - total transaction value above SGD 6 million per month (averaged over 1 year) for two or more activities
  - A PSP needs only one license for any combination of activities; license variations require approval.

### Designation of payment systems and regulatory intensity
- Systemically important payment systems (SIPS) characteristics:
  - sole payment system or principal system by aggregate value
  - handle time-critical, high-value payments
  - settle other systemically important FMIs
- Designation criteria: number and value of transactions; number/type of participants; markets served; market share; interconnectedness; available alternatives at short notice.
- Regulatory intensity categories:
  - Highly regulated: CSP, SIPS, CBRs subject to banking regulation and AML/CFT
  - Moderately regulated: proportionate rules for PIs, ELMIs, MNOs, MTOs; FMI critical service providers subject to oversight expectations
  - Less regulated: informal funds transfers (IFT)
- Jurisdictional approaches may differ.

### Step Three — Risk analysis and management
- Five risk categories: funds protection; financial integrity; cyber/data security; access to payment systems; interoperability.
- Risk map (inherent risks by activity: H = High, M = Moderate, L = Low)
  - Account issuance services: Funds protection M; Financial Integrity H; Cyber and Data Security H; Access to Payment Systems L; Interoperability M
  - E-money issuance: Funds protection H; Financial Integrity L; Cyber and Data Security H/M; Access to Payment Systems M; Interoperability L
  - Domestic funds transfer: Funds protection H; Financial Integrity H; Cyber and Data Security H/M; Access to Payment Systems H; Interoperability L
  - Cross-border funds transfer: Funds protection H; Financial Integrity H; Cyber and Data Security H/M; Access to Payment Systems H; Interoperability L
  - Merchant acquisition services: Funds protection H; Financial Integrity L; Cyber and Data Security H/M; Access to Payment Systems M; Interoperability M
  - Digital payment token services: Funds protection M; Financial Integrity H; Cyber and Data Security H/M; Access to Payment Systems H; Interoperability L

- A. Funds protection — mechanisms and observed measures
  - Objectives: protect electronic money float and funds in transit against insufficiency and trustee/bank insolvency.
  - Mechanisms: segregated bank accounts; treating funds in transit with same safeguarding as e-money; pass-through deposit insurance (depends on legal deposit definition and custodial conditions); insurance guarantees by independent insurers/credit institutions.
  - Central bank reserve example (People’s Bank of China measures):
    - January 2017: required to hold 20 percent of customer funds in a single segregated custodial account at a commercial bank
    - January 2018: ratio raised to 50 percent
    - January 2019: required to hold 100 percent of customer balances in a non-interest-bearing reserve account at the central bank

- B. Financial integrity — AML/CFT application
  - FATF guidance: risk-based approaches for prepaid cards, mobile payments, internet-based payments; enhanced guidance for virtual assets (VA) and virtual asset service providers (VASP).
  - FATF defines virtual asset and requires all VASPs to be subject to AML/CFT supervision (subject to CDD exemption for transactions below USD/EUR 1,000).
  - Jurisdictions (EU, UK, Singapore) use threshold approaches assessing account balances and transaction volumes to decide KYC requirements; some limited e-wallets may be carved out if low ML/TF risk.
  - Singapore applies AML/CFT requirements to reporting entities regardless of transaction being fiat or digital tokens.

- C. Cyber and data security — risks and expectations
  - Risks heightened by open banking, third-party access, weak IT governance, and new players.
  - Principles: sound technology risk management framework; strengthen system security, reliability, resiliency, recoverability; deploy strong authentication.
  - Jurisdictional examples:
    - Singapore: cyber hygiene regulations and technology risk management guidelines for licensees.
    - EU PSD2: security measures mandated by European Banking Authority.
  - Incident illustration: 7-Eleven Japan suspended mobile payment services after hackers compromised USD 500,000 from customer accounts (July 2019).

- D. Access to payment systems — channels and policy trade-offs
  - Access channels: direct non-settling participant; indirect participant.
  - Broader access can diversify arrangements, reduce single points of failure, widen settlement in central bank money, mitigate credit risks, and level the playing field.
  - Access typically restricted to institutions meeting high regulatory/supervisory standards; central bank discretion on settlement account eligibility and intraday/overnight liquidity facilities.
  - Supervisory assessment factors: governance, safeguarding of funds, financial crime compliance, ongoing oversight, independent audits.

- E. Interoperability — objectives and instruments
  - Interoperability reduces market fragmentation and supports e-payments acceptance.
  - SEPA example: technical interoperability via ISO 20022, IBAN, SEPA Credit Transfer and SEPA Direct Debit schemes.
  - Singapore PS Act empowers central bank to ensure interoperability in consumer and market interests.

### Step Four — Promoting legal certainty
- Transparent, comprehensive legal frameworks are imperative as payment services modernize.
- "Same activity, same regulation" applied by some authorities to extend existing banking rules to new entrants.
- Functional (activity-based) regulatory design recommended to regulate providers of the same activity uniformly without tailoring to technology.
- Legal framework components (examples):
  - Laws of general application: property and contract laws; banking and finance laws; insolvency laws; jurisdiction rules; electronic documents/signatures laws.
  - Laws specific to payments: payment instrument laws; payment obligation laws (netting, novation, finality); default and dispute laws; central bank role laws; laws on formation and conduct of infrastructures and markets.
- Model laws and international instruments can inform reforms (UNCITRAL model laws; EU Directive 98/26/EC on settlement finality).

