    [Senate Hearing 115-95]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 115-95

                        EXAMINING THE FINTECH LANDSCAPE

    =======================================================================

                                    HEARING

                                   BEFORE THE

                                  COMMITTEE ON
                       BANKING,HOUSING,AND URBAN AFFAIRS
                              UNITED STATES SENATE

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 FIRST SESSION

                                       ON

      EXAMINING THE INNOVATIVE TECHNOLOGIES BEING USED TO CHANGE THE WAY
       FINANCIAL SERVICES ARE PROVIDED AND THE WAY THE FINANCIAL SYSTEM
                                    OPERATES

                                   __________

                               SEPTEMBER 12, 2017

                                   __________

      Printed for the use of the Committee on Banking, Housing, and Urban
                                    Affairs

                     Available at: http: //www.fdsys.gov /

                                  __________

                        U.S. GOVERNMENT PUBLISHING OFFICE
    27-749 PDF                  WASHINGTON : 2017

    ----------------------------------------------------------------------------------------
    For sale by the Superintendent of Documents, U.S. Government Publishing Office,
    http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
    U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
    E-mail, gpo@custhelp.com.

                COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

                          MIKE CRAPO, Idaho, Chairman

    RICHARD C. SHELBY, Alabama           SHERROD BROWN, Ohio
    BOB CORKER, Tennessee                JACK REED, Rhode Island
    PATRICK J. TOOMEY, Pennsylvania      ROBERT MENENDEZ, New Jersey
    DEAN HELLER, Nevada                  JON TESTER, Montana
    TIM SCOTT, South Carolina            MARK R. WARNER, Virginia
    BEN SASSE, Nebraska                  ELIZABETH WARREN, Massachusetts
    TOM COTTON, Arkansas                 HEIDI HEITKAMP, North Dakota
    MIKE ROUNDS, South Dakota            JOE DONNELLY, Indiana
    DAVID PERDUE, Georgia                BRIAN SCHATZ, Hawaii
    THOM TILLIS, North Carolina          CHRIS VAN HOLLEN, Maryland
    JOHN KENNEDY, Louisiana              CATHERINE CORTEZ MASTO, Nevada

                         Gregg Richard, Staff Director

                     Mark Powden, Democratic Staff Director

                          Elad Roisman, Chief Counsel

                          Travis Hill, Senior Counsel

                  Kristine Johnson, Professional Staff Member

                     Elisha Tuku, Democratic Chief Counsel

                Laura Swanson, Democratic Deputy Staff Director

                  Phil Rudd, Democratic Legislative Assistant

                           Dawn Ratliff, Chief Clerk

                         Cameron Ricker, Hearing Clerk

                          Shelvin Simmons, IT Director

                              Jim Crowell, Editor

                                      (ii)

                                C O N T E N T S

                                  ----------

                          TUESDAY, SEPTEMBER 12, 2017

                                                                       Page

    Opening statement of Chairman Crapo..............................     1

    Opening statements, comments, or prepared statements of:
        Senator Brown................................................     2

                                   WITNESSES

    Lawrance L. Evans, Director, Financial Markets and Community
      Investment, Government Accountability Office...................     4
        Prepared statement...........................................    30
        Responses to written questions of:
            Senator Menendez.........................................    82
    Eric W. Turner, Financial Technology Research Analyst, S&P Global
      Market Intelligence............................................     6
        Prepared statement...........................................    48
        Responses to written questions of:
            Senator Menendez.........................................    83
    Frank Pasquale, Professor of Law, University of Maryland Francis
      King Carey School of Law.......................................     7
        Prepared statement...........................................    66
        Responses to written questions of:
            Senator Brown............................................    87
            Senator Menendez.........................................    90

                  Additional Material Supplied for the Record

    Statement submitted by the Independent Community Bankers of
      America........................................................    95
    Letter submitted by the Electronic Privacy Information Center....    97
    Letter submitted by the Milken Institute Center for Financial
      Markets........................................................   100

                                     (iii)

                        EXAMINING THE FINTECH LANDSCAPE

                                  ----------

                          TUESDAY, SEPTEMBER 12, 2017

                                           U.S. Senate,
              Committee on Banking, Housing, and Urban Affairs,
                                                        Washington, DC.
        The Committee met at 10:02 a.m., in room SD-538, Dirksen
    Senate Office Building, Hon. Mike Crapo, Chairman of the
    Committee, presiding.

                OPENING STATEMENT OF CHAIRMAN MIKE CRAPO

        Chairman Crapo. The Committee will come to order.
        Before we proceed with the hearing today, I wanted to just
    indicate that last night the Senate passed six securities bills
    that we marked up earlier this year, bills that will improve
    economic growth and investor protections. And I want to thank
    you, Senator Brown, for working with me to get these bills
    through the Committee, and thanks to all of the Committee for
    your work in getting these pieces of legislation through the
    Senate.
        These bills were introduced in past Congresses with broad
    bipartisan support, with the House most recently passing
    similar bills last spring. And I want to thank our colleagues
    on the House Financial Services Committee for their work on
    this as well. I look forward to seeing these bills signed into
    law.
        Senator Brown. Could I say a word now?
        Chairman Crapo. Yes.
        Senator Brown. Thank you, Mr. Chairman, for your
    partnership on these bills to improve the securities markets
    and investor protections. I am pleased they passed the Senate
    last night as well. I thank the members of this Committee and
    others in the Senate especially for their work on this bill,
    Senators Heller and Peters, off the Committee; Senators
    Heitkamp, who is here, and Toomey on the Committee, and
    Donnelly, also on the Committee, Menendez, Hatch, Warner, and
    Tillis, and others on this Committee for moving the bill
    forward.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you.
        This morning, we will receive testimony on the growing
    financial technology, or fintech, industry. Fintech is
    providing new and innovative products and services in areas
    such as marketplace lending, digital payments and currencies,
    wealth management, insurance, and more.
        Technological innovation has brought about improvements in
    virtually every sector of the economy, and the financial sector
    is no exception. Technology advances are nothing new to the
    financial world; inventions such as the ATM and the credit card
    led to significant improvements in consumer welfare.
        Today new innovations by fintech companies have similar
    potential to make financial services faster, cheaper, and more
    accessible. For example, marketplace lending has the potential
    to expand the availability of credit to consumers and small
    businesses at lower costs.
        In particular, with the use of alternative data and
    technology, the business models of marketplace lenders may
    enable them to reach underbanked populations. Innovations in
    the payments space can offer enhanced speed, convenience, and
    efficiency in transactions.
        Fintech startups are not the only ones embracing this
    opportunity and responding to changing consumer demand.
    Traditional banks and other established financial institutions
    are increasingly participating in the fintech space through
    partnerships, incubators, investments, and more.
        Fintech firms may also reap the mutual benefits of
    partnering with banks who have well-established operations and
    comparative advantages in certain areas. But with all the
    potential for fintech to improve the financial services sector,
    the industry is still relatively new.
        Uncertainty remains around questions like data security and
    the proper regulatory treatment to ensure that consumers and
    the financial system are safeguarded. The recent Equifax data
    breach reminds us of the critical need to ensure that areas
    like cyber and data security are given the proper attention.
        The tremendous growth in this sector over the past few
    years has gained the attention of market participants,
    regulators, and other stakeholders. The OCC, for example, has a
    proposal to provide special purpose national bank charters for
    fintech companies.
        Other Governments are exploring options such as a
    regulatory sandbox approach that encourages innovation by
    allowing firms to test products and services in a supervised
    environment.
        In response to this Committee's call for economic growth
    proposals, we received a number of fintech-related submissions
    that will also help us as we think about these issues.
        Today I look forward to learning more about the
    opportunities fintech may bring, the various ways fintech is
    interacting with and impacting the financial system, and the
    current regulatory supervision of the fintech industry.
        Senator Brown.

                   STATEMENT OF SENATOR SHERROD BROWN

        Senator Brown. Thank you, Mr. Chairman. I appreciate your
    holding this hearing on financial technology. It has been too
    long since our Committee considered this important topic. I do
    not think any of us knew how timely this hearing would be until
    we got news of the Equifax data breach, apparently after some
    executives at Equifax also knew, although they deny that was
    the case.
        While financial technology covers many different
    activities, all of those activities rely on the responsible use
    and careful protection of data.
        In the case of Equifax, that did not happen. Americans are
    now forced to worry whether the information that hackers stole
    will have lasting impacts, from outright theft to damaged
    credit. We just cannot cancel a credit card to fix this
    problem. Equifax has let criminals get their hands on the most
    private and valuable pieces of millions of Americans' financial
    identities.
        Credit reports also include other deeply personal
    information. A history of our medical debt can reveal
    information we do not share with anyone but our doctors and
    families.
        More and more, new financial technologies rely on the
    collection of vast troves of data no longer limited to our
    financial transactions. Data aggregators collect information
    regarding our associates, what kind of products we buy, and
    maybe even how often we check Facebook.
        The collection and use of this alternative data may promise
    some benefits by providing access to credit for people in
    communities that traditional lenders overlook. But as recent
    data breaches have shown, the risks are clear and substantial.
        It will take us a long time to assess the impact of the
    Equifax data breach on 143 million Americans. Businesses,
    consumers, and Government watchdogs will have to be even more
    vigilant about identifying fraud, possibly making it harder for
    Americans to get access to credit.
        It is bad enough that the Equifax breach included important
    personally identifiable information--names, dates of birth,
    Social Security numbers, addresses, and credit card numbers--
    the building blocks for your financial identity. Future
    breaches at firms that use alternative data might include far
    more personal information with far-reaching consequences.
        Today I want to hear how we can improve Federal oversight
    of data collection and data security to protect working
    American families. I hope we can work together to make sure
    companies that use our private data are held accountable for
    its protection.
        If a college student in Columbus misses a credit card
    payment or a family in Toledo is forced into bankruptcy because
    of medical debt, Equifax would undoubtedly ding their credit
    scores. So now that this breach has left millions of people
    vulnerable to criminals, what should be done to hold Equifax
    accountable?
        At a minimum, customers should have the right to use the
    court system to help make them whole. That is why I appreciate,
    under apparently some public pressure, Equifax answered my
    call, and that of others on the Committee, to remove forced
    arbitration clauses from its free credit monitoring product.
        This is a step in the right direction, but customers cannot
    be sure their rights are truly protected until Equifax makes
    this policy clear for all products and on all of its websites.
        One year of credit monitoring cannot be expected to undo
    the damage of this breach. After the 2015 breach of the Office
    of Personnel Management put information of Government employees
    at risk, this body passed 10 years of free credit monitoring.
    We cannot accept any less for the people we serve.
        Today's hearing is focused on new products and markets. I
    am interested in how Congress can encourage fintech innovation
    to make it easier for community banks to serve their customers,
    to comply with important safety and soundness and anti-money-
    laundering rules.
        If we can encourage banks to partner with each other or
    innovative startups, we may be able to cut down on red tape
    without exposing consumers or the financial system to
    additional risk.
        I am also interested in how these new technologies can help
    Americans who are currently underserved by the traditional
    banking system. We have already seen how mobile payments have
    expanded access for many to the financial system, both at home
    and abroad. But we need to fully understand the risks and
    ensure that oversight gaps do not exist for bad actors to
    exploit American customers.
        I thank the witnesses for joining us.
        Chairman Crapo. Thank you, Senator Brown. We will now move
    to our witnesses.
        First we will hear testimony from Mr. Lawrance Evans,
    Director of Financial Markets at the U.S. Government
    Accountability Office.
        Then we will hear testimony from Mr. Eric Turner, research
    analyst at S&P Global Market Intelligence.
        And then, finally, we will hear testimony from Mr. Frank
    Pasquale, professor of law at the University of Maryland
    Francis King Carey School of Law.
        I would remind each of our witnesses that your full
    testimony has been made a part of the record. We ask you to
    limit your presentation orally to 5 minutes. There will be
    plenty of opportunity for further follow-up with questions from
    the Committee.
        With that, Mr. Evans.

    STATEMENT OF LAWRANCE L. EVANS, DIRECTOR, FINANCIAL MARKETS AND
         COMMUNITY INVESTMENT, GOVERNMENT ACCOUNTABILITY OFFICE

        Mr. Evans. Thank you very much, Mr. Chairman. I am pleased
    to appear before you, Ranking Member Brown, and the other
    Members of the Committee to discuss the fintech landscape,
    which currently finds a number of potentially disruptive and
    foundational technologies, and innovative firms that are
    transforming the financial industry. Calling this hearing
    represents the type of forward thinking that is essential to
    effectively harnessing the opportunities these developments
    bring.
        My testimony today is based on our April 2017 report
    produced as a partial response to a request from the Ranking
    Member and others. The report covers a high-level look at four
    commonly referenced fintech subsectors: marketplace lending,
    mobile payments, digital wealth management, and distributive
    ledger technology, which I will refer to as ``DLT.'' While this
    report is largely based on secondary sources, we are able to
    glean some useful findings and observations for consideration.
        Considering the benefits, our sources suggest that
    technological innovation is occurring throughout the financial
    ecosystem, driven by large technology firms and smaller
    technology-driven new entrants known as ``fintechs'' or
    ``fintech firms.'' One of the primary potential benefits
    include expanded access to financial services.
        For example, digital wealth platforms, which rely on data-
    driven algorithms and minimize human interaction, provide
    services to a class of investors previously frozen out of
    traditional wealth management. Other potential benefits include
    convenience, speed, and lower costs across a range of financial
    services.
        On the flip side, new technologies and new entrants into
    the financial services industry, while bringing much needed
    innovation, bring potential risk. For example, the data-driven
    algorithms marketplace lenders rely on to assess
    creditworthiness and underwrite loans raise concerns about the
    use of nontraditional data and the risk for potential fair
    lending violations. Moreover, data security and privacy risks
    may exist with these newer technologies.
        It is important to note that these concerns are real, but
    they are not unique to these innovations. And there are also
    features in mobile payments in DLT that may produce benefits in
    the area of data security. Losing sight of the benefits and
    overreacting to risk could stifle financial inclusion and much
    needed innovation in the area of payments, value transfer, and
    recordkeeping. Therein lies the great challenge for
    policymakers and regulators. There is always a need to manage
    the risk-reward balance of innovation; that is, managing risk
    without stifling innovation, ensuring consistent regulation and
    a level playing field, and encouraging socially beneficial
    innovation without picking winners or losers.
        On the one hand, advances in technology are occurring in a
    heavily regulated and mature financial ecosystem. On the other
    hand, the financial regulatory structure in the U.S. is
    complex, with responsibilities fragmented among multiple
    Federal and State agencies that have overlapping authorities.
    This has raised concerns about gaps in coverage, inconsistent
    regulation, compliance challenges for new and incumbent firms,
    and whether the existing regulatory framework might slow or
    otherwise harm innovation.
        As you know, there are a number of issues being considered
    today that will impact the regulatory landscape going forward,
    such as the appropriate charter type for fintech firms
    conducting bank-like activities. It will be important to
    carefully sort through the various competing interests to
    settle on a regulatory framework that is truly in the public
    interest.
        Putting the public first and developing a regulatory
    framework that is best positioned to achieve it is essential to
    getting the risk-reward balance of innovation correct. As one
    Federal Reserve official recently noted, ``it would be a lost
    opportunity if instead of expanding access in a socially
    beneficial way, some fintech products merely provided a vehicle
    to market high-cost loans to the underserved, exacerbating
    rather than ameliorating financial access inequalities.''
        Similarly, it would also be unfortunate if the regulatory
    framework served as a barrier to entry to innovative firms with
    socially beneficial products. GAO is currently undertaking work
    that will support congressional efforts to strike the
    appropriate balance in this area.
        Chairman Crapo, Ranking Member Brown, and Members of the
    Committee, this concludes my prepared statement. I look forward
    to questions and further dialog.
        Chairman Crapo. Thank you, Mr. Evans.
        Mr. Turner.

