[Senate Hearing 115-95]
[From the U.S. Government Publishing Office]


                                                        S. Hrg. 115-95


                    EXAMINING THE FINTECH LANDSCAPE

=======================================================================

                                HEARING

                               BEFORE THE

                              COMMITTEE ON
                   BANKING,HOUSING,AND URBAN AFFAIRS
                          UNITED STATES SENATE

                     ONE HUNDRED FIFTEENTH CONGRESS

                             FIRST SESSION

                                   ON

  EXAMINING THE INNOVATIVE TECHNOLOGIES BEING USED TO CHANGE THE WAY 
   FINANCIAL SERVICES ARE PROVIDED AND THE WAY THE FINANCIAL SYSTEM 
                                OPERATES

                               __________

                           SEPTEMBER 12, 2017

                               __________

  Printed for the use of the Committee on Banking, Housing, and Urban 
                                Affairs


                 Available at: http: //www.fdsys.gov /
                 
                 
                              __________
                               

                    U.S. GOVERNMENT PUBLISHING OFFICE                    
27-749 PDF                  WASHINGTON : 2017                     
          
----------------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center, 
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].                 
                 
                 


            COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

                      MIKE CRAPO, Idaho, Chairman

RICHARD C. SHELBY, Alabama           SHERROD BROWN, Ohio
BOB CORKER, Tennessee                JACK REED, Rhode Island
PATRICK J. TOOMEY, Pennsylvania      ROBERT MENENDEZ, New Jersey
DEAN HELLER, Nevada                  JON TESTER, Montana
TIM SCOTT, South Carolina            MARK R. WARNER, Virginia
BEN SASSE, Nebraska                  ELIZABETH WARREN, Massachusetts
TOM COTTON, Arkansas                 HEIDI HEITKAMP, North Dakota
MIKE ROUNDS, South Dakota            JOE DONNELLY, Indiana
DAVID PERDUE, Georgia                BRIAN SCHATZ, Hawaii
THOM TILLIS, North Carolina          CHRIS VAN HOLLEN, Maryland
JOHN KENNEDY, Louisiana              CATHERINE CORTEZ MASTO, Nevada

                     Gregg Richard, Staff Director

                 Mark Powden, Democratic Staff Director

                      Elad Roisman, Chief Counsel

                      Travis Hill, Senior Counsel

              Kristine Johnson, Professional Staff Member

                 Elisha Tuku, Democratic Chief Counsel

            Laura Swanson, Democratic Deputy Staff Director

              Phil Rudd, Democratic Legislative Assistant

                       Dawn Ratliff, Chief Clerk

                     Cameron Ricker, Hearing Clerk

                      Shelvin Simmons, IT Director

                          Jim Crowell, Editor

                                  (ii)


                            C O N T E N T S

                              ----------                              

                      TUESDAY, SEPTEMBER 12, 2017

                                                                   Page

Opening statement of Chairman Crapo..............................     1

Opening statements, comments, or prepared statements of:
    Senator Brown................................................     2

                               WITNESSES

Lawrance L. Evans, Director, Financial Markets and Community 
  Investment, Government Accountability Office...................     4
    Prepared statement...........................................    30
    Responses to written questions of:
        Senator Menendez.........................................    82
Eric W. Turner, Financial Technology Research Analyst, S&P Global 
  Market Intelligence............................................     6
    Prepared statement...........................................    48
    Responses to written questions of:
        Senator Menendez.........................................    83
Frank Pasquale, Professor of Law, University of Maryland Francis 
  King Carey School of Law.......................................     7
    Prepared statement...........................................    66
    Responses to written questions of:
        Senator Brown............................................    87
        Senator Menendez.........................................    90

              Additional Material Supplied for the Record

Statement submitted by the Independent Community Bankers of 
  America........................................................    95
Letter submitted by the Electronic Privacy Information Center....    97
Letter submitted by the Milken Institute Center for Financial 
  Markets........................................................   100

                                 (iii)

 
                    EXAMINING THE FINTECH LANDSCAPE

                              ----------                              


                      TUESDAY, SEPTEMBER 12, 2017

                                       U.S. Senate,
          Committee on Banking, Housing, and Urban Affairs,
                                                    Washington, DC.
    The Committee met at 10:02 a.m., in room SD-538, Dirksen 
Senate Office Building, Hon. Mike Crapo, Chairman of the 
Committee, presiding.

            OPENING STATEMENT OF CHAIRMAN MIKE CRAPO

    Chairman Crapo. The Committee will come to order.
    Before we proceed with the hearing today, I wanted to just 
indicate that last night the Senate passed six securities bills 
that we marked up earlier this year, bills that will improve 
economic growth and investor protections. And I want to thank 
you, Senator Brown, for working with me to get these bills 
through the Committee, and thanks to all of the Committee for 
your work in getting these pieces of legislation through the 
Senate.
    These bills were introduced in past Congresses with broad 
bipartisan support, with the House most recently passing 
similar bills last spring. And I want to thank our colleagues 
on the House Financial Services Committee for their work on 
this as well. I look forward to seeing these bills signed into 
law.
    Senator Brown. Could I say a word now?
    Chairman Crapo. Yes.
    Senator Brown. Thank you, Mr. Chairman, for your 
partnership on these bills to improve the securities markets 
and investor protections. I am pleased they passed the Senate 
last night as well. I thank the members of this Committee and 
others in the Senate especially for their work on this bill, 
Senators Heller and Peters, off the Committee; Senators 
Heitkamp, who is here, and Toomey on the Committee, and 
Donnelly, also on the Committee, Menendez, Hatch, Warner, and 
Tillis, and others on this Committee for moving the bill 
forward.
    Thank you, Mr. Chairman.
    Chairman Crapo. Thank you.
    This morning, we will receive testimony on the growing 
financial technology, or fintech, industry. Fintech is 
providing new and innovative products and services in areas 
such as marketplace lending, digital payments and currencies, 
wealth management, insurance, and more.
    Technological innovation has brought about improvements in 
virtually every sector of the economy, and the financial sector 
is no exception. Technology advances are nothing new to the 
financial world; inventions such as the ATM and the credit card 
led to significant improvements in consumer welfare.
    Today new innovations by fintech companies have similar 
potential to make financial services faster, cheaper, and more 
accessible. For example, marketplace lending has the potential 
to expand the availability of credit to consumers and small 
businesses at lower costs.
    In particular, with the use of alternative data and 
technology, the business models of marketplace lenders may 
enable them to reach underbanked populations. Innovations in 
the payments space can offer enhanced speed, convenience, and 
efficiency in transactions.
    Fintech startups are not the only ones embracing this 
opportunity and responding to changing consumer demand. 
Traditional banks and other established financial institutions 
are increasingly participating in the fintech space through 
partnerships, incubators, investments, and more.
    Fintech firms may also reap the mutual benefits of 
partnering with banks who have well-established operations and 
comparative advantages in certain areas. But with all the 
potential for fintech to improve the financial services sector, 
the industry is still relatively new.
    Uncertainty remains around questions like data security and 
the proper regulatory treatment to ensure that consumers and 
the financial system are safeguarded. The recent Equifax data 
breach reminds us of the critical need to ensure that areas 
like cyber and data security are given the proper attention.
    The tremendous growth in this sector over the past few 
years has gained the attention of market participants, 
regulators, and other stakeholders. The OCC, for example, has a 
proposal to provide special purpose national bank charters for 
fintech companies.
    Other Governments are exploring options such as a 
regulatory sandbox approach that encourages innovation by 
allowing firms to test products and services in a supervised 
environment.
    In response to this Committee's call for economic growth 
proposals, we received a number of fintech-related submissions 
that will also help us as we think about these issues.
    Today I look forward to learning more about the 
opportunities fintech may bring, the various ways fintech is 
interacting with and impacting the financial system, and the 
current regulatory supervision of the fintech industry.
    Senator Brown.