### Jurisdictional examples and boxes
- Box 2 — Regulation of digital payment tokens (selected jurisdictions):
  - Singapore PS Act defines digital payment tokens with five characteristics (Part 1, Section 2) including not denominated in any currency and not pegged to any currency.
  - Switzerland (FINMA): payment tokens intended as means of payment; tokens give rise to no claims on issuer; classifies utility, asset, and hybrid tokens; supplements clarify stablecoin classifications.
  - United States: New York BitLicense for virtual currency business activities; H.R. 2144 Token Taxonomy Act of 2019 sought to define virtual currency as "a digital representation of value that is used as a medium of exchange and is not currency" (bill introduced as of April 2019).
- Box 4 — Canada legal reforms for retail payments:
  - Budget 2019 proposals: introduce new retail payments oversight framework; require PSPs to establish operational risk management and protect users’ funds; Bank of Canada to oversee compliance and maintain public registry; technical amendments to Canadian Payments Act to modernize Payments Canada governance.
  - Broader legal context: digital payment token services may implicate other laws and authorities (tax, securities, banking).
  - Authorities’ approaches include regulation/oversight of trading platforms and wallets; guidance and warnings; registration/licensing; tax clarity; sandboxes; bans in some cases.

### Policy issues for central banks
- A. Payments stability
  - Large technology firms could offer cross-border funds transfers via digital payment tokens needing assessment for systemic implications and possibly SIPS designation and PFMI application.
  - Cross-border issues: regulatory arbitrage; unclear passporting rights enabling cross-border services without physical presence.
  - Need for cooperative oversight across central banks, securities regulators, financial intelligence units for lead overseer determination, information sharing, cooperative oversight, and crisis management.

- B. Financial stability
  - Crypto-assets: regulatory gaps when outside perimeters; monitored for financial stability risks at international level.
  - Big Tech: potential to alter market structure, increase concentration and contestability; unbundling of payment services may pressure traditional institutions to pursue riskier activities.
    - Example: in China, nonbank payment institutions offered online money market funds and two firms accounted for 94 percent of the mobile payments market.
  - AI/Machine Learning: applications for transaction analysis raise data privacy, third-party dependency, emergence of systemically important players outside perimeter, lack of interpretability/auditability, and opacity risks.

- C. Monetary stability
  - Mobile money: payments outside traditional banking could complicate monetary policy transmission and central bank liquidity management; e-float raises questions on float role and timing into banking system.
  - Digital payment tokens: potential GSCs could weaken domestic monetary policy, increase cross-border capital mobility, and undermine monetary sovereignty if they substitute for fiat currencies.
  - Central banks have roles to make fiat currencies better/stabler units of account; many central banks researching central bank digital currencies and experimenting with distributed ledger technology.

### Conclusion and policy implications
- Fintech developments necessitate augmenting entity-based regulation with activity-focused approaches.
- Licensing regimes need redesign to include new providers where appropriate, including fintech and large technology firms.
- Four-step analytical framework to guide authorities:
  1. Examine whether an activity is a payment service.
  2. Determine whether an entity requires licensing.
  3. Analyze new risks (funds protection; financial integrity; cyber/data security; access to payment systems; interoperability) not effectively addressed in current frameworks.
  4. Promote legal certainty via transparent, comprehensive legal frameworks.
- Central banks should monitor growing systemic importance and impacts on payments stability, financial stability, and monetary policy transmission; adherence to international standards and additional regulatory requirements may be warranted as risks evolve.

*Source: wpiea2020075-print-pdf - References*

### References .............................................................................................................

### References

### I. Motivation for Analytical Framework
- Fintech has prompted authorities to assess financial stability benefits and risks, particularly in payments, clearing, and settlements.
- Retail payment services have seen rapid developments motivated by promoting cashless-ness, competition, financial inclusion, financial integration, and addressing correspondent banking relationship (CBR) withdrawals.
- While fintech is small relative to the financial system, growth and supervisory/regulatory issues have drawn attention (IMF, 2017; IMF, 2019; FSB, 2017a).
- Regulatory approaches need to augment entity-based regulation with activities-based approaches as market structure changes.
- Licensing regimes should be redesigned to bring new service providers, including fintech and Big Tech, within the regulatory perimeter where appropriate (BIS, 2019; FSB, 2019a; Frost et al., 2019; Restoy, 2019).
- Some jurisdictions (e.g., European Union, Singapore, Canada) have modernized frameworks using activity-based, risk-focused approaches to foster safety, efficiency, innovation and competition.
- The paper proposes an analytical framework organized around four key steps; promoting legal certainty may be applicable throughout and steps may occur contemporaneously.
- Sections in the paper cover: identifying payment activities; licensing and designation; major risks and management; legal certainty; policy issues for central banks; and conclusions.