      STATEMENT OF ERIC W. TURNER, FINANCIAL TECHNOLOGY RESEARCH
                ANALYST, S&P GLOBAL MARKET INTELLIGENCE

        Mr. Turner. Thank you, Chairman Crapo, Ranking Member
    Brown, Members of the Committee. Good morning, and thank you
    for inviting me to testify today. My name is Eric Turner, and I
    am a research analyst with S&P Global Market Intelligence,
    where I cover financial technology.
        S&P Global Market Intelligence is a division of S&P Global.
    We provide actionable intelligence on the global financial
    markets and the companies and industries that comprise those
    markets. We support economic growth by providing market- and
    sector-specific data, news, and research to help investors
    identify opportunities and manage risk when providing financing
    to businesses and job creators. S&P Global Market Intelligence
    closely follows the fintech sector, which we view as pivotal to
    economic growth and innovation.
        Financial institutions have long used technology, but
    startups have broken new ground during the past decade. These
    companies have created what we know as fintech today.
    Leveraging advances in technology and the ubiquity of the
    Internet, these companies offer new and cutting-edge financial
    products. Expansive data sets, advanced analytics, and
    automation have made accessing financial services faster and
    less expensive for millions of people.
        Incumbent institutions are increasingly looking to fintechs
    not as competitors but as partners for improving operations and
    reaching new consumers.
        Through our research, we have identified five key areas
    that impact consumers in the financial industry today. These
    include digital lending, mobile payments, digital investment
    management, insurance technology, and distributed ledger
    technology, which includes blockchain. These innovations
    present enormous opportunities to consumers accompanied by
    unique challenges in implementation.
        Digital lending has increased access to credit and made
    borrowing more efficient. Automation and a lack of physical
    offices allow digital lenders to reduce processing time and
    costs. This allows them to offer competitive rates, potentially
    saving borrowers thousands of dollars in interest, while small
    businesses seeking access to working capital are able to obtain
    funds much more quickly.
        Mobile payments services are used by millions of consumers
    because they reduce transaction costs and frictions, while
    offering an enhanced user experience. For international
    transfers, specialized peer-to-peer apps charge low fees for
    the conversion and transfer of funds across borders and
    currencies. This benefits underbanked and immigrant
    communities.
        Mobile wallets create more secure transactions by
    preventing fraudsters from skimming card data or stealing PIN
    information. Additional features, like biometric and two-factor
    authentication, have further enhanced security.
        Digital investment management has given retail investors
    new access to professional investment services, and insurance
    technology has made it easier and more affordable to protect
    against risk. If implemented properly, distributed ledger
    technology, including blockchain, will revolutionize many parts
    of our financial system, reducing costs and settlement times
    while enhancing transparency.
        Despite the benefits discussed today, the industry is still
    young and challenges remain. Regulation has been unevenly
    applied to the sector, and in many ways the introduction of a
    clear regulatory framework could help boost innovation. This
    may require firms to define their stake in the financial system
    and could lead to technology-only platforms exiting certain
    lines of business like lending. Overall, this will lead to a
    more fair and defined playing field for startups and incumbents
    alike.
        Issues such cybersecurity, data ownership, and data privacy
    are important not just to fintechs but to the financial
    industry as a whole. Clear standards and regulation can provide
    clarity in these areas as well. Understanding the fintech
    landscape as well as the benefits and challenges presented by
    this growing industry can help shape a clear framework for
    responsible innovation.
        Thank you again for inviting me to testify, and I would be
    happy to answer any questions for the Committee.
        Chairman Crapo. Thank you, Mr. Turner.
        Mr. Pasquale.