               STATEMENT OF SENATOR SHERROD BROWN

    Senator Brown. Thank you, Mr. Chairman. I appreciate your 
holding this hearing on financial technology. It has been too 
long since our Committee considered this important topic. I do 
not think any of us knew how timely this hearing would be until 
we got news of the Equifax data breach, apparently after some 
executives at Equifax also knew, although they deny that was 
the case.
    While financial technology covers many different 
activities, all of those activities rely on the responsible use 
and careful protection of data.
    In the case of Equifax, that did not happen. Americans are 
now forced to worry whether the information that hackers stole 
will have lasting impacts, from outright theft to damaged 
credit. We just cannot cancel a credit card to fix this 
problem. Equifax has let criminals get their hands on the most 
private and valuable pieces of millions of Americans' financial 
identities.
    Credit reports also include other deeply personal 
information. A history of our medical debt can reveal 
information we do not share with anyone but our doctors and 
families.
    More and more, new financial technologies rely on the 
collection of vast troves of data no longer limited to our 
financial transactions. Data aggregators collect information 
regarding our associates, what kind of products we buy, and 
maybe even how often we check Facebook.
    The collection and use of this alternative data may promise 
some benefits by providing access to credit for people in 
communities that traditional lenders overlook. But as recent 
data breaches have shown, the risks are clear and substantial.
    It will take us a long time to assess the impact of the 
Equifax data breach on 143 million Americans. Businesses, 
consumers, and Government watchdogs will have to be even more 
vigilant about identifying fraud, possibly making it harder for 
Americans to get access to credit.
    It is bad enough that the Equifax breach included important 
personally identifiable information--names, dates of birth, 
Social Security numbers, addresses, and credit card numbers--
the building blocks for your financial identity. Future 
breaches at firms that use alternative data might include far 
more personal information with far-reaching consequences.
    Today I want to hear how we can improve Federal oversight 
of data collection and data security to protect working 
American families. I hope we can work together to make sure 
companies that use our private data are held accountable for 
its protection.
    If a college student in Columbus misses a credit card 
payment or a family in Toledo is forced into bankruptcy because 
of medical debt, Equifax would undoubtedly ding their credit 
scores. So now that this breach has left millions of people 
vulnerable to criminals, what should be done to hold Equifax 
accountable?
    At a minimum, customers should have the right to use the 
court system to help make them whole. That is why I appreciate, 
under apparently some public pressure, Equifax answered my 
call, and that of others on the Committee, to remove forced 
arbitration clauses from its free credit monitoring product.
    This is a step in the right direction, but customers cannot 
be sure their rights are truly protected until Equifax makes 
this policy clear for all products and on all of its websites.
    One year of credit monitoring cannot be expected to undo 
the damage of this breach. After the 2015 breach of the Office 
of Personnel Management put information of Government employees 
at risk, this body passed 10 years of free credit monitoring. 
We cannot accept any less for the people we serve.
    Today's hearing is focused on new products and markets. I 
am interested in how Congress can encourage fintech innovation 
to make it easier for community banks to serve their customers, 
to comply with important safety and soundness and anti-money-
laundering rules.
    If we can encourage banks to partner with each other or 
innovative startups, we may be able to cut down on red tape 
without exposing consumers or the financial system to 
additional risk.
    I am also interested in how these new technologies can help 
Americans who are currently underserved by the traditional 
banking system. We have already seen how mobile payments have 
expanded access for many to the financial system, both at home 
and abroad. But we need to fully understand the risks and 
ensure that oversight gaps do not exist for bad actors to 
exploit American customers.
    I thank the witnesses for joining us.
    Chairman Crapo. Thank you, Senator Brown. We will now move 
to our witnesses.
    First we will hear testimony from Mr. Lawrance Evans, 
Director of Financial Markets at the U.S. Government 
Accountability Office.
    Then we will hear testimony from Mr. Eric Turner, research 
analyst at S&P Global Market Intelligence.
    And then, finally, we will hear testimony from Mr. Frank 
Pasquale, professor of law at the University of Maryland 
Francis King Carey School of Law.
    I would remind each of our witnesses that your full 
testimony has been made a part of the record. We ask you to 
limit your presentation orally to 5 minutes. There will be 
plenty of opportunity for further follow-up with questions from 
the Committee.
    With that, Mr. Evans.