### II. Step One — Identifying Activities as Payment Services
- Purpose: identify whether an economic activity is a payment service to design effective oversight and avoid regulatory overlap or duplication.
- International experiences organize payment activities into 6 groups:
  - (i) account issuance
  - (ii) electronic money issuance
  - (iii) domestic funds transfer
  - (iv) cross-border funds transfer
  - (v) merchant acquisition
  - (vi) digital payment tokens
- Explicit payment service laws provide clarity:
  - EU Payment Services Directive 2 (PSD2) of 2015 (Article 4) defines payment services as business activity associated with 8 types of activities annexed to the Directive.
  - PSD2 (Annex 1) groups payment services as: (i) services enabling cash to be placed on a payment account as well as all the operations required for operating a payment account; (ii) services enabling cash withdrawals from a payment account as well as all the operations required for operating a payment account; (iii) execution of payment transactions, including transfers of funds on a payment account with the user’s PSP or with another PSP; (iv) execution of payment transactions where the funds are covered by a credit line for a payment service user; (v) issuing of payment instruments and/or acquiring of payment transactions; (vi) money remittance; (vii) payment initiation services; and (viii) account information services.
  - Singapore’s Payment Services Act (PS Act) of 2019 defines payment activities into 7 categories for licensing (Part 2, Section 6; Part 1 of the First Schedule): (i) account issuance service; (ii) domestic money transfer service; (iii) cross-border money transfer service; (iv) merchant acquisition service; (v) electronic money issuance service; (vi) digital payment token service; and (vii) money-changing service.
- Exclusions:
  - EU PSD2 (Article 3) determines non-applicability to 15 payment activities such as cash, paper-based instruments, and ATM cash withdrawals.
  - Singapore PS Act (Part 2, Section 13) exempts certain persons and entities and lists activities not considered payment services (Part 2 of the First Schedule).
- Big Tech payment business models:
  - Two settlement architectures: overlay system (using third-party infrastructures) and proprietary system (using firm-owned infrastructures).
  - Common applications: digital wallets, online banking, domestic and cross-border funds transfers.
  - Table 1 (Big Tech Payment Activities) reports approximate offerings by selected firms across Payment Service categories; for illustrative purposes only and non-exhaustive.
  - Specifics from Table 1: Account issuance — Y for Google Pay, Amazon Pay, Facebook Pay, Line Pay, Apple Pay, Baidu Wallet, Alipay, Tencent We Chat Pay; E-money issuance — N, N, N, Y, Y, Y, Y, Y respectively; Domestic funds transfer — N, Y, Y, Y, Y, Y, Y, Y respectively; Cross-border funds transfer — N, N, N, N, N, Y, Y, Y respectively; Merchant acquisition — N, Y, N, Y, Y, Y, Y, Y respectively; Digital payment token — N for all listed firms.

### III. Mobile Money and Payments
- Mobile money services can be account-based or cash-based and differ from traditional banking by:
  - (i) transferring money and making/receiving payments using the mobile phone;
  - (ii) availability to the unbanked; and
  - (iii) exclusion of mobile banking where the mobile phone is just a channel to a traditional banking product.
- GSMA classifies mobile money transaction activities into 8 payment-related categories for statistical harmonization: (i) air-time top-ups funded from customer accounts; (ii) bill payments using mobile money; (iii) bulk disbursement; (iv) cash-in to customer accounts; (v) cash-out from customer accounts; (vi) international remittance made between customer accounts; (vii) merchant payment; and (viii) person-to-person transfers.
- Global mobile money transaction values in 2018 show a large share originating from person-to-person transfers and cash-related activities compared with air-time top-ups or international remittances (Figure 3; source: GSMA).
- Regulatory challenges:
  - MNO mobile money services have posed challenges due to growing systemic importance and earlier light-touch regulatory treatment.
  - Risk-proportionate regulations, especially for AML/CFT, have been used to facilitate financial inclusion without stifling innovation.
  - As scale grows, potential financial stability risks warrant monitoring and supervisory vigilance, applying substance-over-form approaches.
  - Partnerships (e.g., MNOs with micro-finance firms to provide credit) may blur boundaries between payment services and other financial activities, potentially necessitating separate regulatory treatment.
- Box 1 — EU telecom operators:
  - Under EU PSD1, payments through a telecom operator were not covered when the operator acted as an intermediary (operator billing or direct-to-phone-bill purchases).
  - Under EU PSD2, purchases of physical goods through a telecom operator now fall within scope; exclusion narrowed to payments for digital services downloaded on a device, electronic tickets, or donations.
  - Exclusions apply only below certain thresholds: EUR 50 per transaction; EUR 300 per billing month. Telecom operators engaging in such activity must notify competent authorities annually and the activity will be listed in public registers.

### IV. Digital Payment Tokens
- Digital payment tokens are a novel payment method using digital tokens and remain largely untested.
- Stablecoins (crypto-assets linked to a pool of assets) aim to address limitations of earlier crypto-assets; global stablecoins (GSCs) could potentially improve cross-border payments.
- Regulatory concerns and risks for crypto-assets and GSCs include: legal certainty; governance and investment rules; financial integrity; safety, efficiency, integrity of payment systems; cyber security and operational resiliency; market integrity; data privacy, protection and portability; consumer/investor protection; and tax compliance (Group of Seven, 2019).
- Crypto-assets may exhibit features of payments, stores of value, securities, or commodities, possibly creating regulatory gaps if outside perimeters of market regulators and payment system oversight (FSB, 2019b; FSB, 2018).
- U.S. considerations for digital payment tokens included cash in circulation, reserve currency status of the US dollar, robustness of the banking system, and availability of digital payment options (Brainard, 2019).
- A few jurisdictions have initiated regulatory reforms addressing digital payment tokens as a means of payment.