     STATEMENT OF FRANK PASQUALE, PROFESSOR OF LAW, UNIVERSITY OF
               MARYLAND FRANCIS KING CAREY SCHOOL OF LAW

        Mr. Pasquale. Chairman Crapo, Ranking Member Brown, and
    distinguished Members of this Committee, thank you for the
    opportunity to testify today. My name is Frank Pasquale, and I
    am a professor of law at the University of Maryland.
        The financial technology, or fintech, landscape ranges from
    the very simple to the tremendously complex. Regulators at the
    OCC's Office of Innovation and the CFPB's Project Catalyst are
    energetically helping entrepreneurs to comply with existing
    consumer protections and other Federal mandates. Fintech may
    promote competition and create new options for consumers, but
    we should ensure that it is fair competition and that these
    options do not have hidden pitfalls.
        In my research on the finance and Internet sectors over the
    past decade, I have explored patterns of regulatory arbitrage
    and opaque business practices that sparked the mortgage crisis
    of 2008. I am afraid I see some similar themes emerging today.
        In the run-up to the crisis, Federal authorities preempted
    State law meant to protect consumer borrowers. Their stated aim
    was to ensure financial inclusion and innovation, but the
    unintended consequences were disastrous. Federal authorities
    were not adequately staffed to monitor, let alone deter or
    punish, widespread fraudulent practices. They also flattened
    diverse State policies into a one-size-fits-all, cookie-cutter
    approach. We all know the results. Millions of families lost
    their homes to foreclosure, and the economy suffered a
    permanent output gap.
        That history should make us cautious about legislative or
    regulatory efforts to federally preempt State laws now applying
    to fintech. Why should consumers lose important protections
    provided by their own States simply because they engage with
    fintech firms? Think, for instance, of restrictions on payday
    lending. As the New Economy Project and hundreds of community,
    labor, military, and veterans groups have argued earlier this
    year, 90 million Americans live in jurisdictions where payday
    lending is illegal. These State laws help consumers save
    billions of dollars each year in predatory payday loan fees
    that could trap people in long-term devastating cycles of debt.
    OCC should not strip these consumers of these protections.
        Advocates for deregulation will likely argue that imposing
    a level playing field on fintech and non-fintech firms might
    harm innovation in the fintech sector. But innovation is not
    good in itself. The toxic assets at the core of the financial
    crisis were innovative in many ways, but ultimately posed
    unacceptable risks.
        Promoters of fintech deregulation may claim that such
    worries are anecdotal. But many tech firms prevent more robust
    analysis as they obscure what we know about the sector. As I
    explain in my book ``The Black Box Society'', aggressive
    assertion of trade secrecy claims--both about data collection
    and use, and the algorithms used to make judgments about us--
    keep regulators and legislators in the dark about the full
    range of risks in finance in general and fintech in particular.
        A key message I hope to convey to the Committee today is to
    empower agencies like CFPB and OFR and to expand their funding
    as they try to come to grips with a rapidly financial
    landscape.
        Data gathering is important because nearly every story of
    technologized ``financial inclusion'' can be countered with
    other stories of exclusion, via digital redlining. As Cathy
    O'Neil's book ``Weapons of Math Destruction'' shows, consumers
    often are in the dark about what new algorithms are judging
    them and how they can respond if they think they have been
    treated unfairly. Regulators must more full understand what
    firms are doing and how they are performing. Moreover, as the
    recent Equifax hack shows, concentration of information in
    almost any firm creates great risks to consumers. Improving
    financial cybersecurity should be an essential goal in fintech
    policy, and I applaud the GAO for highlighting security issues
    in its report, as well as proposals by Senator Reed to require
    cybersecurity expertise at large firms.
        We should not have faith that accelerated deregulation will
    free the financial sector to solve important social problems.
    There is a difference between exploiting an existing problem in
    credit provision and addressing the root causes. For example,
    if fintechs can make hefty profits by refinancing student debts
    owed to the U.S. Government, perhaps that is less an indication
    of fintechs' business prowess than it is evidence that the
    Government is overcharging students for loans. If consumers are
    desperate for marketplace lending to cover next month's utility
    bills, maybe we need to ensure work pays more fairly. I am
    confident that a system of postal banking would do far more
    than the fintech sector to ensure financial inclusion to
    millions of Americans without adequate access to deposit
    accounts, as Mehrsa Baradaran has helped prove in her book
    ``How the Other Half Banks''.
        In conclusion, fintech should not be an excuse for
    stripping safeguards from consumers. We need far more
    information about how fintech firms are gathering, processing,
    and protecting data. And we should be wary about the ability of
    technology alone to solve much larger social problems of
    financial inclusion, opportunity, and nondiscriminatory credit
    provision.
        Thank you for the opportunity to testify today.
        Chairman Crapo. Thank you, Mr. Pasquale.
        This is a question for the entire panel, so I would like to
    ask you to each be brief in your responses. But could each of
    you discuss, as we move forward, what are some of the most
    significant risks that we should evaluate? And in your
    response, if you have an opinion on whether there should be a
    specific charter for fintech companies separate from other
    types of charters that we deal with in a regulatory context, I
    would appreciate your thoughts on that. Mr. Evans.
        Mr. Evans. So I think you see many of the risks that are
    commonly witnessed when you think about innovation, and there
    is, I think, a disconnect between the ``move fast and break
    things'' approach that you might see in the technology industry
    with the more conservative approach in the banking industry.
    And so I think there could be some significant compliance
    challenges going forward as they grapple with the various rules
    and regulations that are in place.
        I will punt on the issue of a Federal or a State charter. I
    know it is a critical issue. There are pros and cons on both
    sides, and I think other witnesses might----
        Chairman Crapo. I figured you might pass on that part of
    it.
        Mr. Turner.
        Mr. Turner. Thanks, Senator. I think as you mentioned,
    probably the biggest risk right now is a fractured regulatory
    system. I think when people look at fintech companies, they
    kind of assume that, you know, when you hear things like
    regulatory arbitrage and lack of regulation, that these
    companies are operating, you know, like it is the Wild West.
    And that is really not the case. These companies have looked
    for regulation wherever they can, and right now it seems that
    they are just trying to fit themselves into a system that was
    not made for them.
        Chairman Crapo. Thank you.
        Mr. Pasquale.
        Mr. Pasquale. Yes, thank you, Senator. I would cite
    problems in three areas, one being an area of opaque algorithms
    being used to assess credit. I think that we are entering into
    a new world, and we do not quite understand fully how many
    different types of data sources could enter into, say, emerging
    credit decision making. And I give some examples in my written
    testimony of how fintech firms, say, outside of the U.S. have
    used some types of data that might be troubling, I think, to
    people, like political activity or other issues like that.
        I would also say that with respect to looking at the 2016
    Fed survey on small business credit, the Fed found that there
    were lots of small businesses that distrusted fintech firms
    more than they distrusted small banks, or even large banks.
    With respect to high interest rates, they felt they were being
    overcharged, and I think that that highlights some concerns
    about the potential overextension of credit into, say, marginal
    communities or into marginal business opportunities.
        And I would finally highlight the cybersecurity concerns
    because I do think that as more and more--even Jamie Dimon and
    other folks were sort of concerned about consumers sharing too
    much of their data with unvetted apps.
        Chairman Crapo. Thank you very much.
        Mr. Turner, in the United Kingdom, the Financial Conduct
    Authority has implemented a regulatory sandbox that allows
    firms to operate on a limited basis to test different ideas
    while under the FCA's supervision, but without needing to
    comply with the full regulatory enforcement regime. Could you
    just discuss your thoughts on whether that is a good idea or
    something that we should possibly pursue here?
        Mr. Turner. Yes. Thanks, Senator. So just a little
    background. Whenever I speak to somebody in the industry, you
    know, they do say that the U.S. is pretty far behind on this,
    and there are other countries with these regulatory sandboxes
    that are beating us in innovation. And I think as we look at
    some sort of specific regulatory framework, a sandbox not only
    will let fintechs continue to innovate, but it will also give
    regulators a way to actually test new ideas and learn a little
    bit more about the process.
        Chairman Crapo. Thank you.
        Mr. Pasquale, do you have a thought on the sandbox
    approach?
        Mr. Pasquale. You know, I have written in the past in favor
    of pilot programs, and I think that they have proven their
    worth in some areas, for example, in health care policy. And I
    think that a very--we would have to do a very careful
    assessment of it, but there may be some promise there in terms
    of experimenting to learn more about exactly how this
    innovation might play out in certain contexts.
        Chairman Crapo. Thank you.
        Mr. Evans, do you have anything to add?
        Mr. Evans. We have a report that will be released in the
    winter of 2018 that actually looks at various regulatory
    approaches to fintech. And, in fact, our teams have traveled to
    Singapore, U.K., and Hong Kong and will be reporting out on
    ones that we think are more applicable to the United States.
        It is important to point out that the CFPB does have
    Project Catalyst, which allows fintech firms to pilot
    innovations that are deemed consumer-friendly.
        Chairman Crapo. Thank you.
        Senator Brown.
        Senator Brown. Thank you, Mr. Chairman. Thank you to all
    three of you for joining us.
        Professor Pasquale, the Equifax breach showed why CFPB's
    arbitration rule is so important. Had it not been for sharp-
    eyed consumer advocates and lots of public pressure, millions
    of scared consumers may have accidentally signed away their
    right to a day in court. But Americans should not have to go to
    court to defend themselves from companies that never got
    permission to collect their data. Big companies like Equifax
    got to hold Americans accountable for mistakes of every size.
    Now that this breach has left 143 million people around our
    country vulnerable to criminals, what should the Government do
    to hold them accountable at this point?
        Mr. Pasquale. So I think that this breach really ought to
    be a watershed and that we ought to really reconceive how we
    regulate this area. I think existing approaches are failing. I
    know that the Federal Trade Commission and the SEC are trying
    very hard with existing approaches, but I do not think they are
    really protecting people.
        And what I like to analogize the situation to is if you
    have a doctor, for example, in a State that repeatedly commits
    malpractice, they lose their license. If you have a lawyer
    that, you know, shirks duties to clients, et cetera, they will
    lose their license. And I think we really have to think
    seriously about licensing certain entities, as we do at the
    corporate level, with respect to the consumer finance
    information because we have seen so many instances of failure
    here. And I think repeated instances of failure should lead to
    a revocation of such a license. But I know that is a long way
    off.
        Senator Brown. Thank you.
        Mr. Turner, the Equifax breach exposed, as we have said
    repeatedly, 143 million Americans' financial data to potential
    fraudsters. Do you have an opinion as a market analyst on what
    its impact may be for the broader economy when this happens?
        Mr. Turner. I do not have an exact opinion related to this
    case. I think when you look at cybersecurity, you need to look
    at a few factors. You know, it is not only the technology that
    actually is in place to protect against a breach, but also a
    culture around compliance. So I think if we did have some sort
    of nationwide standard around cybersecurity, we could prevent
    instances like this in the future.
        Senator Brown. So because this has been so front and center
    in the Nation's media and people are increasingly concerned and
    in some cases have a pretty good belief that they were
    breached, does this make consumers less likely to give their
    data to new fintech platforms? Will established banks and
    financial firms think twice before partnering with a fintech
    and sharing their consumer data? Take that out and its impact
    on the economy that way, answer that directly, and then in a
    broader way, its impact on the economy through those portals,
    if you will.
        Mr. Turner. Yeah, so I think that fintech companies in
    general are pretty advanced when it comes to cybersecurity. I
    think if you look at, as I mentioned, culture, the cultures are
    all really based around the technology. People are very aware
    of the risks. And in many cases, these companies actually just
    use an API to get information from a bank that has created this
    data trail in the past.
        So I think maybe a more important question needs to be when
    we create data, whether it is financial transactions, whatever
    it may be, who owns that data? Is it the consumer that owns
    that data or is it the institution that created it? And should
    consumers have the ability to own their data and only display
    it when it is actually needed?
        Senator Brown. So what happens if banks decide that they
    just do not want to partner with a fintech and share this data?
    Understanding what you just said, but what happens then?
        Mr. Turner. Yeah, I think that has actually been an area of
    concern because there has been some back and forth between
    large banks and fintechs. And I think that depending on the
    platform and the implementation, you know, if you look at a
    company that needs your bank account information in order to
    process payments or needs access to, you know, your bank
    account, those companies will not exist and that innovation
    will go away if there is not some sort of agreement on how to
    share data.
        Senator Brown. OK. Mr. Evans, under Section 1033 of Dodd-
    Frank, the CFPB is ordered to create rules granting consumers
    more control over their financial data. The law specifically,
    as I think you know, exempts sharing data about algorithms or
    other methods companies use to create risk scores or make other
    predictions about a consumer's financial performance. Should
    these algorithms be exempt?
        Mr. Evans. That is a tough question because, on the one
    hand, these algorithms might represent proprietary information
    that gives institutions their advantage in whatever space they
    are operating.
        On the other hand, these algorithms and the use of
    nontraditional data could be important in determining whether
    or not a person gets credit or not, and we do not have a lot of
    information about the algorithms.
        I think one of the critical issues, though, is that this
    aggregation of information fuels some of the novel fintech
    approaches. For example, it is based on the aggregation of
    accounts across an individual's life to give a holistic picture
    of what the financial situation is.
        If knowledge of the algorithm has a chilling effect on
    that, that could be problematic for some models. So it is
    tough, Senator Brown. It could go both ways.
        Senator Brown. But it is pretty hard to argue, in light of
    the data breach, that consumers should not know exactly how
    their data is being used.
        Mr. Evans. Absolutely.
        Senator Brown. All right. Thank you.
        Chairman Crapo. Senator Perdue.
        Senator Perdue. Mr. Evans, this is off point, but would you
    agree the same thing applies to the CFPB?
        Mr. Evans. Could you clarify, Senator?
        Senator Perdue. That the data that the CFPB is collecting
    should meet the same standards of the data that we are talking
    about here?
        I will withdraw the question. I have got a more relevant
    question.
        Mr. Evans. OK. Thank you.
        Senator Perdue. We will talk offline about that.
        Mr. Evans. OK.
        Senator Perdue. I am concerned about the fact that this
    area has no borders. Forty-seven percent of all global online
    transactions, retail transactions, are made in China, are from
    China, and 40 percent of all Chinese consumers are using new
    payment systems like we are talking about today. They are
    talking about WeChat, Ant Financial, and others. This is a very
    rapidly growing sector over there, and I am very concerned that
    we have our regulatory environment here, but we have a lot of
    transactions going on around the world that come and go across
    borders.
        What recommendations, given the global impact--and I would
    like all three of you to comment on it. What do you recommend
    that we--what should we be doing here to get ahead of this?
        Mr. Evans. Excellent question, and I think it goes back to
    something Eric pointed out before and we have pointed out in
    this report, that our regulatory system in the United States is
    quite fragmented. It could stifle innovation to some degree.
    And so that should be job number one for Congress and
    regulators, to make sure we have the right regulatory framework
    given these novel approaches being taken across the financial
    landscape.
        Senator Perdue. Mr. Turner.
        Mr. Turner. Thank you, Senator, and I think I just want to
    clarify something here. When you look at China, you know, in
    some ways we actually are at a disadvantage because we are so
    advanced in our financial system. They are coming into a time
    where they did not have a lot of the infrastructure we have, so
    if you look at--you mentioned WeChat and payment systems like
    that. It is because there was not a robust card network
    presence or an ACH system like we have. So if you look at what
    we have in terms of peer-to-peer payment systems, global
    payment systems, those for the most part actually still, you
    know, as you would say, ride the rails. They still process
    through the same systems of the large card networks or ACH. I
    think that, you know, that is going back to regulation because
    these payment companies know that they are doing--they are
    complying with the way things need to be done. They are using
    systems that are in place. So, you know, I think as everybody
    has mentioned, if we want to push that innovation forward and
    you want to see us on par with, you know, the innovation in
    China or something like that, there just needs to be more
    clarity on where fintechs can go. So if that is a regulatory
    sandbox or some sort of specific regulatory framework, I am not
    sure, but it is going to be something like that.
        Senator Perdue. Dr. Pasquale.
        Mr. Pasquale. Yes, I think you are absolutely right,
    Senator, to point to China as a place where there is a great
    deal of innovation here. It is very cutting edge. I remember
    Connie Chung's piece for a16z on WeChat and describing just how
    many things you can do within the app. And I am sure that
    consumers would find it extremely convenient. And global
    cooperation among regulators could enable similar types of apps
    to arise in the U.S.
        My only caution would be that I think looking at some of
    the literature on the Chinese social credit scoring system,
    which I cite in my written testimony, I do have concerns that
    the integration of information across so many sectors into one
    app could raise both concerns about competition and about
    privacy. So I think we should work with global regulators, but
    we should be cognizant of some of the risks.
        Senator Perdue. Mr. Turner, in the time remaining, talk to
    us about tokenization. Is this a way of the future relative to
    EMV chips and PIN efforts right now in terms of privatization
    and security of data?
        Mr. Turner. Yeah, I think we are seeing--you know, again,
    this is kind of an area where the U.S. is catching up on a lot
    of this. If you look at the U.K., the most popular form of
    payment is contactless card payments. So, you know, we are just
    getting to the point where we are upgrading to EMV systems, and
    there is no doubt that those are more secure than what we had
    with magnetic strips.
        I think that, you know, if we continue to see growth in
    payments being moved outside of the traditional network, so as
    we see cards go away, as we see cash go away, you know,
    tokenization will be how everything is processed, and that will
    either be with our mobile wallets, if we are doing some sort of
    contactless transaction in a store, or if we are sending
    payments person to person.
        Senator Perdue. Do you see this as a rising capability that
    makes some of--well, let us just say the terrorist network in
    terms of shadow banking and so forth. I mean, we have heard
    testimony here in other committees about that. Do you have any
    insights into that?
        Mr. Turner. Really, I think that as we continue to have
    growth in digital payments, a lot of people do not realize that
    is probably good for controlling things like AML, anti-money-
    laundering. I think that it creates an audit trail, and as we
    see things like blockchain technology start to take off, you
    know, those transactions are recorded in an immutable ledger.
    You cannot go back and change them. You can trace them, and you
    can actually do AML compliance in real time. So I think the way
    that we are moving in digital payments in the future is
    actually going to be a lot easier for companies to control
    these compliance costs.
        Senator Perdue. Thank you.
        Thank you, Mr. Chairman.
        Chairman Crapo. Senator Reed.
        Senator Reed. Well, thank you very much, Mr. Chairman. And
    thank you, gentlemen, for your testimony.
        Professor Pasquale, thank you for citing my proposed
    legislation along with Senator Warren and Senator Collins. It
    is a response really to all of what we are seeing in terms of
    the Equifax breaches and everything else. And the underlying
    principle is it is a disclosure bill. I think shareholders
    should be aware of what their investment--or their company is
    doing in terms of cybersecurity. And it leads to the question
    that I think a lot of people are asking now: Are companies at
    the proper level focusing proactively on avoiding major and
    costly cybersecurity attacks? So I will ask you, in your
    opinion, are most companies doing that now, or is it the
    exception?
        Mr. Pasquale. Thank you, Senator. I do think it is the
    exception. Based on the work of Kristin Johnson on managing
    cyber risks, I think she has done some very interesting
    analysis of how the problem is that when these types of cyber
    risks arise, there can be a huge leak of data, but the full
    consequences may not be known for years or even decades
    afterward. And the problem is, as your bill anticipates, how do
    you sort of front-load awareness of these problems and try to