STATEMENT OF LAWRANCE L. EVANS, DIRECTOR, FINANCIAL MARKETS AND 
     COMMUNITY INVESTMENT, GOVERNMENT ACCOUNTABILITY OFFICE

    Mr. Evans. Thank you very much, Mr. Chairman. I am pleased 
to appear before you, Ranking Member Brown, and the other 
Members of the Committee to discuss the fintech landscape, 
which currently finds a number of potentially disruptive and 
foundational technologies, and innovative firms that are 
transforming the financial industry. Calling this hearing 
represents the type of forward thinking that is essential to 
effectively harnessing the opportunities these developments 
bring.
    My testimony today is based on our April 2017 report 
produced as a partial response to a request from the Ranking 
Member and others. The report covers a high-level look at four 
commonly referenced fintech subsectors: marketplace lending, 
mobile payments, digital wealth management, and distributive 
ledger technology, which I will refer to as ``DLT.'' While this 
report is largely based on secondary sources, we are able to 
glean some useful findings and observations for consideration.
    Considering the benefits, our sources suggest that 
technological innovation is occurring throughout the financial 
ecosystem, driven by large technology firms and smaller 
technology-driven new entrants known as ``fintechs'' or 
``fintech firms.'' One of the primary potential benefits 
include expanded access to financial services.
    For example, digital wealth platforms, which rely on data-
driven algorithms and minimize human interaction, provide 
services to a class of investors previously frozen out of 
traditional wealth management. Other potential benefits include 
convenience, speed, and lower costs across a range of financial 
services.
    On the flip side, new technologies and new entrants into 
the financial services industry, while bringing much needed 
innovation, bring potential risk. For example, the data-driven 
algorithms marketplace lenders rely on to assess 
creditworthiness and underwrite loans raise concerns about the 
use of nontraditional data and the risk for potential fair 
lending violations. Moreover, data security and privacy risks 
may exist with these newer technologies.
    It is important to note that these concerns are real, but 
they are not unique to these innovations. And there are also 
features in mobile payments in DLT that may produce benefits in 
the area of data security. Losing sight of the benefits and 
overreacting to risk could stifle financial inclusion and much 
needed innovation in the area of payments, value transfer, and 
recordkeeping. Therein lies the great challenge for 
policymakers and regulators. There is always a need to manage 
the risk-reward balance of innovation; that is, managing risk 
without stifling innovation, ensuring consistent regulation and 
a level playing field, and encouraging socially beneficial 
innovation without picking winners or losers.
    On the one hand, advances in technology are occurring in a 
heavily regulated and mature financial ecosystem. On the other 
hand, the financial regulatory structure in the U.S. is 
complex, with responsibilities fragmented among multiple 
Federal and State agencies that have overlapping authorities. 
This has raised concerns about gaps in coverage, inconsistent 
regulation, compliance challenges for new and incumbent firms, 
and whether the existing regulatory framework might slow or 
otherwise harm innovation.
    As you know, there are a number of issues being considered 
today that will impact the regulatory landscape going forward, 
such as the appropriate charter type for fintech firms 
conducting bank-like activities. It will be important to 
carefully sort through the various competing interests to 
settle on a regulatory framework that is truly in the public 
interest.
    Putting the public first and developing a regulatory 
framework that is best positioned to achieve it is essential to 
getting the risk-reward balance of innovation correct. As one 
Federal Reserve official recently noted, ``it would be a lost 
opportunity if instead of expanding access in a socially 
beneficial way, some fintech products merely provided a vehicle 
to market high-cost loans to the underserved, exacerbating 
rather than ameliorating financial access inequalities.''
    Similarly, it would also be unfortunate if the regulatory 
framework served as a barrier to entry to innovative firms with 
socially beneficial products. GAO is currently undertaking work 
that will support congressional efforts to strike the 
appropriate balance in this area.
    Chairman Crapo, Ranking Member Brown, and Members of the 
Committee, this concludes my prepared statement. I look forward 
to questions and further dialog.
    Chairman Crapo. Thank you, Mr. Evans.
    Mr. Turner.

  STATEMENT OF ERIC W. TURNER, FINANCIAL TECHNOLOGY RESEARCH 
            ANALYST, S&P GLOBAL MARKET INTELLIGENCE

    Mr. Turner. Thank you, Chairman Crapo, Ranking Member 
Brown, Members of the Committee. Good morning, and thank you 
for inviting me to testify today. My name is Eric Turner, and I 
am a research analyst with S&P Global Market Intelligence, 
where I cover financial technology.
    S&P Global Market Intelligence is a division of S&P Global. 
We provide actionable intelligence on the global financial 
markets and the companies and industries that comprise those 
markets. We support economic growth by providing market- and 
sector-specific data, news, and research to help investors 
identify opportunities and manage risk when providing financing 
to businesses and job creators. S&P Global Market Intelligence 
closely follows the fintech sector, which we view as pivotal to 
economic growth and innovation.
    Financial institutions have long used technology, but 
startups have broken new ground during the past decade. These 
companies have created what we know as fintech today. 
Leveraging advances in technology and the ubiquity of the 
Internet, these companies offer new and cutting-edge financial 
products. Expansive data sets, advanced analytics, and 
automation have made accessing financial services faster and 
less expensive for millions of people.
    Incumbent institutions are increasingly looking to fintechs 
not as competitors but as partners for improving operations and 
reaching new consumers.
    Through our research, we have identified five key areas 
that impact consumers in the financial industry today. These 
include digital lending, mobile payments, digital investment 
management, insurance technology, and distributed ledger 
technology, which includes blockchain. These innovations 
present enormous opportunities to consumers accompanied by 
unique challenges in implementation.
    Digital lending has increased access to credit and made 
borrowing more efficient. Automation and a lack of physical 
offices allow digital lenders to reduce processing time and 
costs. This allows them to offer competitive rates, potentially 
saving borrowers thousands of dollars in interest, while small 
businesses seeking access to working capital are able to obtain 
funds much more quickly.
    Mobile payments services are used by millions of consumers 
because they reduce transaction costs and frictions, while 
offering an enhanced user experience. For international 
transfers, specialized peer-to-peer apps charge low fees for 
the conversion and transfer of funds across borders and 
currencies. This benefits underbanked and immigrant 
communities.
    Mobile wallets create more secure transactions by 
preventing fraudsters from skimming card data or stealing PIN 
information. Additional features, like biometric and two-factor 
authentication, have further enhanced security.
    Digital investment management has given retail investors 
new access to professional investment services, and insurance 
technology has made it easier and more affordable to protect 
against risk. If implemented properly, distributed ledger 
technology, including blockchain, will revolutionize many parts 
of our financial system, reducing costs and settlement times 
while enhancing transparency.
    Despite the benefits discussed today, the industry is still 
young and challenges remain. Regulation has been unevenly 
applied to the sector, and in many ways the introduction of a 
clear regulatory framework could help boost innovation. This 
may require firms to define their stake in the financial system 
and could lead to technology-only platforms exiting certain 
lines of business like lending. Overall, this will lead to a 
more fair and defined playing field for startups and incumbents 
alike.
    Issues such cybersecurity, data ownership, and data privacy 
are important not just to fintechs but to the financial 
industry as a whole. Clear standards and regulation can provide 
clarity in these areas as well. Understanding the fintech 
landscape as well as the benefits and challenges presented by 
this growing industry can help shape a clear framework for 
responsible innovation.
    Thank you again for inviting me to testify, and I would be 
happy to answer any questions for the Committee.
    Chairman Crapo. Thank you, Mr. Turner.
    Mr. Pasquale.