### V. Step Two — Licensing Entities and Designating Systems
- Purpose: determine if an entity providing the payment service requires licensing or designation (if it is a payment system).
- Regulatory responsibilities for payment-related activities involve two distinct roles:
  - Prudential supervision — targets PSPs (payment service providers).
  - Oversight — focuses on payment systems, critical service providers, payment instruments, and schemes.
- Supervisory and oversight powers are generally established in central bank laws and payment service laws; the approaches are complementary.
- Oversight ensures sound and safe functioning of payment systems, payment instruments, payment schemes, or other payment infrastructures.
- Prudential supervision pursues safe, stable, and secure financial institutions delivering payment services to users.

*Source: wpiea2020075-print-pdf - References*

### Box 2. Regulation of Digital Payment Tokens in Selected Jurisdictions

### Box 2. Regulation of Digital Payment Tokens in Selected Jurisdictions

### Jurisdictional definitions and guidance
- Singapore
  - The Singapore PS Act (Part 1, Section 2) defines digital payment tokens as: “any digital representation of value (other than an excluded digital representation of value) that (i) is expressed as a unit; (ii) is not denominated in any currency, and is not pegged by its issuer to any currency; (iii) is, or is intended to be, a medium of exchange accepted by the public, or a section of the public, as payment for goods or services or for the discharge of debt; (iv) can be transferred, stored or traded electronically; and (v) satisfies such other characteristics as the authority may prescribe.”
- Switzerland
  - FINMA Guidelines for Enquiries Regarding the Regulatory Framework for Initial Coin Offerings (ICO) describe payment tokens (synonymous with cryptocurrencies) as: “tokens which are intended to be used, now or in the future, as a means of payment for acquiring goods or services or as a means of money or value transfer. Cryptocurrencies give rise to no claims on their issuer”.
  - The Guideline describes utility tokens, asset tokens, and hybrid tokens (where asset and utility tokens are also classified as payment tokens, and in effect, are deemed to be both securities and means of payment).
  - A Supplement clarifies stable coin classifications and potential relevance of money laundering, securities trading, banking, fund management and financial infrastructure regulation.
- United States
  - New York State Department of Financial Services established a BitLicense for entities associated with virtual currency business activities.
  - A bill (H.R. 2144 Token Taxonomy Act of 2019) was introduced to the U.S. House of Representatives (as of April 2019), which sought to define virtual currency as: “a digital representation of value that is used as a medium of exchange and is not currency”.

*Source: Monetary Authority of Singapore, Swiss Financial Market Supervisory Authority, New York State Department of Financial Services.*

### A. Licensing entities for prudential supervision — structure, gaps, and statistics
- Licensing overview and entity classification
  - Licensing processes typically start with the application process; payment service laws could exempt certain entities from licensing (Singapore’s PS Act (Part 2, Section 13) exempts licensed banks, merchant banks, finance companies, persons licensed to issue credit cards or charge cards, and any person or class of persons that may be prescribed).
  - Entities offering payment services can be grouped as: (i) credit institutions; (ii) electronic money institutions (ELMI); (iii) post office institutions; (iv) payment institutions (PI); and (v) national central banks. This classification helps determine applicable laws, licensing and regulatory requirements, competent authority, and regulatory gaps.
  - Prudential supervision becomes more important if the institution collects client balances (e.g., e-wallets) and when services resemble deposit/current account services provided by banks.
- Global licensing statistics (Table 2 — licensing of payment-related activities)
  - Providing payments and value transfer services: 16 (Full Banking License), 7 (Limited Banking License), 19 (Other Financial License), 1 (No License)
  - Issuance / transfer of non-fiat digital currency: 6 (Full Banking License), 2 (Limited Banking License), 7 (Other Financial License), 12 (No License)
  - Providing clearing and/or settlement of payment transactions or transactions in financial instruments: 6 (Full Banking License), 3 (Limited Banking License), 16 (Other Financial License), 1 (No License)
  - Note: BCBS survey included agencies in 19 jurisdictions (listed in the source).
- Licensing variation and thresholds
  - Licensing may vary by capital requirements, fit and propriety, financial conditions, incorporation, operational requirements, and public interest.
  - Threshold values can separate licensing and registration requirements; authorities may benchmark using metrics such as average daily balances of e-money float and monthly averages of payment transactions in the preceding 12 months.

### Box 3 — Licensing and threshold values in selected jurisdictions (illustrative thresholds)
- European Union
  - Exemption from supervisory licenses if the monthly average of the preceding 12 months’ total value of payment transactions, including any agent, does not exceed a limit set by the Member State but that, in any event, amounts to no more than EUR 3 million.
  - ELMI licensing exemptions if the total business activities generate an average outstanding e-money that does not exceed a limit set by the Member State but that, in any event, amounts to no more than EUR 5 million. Registration is required in both cases.
  - UK specifics: a small payment institution (SPI) has an average turnover in payment transactions not exceeding EUR 3 million per month; authorized payment institution (API) is over the EUR 3 million threshold and/or provides services in the EEA. Small EMI: business does not generate more than EUR 5 million average outstanding e-money; authorized EMI: business will generate more than EUR 5 million average outstanding e-money.
- Singapore (three license types and thresholds)
  - License types: (i) standard payment institution (SPI), (ii) major payment institution (MPI), and (iii) money changing. Threshold approach distinguishes SPIs and MPIs; thresholds do not apply to money-changing licensees.
  - SPI thresholds:
    - e-money float of up to SGD 5 million only (calculated as an average daily balance over a year)
    - total transaction value of up to SGD 3 million per month only (averaged over 1 year) for any one activity
    - total transaction value up to SGD 6 million per month (averaged over 1 year) for two or more activities
  - MPI required if:
    - e-money float is above SGD 5 million (average daily balance over a year)
    - total transaction value above SGD 3 million per month (averaged over 1 year) for any one activity
    - total transaction value above SGD 6 million per month (averaged over 1 year) for two or more activities
  - A PSP needs only one license for one or any number or combination of activities; licensees must obtain approval for any variation of license (e.g., to add a new activity).