    engage the board so that we are thinking about it not after the
    fact, not requiring disclosure after something bad has
    happened, but actually requiring something that happened
    beforehand.
        So, yes, I do think that it is an area that needs much more
    attention from corporate boards.
        Senator Reed. Let me ask you, Mr. Turner, your experience
    too in terms of looking across the spectrum of both private and
    publicly held companies. Is suitable attention being paid to
    cybersecurity issues, in your view?
        Mr. Turner. I think if we are looking at the fintech sector
    in particular, as I mentioned before, cybersecurity is a big
    focus. But, you know, as you start to take a step back and look
    at the economy as a whole, especially just the financial system
    we have today, cybersecurity is definitely a big focus. But I
    think a lot of the problems lie in the fact that our banking
    system really is a product of decades' worth of consolidation.
    There are a lot of, you know, fractured technology systems,
    physical servers, and things where, you know, it is hard to
    comply and keep an eye on cybersecurity when you are really
    just trying to keep these old systems running on a day-to-day
    basis. And I think we see some of the more innovative
    institutions moving toward things like cloud storage and cloud
    computing. And as we start to get there, I think it will be
    easier for firms to take a good look at cybersecurity and put
    some good measures in place.
        Senator Reed. But it would seem appropriate to have the
    Securities and Exchange Commission lead that effort to try to
    get them to that position. That is fair?
        Mr. Turner. Yeah, again, I mean, you know, an actual
    cybersecurity law or regulatory framework is really up to
    Congress and the regulators. But I do think, you know, it is
    not only that but just a--you know, if you had some sort of
    national standardization even in what these terms mean, you
    know, if NIST or someone like that could come out as well, I
    think those are all good steps in the right direction.
        Senator Reed. You actually raised a very profound question,
    and the best parts of these hearings are not the answers but
    the questions that we have to think about, like who owns the
    data, which has to be done on an international basis,
    obviously, since it flows so freely across the globe. But that
    is an issue that we have to confront, I think, in Congress, at
    least for the United States. I think there are other questions
    like that. Are there data that should be off limits, you know,
    no one can have it or the person has to give an affirmative
    thumbs up or thumbs down? Should data be purged rapidly so that
    you do not accumulate this vast holding stretching back that is
    more transactional than archaeological, if that is a term? And
    I think there is a whole series of questions that you have
    raised which I find very, very helpful, so thank you very much.
        Mr. Evans, thank you and your colleagues at GAO. Just a
    final point. I have just a few seconds. Your response to the
    perception of how well prepared or well versed most companies
    are with respect to cyber, is it----
        Mr. Evans. Yes, so my team did not look at that as part of
    this work.
        Senator Reed. Yes, sir.
        Mr. Evans. But it is something that we are considering, and
    we do have folks that have given great thought to cybersecurity
    and the innovative technologies that might lead to improvements
    in this space. But, unfortunately, I have nothing to add to
    that question.
        Senator Reed. Thank you very much. Thank you, gentlemen.
        Chairman Crapo. Senator Cotton.
        Senator Cotton. Thank you, gentleman, for your appearance
    and your testimony this morning on this important topic.
        Estimates from a 2015 FDIC survey indicated that 7 percent
    of households in our country are unbanked; another 20 percent
    were underbanked, which means they have access to a bank but
    also used products outside the traditional banking sector. So
    that is over a quarter of our fellow citizens who do not have
    the kind of traditional banking relationships that the rest of
    Americans do.
        Mister--is it ``Pascal''?
        Mr. Pasquale. Pasquale. Thank you.
        Senator Cotton. I apologize. ``Pascal'' is how we pronounce
    it in Arkansas.
        [Laughter.]
        Senator Cotton. Along with other innovative pronunciations
    of different words. Do you think that the growing fintech
    market has the potential to help these unbanked and underbanked
    Arkansans access the digital economy and achieve greater
    financial security? And if so, please elaborate on how exactly.
        Mr. Pasquale. You know, I do think that when we look around
    the world, we have seen fintech used as a tool of financial
    inclusion. For example, with M-Pesa in Kenya and some other
    areas around the world, you see an effort there. And I do think
    that that is--you know, there could be some inspiring
    opportunities in order to sort of create that sort of tier of
    opportunity.
        But I think one of the very difficult questions for
    Senators and for the regulators now is: Do you want to create
    sort of a two-track system, sort of a system that, say, is
    maybe a higher tier, that has higher levels of protection and
    regulatory standards, and then a lower level? Or to what extent
    do we want to maintain sort of a more unitary set of
    protections?
        So I do think that, yes, there are definitely global
    examples of inclusion, but I am also cautious about, you know,
    what we might be giving up in order to bring them to the U.S.
        Senator Cotton. What, if anything, is inherent in fintech
    that would lead to that kind of two-tier system that we should
    have on our minds as we craft policy?
        Mr. Pasquale. I think that one of the things is that if you
    have, for example, fintech firms wanting to avoid, say,
    consolidated supervision or other sorts of requirements that go
    along with some of the benefits of, say, certain forms of
    regulation, that could be one aspect of the problem. But I
    think the other aspect is that I think sometimes fintech is
    confused because--the term itself leads to confusion because a
    lot of the technology ideally would be sort of an adjunct to
    existing banks that might be required to do what we want them
    to do in terms of serving the underbanked as opposed to itself
    providing those services.
        Senator Cotton. OK. Mr. Evans, you look like you might have
    something to add on that point?
        Mr. Evans. Yes, so I was just thinking through some of what
    Dr. Pasquale was discussing. Certainly I think there are great
    possibilities in this particular area, and of course, great
    risks that we detailed in the report. And it is almost too soon
    to know. We have not seen a full credit cycle. And we have
    seen, you know, earlier episodes where we have seen spikes in
    homeownership rates that were not sustainable. And so we want
    responsible, sustainable access to credit, and so those are
    some of the things we need to shake through when we think about
    marketplace lending.
        Senator Cotton. Mr. Turner, would you like to round out
    these thoughts?
        Mr. Turner. Yeah, I think it is important to note when we
    are talking about, you know, the unbanked and the underbanked,
    and when we say fintech can promote inclusion, you know, there
    are really two parts to that. There is the idea just of access,
    you know, as we continue to see bank branches closing, it is
    harder for people to actually have that local bank that they
    can go to and get financial services. So if we have, you know,
    mobile applications where people can bank on their phone, I
    think that is access.
        And then I think the second part of that is the inclusion
    that comes with, you know, expanded services that might use
    alternative data or something like that to make a decision on a
    loan that a FICO score might show a borrower is, you know, a
    risk, where if you include some additional data, you can get a
    better picture, and that person actually can get credit.
        So I think there is a lot to consider, and I think that,
    you know, as we move forward and we look at regulation, it is
    important to remember and it is important to make sure that
    fintechs kind of have a framework where, you know, they need to
    decide are they going to be deposit-taking institutions and be
    like a real bank or are they going to continue as they are now
    and then need some sort of defined regulatory structure
    specific to fintechs.
        Senator Cotton. Thank you.
        Mr. Pasquale, I would like to look at fintech from another
    perspective now. We were looking at it from the customer's
    perspective, now from the perspective of jobs and investors. A
    CEO of a London-based company called ``TransferWise'' recently
    said that he was recruited by Silicon Valley venture
    capitalists, but he chose the U.K. because of their regulatory
    structure. That is disappointing from the standpoint of
    American jobs. What, if anything, can we do to prevent future
    companies from making that decision and seeing the United
    States is the best, most favorable climate in which to start
    their companies and create new jobs?
        Mr. Pasquale. You know, I do think that the problem of is
    the U.S. sort of falling behind sort of the awareness of other
    countries like the U.K., that is a key problem. I also would
    note, though, in terms of the work involved, I think that we do
    have such a great advantage in terms of some of our sources of
    strength in Silicon Valley and in New York in terms of the
    funding of institutions there of education and other areas that
    sort of led to a big advantage there.
        So I guess my thought would be that I would not necessarily
    want to see the U.S. regulatory infrastructure be rapidly
    chipped away at to sort of keep up with this, with, say, what
    is going on other countries. But I do think that we should keep
    in mind that if there is a certain level of divergence, maybe
    that should lead to some more international cooperation to lead
    to more convergence, as we were talking earlier with Senator
    Perdue with some of the Chinese apps.
        Senator Cotton. Thank you.
        Mr. Turner and Mr. Evans, I regret my time has expired. We
    would welcome your comments on that question for the record,
    though. Thank you.
        Chairman Crapo. Thank you.
        Senator Cortez Masto.
        Senator Cortez Masto. Thank you, Mr. Chair, and thank you,
    gentlemen. This is an important discussion we are having, so I
    appreciate your comments today.
        Mr. Pasquale, let me start with you because Chairman Crapo
    had asked you, all of you, what the risks are, and one of the
    things that you talked about was the opaque algorithms to
    assess credit, and that was one of my questions. Can you
    elaborate on that a little bit, please?
        Mr. Pasquale. Sure. So one of the big problems in the U.S.
    credit industry is that there are lots of people who either
    have no file or a thin file, and so they are very hard for a
    bank to extend credit to because it sees them not having
    adequate--we do not have adequate background information on
    them. And so the answer from a lot of fintech firms is to say,
    ``Well, why don't we look at other sources of data?'' And there
    was a think tank called ``UpTurn'' that divided these into
    traditional, alternative, and fringe sources of data. So
    alternative data could be like your utility bill or rent bill,
    how often you pay your rent, et cetera. That seems pretty
    legitimate to me. But some of the fringe data could be things
    like how do you fill out a form online. Did you look at it for
    too long?
        In the others, reports of lenders saying if they see
    political activity on someone's Twitter account, they say,
    ``Oh, wow, well, maybe we should not lend to them. Maybe they
    are getting mixed up in things that we do not want to be
    involved in.'' And sometimes even the content of someone's
    smartphone, like the deal might be offered, just let us
    download everything on your smartphone and maybe we will give
    you a loan.
        And I think that these sort of business models could lead
    to what I call ``big data proxies.'' So the problem is that the
    companies involved may not necessarily be looking to
    intentionally discriminate against individuals, but as we know
    from ACOA, that is not the touchstone of liability there. The
    really key issue is: Could you use that sort of data like
    locational, other aspects of data to discriminate against
    people?
        And a final version of this could be that, for example, you
    might have very sophisticated algorithms that could from
    someone's face, say, tell their age or tell different medical
    conditions from them. This sort of face recognition software is
    already being used, say, to infer criminality from faces. And
    so the level of advances in AI means that there are so many
    different data sources, and the opacity of these is really a
    challenge to fair lending.
        Senator Cortez Masto. Thank you. And I know you have
    written extensively on data brokers, and I think that is
    important. I think it is important for all of us to understand
    there is so much data out there and the concern when it comes
    to credit or how we determine somebody's creditworthiness, if
    we are going to take all of that data into consideration, might
    at times create some sort of bias unintentionally because of
    the data we are collecting. Is that what you are saying?
        Mr. Pasquale. Absolutely, and I think Federal Trade
    Commissioner Edith Ramirez was a real intellectual leader here
    in terms of pointing this out as an issue, getting the FTC to
    write some good reports on it, and the White House big data
    report from last year.
        Senator Cortez Masto. OK. Thank you.
        Mr. Turner--and this is for Mr. Pasquale as well--how
    should policymakers think about balancing both the innovation
    provided by fintech companies and also ensuring that the same
    rules of the road that apply to traditional lenders also apply
    in this space?
        Mr. Turner. Yeah, I think that is actually a very important
    question right now, and I think, you know, things like the OCC
    charter are a step in the right direction. If you look at these
    lenders and, you know, if their primary business is lending,
    they should be treated like other lenders. And right now, you
    know, there are about three different ways that digital lenders
    operate. You know, they are either partnering with the
    federally regulated bank, they are going State by State and
    getting licensed, or they are doing, you know, kind of a mix of
    both. So I think that if you want to talk about a fair and
    level playing field, you know, while continuing to promote
    innovation, it needs to be something where both the incumbent
    financial institutions and the lenders feel like they are
    getting a fair deal. And I think, you know, something that has
    been mentioned before that is important is as we start to have
    some sort of regulatory framework for these digital lenders,
    you know, it is important to make sure that you do not have a
    very high interest rate lender just setting up a website and
    calling themselves a digital lender. I think it is important
    that you probably define what those lenders actually are first.
        Senator Cortez Masto. And then can you also address--and I
    will open it up to Mr. Pasquale as well--State preemption.
    Obviously, the crisis that we just came through--and I was
    working in the State of Nevada as Attorney General--the Federal
    regulators I think failed us to some extent. And so I am always
    concerned about some sort of State preemption in this space.
    And along with that--let me put my law enforcement hat on--
    fraud and money laundering when it comes to fintech companies
    and FinCEN and how that interaction should be involved with
    this process as well. So let me just throw that outcome there.
        Mr. Pasquale. I completely agree with your concerns about
    preemption, and in my written testimony, I have talked a bit
    about some of the critiques of the potential for OCC to preempt
    some of the relevant State laws, including usury laws, because
    there are already some worries in exactly that area. And we saw
    even the Supreme Court reconsidering its embrace of preemption
    in Watters v. Wachovia in the later case Cuomo. And I think
    that that sort of signal from the Supreme Court should be a
    signal to regulators and to Congress in terms of exactly the
    type of concerns that you are raising.
        Senator Cortez Masto. OK. Thank you. I notice my time is
    up. Thank you, gentleman. I appreciate the comments.
        Chairman Crapo. Thank you.
        Senator Tillis.
        Senator Tillis. Thank you, Mr. Chair. Gentlemen, thank you
    for being here.
        I want to go back. I have got a couple of things I hope I
    have time to ask about, but, Mr. Evans, I think you mentioned
    in response to the Chair's questions about the sandboxes some
    of the other countries are experimenting with that, you know,
    you want to be in an environment where you can move fast and
    break things, but maybe do it with the right rails in place.
        Number one, you said that you are going to do a report that
    is due out in the winter of next year.
        Mr. Evans. That is right.
        Senator Tillis. That is about a dog year in technical
    terms. So one question I have is: What can we do now to
    potentially look at this with the right kind of safeguards and
    not wait 2 or 3 years where a lot of things will be different,
    as they were 2 or 3 years ago?
        Mr. Evans. Very good question. I think you are going to see
    some competing interests on both sides of the issue when you
    think about what the appropriate regulatory approach is in the
    U.S. and what we can actually glean from other economies.
        Senator Tillis. And do you think the current regs make it
    difficult for a large traditional bank to even really get into
    this mode of where they could move fast and break things? Or
    are they at a decided disadvantage until we have some sort of
    rationalization?
        Mr. Evans. Yes, and I do not think that that is the
    appropriate model in the financial services space because we
    are not talking about apps. We are talking about access to
    credit. And so the more appropriate model is maybe move fast,
    be careful, think through what the landscape looks like.
        Senator Tillis. Yeah, and I meant it actually in a more
    positive light, I think, in innovation. What you are trying to
    do is innovate, particularly for our U.S.-based entities and
    innovators to be globally competitive. So I am trying to find a
    sweet spot where you do that but it does not become disruptive.
        Mr. Evans. Right.
        Senator Tillis. I hope that if--the report takes as long as
    a report takes, but I hope that we have other information that
    is instructive to Congress so that, to the extent that
    regulatory or legislative action is required, we are able to
    move more quickly than a dog year in technology.
        Mr. Evans. Yes, sir, and this will be early----
        Senator Tillis. Early winter?
        Mr. Evans. Early 2018.
        Senator Tillis. Oh, OK. Good. There are two winters in
    2018, so you are talking about the early part.
        Mr. Evans. That is right.
        Senator Tillis. Good. One question I have is whether or not
    we have got a bubble with respect to cryptocurrencies, and, you
    know, you have got a thousand different cryptocurrencies out
    there. Can you talk a little bit about the need for regulation
    and watching how the industry is moving? We will start with
    you, Mr. Pasquale, and just go down the line.
        Mr. Pasquale. Yes, Senator Tillis, I think that is a really
    powerful concern right now. I have seen stories, for example,
    of people trying to puff a certain cryptocurrency by saying,
    ``I am a taxi driver. I took my money out of the bank. I put it
    into the cryptocurrency and now I am rich.'' And I think that
    when you look particularly at the diversity of the initial coin
    offerings and how they are proliferating, even boosters of the
    cryptocurrency industry like CoinDesk have published articles
    saying here are massive governance deficits with respect to how
    these ICOs work and how some of the cryptocurrencies work.
        So I do hope that--I think that our regulators are trying
    to catch up with it, but I think it is going to take a lot more
    coordinated, concentrated effort to do so.
        Senator Tillis. I have got limited time. If you want to
    briefly comment.
        Mr. Turner. So I think that when you look at
    cryptocurrencies, you need to realize, you know, the entire
    market is only a little more than $100 billion, and this is
    globally. So, you know, you cannot really call a bubble or
    anything like that, but it is not that much compared to other
    asset classes. I think that as Dr. Pasquale mentioned, you
    know, there needs to be some sort of regulation around initial
    coin offerings or token offerings, and whether that involves,
    you know, offering them only to accredited investors or setting
    up some sort of governance agency or having a current regulator
    look at them, I do not know. But there definitely needs to be
    something.
        Senator Tillis. I am sorry, Mr. Evans. I want to get to a
    final question, and it relates to some of your opening
    comments, Mr. Pasquale, or maybe I inferred incorrectly from
    it. But with respect to the algorithms that are being used by
    some of the players and the concern with maybe the risk of
    predatory lending practices, is there any information out there
    that would suggest that the rates on the whole that are being
    charged by people that are in the fintech space or there are
    substantial outliers based on the underlying risk using maybe
    factors that have not traditionally been used in the
    underwriting model? In other words, is there a real clear base
    of evidence that suggests that they are engaged in any kind of
    unfair lending practices? I infer that maybe you thought there
    was or there was a potential for it, so I was curious. That
    will be my final question.
        Mr. Pasquale. I would put it more on the potential side
    right now, Senator. I think that the issue in terms of--I
    briefly cited this 2016 Federal credit survey--or a credit
    survey by the Fed of some small businesses, and there was also
    an interesting story cited in my written testimony by David
    Lazarus about certain people had used the fintech platform and
    then later found out that the Small Business Administration had
    suggested--or someone from the SBA had suggested that if they
    have used certain lenders vetted by the SBA, they could have
    gotten a much better deal. But I would say that it is very--we
    are still in early days.
        Senator Tillis. More of a risk than a measured reality.
        Mr. Evans, and then I will finish.
        Mr. Evans. Certainly if you look at some of the enforcement
    actions--and there have only been a few--there was one case
    where the entity was a bit more aspirational than they should
    have been, and they promised benefits that did not actually pan
    out, and they were cited by the CFPB. But in terms of
    widespread evidence, I will say no, and in some cases you do
    see lower rates relative to some other higher-cost alternatives
    like payday lending.
        Senator Tillis. Thank you.
        Chairman Crapo. Senator Warren.
        Senator Warren. Thank you, Mr. Chairman.
        So we are here talking about innovative new financial
    services companies, and in that context, I want to ask some
    questions about the data on the cost of financial advice.
        Dr. Evans, you are the Director of the Financial Markets
    Group at the Government Accountability Office and an expert on
    all things financial markets, and you look at a whole lot of
    the data in this area. Is it your sense that it is now harder
    or easier for middle-income savers to access investment advice?
        Mr. Evans. So I would say easier, and that is a qualitative
    assessment and is based on consensus, because if you look at
    traditional wealth management, it takes $250,000 to get in the