 STATEMENT OF FRANK PASQUALE, PROFESSOR OF LAW, UNIVERSITY OF 
           MARYLAND FRANCIS KING CAREY SCHOOL OF LAW

    Mr. Pasquale. Chairman Crapo, Ranking Member Brown, and 
distinguished Members of this Committee, thank you for the 
opportunity to testify today. My name is Frank Pasquale, and I 
am a professor of law at the University of Maryland.
    The financial technology, or fintech, landscape ranges from 
the very simple to the tremendously complex. Regulators at the 
OCC's Office of Innovation and the CFPB's Project Catalyst are 
energetically helping entrepreneurs to comply with existing 
consumer protections and other Federal mandates. Fintech may 
promote competition and create new options for consumers, but 
we should ensure that it is fair competition and that these 
options do not have hidden pitfalls.
    In my research on the finance and Internet sectors over the 
past decade, I have explored patterns of regulatory arbitrage 
and opaque business practices that sparked the mortgage crisis 
of 2008. I am afraid I see some similar themes emerging today.
    In the run-up to the crisis, Federal authorities preempted 
State law meant to protect consumer borrowers. Their stated aim 
was to ensure financial inclusion and innovation, but the 
unintended consequences were disastrous. Federal authorities 
were not adequately staffed to monitor, let alone deter or 
punish, widespread fraudulent practices. They also flattened 
diverse State policies into a one-size-fits-all, cookie-cutter 
approach. We all know the results. Millions of families lost 
their homes to foreclosure, and the economy suffered a 
permanent output gap.
    That history should make us cautious about legislative or 
regulatory efforts to federally preempt State laws now applying 
to fintech. Why should consumers lose important protections 
provided by their own States simply because they engage with 
fintech firms? Think, for instance, of restrictions on payday 
lending. As the New Economy Project and hundreds of community, 
labor, military, and veterans groups have argued earlier this 
year, 90 million Americans live in jurisdictions where payday 
lending is illegal. These State laws help consumers save 
billions of dollars each year in predatory payday loan fees 
that could trap people in long-term devastating cycles of debt. 
OCC should not strip these consumers of these protections.
    Advocates for deregulation will likely argue that imposing 
a level playing field on fintech and non-fintech firms might 
harm innovation in the fintech sector. But innovation is not 
good in itself. The toxic assets at the core of the financial 
crisis were innovative in many ways, but ultimately posed 
unacceptable risks.
    Promoters of fintech deregulation may claim that such 
worries are anecdotal. But many tech firms prevent more robust 
analysis as they obscure what we know about the sector. As I 
explain in my book ``The Black Box Society'', aggressive 
assertion of trade secrecy claims--both about data collection 
and use, and the algorithms used to make judgments about us--
keep regulators and legislators in the dark about the full 
range of risks in finance in general and fintech in particular.
    A key message I hope to convey to the Committee today is to 
empower agencies like CFPB and OFR and to expand their funding 
as they try to come to grips with a rapidly financial 
landscape.
    Data gathering is important because nearly every story of 
technologized ``financial inclusion'' can be countered with 
other stories of exclusion, via digital redlining. As Cathy 
O'Neil's book ``Weapons of Math Destruction'' shows, consumers 
often are in the dark about what new algorithms are judging 
them and how they can respond if they think they have been 
treated unfairly. Regulators must more full understand what 
firms are doing and how they are performing. Moreover, as the 
recent Equifax hack shows, concentration of information in 
almost any firm creates great risks to consumers. Improving 
financial cybersecurity should be an essential goal in fintech 
policy, and I applaud the GAO for highlighting security issues 
in its report, as well as proposals by Senator Reed to require 
cybersecurity expertise at large firms.
    We should not have faith that accelerated deregulation will 
free the financial sector to solve important social problems. 
There is a difference between exploiting an existing problem in 
credit provision and addressing the root causes. For example, 
if fintechs can make hefty profits by refinancing student debts 
owed to the U.S. Government, perhaps that is less an indication 
of fintechs' business prowess than it is evidence that the 
Government is overcharging students for loans. If consumers are 
desperate for marketplace lending to cover next month's utility 
bills, maybe we need to ensure work pays more fairly. I am 
confident that a system of postal banking would do far more 
than the fintech sector to ensure financial inclusion to 
millions of Americans without adequate access to deposit 
accounts, as Mehrsa Baradaran has helped prove in her book 
``How the Other Half Banks''.
    In conclusion, fintech should not be an excuse for 
stripping safeguards from consumers. We need far more 
information about how fintech firms are gathering, processing, 
and protecting data. And we should be wary about the ability of 
technology alone to solve much larger social problems of 
financial inclusion, opportunity, and nondiscriminatory credit 
provision.
    Thank you for the opportunity to testify today.
    Chairman Crapo. Thank you, Mr. Pasquale.
    This is a question for the entire panel, so I would like to 
ask you to each be brief in your responses. But could each of 
you discuss, as we move forward, what are some of the most 
significant risks that we should evaluate? And in your 
response, if you have an opinion on whether there should be a 
specific charter for fintech companies separate from other 
types of charters that we deal with in a regulatory context, I 
would appreciate your thoughts on that. Mr. Evans.
    Mr. Evans. So I think you see many of the risks that are 
commonly witnessed when you think about innovation, and there 
is, I think, a disconnect between the ``move fast and break 
things'' approach that you might see in the technology industry 
with the more conservative approach in the banking industry. 
And so I think there could be some significant compliance 
challenges going forward as they grapple with the various rules 
and regulations that are in place.
    I will punt on the issue of a Federal or a State charter. I 
know it is a critical issue. There are pros and cons on both 
sides, and I think other witnesses might----
    Chairman Crapo. I figured you might pass on that part of 
it.
    Mr. Turner.
    Mr. Turner. Thanks, Senator. I think as you mentioned, 
probably the biggest risk right now is a fractured regulatory 
system. I think when people look at fintech companies, they 
kind of assume that, you know, when you hear things like 
regulatory arbitrage and lack of regulation, that these 
companies are operating, you know, like it is the Wild West. 
And that is really not the case. These companies have looked 
for regulation wherever they can, and right now it seems that 