### B. Designating payment systems for oversight — criteria and regulatory intensity
- Systemically important payment systems (SIPS)
  - SIPS are highly regulated given their potential to trigger or transmit systemic disruptions. Typical characteristics:
    - sole payment system in a country or principal system by aggregate value of payments
    - mainly handle time-critical, high-value payments
    - settle payments used to effect settlement in other systemically important FMIs
  - Criteria often considered for designation: (i) number and value of transactions processed; (ii) number and type of participants; (iii) markets served; (iv) market share controlled; (v) interconnectedness with other FMIs and other financial institutions; and (vi) available alternatives to using the FMI at short notice.
- Regulatory intensity categories for payment infrastructures (payment systems, payment service providers, payment schemes, and critical service providers)
  - Highly regulated
    - CSP, SIPS
    - CBRs are an activity subject to banking regulation, AML/CFT laws, and other relevant regulations
    - Non-SIPS considered non-systemic but may be required to comply fully or partly with relevant international standards
  - Moderately regulated
    - Proportionate regulation and threshold values applied to PIs, ELMIs, MNOs, MTOs
    - FMI critical service providers (IT and messaging providers) subject to oversight expectations
    - Postal office institutions provide postal payment services under their regulations
  - Less regulated
    - Informal funds transfers (IFT)
  - Note: Actual regulatory approach may differ by jurisdiction.

### IV. Step Three — Analyzing and managing risks (risk map and categories)
- Five risk categories to consider: funds protection, financial integrity, cyber/data security, access to payment systems, interoperability.
- Risk map — approximate inherent risks by payment activity (H = High, M = Moderate, L = Low)
  - Account issuance services: Funds protection M, Financial Integrity H, Cyber and Data Security H, Access to Payment Systems L, Interoperability M
  - E-money issuance: Funds protection H, Financial Integrity L, Cyber and Data Security H/M, Access to Payment Systems M, Interoperability L
  - Domestic funds transfer: Funds protection H, Financial Integrity H, Cyber and Data Security H/M, Access to Payment Systems H, Interoperability L
  - Cross-border funds transfer: Funds protection H, Financial Integrity H, Cyber and Data Security H/M, Access to Payment Systems H, Interoperability L
  - Merchant acquisition services: Funds protection H, Financial Integrity L, Cyber and Data Security H/M, Access to Payment Systems M, Interoperability M
  - Digital payment token services: Funds protection M, Financial Integrity H, Cyber and Data Security H/M, Access to Payment Systems H, Interoperability L

### A. Funds protection — mechanisms and observed policy measures
- Objectives and mechanisms
  - Safeguarding measures protect electronic money float and funds in transit against insufficient funds to meet customer demand and against insolvency of trustee/bank.
  - Effective off- and on-site supervision is a pre-condition for any funds protection mechanism; alternatives must be assessed for pros and cons.
- Key design considerations and examples
  - Segregated bank accounts protect customers from insolvency of the issuer but not from insolvency of the safeguarding bank itself.
  - Funds in transit (funds received from a user but not yet paid to the payee) can be exposed to credit risk when PSPs hold customer funds during payment chains; authorities should subject these funds to the same safeguarding requirements as electronic money.
  - Pass through deposit insurance extends bank deposit protection to stored value facilities; applicability depends on the legal definition of “deposits” and conditions like custodial relationships and identity/amount records for each owner.
  - Customer funds may be covered by an insurance policy or comparable guarantee by an insurance company or credit institution; guarantees should not belong to the same group as the payment institution and the amount should be equivalent to the segregated amount and payable when the payment institution is unable to meet its financial obligations.
- Central bank reserve requirement example
  - People’s Bank of China measures (as of January 2019): nonbank payment institutions were required to hold 100 percent of customer balances in a non-interest-bearing reserve account at the central bank. Timeline of measures:
    - January 2017: required to hold 20 percent of customer funds in a single segregated custodial account at a commercial bank
    - January 2018: ratio raised to 50 percent
    - January 2019: required to hold 100 percent

### B. Financial integrity — AML/CFT application to payment services and VAs/VASPs
- FATF and international guidance
  - FATF Guidance: “Risk-Based Approach: Prepaid Cards, Mobile Payments and Internet-based Payments” for applying a risk-based approach to AML/CFT measures.
  - FATF enhanced guidance for regulating virtual assets (VA) and virtual asset service providers (VASP).
  - FATF defines virtual asset as digital representations of value that can be digitally traded or transferred and can be used for payment or investment purposes; virtual assets are distinct from fiat currency.
  - If a VA/VASP falls within the scope of a product/service/activity covered by the FATF standard, it will be subject to AML/CFT requirements (subject to the CDD exemption for transactions below USD/EUR 1,000). All VASPs must be subject to AML/CFT supervision, commensurate with the nature, scale, and risks of their activities.
- Threshold approaches in practice
  - EU, UK, and Singapore use threshold approaches that assess account balances and transaction volume to decide whether Know Your Customer (KYC) is required.
  - For certain limited e-wallets with restricted reach/capability, jurisdictions may carve them out from regulations if assessed to carry low money-laundering and terrorist financing risks (examples of criteria used by MAS are listed in the source).
  - AML/CFT requirements applied to reporting entities regardless of whether transactions are in fiat currency or digital tokens in Singapore (IMF, 2019).