    game; whereas, the digital wealth platforms require no minimum
    or a small amount, say $500. And some of these are automated
    platforms that do things like automatically rebalance the
    portfolio, which means lower fees. Examples of these include
    Betterment and Wealthfront.
        Senator Warren. Good, so getting easier. And, Mr. Turner,
    you are a research analyst at S&P Global Market Intelligence.
    You are also an expert on all things financial markets. In your
    expert opinion, is financial advice getting more expensive or
    less expensive for investors?
        Mr. Turner. Thanks, Senator. I think just echoing those--
    you know, as you continue to see the growth in digital
    advisors, you know, with much lower fees, consensus seems to be
    that advice is getting less expensive.
        Senator Warren. So here you are; you are both independent
    experts. I appreciate your opinions. They reflect the data.
    They reflect the facts as best we know them. But the National
    Chamber of Commerce apparently disagrees with you, and they
    think they have bought some facts to back them up.
        Last week, they hosted a meeting to complain about a new
    Department of Labor rule that prevents Americans who are saving
    for retirement from being cheated by their investment advisors.
    It is called the fiduciary rule. I know you are all familiar
    with it. And it requires investment advisors to offer advice
    that is good for the customers, not advice that makes more
    money for the investment advisor.
        Now, the Chamber was hyping a new study which they had
    bought and paid for claiming to show that the new rule made
    financial services more expensive for families.
        Now, my first guess when I saw this is that they were
    pushing around this so-called study because under the new
    fiduciary rule, financial advisors are hurting for profits.
        So, Mr. Turner, this is your area of expertise. With the
    new fiduciary rule in place, are investments shrinking and are
    financial advisors hurting for profits?
        Mr. Turner. Yes, so that is an interesting question. I
    think if you actually look in what I submitted for my written
    testimony, we predict by 2021 there will be $450 billion in
    digital advisors. That is a fourfold increase from where it was
    at the end of last year, and a lot of that growth is actually
    being driven by incumbent investment advisors who are looking
    toward these new technologies. So no longer is it the startups,
    but it is actually the larger firms that are offering these
    products.
        Senator Warren. So this is really interesting. So startups
    are doing well. That is part of what we are learning here. And
    the CEOs for the large financial firms like UBS and Charles
    Schwab actually have now told their shareholders in earnings
    calls that their profits are great and going up with the
    fiduciary rule in place. So the new rule is obviously lowering
    prices for consumers. It is shutting down cheating. It is
    letting investors access new markets. It is great for new
    financial startups like Betterment. It is good for big guys
    like UBS. And yet the Chamber of Commerce is running around
    like a chicken with its head cutoff trying to kill the rule.
        I get it. There are some investment advisors who built
    their profit models on kickbacks and on tricking their
    customers. But the fiduciary rule is good for consumers. It is
    good for markets. It is good for competition. It is good for
    startups. And it is even good for some of the biggest
    investment companies.
        Even so, the lobbyists and the trade associations like the
    National Chamber of Commerce are sucking down billions of
    dollars every year in this town, and those dollars do not keep
    flowing unless there is a fight somewhere. So the lobbyists and
    the trade associations keep right on fighting, whether it makes
    any sense or not.
        If I ran one of these companies, I would take a long, hard
    look at all of the shareholder money that is wasted on trade
    associations and membership in the National Chamber of
    Commerce. I think they are being taken for a ride.
        Chairman Crapo. Senator Van Hollen.
        Senator Van Hollen. Thank you, Mr. Chairman, and I thank
    all of you for your testimony.
        Mr. Pasquale, we are very proud to have you at the
    University of Maryland, and let me start with a question for
    you, because in your written testimony you have a section
    entitled ``The Problems of Extant Data Collectors are a Reason
    for More Scrutiny of Fintech, Not Less'', and you talk about
    different kinds of problems with a lot of the data that is
    being collected, accuracy, relevancy, and some other
    provisions.
        I just want to focus on accuracy for a moment because in
    this fintech world--and then I am going to ask you about the
    existing rule that is already more regulated. It seems that the
    burden is always on the consumer from inaccurate data, and the
    question is if a consumer is being harmed because of inaccurate
    information about them, why should they be paying the penalty?
    Why not the provider of bad information?
        So let me ask you, first, in the fintech world, is it still
    the Wild West? Do we need to have some provisions that say that
    those people who provide bad information that causes harm to
    consumers should have to pay some penalty rather than the
    burden on the consumer?
        Mr. Pasquale. I think that is an excellent proposal, and it
    really would rebalance things, because one of the things that I
    think is so tragic about the Equifax data breach or several
    data breaches is the amount of lost time, I mean people having
    to spend time haggling over the phone just trying to
    reestablish the basics of their identity to protect it from
    being exploited. And I think trying to rebalance the playing
    field--I mean, I know in Europe they have talked about a data
    levy, because the idea is that data--you know, we have often
    heard data is the new oil. But we also know that oil has some
    wonderful sides and has some terrible sides. And we try to deal
    with the environment consequences of oil.
        I think very similarly, when we have these large quantities
    of data that can create such harms once they are released, we
    need to sort of be storing up some level of reserve for
    regulatory efforts that would put the burden and the cost on
    the person that causes the accident, not the victims of it.
        Senator Van Hollen. All right. So let me follow up with
    Equifax, because most of the focus understandably right now is
    on breach of privacy, everyone's very personal information
    being exposed to the public and people who may want to do bad
    things with it. But you raised the issue that I hear constantly
    from our consumers, even before the data breach, which is that
    they get a question on--you know, they are denied a loan or
    their bank tells them there is a problem or whatever it may be.
    You mentioned an Arkansas woman in here who was denied a job.
        So even under those more regulated systems like Equifax,
    you have these problems today where consumers are stuck with
    the costs of bad information. Do you have any suggestions about
    how we can deal with that? Because if we can get it right with
    Equifax and the already more regulated entities, those sort of
    models could also be applied to fintech. I do not want to
    suppress the benefits of fintech. I just want to make sure it
    is not the consumers who are paying the costs for inaccurate
    information about them.
        Mr. Pasquale. Right, and I think one idea that I have
    explored in past work is requiring certain push notifications
    to consumers if they are put in a certain suspect category. And
    some of those suspect categories could be, for example, as I
    discuss in the written testimony, lists of people with certain
    illnesses. There are lists of people with diabetes, with AIDS,
    HIV-positive, mentally ill, et cetera. If you are on one of
    these lists, perhaps you should have to get a push notification
    so you could dispute it or at least you could understand what
    was happening. And also, I think there should be further
    regulatory effort on the use of the data, so not only putting
    the burden on the consumer but also restricting certain usages
    of data that may have, say, illicit provenance or have not
    sufficiently been vetted by, say, outside auditors or others.
        So I think that those would be two options, you know, both
    a consumer-facing option and an option of restrictions on use
    without proper vetting and auditing.
        Senator Van Hollen. All right. I look forward to working
    with you on it. There are two issues. One is the relevancy of
    the data, right? I mean, is a health condition relevant to
    whether you get a loan or something? The other is the accuracy.
    And they are both important, but it does drive me crazy when
    something that is just dead wrong gets on a credit report and
    the credit rating agency, whoever it may be, does not pay any
    penalty other than the fact that after months and months of
    work, they may say, ``Oh, yeah, we were wrong,'' even though it
    has created incredible economic and other kind of pain to
    consumers. So I look forward to working with you on that.
        Just a quick question you can answer for the record, if you
    want. With respect to bank loans, for example, we have FDIC
    protection. We have got this great new area in fintech where
    people have, you know, a lot of their--you know, not a lot of
    wealth but they have money stored in these areas that are not
    really insured.
        For the record, Mr. Chairman, any thoughts any of you have
    about how we deal with that issue? If I have money in my bank
    account and it is lost, I have the FDIC. What is the recourse
    for a consumer who uses fintech and their money is lost? So I
    would appreciate any answers you have for the record since it
    looks like my time is out.
        Chairman Crapo. Senator Schatz.
        Senator Schatz. Thank you, Mr. Chairman. Thank you to the
    witnesses for this important hearing.
        This is a question for all the witnesses. We hope that
    financial innovation breaks down barriers and increases
    financial inclusion and ultimately does good, but sort of
    pursuant to Senator Tillis' line of questions and what the
    panel has been talking about, the risks are real. There are
    security issues. As we saw with Equifax, our most sensitive
    personal information can be vulnerable, and there is the risk
    of creating a platform for predatory actors entrenching social
    and racial biases. And so innovation is disruptive, but it can
    be disruptive in positive and negative ways.
        I think we have an opportunity here. We can choose to lift
    up innovation that creates economic opportunity. We can make
    consumer protection a core value of what we do in fintech. When
    someone asks for regulatory flexibility, we can ask how is this
    innovation going to actually help people.
        As a starting point, I think it would be helpful to have a
    dedicated Innovation Office that is thinking comprehensively
    about these questions. This could be a one-stop shop in the
    Government for fintech businesses to figure out which
    regulations apply to them and a mechanism for coordinating
    among the regulators. It will be a Wild West without some
    attempt to coordinate.
        You already have regulators with varying degrees of
    aggressiveness in this space and enthusiasm for this space. But
    we need someone who is thinking around a few corners rather
    than just sort of narrow questions of compliance for particular
    companies.
        I would like to get each one of the panelists' views on the
    potential for an Innovation Office and a one-stop shop,
    starting with Mr. Evans.
        Mr. Evans. I will just quickly say that it is something
    that should strongly be considered. It is envisioned in the
    bill that is before the House. The regulators have talked about
    these type of initiatives, and it is worth full consideration.
        Mr. Turner. I think it is a great idea. I think as we start
    to look at potential regulation for the industry, having some
    sort of Innovation Office, having some sort of sandbox program
    in place could help fintechs and regulators really figure out,
    you know, what they are working toward. And I think if you look
    at large banks today, they all have Innovation Offices.
        Mr. Pasquale. Yes, and I would agree. I think that the
    problem of interagency cooperation is a really profound one,
    and the Dodd-Frank Act took certain steps in that direction
    with respect to the Financial Stability Oversight Council. And
    we see also in terms of data sharing and the governance of data
    sharing and the intelligence apparatus there are some efforts
    to sort of understand exactly what is going on in the overall
    ecosystem. And I think you are absolutely right that that is
    going to be the big agenda item, I think, over the next decade,
    is how you can get these agencies to cooperate around something
    like an Office of Innovation.
        Senator Schatz. Let me just ask another question not on my
    prepared list of questions. You know, the challenge, I think,
    with this Committee, at least to a certain extent, is that the
    public's eyes glaze over, even though all of these issues
    impact them directly. It is hard to describe why this panel and
    this topic matters to folks that we all represent, and yet it
    does.
        So could you just describe as concisely as you can, each
    one of you, the best opportunity when it comes to fintech and
    sort of the worst of a parade of horribles when it comes to
    fintech?
        Mr. Evans. So I think that the best opportunity, of course,
    is enhanced and sustained financial inclusion. The horror story
    is fintech companies being used as a platform to market high-
    cost loans to individuals that further undermine access to
    credit.
        Senator Schatz. Mr. Turner.
        Mr. Turner. I pretty much echo that. I think fintech really
    offers access. It offers ease of use. It offers reduced
    frictions. It offers reduced costs. And the only downside I
    could see in the future is bad actors parading as fintechs and
    trying to get fit into regulation that might be formed.
        Senator Schatz. Just as a quick follow-up, do we have a
    statutory framework that prevents those bad actors? Or are we
    just hoping they will not take advantage of this new aperture?
        Mr. Turner. I think if there is to be any sort of fintech-
    specific regulation, you will need to define what a digital
    lender is, what a peer-to-peer payment company is. It needs to
    be--you know, this is probably step one in doing that.
        Senator Schatz. And this becomes hard because banks are
    going to be in this space already.
        Mr. Turner. I think it could be difficult, but I think it
    is definitely necessary.
        Senator Schatz. OK. Mr. Pasquale.
        Mr. Pasquale. Yes, I think, you know, on the bright side, I
    do think when I look--I listen to a lot of podcasts on fintech,
    like the Wharton Fintech or Fintech Insider, and you often hear
    on these podcasts very interesting entrepreneurs who are
    bringing to people, say, the opportunity to buy insurance for
    an hour if they want to borrow their friend's car or something.
    And those sorts of things, like insurer tech, those sorts of
    things, are really, I think, filling a gap for consumers and
    might ultimately, if the market is structured correctly, lead
    to much better competition for financial services if options
    are transparent and understandable.
        For the downside, I would just reference there is a British
    science fiction series called ``Black Mirror'', and it has a
    terrific episode where someone finds that their score--they
    keep having negative social interactions, and their score,
    which also acts as a credit score, keeps going down and ruins
    their life.
        Senator Schatz. For the record, can I find that on Netflix
    or----
        Mr. Pasquale. Yes.
        [Laughter.]
        Chairman Crapo. Senator Warner.
        Senator Warner. Thank you, Mr. Chairman. I will tell you,
    Dr. Pasquale, I listen to a lot of podcasts as well. I am not
    sure Wharton Insider has been on my list recently. But let me
    compliment my friend Senator Schatz. I think the idea of this
    Innovation Office, this kind of one-stop shop makes an enormous
    amount of sense. I would love to help you on the--I do not--to
    try to accomplish that since we think about FSOC and other
    efforts. This notion of having some single point of reference
    in this area is a great idea. How we implement it is going to
    be a real challenge because I think, as Mr. Turner talked about
    a little bit, my old business used to be mobile telephony. I
    mean, mobile payments are a part of the fintech world. This is
    going to continue to grow in a number of ways, but I think it
    is a great idea.
        I want to come back to--I am going to try to get in two
    items. One, on the whole question of what Senator Reed raised
    in terms of trying to elevate this whole question around data
    protection at a higher level, I would simply point out I think
    we have got like 9,000 public companies. Even Yahoo, when it
    had its massive data breach, did not really view that as a
    material fact in terms of how do you not have a billion users
    hacked into and that not be material. Now, we whacked Yahoo,
    but the fact is I think less than 100 companies in the last
    decade have ever reported on a data breach in an SEC filing. So
    some of the things that Senator Reed has suggested are very
    important.
        Another piece I think is very important is--and this is not
    one that is a partisan issue. We have been working for 3\1/2\
    years trying to get a common standard around data breach. We
    have got 49 different State laws now on data breach. So the
    fact that Equifax took 6 weeks before they notified consumers
    was a reflection of the fact that we do not have a single
    standard around data breach. And the problem has not been
    actually lack of need for a standard. It has been individual
    industries, and in many cases my old industry, telecom wanted
    to try to exempt themselves from the requirements of
    notification.
        I know this is a little bit off topic, but because Equifax
    is kind of in the news and as we think about fintech being a
    brave new world, do you guys have a sense about the need--and I
    know, Dr. Pasquale, you had some concerns about Federal
    preemption. But in the case of the data breach, I strongly
    believe that we need a single national standard here. Do you
    have a view on any of that?
        Mr. Pasquale. I guess I would say that there are
    certainly--it is a very tough question because I do think that
    I want to preserve the ability of certain States to be on the
    cutting edge in terms of expansive requirements, and I think
    that, you know, California to some extent has had a very
    forward-thinking privacy office there in the Office of the
    Attorney General. But I also do see your point that it could
    become very costly for companies to comply with all the
    different standards, try to understand them all.
        And I think that, you know, I would have to study it
    further to know whether the benefit of uniformity----
        Senator Warner. I would love to get some--because we are
    very close. The challenge has not been trying to get a standard
    or the standard has to evolve. It also has notification
    requirements. But I think the challenge in a lot of data
    breaches is everybody blames somebody else. You know, is it the
    institution? Is it the financial institution? Is it the telecom
    companies? Is it some other player? And we end up now having
    these circumstances where, again, in the Equifax case we wait 6
    weeks before the public is notified.
        Mr. Turner and Mr. Evans, quickly, because I have got one
    other area I want to raise.
        Mr. Turner. Yeah, I just want to point out that I think, as
    you mentioned, just a national standard is probably step one.
    So I do not know if it is going to be specific Federal
    regulation or harmonized State regulation. But if everybody is
    on the same page, you know, at least it can start down that
    path.
        Senator Warner. Mr. Evans.
        Mr. Evans. And I would just echo those sentiments. What you
    want is consistent treatment.
        Senator Warner. One area that I have been intrigued with--
    and, again, there is a little poor guy who had all these other
    great, very specific fintech questions who is going to be upset
    I am not asking them, but this is another area. I think there
    is a real opportunity in fintech. One of the things I have
    looked at over the last 2 years is the transformation in the
    nature of work and the transformation in the notion of
    employment. You know, back in the 1990s, about 90 percent of
    Americans worked full-time in a W-2 type environment, yet we
    are the only industrial country in the world that makes all of
    our social insurance dependent upon your labor status. So that
    social contract that said if you work full-time, you get
    unemployment, health care, workmen's comp, disability,
    retirement, that world is changing. A third of the workforce
    right now is not in traditional work. They are in contingent
    work. You know, they are part-time, they are temp workers, they
    are 1099 independent contractors, the kind of sexy areas, the
    gig workers. All of that workforce, a third of the American
    workforce--the estimates are it is going to go to half--have no
    social insurance at all.
        One of the things we have looked at is the notion of
    portable benefits, and I think fintech offers an enormous
    opportunity, as long as it is properly regulated, to have the
    ability to have that portable benefit system that would allow
    you to move from firm to firm and carry those benefits with
    you.
        Any quick comments on that, right down the path,
    recognizing I am already out of time?
        Mr. Evans. I will pass.
        Mr. Turner. I think technology will be a great enabler of
    anything that does happen in that area.
        Mr. Pasquale. And I would agree with you. I follow some of
    the work on platform cooperativism, which are a lot of groups
    that are trying to create fairer forums of platform----
        Senator Warner. Stride Health and others, et cetera.
        Mr. Pasquale. Yeah, and I think that the portable benefits
    via some of these fintech firms could help them--could help
    individuals to get out of job lock, which I think is really a
    big drain on entrepreneurialism.
        Senator Warner. I would only say, Mr. Chairman--I know my
    time is up--that, you know, I do not think we are going to be
    able to force an economy back into a 20th century model where
    everybody works for the same company for 38 years the way my
    Dad did. But we are going to have to recognize that we need a
    social insurance platform or new social contract that meets the
    workforce where they are at and, again, as Dr. Pasquale said,
    allows people to move from job to job, and part of that means
    portability of benefits. So I think fintech offers a great
    opportunity here.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you, Senator Warner. And that
    concludes our questions. We have finished the hearing with 2
    minutes to spare, so I thank our witnesses for being concise in
    your testimony and also for your testimony. You will probably
    get additional questions from Senators, and the Senators should
    note that they have until Tuesday, September 19th, to submit
    questions. I urge our witnesses to respond to those questions,
    if you receive them, as quickly as you can.
        This is a very critical issue, and your testimony has been
    very helpful to us. We will probably look forward to working
    with you in the future to get further help from you.
        With that, the hearing is adjourned.
        [Whereupon, at 11:28 a.m., the hearing was adjourned.]
        [Prepared statements, responses to written questions, and
    additional material supplied for the record follow:]
                    PREPARED STATEMENT OF LAWRANCE L. EVANS
       Director, Financial Markets and Community Investment, Government
                             Accountability Office
                               September 12, 2017

