FSI Paper Endorses Entity-Based Regime for Regulating Big Tech Firms

The paper notes that such large digital platform companies (or big tech firms) operate highly interconnected platform ecosystems and have gained a substantial footprint in the provision of financial services. Such firms are increasingly becoming intrinsic to the financial services sector and are embedding, into their business models, offerings like cloud computing, banking-as-a-service partnerships, payments, credit scoring, and the available data/analytics on existing customers. In particular, several big tech firms have developed proprietary credit scoring systems serving all their business segments. The big tech firms leverage alternative data and sophisticated artificial intelligence-based tools as part of their credit scoring systems. These systems can identify eligible potential customers who might not qualify for credit on the basis of traditional credit risk models used by financial institutions. This is possible because big tech models not only analyze the credit history of customers but also past transactions and digital behavior in their ecosystems. Overall, these advantages of big tech firms' credit scoring systems have become important for their service offerings and, therefore their, profitability. These firms are also increasingly becoming critical third-party service providers to the financial institutions, thus giving rise to not only information and communications technology (ICT) and cyber risks, operational risks, reputational risks, consumer protection risks, and related moral hazards, but also to systemic and financial stability risks. 

The big tech firms' operations in financial services are, however, regulated on the basis of sectoral regulatory regimes. When a big tech entity provides its financial services in collaboration with other financial institutions, it usually does not need any license because its partners will typically meet the regulatory requirements. Though if a big tech entity is licensed to perform a regulated financial activity, it faces a body of regulatory requirements attached to that license under sectoral financial regulations. The regulatory frameworks for different financial sectors were not formulated with large interconnected digital platform companies in mind and thus they do not fully capture such risks under sectoral regulations. Thus, to effectively foster operational resilience and preserve financial stability, it seems essential that the entity-based rules be put in place to comprehensively address risks related to interdependences. The paper notes that a few jurisdictions have started to insert entity-based rules in their regulatory framework to cope with selected risks presented by big tech firms. The paper also concludes that strong intragroup dependencies among big tech entities call for risk assessment at the group level.

The paper suggests that, until the entity-based regime is in place, to begin with, authorities could focus on regulated financial entities and use them as a lever to counter potential financial stability risks:

• For regulated financial entities that are members of big tech groups, authorities may wish to assess whether they have a clear picture of the risks stemming from interdependencies. Based on the assessment, they could enter into a structured supervisory dialog with the examined entities to discuss the findings and potential risk mitigants.
• For all regulated financial entities, authorities may wish to assess whether there is a need to strengthen digital operational resilience. It would also include assessing regulated entities’ resilience to cyber incidents and whether they follow international guidance and industry best practices. Deficiencies identified in the assessment could be addressed with the existing regulatory instruments, which encompass, among others, prudential capital requirements, large exposure limits, AML/CFT requirements, outsourcing requirements, rules on related-party transactions, regulatory disclosures, and cyber and operational resilience standards and guidelines.
• For regulated entities’ use of critical services, authorities may wish to ramp up their monitoring efforts. A major concern in this respect is that the limited number of providers of cloud services could magnify the impact of any operational vulnerability.

Related Links

• FSI Notification
• FSI Paper (PDF)

Keywords: International, Banking, Regtech, BaaS, Lending, Lending Marketplace, Platform Businesses, Cloud Computing, Systemic Risk, Basel, Entity Based Regulation, FSI, BIS