### C. Cyber and data security — risks and supervisory expectations
- Key cyber/data security risks
  - New players and models raise cyber and data security risks, especially in open banking where account servicing PSPs expose payment account infrastructure to third-party PSPs.
  - Technology risk includes unsecured payment services and weak IT governance by service providers.
- Risk management principles and examples
  - Technology risk management principles: (i) establish a sound and robust technology risk management framework; (ii) strengthen system security, reliability, resiliency, and recoverability; (iii) deploy strong authentication.
  - Technical standards and guidelines can form part of licensing requirements and regulatory compliance.
  - Jurisdictional examples:
    - Singapore: implemented cyber hygiene regulations and technology risk management guidelines for licensees relying on technology to supply payment services.
    - EU PSD2: European Commission mandates on the European Banking Authority include security measures for electronic payments.
  - Illustration of cyber incident impact: 7-Eleven Japan suspended mobile payment application services after hackers compromised USD 500,000 from customer accounts (July 2019).

### D. Access to payment systems — channels, eligibility, and public policy trade-offs
- Common access channels for nonbank PSPs
  - Direct non-settling participant: connects directly to a payment system to submit/receive payments but uses another direct settling participant that holds a settlement account with the central bank.
  - Indirect participant: sends payment instructions through a direct participant.
- Public policy considerations for access
  - Broadening access can diversify payment arrangements, reduce single points of failure, widen transactions settling in central bank money, mitigate credit risks, and create a more level playing field for nonbank PSPs.
  - Access is commonly restricted to financial institutions meeting high regulatory and supervisory standards and access criteria set by the payment system operator and central bank.
- Eligibility criteria examples and discretion
  - Eligibility considerations may include:
    - Authorized nonbank PSPs: major authorized ELMIs and PIs whose payment transactions meet established value thresholds; not all ELMIs and PIs are automatically eligible for direct access.
    - Direct settlement participant: eligibility considered by the payment system/payment scheme, the central bank (as settlement service provider), and the competent supervisory authority (and financial intelligence unit where appropriate).
    - Settlement account: eligibility at the sole discretion of the central bank, using supervisory assessment results; nonbank PSPs ineligible for reserve accounts if business models suggest no exposure to overnight liquidity risk and typically ineligible for intraday liquidity facilities.
  - Supervisory assessments focus on governance arrangements, safeguarding of customer funds, financial crime compliance, and ongoing supervisory oversight (including independent audits).

### E. Interoperability — objectives and instruments
- Interoperability reduces fragmentation in payment markets and supports acceptance of e-payments.
- Example: SEPA achieved technical interoperability by standardization (ISO 20022, International Bank Account Number, SEPA Credit Transfer scheme, SEPA Direct Debit scheme) to prevent market fragmentation.
- Singapore PS Act empowers the central bank to ensure interoperability of payment solutions in the interests of consumers and market development.

### V. Step Four — Promoting legal certainty
- Principle and approaches
  - A transparent, comprehensive, and sound legal framework is imperative as payment services modernize.
  - Some authorities apply “same activity, same regulation” to extend existing banking regulations to new entrants (e.g., Big Techs).
  - Functional (activity-based) regulatory design is recommended to regulate providers of the same activity uniformly without adjusting legal frameworks to technology.
- Considerations for legal certainty (adapted from CPSS)
  - Legal framework, consultations, transparency and accessibility, and role of the central bank are key considerations for promoting legal certainty for national payment systems and emerging payment services.

*Source: Extracted from the chapter “Box 2. Regulation of Digital Payment Tokens in Selected Jurisdictions” (wpiea2020075-print-pdf).*

### Box 4. Canada—Legal Reforms for Retail Payments Oversight

### Box 4. Canada—Legal Reforms for Retail Payments Oversight

### Canada: Proposed legislative reforms for retail payments
- Government of Canada acknowledged emergence of new innovative service providers and technologies changing how Canadians make payments.
- Budget 2019 proposals:
  - Introduce legislation to implement a new retail payments oversight framework to allow continued innovation while ensuring reliability and safety.
  - Framework would require payment service providers to establish sound operational risk management practices and to protect users’ funds against losses.
  - Bank of Canada would oversee compliance with operational and financial requirements and maintain a public registry of regulated payment service providers.
  - Introduce technical amendments to the Canadian Payments Act to modernize the governance framework of Payments Canada, following a legislative review undertaken by the Government in 2018.
- Proposed legislative measure follows industry-wide consultations led by the Department of Finance Canada.
- Source cited: Department of Finance Canada (2019).

### Broader legal context and implications for digital payment tokens and crypto-assets
- Central bank oversight powers largely drawn from legal mandates but may not be plenary over payment systems, payment services, or other financial activities.
- Provision of digital payment token services could implicate other laws and competent authorities (e.g., if tokens are identified as securities or financial instruments) or require new regulations or guidelines for legal clarity.
- Authorities’ approaches to crypto-assets include:
  - regulating or increasing regulatory oversight for crypto-asset trading platforms, hosted wallets and certain intermediaries;
  - regulatory guidance, and consumer and investor warnings;
  - registration or licensing;
  - clarification of the legal status of crypto-assets for tax purposes;
  - regulatory sandboxes for pilot testing under regulatory supervision;
  - bans on providing financial services to crypto-asset firms and/or on their use by financial institutions or for payment (FSB, 2018).