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                   RESPONSES TO WRITTEN QUESTIONS OF
                SENATOR MENENDEZ FROM LAWRANCE L. EVANS

    Q.1. The Equifax data breach which impacted more than 143
    million U.S. consumers revealed weaknesses in the company's
    data security protocols. In your opinion, do consumer reporting
    agencies have sufficient data security standards and
    infrastructure to effectively protect the sensitive personal
    data they hold? Are there any existing legislative or
    regulatory gaps that contribute to this problem?

    A.1. While we cannot opine on the sufficiency of data security
    standards and infrastructure at consumer reporting agencies at
    this time, we are initiating work in response to a request from
    the Ranking Member of the Subcommittee on Financial
    Institutions and Consumer Protection that will allow GAO to
    address these concerns. Based on our existing body of work we
    can comment on infrastructure, data security and the regulatory
    landscape more broadly.
        Regarding oversight of critical infrastructure (which
    includes 16 key sectors, including the financial services
    sector) the National Institute of Standards and Technology
    Cybersecurity Framework is a voluntary standard intended to
    establish a common taxonomy for building cybersecurity
    programs. Outside of that, each industry is driven by its own
    regulatory requirements and Federal/State oversight structures.
        Current regulations impose requirements on financial
    institutions to protect consumer data and these safeguards
    explicitly apply to consumer reporting agencies. Specifically,
    the Gramm-Leach-Bliley (GLB) Act restricts, with some
    exceptions, the disclosure of nonpublic information by
    companies defined under the law as ``financial institutions''.
    The Act also requires the Federal Trade Commission (FTC) and
    certain other Federal agencies to establish standards for
    financial institutions relating to administrative, technical,
    and physical information safeguards. As part of its
    implementation of the GLB Act, the FTC issued the Safeguards
    Rule, which requires financial institutions under FTC
    jurisdiction to have measures in place to secure customer
    information and ensure affiliates and services providers also
    safeguard this information. \1\ The Rule applies to many
    companies of all sizes that are significantly engaged in
    financial products and services, including consumer reporting
    agencies. FTC has also used its statutory authority to address
    unfair and deceptive acts and practices under section 5 of the
    FTC act to enforce data security compliance.
    ---------------------------------------------------------------------------
         \1\ For additional information on the Rule see https://
    www.ftc.gov/tips-advice/business-center/guidance/financial-
    institutions-customer-information-complying.
    ---------------------------------------------------------------------------
        Currently, there is no Federal law that governs breach
    reporting but the prudential banking regulators have issued
    interpretive guidance requiring their regulated institutions to
    report breaches promptly to allow breach victims to take steps
    to protect themselves. Similarly, the Securities and Exchange
    Commission and the Commodity Futures Trading Commission have
    also issued rules that require compliance with the notification
    requirements of GLB Act.
        Moreover, States have varying laws associated with privacy/
    data breach notification. It is important to note that the FTC
    Safeguards Rule establishes standards but does not place
    requirements on institutions to notify customers within a
    specified timeframe. \2\ While banks are subject to regular
    examination of their information security practices, the
    nationwide consumer reporting companies (Equifax, TransUnion,
    and Experian) may not receive the same level of supervisory
    scrutiny. The Bureau of Consumer Financial Protection (CFPB)
    has supervisory and enforcement authority over the national
    consumer reporting companies but the extent to which this
    oversight includes regular examinations of information security
    practices will be the subject of future GAO work. CFPB does not
    have authority to enforce the GLB Act's data security
    provisions, but the agency has taken an enforcement action
    under its unfair, deceptive or abusive acts or practices
    authority against a payments company for allegedly deceptive
    statements about data security practices.
    ---------------------------------------------------------------------------
         \2\ The FTC is seeking comment on the Safeguards Rule, including
    whether the elements of an information security program should include
    a breach response plan. See 81 FR 61,632.
    ---------------------------------------------------------------------------
                                    ------

                   RESPONSES TO WRITTEN QUESTIONS OF
                  SENATOR MENENDEZ FROM ERIC W. TURNER

    Q.1. The Federal Deposit Insurance Corporation (FDIC) found
    that in 2013 nearly 30 percent of Americans households were
    ``unbanked'' or ``underbanked,'' with the highest rates among
    non-Asian minorities, low income households, and unemployed
    households. What technological advancements in the Fintech
    industry can promote financial inclusion among the ``unbanked''
    and underbanked''?

    A.1. Innovations in financial technology can provide increased
    financial inclusion through the ability to obtain services and
    the use of alternative data sources or underwriting
    methodologies.
        Traditionally consumers have obtained financial services
    from physical branch locations. As banks continue to close
    branches, many consumers have lost access to important
    financial services. U.S. bank branches decreased by 1,981
    locations during the period between June 30, 2016, and June 30,
    2017. As this trend continues, fintech innovations are filling
    the gap by providing traditional banking services such as
    deposit accounts, payments, and lending through digital
    channels.
        Regardless of their location, users can now access these
    services through online or mobile channels. This especially
    benefits people in rural or other areas that have a low number
    of bank branches due to the economics of keeping a physical
    location. Mobile banking technology can also help community
    banks serve more customers even without the extensive branch
    networks of large banks.
        According to a survey fielded by S&P Global Market
    Intelligence earlier this year, 65.5 percent of mobile banking
    users had an annual income of less than $75,000 and 54.2
    percent of users held less than $10,000 in their combined
    checking and savings accounts.
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        These statistics are similar to those of mobile payment
    users, who instead of using cash or checks to complete
    transactions rely on mobile applications to do things such as
    pay a bill, send money to another individual, or complete a
    purchase. According to S&P Global Market Intelligence survey
    results, 63.7 percent of mobile payment users had an annual
    income of less than $75,000.
    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

        In both cases, it is clear that lower income individuals
    have found mobile banking and payment technologies beneficial
    to their financial well being.
        Furthermore, increased access to term loans, as opposed to
    payday loans, can benefit the traditionally unbanked or
    underbanked. Digital lenders rely on mobile or web-based
    platforms and nontraditional underwriting models to deliver
    loans to consumers and small businesses that may otherwise be
    denied credit by traditional banks. Square Capital, for
    instance, sees 54 percent of loans go to women, compared to the
    16 percent quoted by the Small Business Administration. \1\
    ---------------------------------------------------------------------------
         \1\ https://www.snl.com/web/client?auth=inherit#news/
    article?id=42127613&KPLT=6&s_data=si%3D2%26kpa%3D4db0879a-62d3-40e0-
    b6fd-9e14f2ab7bee%26sa%3D
    ---------------------------------------------------------------------------
        Digital lenders offer credit to borrowers based on advanced
    analytics, nontraditional underwriting, and alternative data.
    These platforms leverage quantitative models that look to
    create proprietary credit scores outside of those provided by
    models such as FICO or even Vantage scores. While some
    platforms use inputs from national credit reporting bureaus,
    they may also include alternative data or weight credit factors
    differently than more well known models.
        Alternative data presents the opportunity to gain a more
    holistic view of a borrower. For example, information such as
    utility or rent payments can be included in the underwriting
    decision. For low-income borrowers who may choose to rent
    housing and where utility bills may be a large monthly expense,
    these are important and likely more predictive factors when it
    comes to the ability to repay.
        According to a Federal Reserve research paper published in
    July 2017, alternative data sources allowed borrowers with few
    or inaccurate credit records to access credit. \2\ This report
    further reinforced that these borrowers were from areas that
    lacked access to credit due to low income levels or
    disproportionate branch closings.
    ---------------------------------------------------------------------------
         \2\ https://www.philadelphiafed.org/-/media/research-and-data/
    publications/working-papers/2017/wp17-17.pdf

    Q.2. Fintech companies are subject to anti-discrimination laws
    related to the services and products they provide. However,
    there are concerns that using new data and algorithms could
    result in a company unintentionally discriminating against a
    protected group. What steps are companies taking to ensure that
    their services and products do not discriminate against
    ---------------------------------------------------------------------------
    protected classes?

    A.2. The use of new data and algorithms primarily applies to
    providing credit to individuals in the digital lending space.
    These lenders have sought ways to provide credit to previously
    underserved individuals using alternative sets of data. As the
    industry has matured, there have been numerous cases where it
    was decided that some data sets could potentially discriminate
    against protected classes. For example, offering personal loans
    based on the college from which you graduated was largely
    considered a valid input for lenders years ago, but many have
    shifted away from this. Other inputs like social media usage
    were once considered but never ultimately made it into
    underwriting criteria due to similar concerns.
        Digital lenders have made great effort to ensure that
    underwriting algorithms are accurate and provide the best
    financial inclusion possible. In order to ensure that this
    continues, regulators should create a friendly environment for
    innovation. This could be through a regulatory sandbox or
    innovation office. The recent no-action letter from the CPFB to
    personal-focused digital lender Upstart is a good example of
    how regulators can better understand the space. \3\
    ---------------------------------------------------------------------------
         \3\ https://www.consumerfinance.gov/about-us/newsroom/cfpb-
    announces-first-no-action-letter-upstart-network/
    ---------------------------------------------------------------------------
        Many of the underwriting inputs used by fintech startups
    today are similar to those used by traditional lenders, but in
    cases where alternative data is used, it will be up to the
    lenders and regulators to closely monitor adherence to fair
    lending practices.
        Thank you again for the questions; I hope that our response
    has been useful.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
                          FROM FRANK PASQUALE

    Q.1. Senator Crapo asked about regulatory sandboxes that would
    allow financial technology companies to experiment in real
    markets, and you mentioned some pilot programs have ``proven
    their worth in health care policy.'' Can you describe the types
    of pilot programs that have worked in other sectors; how such
    programs navigated conflicts between State and Federal law; and
    under what parameters or considerations a financial technology
    pilot program would need to operate in order to protect
    consumers and the marketplace?