they are just trying to fit themselves into a system that was 
not made for them.
    Chairman Crapo. Thank you.
    Mr. Pasquale.
    Mr. Pasquale. Yes, thank you, Senator. I would cite 
problems in three areas, one being an area of opaque algorithms 
being used to assess credit. I think that we are entering into 
a new world, and we do not quite understand fully how many 
different types of data sources could enter into, say, emerging 
credit decision making. And I give some examples in my written 
testimony of how fintech firms, say, outside of the U.S. have 
used some types of data that might be troubling, I think, to 
people, like political activity or other issues like that.
    I would also say that with respect to looking at the 2016 
Fed survey on small business credit, the Fed found that there 
were lots of small businesses that distrusted fintech firms 
more than they distrusted small banks, or even large banks. 
With respect to high interest rates, they felt they were being 
overcharged, and I think that that highlights some concerns 
about the potential overextension of credit into, say, marginal 
communities or into marginal business opportunities.
    And I would finally highlight the cybersecurity concerns 
because I do think that as more and more--even Jamie Dimon and 
other folks were sort of concerned about consumers sharing too 
much of their data with unvetted apps.
    Chairman Crapo. Thank you very much.
    Mr. Turner, in the United Kingdom, the Financial Conduct 
Authority has implemented a regulatory sandbox that allows 
firms to operate on a limited basis to test different ideas 
while under the FCA's supervision, but without needing to 
comply with the full regulatory enforcement regime. Could you 
just discuss your thoughts on whether that is a good idea or 
something that we should possibly pursue here?
    Mr. Turner. Yes. Thanks, Senator. So just a little 
background. Whenever I speak to somebody in the industry, you 
know, they do say that the U.S. is pretty far behind on this, 
and there are other countries with these regulatory sandboxes 
that are beating us in innovation. And I think as we look at 
some sort of specific regulatory framework, a sandbox not only 
will let fintechs continue to innovate, but it will also give 
regulators a way to actually test new ideas and learn a little 
bit more about the process.
    Chairman Crapo. Thank you.
    Mr. Pasquale, do you have a thought on the sandbox 
approach?
    Mr. Pasquale. You know, I have written in the past in favor 
of pilot programs, and I think that they have proven their 
worth in some areas, for example, in health care policy. And I 
think that a very--we would have to do a very careful 
assessment of it, but there may be some promise there in terms 
of experimenting to learn more about exactly how this 
innovation might play out in certain contexts.
    Chairman Crapo. Thank you.
    Mr. Evans, do you have anything to add?
    Mr. Evans. We have a report that will be released in the 
winter of 2018 that actually looks at various regulatory 
approaches to fintech. And, in fact, our teams have traveled to 
Singapore, U.K., and Hong Kong and will be reporting out on 
ones that we think are more applicable to the United States.
    It is important to point out that the CFPB does have 
Project Catalyst, which allows fintech firms to pilot 
innovations that are deemed consumer-friendly.
    Chairman Crapo. Thank you.
    Senator Brown.
    Senator Brown. Thank you, Mr. Chairman. Thank you to all 
three of you for joining us.
    Professor Pasquale, the Equifax breach showed why CFPB's 
arbitration rule is so important. Had it not been for sharp-
eyed consumer advocates and lots of public pressure, millions 
of scared consumers may have accidentally signed away their 
right to a day in court. But Americans should not have to go to 
court to defend themselves from companies that never got 
permission to collect their data. Big companies like Equifax 
got to hold Americans accountable for mistakes of every size. 
Now that this breach has left 143 million people around our 
country vulnerable to criminals, what should the Government do 
to hold them accountable at this point?
    Mr. Pasquale. So I think that this breach really ought to 
be a watershed and that we ought to really reconceive how we 
regulate this area. I think existing approaches are failing. I 
know that the Federal Trade Commission and the SEC are trying 
very hard with existing approaches, but I do not think they are 
really protecting people.
    And what I like to analogize the situation to is if you 
have a doctor, for example, in a State that repeatedly commits 
malpractice, they lose their license. If you have a lawyer 
that, you know, shirks duties to clients, et cetera, they will 
lose their license. And I think we really have to think 
seriously about licensing certain entities, as we do at the 
corporate level, with respect to the consumer finance 
information because we have seen so many instances of failure 
here. And I think repeated instances of failure should lead to 
a revocation of such a license. But I know that is a long way 
off.
    Senator Brown. Thank you.
    Mr. Turner, the Equifax breach exposed, as we have said 
repeatedly, 143 million Americans' financial data to potential 
fraudsters. Do you have an opinion as a market analyst on what 
its impact may be for the broader economy when this happens?
    Mr. Turner. I do not have an exact opinion related to this 
case. I think when you look at cybersecurity, you need to look 
at a few factors. You know, it is not only the technology that 
actually is in place to protect against a breach, but also a 
culture around compliance. So I think if we did have some sort 
of nationwide standard around cybersecurity, we could prevent 
instances like this in the future.
    Senator Brown. So because this has been so front and center 
in the Nation's media and people are increasingly concerned and 
in some cases have a pretty good belief that they were 
breached, does this make consumers less likely to give their 
data to new fintech platforms? Will established banks and 
financial firms think twice before partnering with a fintech 
and sharing their consumer data? Take that out and its impact 
on the economy that way, answer that directly, and then in a 
broader way, its impact on the economy through those portals, 
if you will.
    Mr. Turner. Yeah, so I think that fintech companies in 
general are pretty advanced when it comes to cybersecurity. I 
think if you look at, as I mentioned, culture, the cultures are 
all really based around the technology. People are very aware 
of the risks. And in many cases, these companies actually just 
use an API to get information from a bank that has created this 
data trail in the past.
    So I think maybe a more important question needs to be when 
we create data, whether it is financial transactions, whatever 
it may be, who owns that data? Is it the consumer that owns 
that data or is it the institution that created it? And should 
consumers have the ability to own their data and only display 
it when it is actually needed?
    Senator Brown. So what happens if banks decide that they 
just do not want to partner with a fintech and share this data? 