### Legal framework components for payment systems and services
- Laws of general application:
  - Property and contract laws; banking and finance laws; insolvency laws; laws determining applicable jurisdiction’s laws; laws on electronic documents and signatures.
- Laws specific to payments:
  - Payment instrument laws (currency laws, check laws, bill of exchange and electronic payment laws).
  - Payment obligation laws (netting, novation, finality of payment and settlement).
  - Laws on default proceedings and disputes in payments (priority ranking of payment settlement claims, settlement guarantees and loss allocation agreements, priority rights to collateral for settlement credit, evidence laws regarding electronic payments, and dispute resolution mechanisms such as arbitration clauses).
  - Laws on central bank roles, responsibilities and authority in the national payment system.
  - Laws relating to formation and conduct of infrastructure service providers and markets (formation and operation of clearing and settlement arrangements, access and participation in infrastructure systems, pricing of infrastructure services, rules on issuance and redemption of e-money, and protection of central counterparties from risk).
- Legal reforms could involve amending existing laws or regulations or introducing explicit law on payment services.
- Explicit laws on payment services have been established in the EU PSD2 (and formerly the EU PSD) and the Singapore PS Act; in other jurisdictions payment-service recognition may be implicit within broader frameworks.
- Model laws from international legal organizations can inform reforms (e.g., UNCITRAL Model Law on International Credit Transfers; UNCITRAL Model Law on Electronic Commerce; UNCITRAL Model Law on Electronic Signatures; UNCITRAL Model Law on Electronic Transferable Records; EU Directive 98/26/EC on settlement finality).

### EU illustrative legislative building blocks referenced
- Core legislations:
  - Single Euro Payment Area (SEPA) Regulation.
  - Payment Services Directive.
  - Interchange Fee Regulation.
  - Payment Account Directive.
  - Regulation (EU) 2019/518 of the European Parliament and of the Council of 19 March 2019 amending Regulation (EC) No 924/2009 as regards certain charges on cross-border payments in the Union and currency conversion charges.
- Complementary legislations:
  - General Data Protection Regulation (GDPR).
  - Network and Information Systems Directive (NIS).
  - Anti-Money Laundering Directive.
  - Regulation (EU) No 1409/2013 of the European Central Bank of 28 November 2013 on payments statistics (ECB/2013/43).

### Policy issues for central banks arising from fintech in payments
- A. Payments stability
  - Systemic importance:
    - Large technology firms could potentially offer cross-border funds transfers through issuance of digital payment tokens that would need assessment for systemic implications and to meet high regulatory standards where appropriate.
    - Such offerings could create new payment systems with global outreach operating independently from traditional CBR networks and financial messaging service providers.
    - Authorities could face the challenge of licensing and designating such service offerings as SIPS, subjecting them to international standards, particularly the Principles for Financial Market Infrastructures (PFMI) (CPMI/IOSCO, 2012).
  - Cross-border issues:
    - Regulatory arbitrage where a firm is registered as a crypto-exchange in one jurisdiction but as a payment service provider in another.
    - Passporting rights may be unclear across jurisdictions; passporting could enable entities (e.g., PI/ELMI) to provide cross-border services without physical presence.
  - Cooperative oversight:
    - Central banks need to cooperate with other competent authorities (securities regulators, financial intelligence units) to consider additional regulatory requirements for activities not considered payments to ensure safety and security of payment and settlement arrangements.
    - Considerations include determining the lead overseer and establishing regulatory cooperation for information sharing, cooperative oversight, and crisis management.

- B. Financial stability
  - Crypto-assets:
    - Regulatory gaps when crypto-assets fall outside perimeter of market regulators and payment system oversight and in absence of international standards or recommendations (FSB, 2019a; FSB, 2019b; FSB, 2019c).
    - Crypto-assets monitored for potential financial stability risks at international level (FSB, 2018).
  - Big Tech:
    - Big Tech PSPs could alter market structures, affecting concentration and contestability; unbundling of payment services may pressure profitability of traditional financial institutions and push them into riskier activities.
    - Example: in China, nonbank payment institutions offered online money market funds and two firms accounted for 94 percent of the mobile payments market (FSB, 2019a).
    - High concentration risk could have destabilizing effects in event of operational and cyber incidents.
  - AI/Machine Learning:
    - AI/ML applications analyze large transaction datasets for usage patterns, creditworthiness, and AML/CFT issues (FSB, 2017b).
    - Risks include data privacy and data protection concerns, dependencies on third-party service providers, emergence of systemically important players beyond regulatory perimeter, lack of interpretability or “auditability” of AI/ML methods, and opacity that may produce unintended consequences.

- C. Monetary stability
  - Mobile money:
    - Monetary policy transmission and central bank liquidity management could be complicated by payments systems outside traditional banking (e.g., widespread adoption of MNO mobile payments).
    - Questions on role and amount of float created from issuance of e-money and/or mobile payments as an autonomous liquidity factor.
    - E-float could impact cash demand and free reserves held by banking system due to uncertainty over timing of e-money floats entering the banking system.
    - Historical assessments found negligible risk to monetary policy from earlier e-money issuance given limits on e-money accounts and modest growth in transactions; virtual currencies also assessed as having no significant implications for monetary policy, but assessments could change rapidly with proliferation and evolving risks.
  - Digital payment tokens:
    - Potential GSCs could weaken monetary policy on domestic interest rates and credit conditions, increase cross-border capital mobility, and undermine monetary sovereignty if they substitute for fiat currencies (Group of Seven, 2019).
    - Wide acceptance of crypto-assets could potentially reduce demand for central bank money (He, 2018), shifting from account-based systems to token-based alternatives focused on commodity money instead of credit money.
    - Role for central banks to make fiat currencies better and more stable units of account; many central banks have initiated research into central bank digital currencies and experimented with distributed ledger technology in payment, clearing, and settlement arrangements.