    A.1. Pilot programs can be important tools for gathering data
    necessary to evaluate products and services in various sectors,
    such as the health care and financial sectors. \1\ Regulators
    in these sectors need to understand more fully what technology
    firms are doing and how they are performing to ensure proper
    regulations are in place that safeguard individuals but do not
    stifle innovation; pilot programs can be a tool to do this.
    Effective pilot programs support ``responsible innovation'' and
    provide transparency of process necessary to expose any
    potential pitfalls or unanticipated issues. \2\
    ---------------------------------------------------------------------------
         \1\ This answer was prepared by Jennifer Smith, Ryan H. Easley
    Research Fellow at the University of Maryland School of Law, after a
    request with initial guidance from Frank Pasquale, the witness.
    Professor Pasquale has reviewed the response and believes it to be a
    fully responsive response to the question.
         \2\ Press Release, Off. Comptroller of the Currency, Dept. of the
    Treasury, ``OCC Issues Responsible Innovation Framework'' (Oct, 26,
    2016), https://www.occ.gov/news-issuances/news-releases/2016/nr-occ-
    2016-135.html.
    ---------------------------------------------------------------------------
        Pilot programs are particularly important in gathering
    information from sectors that are not apt to be transparent
    with data. As in health care, where the average consumer does
    not have the information necessary to `` `second guess' his or
    her [medical] provider about the amount or nature of care
    needed, \3\'' the average consumer does not know how his or her
    financial and personal data is being used, or what data is even
    being mined, in order to make informed decisions and protect
    his or her financial health. Due to this knowledge gap,
    consumers of both health care and financial services depend on
    regulations that are based on a thorough and thoughtful
    understanding of the industry being regulated. Pilot programs
    can provide State and Federal regulators with the data and
    information necessary to formulate thorough and thoughtful
    regulations that do not stifle innovation and protect
    consumers.
    ---------------------------------------------------------------------------
         \3\ Frank Pasquale, ``Ending the Specialty Hospital Wars: A Plea
    for Pilot Program as Information-Forcing Regulatory Design'', in The
    Fragmentation of U.S. Health Care: Causes and Solutions 235, 272 (Einer
    Elhauge, ed., 2010).
    ---------------------------------------------------------------------------
        In the health care sector, pilot programs are used to
    promote innovation and test new models of patient care and
    service. Although the health care and financial industries have
    their own unique issues and obstacles, health care pilot
    programs provide lessons that can assist the development and
    implementation of fintech pilots. For a recent example, the
    Food and Drug Administration (FDA) announced the launch of the
    Pre-Cert for Software Pilot Program in July 2017 and in
    September announced the nine companies selected to take part in
    the pilot program. \4\ One of the pilot program goals is to
    ``enable [the FDA] to develop a tailored approach toward
    regulating [digital health] technology by looking first at the
    software developer and/or digital health technology developer,
    rather than primarily at the product, which is what [the FDA]
    currently [does] for more traditional medical devices. \5\''
    Although this pilot program is in the beginning stages, the
    impetus, framework, and eventual outcomes may serve as guidance
    for developing pilot programs for fintech firms and regulators.
    ---------------------------------------------------------------------------
         \4\ Scott Gottlieb, ``FDA Announces New Steps To Empower Consumers
    and Advance Digital Healthcare'', FDA Voice (July 27, 2017), https://
    blogs.fda.gov/fdavoice/index.php/2017/07/fda-announces-new-steps-to-
    empower-consumers-and-advance-digital-healthcare/; Press Release, U.S.
    Food & Drug Admin, ``FDA Selected Participants for New Digital Health
    Software Precertification Pilot Program'' (Sept. 26, 2017), https://
    www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm577480.htm. The
    nine companies selected are Apple, Fitbit, Johnson & Johnson, Pear
    Therapeutics, Phosphorus, Roche, Samsung, Tidepool, and Verily. Id.
         \5\ Digital Health Software Precertification (Precert) Program,
    U.S. Food & Drug Admin. (Sept. 27, 2017), https://www.fda.gov/
    MedicalDevices/DigitalHealth/DigitalHealthPreCertProgram/default.htm.
    ---------------------------------------------------------------------------
        An example of a completed health care pilot program that
    may provide guidance for fintech pilots is a program testing a
    bundled payment model for care. \6\ This program was through
    the Agency for Healthcare Research and Quality (AHRQ) at the
    Department of Health and Human Services (HHS). Some of the
    takeaways that may inform the development and implementation of
    fintech pilot programs are: ensure the number of stakeholders
    and volume of participants are sufficient to provide good data;
    build consensus around key definitions and issues, such as
    assumption of risk; and build trust among participants.
    Additionally, the bundled payment model pilot program faced
    ``delays and uncertainty related to State regulations.'' \7\
    Specifically, California hospitals and health care plans
    participating in the pilot program worried physician payments
    through the bundled payment contracts would violate California
    regulations prohibiting the ``corporate practice of medicine.
    \8\'' In response to this concern a model contract template was
    created and participants in California developed a split-bundle
    model. The ``development and successful deployment of a common
    contracting template that largely satisfied the contracting
    parties and State regulators'' is cited as one of the programs'
    successes. \9\
    ---------------------------------------------------------------------------
         \6\ In a bundled payment model ``a group of providers receives a
    fixed payment from participating health plans. The payment is designed
    to cover the average cost of a defined `bundle' of services related to
    a procedure or course of treatment.'' M. Susan Ridgely et al., ``The
    IHA Bundled Episode Payment and Gainsharing Demonstration'', AHRQ
    Delivery System Research: Study Snapshot 1 (AHRQ Pub. No. 15-0016-2-EF,
    2015).
         \7\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
    Gainsharing Demonstration'', AHRQ Delivery System Research: Study
    Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
         \8\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
    Gainsharing Demonstration'', AHRQ Delivery System Research: Study
    Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
         \9\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
    Gainsharing Demonstration'', AHRQ Delivery System Research: Study
    Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
    ---------------------------------------------------------------------------
        In addition to examining domestic pilot programs in various
    sectors, it is informative to look at international regulatory
    sandbox and pilot programs. Internationally, regulatory
    sandboxes/pilot programs are utilized to promote innovation in
    fintech and develop regulations. \10\ The United Kingdom's
    Financial Conduct Authority (FCA) is often cited as a model for
    regulatory sandbox programs. \11\ To date, the FCA has
    completed one cohort of testing, is in the process of testing
    for the second cohort, and is reviewing applications for
    inclusion in cohort three. \12\ Hong Kong also utilizes
    supervisory sandboxes to ``encourag[e] financial institutions
    to make use of Fintech and support[] initiatives that drive
    Fintech adoption and innovation. \13\'' Hong Kong's supervisory
    sandboxes are run through three regulators: the Hong Kong
    Monetary Authority, \14\ the Securities and Futures Commission,
    \15\ and the Insurance Authority. \16\ Additionally, the
    Monetary Authority of Singapore (MAS) supports regulatory
    sandboxes that ``provide appropriate regulatory support by
    relaxing specific legal and regulatory requirements . . . for
    the duration of the sandbox. \17\''
    ---------------------------------------------------------------------------
         \10\ See Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
    fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017); ``Monetary
    Authority Singapore, Fintech Regulatory Sandbox'', http://
    www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/
    FinTech-Regulatory-Sandbox.aspx (last visited Oct. 3, 2017); Fin.
    Conduct Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8,
    2017), https://www.fca.org.uk/firms/regulatory-sandbox.
         \11\ Stephanie Forshee, ``OCC Has Banking Sandbox-like `Pilot' for
    Fintechs in the Works'', Law.com (Aug. 10, 2017), http://www.law.com/
    sites/almstaff/2017/08/10/occ-has-banking-sandbox-like-pilot-for-
    fintechs-in-the-works/?slreturn=20170902083457. See also Fin. Conduct
    Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8, 2017),
    https://www.fca.org.uk/firms/regulatory-sandbox.
         \12\ Fin. Conduct Authority (U.K.), ``Financial Conduct Authority
    Provides Update on Regulatory Sandbox'' (June 15, 2017), https://
    www.fca.org.uk/news/press-releases/financial-conduct-authority-
    provides-update-regulatory-sandbox.
         \13\ Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
    fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017).
         \14\ Hong Kong Monetary Authority, ``Fintech Supervisory Sandbox''
    (FSS) (Sept. 29, 2017), http://www.hkma.gov.hk/eng/key-functions/
    international-financial-centre/fintech-supervisory-sandbox.shtml. The
    Hong Kong Monetary Authority operates a Fintech supervisory sandbox for
    ``Fintech and other technology initiatives intended to be launched in
    Hong Kong by banks.'' Id.
         \15\ Sec. & Futures Comm'n, ``SFC Regulatory Sandbox'' (Sept. 29,
    2017), http://www.sfc.hk/web/EN/sfc-fintech-contact-point/sfc-
    regulatory-sandbox.html. The Securities and Futures Commission operates
    a regulatory sandbox ``to provide a confined regulatory environment for
    qualified firms.'' Id. Qualified firms are ``both licensed corporations
    and start-up firms that intend to carry on a regulated activity under
    the [Securities and Futures Ordinance].'' Id.
         \16\ Ins. Auth. (H.K.), ``Insurtech Corner'', https://
    www.ia.org.hk/en/aboutus/insurtech_corner.html (last visited Oct. 3,
    2017). The Insurance Authority's ``Insurtech Sandbox'' was created to
    ``facilitate a pilot run of innovative Insurtech applications by
    authorized insurers to be applied in their business operations.'' Id.
         \17\ Monetary Authority Sing., ``Understanding and Applying to the
    Sandbox'', http://www.mas.gov.sg/Singapore-Financial-Centre/Smart-
    Financial-Centre/FinTech-Regulatory-Sandbox/Understanding-and-applying-
    to-the-sandbox.aspx (last visited Oct. 3, 2017). See also ``Monetary
    Authority Sing., Fintech Regulatory Sandbox Guidelines'' (Nov. 2016),
    http://www.mas.gov.sg//media/Smart%20Financial%20Centre/Sandbox/
    FinTech%20Regulatory%20Sandbox%20Guidelines.pdf.
    ---------------------------------------------------------------------------
        In conclusion, pilot programs can be important tools for
    gathering data necessary to evaluate and refine fintech.
    Regulators need to understand how fintech firms operate and how
    they perform in order to properly regulate fintech and ensure
    innovation is supported and consumers are protected; pilot
    programs can support and advance responsible innovation.
                                    ------

                   RESPONSES TO WRITTEN QUESTIONS OF
                  SENATOR MENENDEZ FROM FRANK PASQUALE

    Q.1. The Federal Deposit Insurance Corporation (FDIC) found
    that in 2013 nearly 30 percent of Americans households were
    ``unbanked'' or ``underbanked,'' with the highest rates among
    non-Asian minorities, low income households, and unemployed
    households. \1\ As new companies begin to market products and
    services to unbanked and underbanked households, what actions
    should Federal or State regulators pursue to ensure that
    consumers receive sufficient protections?
    ---------------------------------------------------------------------------
         \1\ Fed. Deposit Ins. Corp., ``2013 FDIC National Survey of
    Unbanked and Underbanked Households: Executive Summary'' (2014),
    https://www.fdic.gov/?householdsurvey?/2013??execsumm.pdf.