Understanding what you just said, but what happens then?
    Mr. Turner. Yeah, I think that has actually been an area of 
concern because there has been some back and forth between 
large banks and fintechs. And I think that depending on the 
platform and the implementation, you know, if you look at a 
company that needs your bank account information in order to 
process payments or needs access to, you know, your bank 
account, those companies will not exist and that innovation 
will go away if there is not some sort of agreement on how to 
share data.
    Senator Brown. OK. Mr. Evans, under Section 1033 of Dodd-
Frank, the CFPB is ordered to create rules granting consumers 
more control over their financial data. The law specifically, 
as I think you know, exempts sharing data about algorithms or 
other methods companies use to create risk scores or make other 
predictions about a consumer's financial performance. Should 
these algorithms be exempt?
    Mr. Evans. That is a tough question because, on the one 
hand, these algorithms might represent proprietary information 
that gives institutions their advantage in whatever space they 
are operating.
    On the other hand, these algorithms and the use of 
nontraditional data could be important in determining whether 
or not a person gets credit or not, and we do not have a lot of 
information about the algorithms.
    I think one of the critical issues, though, is that this 
aggregation of information fuels some of the novel fintech 
approaches. For example, it is based on the aggregation of 
accounts across an individual's life to give a holistic picture 
of what the financial situation is.
    If knowledge of the algorithm has a chilling effect on 
that, that could be problematic for some models. So it is 
tough, Senator Brown. It could go both ways.
    Senator Brown. But it is pretty hard to argue, in light of 
the data breach, that consumers should not know exactly how 
their data is being used.
    Mr. Evans. Absolutely.
    Senator Brown. All right. Thank you.
    Chairman Crapo. Senator Perdue.
    Senator Perdue. Mr. Evans, this is off point, but would you 
agree the same thing applies to the CFPB?
    Mr. Evans. Could you clarify, Senator?
    Senator Perdue. That the data that the CFPB is collecting 
should meet the same standards of the data that we are talking 
about here?
    I will withdraw the question. I have got a more relevant 
question.
    Mr. Evans. OK. Thank you.
    Senator Perdue. We will talk offline about that.
    Mr. Evans. OK.
    Senator Perdue. I am concerned about the fact that this 
area has no borders. Forty-seven percent of all global online 
transactions, retail transactions, are made in China, are from 
China, and 40 percent of all Chinese consumers are using new 
payment systems like we are talking about today. They are 
talking about WeChat, Ant Financial, and others. This is a very 
rapidly growing sector over there, and I am very concerned that 
we have our regulatory environment here, but we have a lot of 
transactions going on around the world that come and go across 
borders.
    What recommendations, given the global impact--and I would 
like all three of you to comment on it. What do you recommend 
that we--what should we be doing here to get ahead of this?
    Mr. Evans. Excellent question, and I think it goes back to 
something Eric pointed out before and we have pointed out in 
this report, that our regulatory system in the United States is 
quite fragmented. It could stifle innovation to some degree. 
And so that should be job number one for Congress and 
regulators, to make sure we have the right regulatory framework 
given these novel approaches being taken across the financial 
landscape.
    Senator Perdue. Mr. Turner.
    Mr. Turner. Thank you, Senator, and I think I just want to 
clarify something here. When you look at China, you know, in 
some ways we actually are at a disadvantage because we are so 
advanced in our financial system. They are coming into a time 
where they did not have a lot of the infrastructure we have, so 
if you look at--you mentioned WeChat and payment systems like 
that. It is because there was not a robust card network 
presence or an ACH system like we have. So if you look at what 
we have in terms of peer-to-peer payment systems, global 
payment systems, those for the most part actually still, you 
know, as you would say, ride the rails. They still process 
through the same systems of the large card networks or ACH. I 
think that, you know, that is going back to regulation because 
these payment companies know that they are doing--they are 
complying with the way things need to be done. They are using 
systems that are in place. So, you know, I think as everybody 
has mentioned, if we want to push that innovation forward and 
you want to see us on par with, you know, the innovation in 
China or something like that, there just needs to be more 
clarity on where fintechs can go. So if that is a regulatory 
sandbox or some sort of specific regulatory framework, I am not 
sure, but it is going to be something like that.
    Senator Perdue. Dr. Pasquale.
    Mr. Pasquale. Yes, I think you are absolutely right, 
Senator, to point to China as a place where there is a great 
deal of innovation here. It is very cutting edge. I remember 
Connie Chung's piece for a16z on WeChat and describing just how 
many things you can do within the app. And I am sure that 
consumers would find it extremely convenient. And global 
cooperation among regulators could enable similar types of apps 
to arise in the U.S.
    My only caution would be that I think looking at some of 
the literature on the Chinese social credit scoring system, 
which I cite in my written testimony, I do have concerns that 
the integration of information across so many sectors into one 
app could raise both concerns about competition and about 
privacy. So I think we should work with global regulators, but 
we should be cognizant of some of the risks.
    Senator Perdue. Mr. Turner, in the time remaining, talk to 
us about tokenization. Is this a way of the future relative to 
EMV chips and PIN efforts right now in terms of privatization 
and security of data?
    Mr. Turner. Yeah, I think we are seeing--you know, again, 
this is kind of an area where the U.S. is catching up on a lot 
of this. If you look at the U.K., the most popular form of 
payment is contactless card payments. So, you know, we are just 
getting to the point where we are upgrading to EMV systems, and 
there is no doubt that those are more secure than what we had 
with magnetic strips.
    I think that, you know, if we continue to see growth in 
payments being moved outside of the traditional network, so as 
we see cards go away, as we see cash go away, you know, 
tokenization will be how everything is processed, and that will 
either be with our mobile wallets, if we are doing some sort of 
contactless transaction in a store, or if we are sending 
payments person to person.
    Senator Perdue. Do you see this as a rising capability that 
makes some of--well, let us just say the terrorist network in 
terms of shadow banking and so forth. I mean, we have heard 
testimony here in other committees about that. Do you have any 
insights into that?
    Mr. Turner. Really, I think that as we continue to have 