### Conclusion: regulatory implications and analytical framework
- Fintech developments suggest regulatory approaches and legal foundations need to augment entity-based regulation with increasing focus on activities.
- Licensing regimes will need redesign to bring new types of service providers within regulatory perimeter where appropriate, including fintech firms and large technology firms.
- A four-step analytical framework proposed to guide authorities in regulating payment services:
  1. Examine if an underlying economic activity is considered a payment service.
  2. Determine if an entity requires licensing.
  3. Analyze if there are new risks not effectively addressed in current framework, including risks associated with funds protection, financial integrity, cyber and data security, access to payment systems, and interoperability.
  4. Promote legal certainty to develop a transparent, comprehensive and sound legal framework for payment services.
- Payments and fintech developments pose policy considerations and challenges for central banks to monitor growing systemic importance and impacts on payments stability, financial stability, and monetary policy transmission; adherence to international standards and additional regulatory requirements may be warranted as risks evolve.

*Source: Box 4. Canada—Legal Reforms for Retail Payments Oversight (from the provided IMF source content).*

### REFERENCES

### REFERENCES

### Major referenced institutions and publications
- Bank for International Settlements (2019). Big Tech in Finance: Opportunities and Risks, BIS Annual Economic Report 2019, June 23.
- Bank of England (2017). Access to UK Payment Schemes for Nonbank Payment Service Providers, July.
- Bank of England (2019). Bank of England Settlement Accounts, March.
- Basel Committee on Banking Supervision (2018). Sound Practices: Implications of Fintech Developments for Banks and Bank Supervisors, February.
- Basel Committee on Banking Supervision (2019). Report on Open Banking and Application Programming Interfaces, November.
- Committee on Payments and Market Infrastructures; International Organization of Securities Commissions; World Bank — multiple standards and guidance documents (2012, 2014, 2016).
- Financial Action Task Force (2013; 2019) — guidance on prepaid cards, mobile payments, internet-based payment services, and virtual assets.
- Financial Stability Board (2017a; 2017b; 2018; 2019a; 2019b; 2019c) — fintech, AI/ML, crypto-assets, market structure, and stablecoins.
- Group of Seven (2019). Investigating the Impact of Global Stablecoins, October.
- GSMA (2016; 2019) — safeguarding mobile money and impact of mobile money on monetary and financial stability in Sub-Saharan Africa.
- International Monetary Fund and World Bank (2018; 2019) — Bali Fintech Agenda and Fintech: The Experience So Far.
- International Monetary Fund (2017; 2019) — correspondent banking relationships and Singapore technical note on fintech regulation and supervision.
- Selected authors and working papers: Brainard, L (2019); Frost, J., Gambacorta, Y. Huang, H. S. Shin, and P. Zbinden (2019) BIS Working Papers No. 779, April; He, D (2018); He, D. et al. (2017) IMF Staff Discussion Note 17/05, June; Restoy, F. (2019); Swinehart, M. W. (2018).

### Key topics covered by the references (as listed)
- Big Tech in finance, opportunities and risks.
- Access to payment schemes and settlement accounts.
- Sound practices and supervisory implications of fintech developments for banks.
- Open banking and application programming interfaces (APIs).
- Digital currencies, stablecoins, crypto-assets, and their regulatory and financial stability implications.
- Principles, guidance, and assessment methodologies for financial market infrastructures and critical service providers.
- Cyber resilience for financial market infrastructures.
- Payment aspects of financial inclusion and national payment system development.
- Correspondent banking trends and remittance service principles and general guidance.
- Informal funds transfer systems (Hawala).
- Risk-based approaches to prepaid cards, mobile payments, internet-based payment services, virtual assets, and virtual asset service providers.
- Modeling payments regulation and financial change.
- Country- and region-specific reviews and technical notes (e.g., Singapore; Monetary Authority of Singapore Financial Stability Reviews 2017 and 2018; National Bank of Belgium Report 2019).
- Market development studies and case studies for Sub-Saharan Africa payment systems.

### Appendix I — Licensing Practices for Mobile Network Operators by Region (listed items and sources)
- 1. MNO Licensing  
  - Source: World Bank (2018) Payment Systems Worldwide: A Snapshot, September.
- 2. MNO Admissible Activities  
  - Source: World Bank (2018) Payment Systems Worldwide: A Snapshot, September.
- 3. MNO Licensing Requirements  
  - Source: World Bank (2018) Payment Systems Worldwide: A Snapshot, September.
- 4. Authorities Legally Empowered to Supervise MNOs  
  - Source: World Bank (2018) Payment Systems Worldwide: A Snapshot, September.
- 5. MNO Licensing/Registration Requirements to Provide Remittance Services  
  - Source: World Bank (2018) Payment Systems Worldwide: A Snapshot, September.

*Source: wpiea2020075-print-pdf - REFERENCES (IMF).*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2020/english/wpiea2020075-print-pdf.pdf_