    A.1. Fintech can be a means of building financial inclusion,
    especially for those Americans currently unbanked or
    underbanked; but there must be proper protections to ensure
    consumers are protected and information is obtained and used in
    a secure manner and in a way that does not unintentionally
    discriminate. \2\ Federal and State regulators need to ensure
    consumers are protected from technical and privacy issues we
    know about now, as well as those we have yet to encounter. In
    order to build consumer trust and ensure protections, Federal
    and State regulators can take a number of actions, including:
    addressing regulatory confusions; extending privacy protections
    in other areas of the law to cover consumer data compiled and
    used by data brokers and fintech firms; require data brokers
    register with the Federal Trade Commission (FTC); and empower
    and expand funding to Federal agencies like the Consumer
    Financial Protection Bureau (CFPB) and the Office of Financial
    Research (OFR). But State and Federal regulators should not
    rush to deregulate in order to spur innovation and, further,
    the Federal Government should not preempt State laws aimed at
    protecting consumers, especially the unbanked and underbanked.
    ---------------------------------------------------------------------------
         \2\ This answer was prepared by Jennifer Smith, Ryan H. Easley
    Research Fellow at the University of Maryland School of Law, after a
    request with initial guidance from Frank Pasquale, the witness.
    Professor Pasquale has reviewed the response and believes it to be a
    fully responsive response to the question.
    ---------------------------------------------------------------------------
        Consumers encounter confusion regarding regulations of the
    traditional banking sector and fintech sector. For example, Rob
    Nichols, president and chief executive of the American Banker
    Association stated: ``consumers [] face potential confusion
    when dealing with two sectors that have differing regulatory
    regimes'' and Nichols views this confusion as ``leading to gaps
    in consumer protections.'' \3\ As more consumers use fintech
    services regulatory confusion is likely to grow. \4\ Regulatory
    confusion may be particularly acute with the unbanked and
    underbanked, who are more likely to have lower levels of
    education than banked individuals. \5\ Addressing regulatory
    confusion on the State and Federal level is necessary to ensure
    consumers are protected.
    ---------------------------------------------------------------------------
         \3\ Rob Nichols, ``BankThink: Bank or No Bank, Fintech Must Be
    Regulated'', Am. Banker (Feb. 18, 2016, 9:30 AM), https://
    www.americanbanker.com/opinion/bank-or-no-bank-fintech-must-be-
    regulated.
         \4\ A recent global survey on fintech adoption by EY found the
    global average of fintech adoption as 33 percent, up from 16 percent in
    2015. EY, ``EY Fintech Adoption Index 2017'' 6 (2017).
         \5\ Fed. Deposit Ins. Corp., ``2015 FDIC National Survey of
    Unbanked and Underbanked Households'' 15-16 (Oct. 20, 2016).
    ---------------------------------------------------------------------------
        Unbanked and underbanked individuals who may utilize
    fintech services instead of traditional banking services can
    benefit from extension of existing privacy protections.
    Specifically, the Health Insurance Portability and
    Accountability Act (HIPAA) \6\ and the Fair Credit Reporting
    Act \7\ can be modernized to apply to all companies that peddle
    sensitive personal information. For example, HIPAA protections
    do not govern health profiles compiled and traded by data
    brokers and fintech firms. Further, Congress should require
    data brokers to register with the FTC and allow individuals to
    request immediate notification once they have been placed on
    lists that contain sensitive data. In addition to expanding
    already existing regulations, Congress should empower and
    expand funding to Federal agencies, including the CFPB and the
    OFR, to ensure these agencies have the resources necessary to
    come to grips with a rapidly changing financial landscape.
    ---------------------------------------------------------------------------
         \6\ Health Insurance Portability and Accountability Act of 1996,
    Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered
    sections of 18, 26, 29, and 42 U.S.C.).
         \7\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
    ---------------------------------------------------------------------------
        Fintech can be a means of opening up the financial industry
    to unbanked and underbanked consumers but Federal and State
    legislatures must be cautious about rushing to deregulate as a
    means of spurring innovation. Some fintech may promote
    competition and create new options for consumers, but it must
    be fair competition. Further, Federal authorities should not
    preempt State law meant to protect consumers. Although
    preemption may be aimed at ensuring financial inclusion and
    innovation, preemption of consumer protections can have
    disastrous unintended consequences, as we saw in the mortgage
    crisis of 2008. \8\ For example, the Office of the Comptroller
    of the Currencys' (OCC) proposed plan to charter fintech
    companies could have unintended consequences, such as enabling
    regulatory arbitrage around State restrictions on pay day
    lending. \9\ Regulatory arbitrage around State restrictions
    could have negative impacts on the unbanked and underbanked
    individuals the OCC is attempting to open the financial
    industry to. \10\
    ---------------------------------------------------------------------------
         \8\ For a discussion of regulatory arbitrage and opaque business
    practices that sparked the 2008 mortgage crisis, see Frank Pasquale,
    ``The Black Box Society'' (2015), specifically Chapters 4 and 5.
         \9\ ``Exploring Special Purpose National Bank Charters for Fintech
    Companies'', Off. Comptroller Currency (Dec. 2016). For comments to the
    OCC's paper, see ``Public Comments On Exploring Special Purpose
    National Bank Charters For Fintech Companies'', Off. Comptroller
    Currency, https://www.occ.gov/topics/responsible-innovation/fintech-
    charter-comments.html (last visited Oct. 3, 2017).
         \10\ See Comment, ``New Economy Project on Behalf of Signees, Re:
    Exploring Special Purpose National Bank Charters for Fintech
    Companies'' (Jan. 13, 2017), https://www.occ.gov/topics/responsible-
    innovation/comments/comment-new-economy-project-fintech-charters.pdf
    (comment letter from over 200 consumer, civil rights, and community
    groups opposing the proposed OCC nonbank lending charters, stating that
    ``[s]tate laws often operate as the primary line of defense for
    consumers and small businesses'' and they ``have also seen costly
    payday lenders hide behind the costume of `fintech.' ''); Comment,
    ``Am. For Fin. Reform, Re: Exploring Special Purpose National Bank
    Charters for Fintech Companies'' (Jan. 15, 2017), https://www.occ.gov/
    topics/responsible-innovation/comments/comment-americans-for-financial-
    reform.pdf (comment letter ``urging the OCC to refrain from issuing
    charters to nondepository fintech lenders'' and explaining a broad
    array of legal and policy issues that could arise); Comment, ``Ctr. For
    Digital Democracy & U.S. Pub. Int. Res, Group, Re: Exploring Special
    Purpose National Bank Charters for Fintech Companies'' (Jan. 15, 2017),
    https://www.occ.gov/topics/responsible-innovation/comments/comment-cdd-
    uspirg.pdf (comment letter opposing the proposed OCC nonbank lending
    charters, stating ``lack of transparency around the processing of data
    and automated algorithms may lead to increasing information asymmetries
    between the financial institution and the individual and thus consumers
    are left with less awareness and a lack of understanding and control
    over important financial decisions.'').
    ---------------------------------------------------------------------------
        It is important to remember consumer protections build
    consumer trust. Consumer trust is an essential factor in
    encouraging the unbanked and underbanked to utilize financial
    services in general. For example, research by the FDIC reveals
    unbanked and underbanked households have limited trust or a
    complete lack of trust in the banking industry, which
    influences how and if they utilize banking or other financial
    services. \11\ Additionally, ``concern over security--real or
    perceived--is one of the most significant barriers to [mobile
    financial services] adoption for consumers.'' \12\
    Deregulation, even if it is done with the goal of innovation
    and inclusion, can lead to unintended consequences that weaken
    trust in the financial system and eventually lead to more
    unbanked and underbanked Americans.
    ---------------------------------------------------------------------------
         \11\ Kristopher M. Rengert and Sherrie L.W. Rhine, Fed. Deposit
    Ins. Corp., ``Bank Efforts To Serve Unbanked And Underbanked
    Consumers'' (May 25, 2016), https://www.fdic.gov/consumers/community/
    research/qualitativeresearch_may2016.pdf; Fed. Deposit Ins. Corp.,
    ``2015 FDIC National Survey of Unbanked and Underbanked Households''
    (Oct. 20, 2016), https://www.fdic.gov/householdsurvey/2015/
    2015report.pdf. According to the FDIC 2015 survey of unbanked and
    underbanked households, one in four unbanked households ``do not trust
    banks'' and ``[l]ack of trust in banks was the second most frequently
    cited main reason for being unbanked.'' Id. at 60.
         \12\ Mobil Financial Services, Consumer Fin. Protection Bureau
    (Nov. 2015), http://files.consumerfinance.gov/f/201511_cfpb_mobile-
    financial-services.pdf.
    ---------------------------------------------------------------------------
        In conclusion, fintech can help build financial inclusion,
    especially for the unbanked and underbanked; but there must be
    proper protections to build and sustain consumer trust and
    ensure consumers are protected. Diminishing regulatory
    confusion, extending existing privacy protections, and
    providing resources to agencies to keep abreast of the evolving
    financial sector are all ways Federal and State regulators can
    help protect the unbanked and underbanked and build consumer
    trust. But regulators should not rush to deregulate to spur
    innovation, nor should Federal regulators preempt State laws
    aimed at protecting consumers, especially the unbanked and
    underbanked.

    Q.2. Are you concerned that fintech companies' use of new data
    and algorithms could result in unintentional discrimination
    against protected classes under Federal anti-discrimination
    laws? If so, should Congress or Federal regulators consider
    legislation or regulatory guidance to ensure compliance?

    A.2. The breadth and scope of data being accumulated and used
    by companies to determine broad aspects of a person's life is
    expanding, often without consumers' knowledge. \13\ Further,
    algorithms utilizing this data are opaque and consumers cannot
    easily determine the types of data being used or if the data is
    correct. The opaque process coupled with more varied datasets
    has the potential to produce ``discriminatory scoring.'' \14\
    The potential for discriminatory results is especially
    troublesome in the fintech industry, where discrimination, even
    if unintended, can have far reaching financial implications.
    ---------------------------------------------------------------------------
         \13\ This answer was prepared by Jennifer Smith, Ryan H. Easley
    Research Fellow at the University of Maryland School of Law, after a
    request with initial guidance from Frank Pasquale, the witness.
    Professor Pasquale has reviewed the response and believes it to be a
    fully responsive response to the question.
         \14\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
    Era of Big Data'', 18 Yale J.L. & Tech. 148, 149 (2017). This article
    is the result of collaboration among lawyers and data scientists on the
    issues of big data's use in credit scoring.
    ---------------------------------------------------------------------------
        Fintech companies' use of new and nontraditional data and
    algorithms could result in unintentional discrimination against
    protected classes under Federal anti-discrimination laws. A
    firm's best intentions to abide by fair lending,
    nondiscriminatory practices may be usurped by machine learning
    systems that use neutral data but ``treat them as proxies for
    immutable or sensitive characteristics,'' such as gender, race,
    or socioeconomic status. \15\ For example, Penny Crosman,
    Editor at Large at American Banker, recently wrote about the
    potential threats to fair lending by machine learning systems
    and artificial intelligence, stating ``a system that considers
    college data could start recognizing that graduates of a
    particular school are a good credit risk, and those students
    may be from mostly privileged socioeconomic backgrounds.'' \16\
    Further, Privacy International recently reported on types of
    nontraditional data being used to determine creditworthiness,
    which many consumers may not realize is being accumulated,
    including people's networks on social media, \17\ the manner in
    which a person fills out an online form, \18\ and if a person
    posts about political issues on social media. \19\ As Mikella
    Hurley and Julius Adebayo acknowledge an ``overabundance of
    data points . . . may lead to increased accuracy in the
    modeling, [but] it can also increase the incidence of spurious
    correlations.'' \20\
    ---------------------------------------------------------------------------
         \15\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
    Era of Big Data'', 18 Yale J.L. & Tech. 148, 190 (2017).
         \16\ Penny Crosman, ``Is AI a Threat to Fair Lending?'', Am.
    Banker (Sept. 7, 2017, 4:21 PM), https://www.americanbanker.com/news/
    is-artificial-intelligence-a-threat-to-fair-lending.
         \17\ ``Case Study: Fintech and the Financial Exploitation of
    Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
    www.privacyinternational.org/node/1499. See also Bethy Hardeman,
    ``Lenddo's Social Credit Score: How Who You Know Might Affect Your Next
    Loan'', Huffpost (June 15, 2012, 9:30 AM), http://
    www.huffingtonpost.com/bethy-hardeman/lenddos-social-credit-
    sco_b_1598026.html (describing Lenddo's use of a person's ``Trusted
    Network'' and an algorithm ``to measure truthfulness, behavioral and
    demographic clues'' to determine if a person qualifies for a loan).
         \18\ ``Case Study: Fintech and the Financial Exploitation of
    Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
    www.privacyinternational.org/node/1499. See also Jeff John Roberts,
    ``Bad Credit Is a Bonanza for Online Lender, But Critics Cry Foul'',
    Fortune (July 9, 2015), http://fortune.com/2015/07/09/elevate-online-
    loans/ (describing Elevate's tool, Rise, which uses a person's FICO
    score and nontraditional data, such as if ``someone appears too hasty
    to fill out the loan form,'' to assess creditworthiness).
         \19\ ``Case Study: Fintech and the Financial Exploitation of
    Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
    www.privacyinternational.org/node/1499. See also Mugdha Variyar and J.
    Vignesh, ``The New Lending Game, Post-Demonetisation'', Econ. Times:
    Tech. (Jan. 6, 2017, 3:05 PM), http://
    tech.economictimes.indiatimes.com/news/technology/the-new-lending-game-
    post-demonetisation/56367457 (quoting a lending platform's founder as
    stating ``[i]f someone is politically active and engages in political
    campaigns, which are visible through their social media profiles, it is
    not a good sign.'').
         \20\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
    Era of Big Data'', 18 Yale J.L. & Tech. 148, 177 (2017).
    ---------------------------------------------------------------------------
        Congress and regulators need to understand the types of
    data being used by fintech firms as well as how the data is
    being used. Knowledge of what fintech firms are doing is very
    important, especially relating to data collection, data use,
    and security and privacy. Based on this knowledge Congress and
    regulators should develop guidance and/or legislation to ensure
    suspect sources of data are not influencing fintech firms'
    decisions in discriminatory ways. Machine learning and
    predictive analytics are not too complex to regulate.
    Regulations should make firms more accountable. Specifically,
    firms should have ``algorithmic accountability,'' meaning firms
    are transparent with what data is being used and how algorithms
    use the data. \21\ Further, although a computational process
    may be complex, regulators can demand to know what datasets are
    used in the process.
    ---------------------------------------------------------------------------
         \21\ See Megan Rose Dickey, ``Algorithmic Accountability'',
    Techcrunch (Apr. 30, 2017), https://techcrunch.com/2017/04/30/
    algorithmic-accountability/;
    ---------------------------------------------------------------------------
        Existing privacy protections in other areas of the law can
    and should be extended to cover the consumer data now fueling
    fintech underwriting. Specifically, the Health Insurance
    Portability and Accountability Act (HIPAA) \22\ and the Fair
    Credit Reporting Act \23\ can be modernized to apply to all
    companies that peddle sensitive personal information. For
    example, currently, HIPAA protections do not govern health
    profiles compiled and traded by data brokers and fintech firms.
    A data broker could obtain information concerning a consumer's
    health related purchases, such as diabetic testing strips,
    pregnancy tests, or medications. \24\ This data could create
    ``inferences about sensitive consumer preferences and
    characteristics.'' \25\
    ---------------------------------------------------------------------------
         \22\ Health Insurance Portability and Accountability Act of 1996,
    Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered
    sections of 18, 26, 29, and 42 U.S.C.).
         \23\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
         \24\ See ``Fed. Trade Comm'n, Data Brokers: A Call For
    Transparency And Accountability'' 14 (May 2014).
         \25\ ``Fed. Trade Comm'n, Data Brokers: A Call For Transparency
    And Accountability'' viii (May 2014).
    ---------------------------------------------------------------------------
        Congress should require data brokers to register with the
    Federal Trade Commission and allow individuals to request
    immediate notification once they have been placed on lists that
    contain sensitive data. Regulations can help make consumers
    aware of the vast information landscape their data is being
    brokered and used in and the potential for unintentional
    discrimination based on this data. Further, consumers should
    have the ability to challenge and amend incorrect data. The
    right to be notified about the use of one's data and the right
    to challenge and correct data errors is fundamental.
        In addition to the above, Congress and Federal regulators
    should empower and expand funding to Federal agencies like the
    Consumer Financial Protection Bureau (CFPB) and the Office of
    Financial Research (OFR). These agencies require the resources
    necessary to come to grips with a rapidly changing financial
    landscape. Empowering and expanding funding will allow the CFPB
    and OFR to develop and implement strategies to ensure
    compliance with Federal anti-discrimination laws and consumer
    protections.
        In conclusion, Fintech companies' use of new and
    nontraditional data and algorithms could result in
    unintentional discrimination against protected classes under
    Federal anti-discrimination laws. Use of expanding and varied
    datasets and new algorithms can be beneficial and may ``force[]
    decisions onto a more reliable empirical foundation by
    formalizing decision-making processes, thus limiting the
    opportunity for individual bias to affect important
    assessments.'' \26\ But there is also the real potential for
    unintentional discrimination. Congress and Federal regulators
    need to understand the types of data being used by fintech
    firms as well as how the data is being used in order to
    determine appropriate regulations that will protect consumers
    from inappropriate and inadvertent discrimination.
    ---------------------------------------------------------------------------
         \26\ Solon Barocas and Andrew D. Selbst, ``Big Data's Disparate
    Impact'', 104 Cal. L. Rev. 671, 676 (2016).

                  Additional Material Supplied for the Record

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                             [all]