growth in digital payments, a lot of people do not realize that 
is probably good for controlling things like AML, anti-money-
laundering. I think that it creates an audit trail, and as we 
see things like blockchain technology start to take off, you 
know, those transactions are recorded in an immutable ledger. 
You cannot go back and change them. You can trace them, and you 
can actually do AML compliance in real time. So I think the way 
that we are moving in digital payments in the future is 
actually going to be a lot easier for companies to control 
these compliance costs.
    Senator Perdue. Thank you.
    Thank you, Mr. Chairman.
    Chairman Crapo. Senator Reed.
    Senator Reed. Well, thank you very much, Mr. Chairman. And 
thank you, gentlemen, for your testimony.
    Professor Pasquale, thank you for citing my proposed 
legislation along with Senator Warren and Senator Collins. It 
is a response really to all of what we are seeing in terms of 
the Equifax breaches and everything else. And the underlying 
principle is it is a disclosure bill. I think shareholders 
should be aware of what their investment--or their company is 
doing in terms of cybersecurity. And it leads to the question 
that I think a lot of people are asking now: Are companies at 
the proper level focusing proactively on avoiding major and 
costly cybersecurity attacks? So I will ask you, in your 
opinion, are most companies doing that now, or is it the 
exception?
    Mr. Pasquale. Thank you, Senator. I do think it is the 
exception. Based on the work of Kristin Johnson on managing 
cyber risks, I think she has done some very interesting 
analysis of how the problem is that when these types of cyber 
risks arise, there can be a huge leak of data, but the full 
consequences may not be known for years or even decades 
afterward. And the problem is, as your bill anticipates, how do 
you sort of front-load awareness of these problems and try to 
engage the board so that we are thinking about it not after the 
fact, not requiring disclosure after something bad has 
happened, but actually requiring something that happened 
beforehand.
    So, yes, I do think that it is an area that needs much more 
attention from corporate boards.
    Senator Reed. Let me ask you, Mr. Turner, your experience 
too in terms of looking across the spectrum of both private and 
publicly held companies. Is suitable attention being paid to 
cybersecurity issues, in your view?
    Mr. Turner. I think if we are looking at the fintech sector 
in particular, as I mentioned before, cybersecurity is a big 
focus. But, you know, as you start to take a step back and look 
at the economy as a whole, especially just the financial system 
we have today, cybersecurity is definitely a big focus. But I 
think a lot of the problems lie in the fact that our banking 
system really is a product of decades' worth of consolidation. 
There are a lot of, you know, fractured technology systems, 
physical servers, and things where, you know, it is hard to 
comply and keep an eye on cybersecurity when you are really 
just trying to keep these old systems running on a day-to-day 
basis. And I think we see some of the more innovative 
institutions moving toward things like cloud storage and cloud 
computing. And as we start to get there, I think it will be 
easier for firms to take a good look at cybersecurity and put 
some good measures in place.
    Senator Reed. But it would seem appropriate to have the 
Securities and Exchange Commission lead that effort to try to 
get them to that position. That is fair?
    Mr. Turner. Yeah, again, I mean, you know, an actual 
cybersecurity law or regulatory framework is really up to 
Congress and the regulators. But I do think, you know, it is 
not only that but just a--you know, if you had some sort of 
national standardization even in what these terms mean, you 
know, if NIST or someone like that could come out as well, I 
think those are all good steps in the right direction.
    Senator Reed. You actually raised a very profound question, 
and the best parts of these hearings are not the answers but 
the questions that we have to think about, like who owns the 
data, which has to be done on an international basis, 
obviously, since it flows so freely across the globe. But that 
is an issue that we have to confront, I think, in Congress, at 
least for the United States. I think there are other questions 
like that. Are there data that should be off limits, you know, 
no one can have it or the person has to give an affirmative 
thumbs up or thumbs down? Should data be purged rapidly so that 
you do not accumulate this vast holding stretching back that is 
more transactional than archaeological, if that is a term? And 
I think there is a whole series of questions that you have 
raised which I find very, very helpful, so thank you very much.
    Mr. Evans, thank you and your colleagues at GAO. Just a 
final point. I have just a few seconds. Your response to the 
perception of how well prepared or well versed most companies 
are with respect to cyber, is it----
    Mr. Evans. Yes, so my team did not look at that as part of 
this work.
    Senator Reed. Yes, sir.
    Mr. Evans. But it is something that we are considering, and 
we do have folks that have given great thought to cybersecurity 
and the innovative technologies that might lead to improvements 
in this space. But, unfortunately, I have nothing to add to 
that question.
    Senator Reed. Thank you very much. Thank you, gentlemen.
    Chairman Crapo. Senator Cotton.
    Senator Cotton. Thank you, gentleman, for your appearance 
and your testimony this morning on this important topic.
    Estimates from a 2015 FDIC survey indicated that 7 percent 
of households in our country are unbanked; another 20 percent 
were underbanked, which means they have access to a bank but 
also used products outside the traditional banking sector. So 
that is over a quarter of our fellow citizens who do not have 
the kind of traditional banking relationships that the rest of 
Americans do.
    Mister--is it ``Pascal''?
    Mr. Pasquale. Pasquale. Thank you.
    Senator Cotton. I apologize. ``Pascal'' is how we pronounce 
it in Arkansas.
    [Laughter.]
    Senator Cotton. Along with other innovative pronunciations 
of different words. Do you think that the growing fintech 
market has the potential to help these unbanked and underbanked 
Arkansans access the digital economy and achieve greater 
financial security? And if so, please elaborate on how exactly.
    Mr. Pasquale. You know, I do think that when we look around 
the world, we have seen fintech used as a tool of financial 
inclusion. For example, with M-Pesa in Kenya and some other 
areas around the world, you see an effort there. And I do think 
that that is--you know, there could be some inspiring 
opportunities in order to sort of create that sort of tier of 
opportunity.
    But I think one of the very difficult questions for 
Senators and for the regulators now is: Do you want to create 
sort of a two-track system, sort of a system that, say, is 
maybe a higher tier, that has higher levels of protection and 
regulatory standards, and then a lower level? Or to what extent 
do we want to maintain sort of a more unitary set of 
protections?
    So I do think that, yes, there are definitely global 
examples of inclusion, but I am also cautious about, you know, 
what we might be giving up in order to bring them to the U.S.
    Senator Cotton. What, if anything, is inherent in fintech 
that would lead to that kind of two-tier system that we should 
have on our minds as we craft policy?
    Mr. Pasquale. I think that one of the things is that if you 
have, for example, fintech firms wanting to avoid, say, 
consolidated supervision or other sorts of requirements that go 
along with some of the benefits of, say, certain forms of 
regulation, that could be one aspect of the problem. But I 
think the other aspect is that I think sometimes fintech is 
confused because--the term itself leads to confusion because a 
lot of the technology ideally would be sort of an adjunct to 
existing banks that might be required to do what we want them 
to do in terms of serving the underbanked as opposed to itself 
providing those services.
    Senator Cotton. OK. Mr. Evans, you look like you might have 
something to add on that point?
    Mr. Evans. Yes, so I was just thinking through some of what 
Dr. Pasquale was discussing. Certainly I think there are great 
possibilities in this particular area, and of course, great 
risks that we detailed in the report. And it is almost too soon 
to know. We have not seen a full credit cycle. And we have 
seen, you know, earlier episodes where we have seen spikes in 
homeownership rates that were not sustainable. And so we want 
responsible, sustainable access to credit, and so those are 
some of the things we need to shake through when we think about 
marketplace lending.
    Senator Cotton. Mr. Turner, would you like to round out 
these thoughts?
    Mr. Turner. Yeah, I think it is important to note when we 
are talking about, you know, the unbanked and the underbanked, 
and when we say fintech can promote inclusion, you know, there 
are really two parts to that. There is the idea just of access, 
you know, as we continue to see bank branches closing, it is 
harder for people to actually have that local bank that they 
can go to and get financial services. So if we have, you know, 
mobile applications where people can bank on their phone, I 
think that is access.
    And then I think the second part of that is the inclusion 
that comes with, you know, expanded services that might use 
alternative data or something like that to make a decision on a 
loan that a FICO score might show a borrower is, you know, a 
risk, where if you include some additional data, you can get a 
better picture, and that person actually can get credit.
    So I think there is a lot to consider, and I think that, 
you know, as we move forward and we look at regulation, it is 
important to remember and it is important to make sure that 
fintechs kind of have a framework where, you know, they need to 
decide are they going to be deposit-taking institutions and be 
like a real bank or are they going to continue as they are now 
and then need some sort of defined regulatory structure 
specific to fintechs.
    Senator Cotton. Thank you.
    Mr. Pasquale, I would like to look at fintech from another 
perspective now. We were looking at it from the customer's 
perspective, now from the perspective of jobs and investors. A 
CEO of a London-based company called ``TransferWise'' recently 
said that he was recruited by Silicon Valley venture 
capitalists, but he chose the U.K. because of their regulatory 
structure. That is disappointing from the standpoint of 
American jobs. What, if anything, can we do to prevent future 
companies from making that decision and seeing the United 
States is the best, most favorable climate in which to start 
their companies and create new jobs?
    Mr. Pasquale. You know, I do think that the problem of is 
the U.S. sort of falling behind sort of the awareness of other 
countries like the U.K., that is a key problem. I also would 
note, though, in terms of the work involved, I think that we do 
have such a great advantage in terms of some of our sources of 
strength in Silicon Valley and in New York in terms of the 
funding of institutions there of education and other areas that 
sort of led to a big advantage there.
    So I guess my thought would be that I would not necessarily 
want to see the U.S. regulatory infrastructure be rapidly 
chipped away at to sort of keep up with this, with, say, what 
is going on other countries. But I do think that we should keep 
in mind that if there is a certain level of divergence, maybe 
that should lead to some more international cooperation to lead 
to more convergence, as we were talking earlier with Senator 
Perdue with some of the Chinese apps.
    Senator Cotton. Thank you.
    Mr. Turner and Mr. Evans, I regret my time has expired. We 
would welcome your comments on that question for the record, 
though. Thank you.
    Chairman Crapo. Thank you.
    Senator Cortez Masto.
    Senator Cortez Masto. Thank you, Mr. Chair, and thank you, 
gentlemen. This is an important discussion we are having, so I 
appreciate your comments today.
    Mr. Pasquale, let me start with you because Chairman Crapo 
had asked you, all of you, what the risks are, and one of the 
things that you talked about was the opaque algorithms to 
assess credit, and that was one of my questions. Can you 
elaborate on that a little bit, please?
    Mr. Pasquale. Sure. So one of the big problems in the U.S. 
credit industry is that there are lots of people who either 
have no file or a thin file, and so they are very hard for a 
bank to extend credit to because it sees them not having 
adequate--we do not have adequate background information on 
them. And so the answer from a lot of fintech firms is to say, 
``Well, why don't we look at other sources of data?'' And there 
was a think tank called ``UpTurn'' that divided these into 
traditional, alternative, and fringe sources of data. So 
alternative data could be like your utility bill or rent bill, 
how often you pay your rent, et cetera. That seems pretty 
legitimate to me. But some of the fringe data could be things 
like how do you fill out a form online. Did you look at it for 
too long?
    In the others, reports of lenders saying if they see 
political activity on someone's Twitter account, they say, 
``Oh, wow, well, maybe we should not lend to them. Maybe they 
are getting mixed up in things that we do not want to be 
involved in.'' And sometimes even the content of someone's 
smartphone, like the deal might be offered, just let us 
download everything on your smartphone and maybe we will give 
you a loan.
    And I think that these sort of business models could lead 
to what I call ``big data proxies.'' So the problem is that the 
companies involved may not necessarily be looking to 
intentionally discriminate against individuals, but as we know 
from ACOA, that is not the touchstone of liability there. The 
really key issue is: Could you use that sort of data like 
locational, other aspects of data to discriminate against 
people?
    And a final version of this could be that, for example, you 
might have very sophisticated algorithms that could from 
someone's face, say, tell their age or tell different medical 
conditions from them. This sort of face recognition software is 
already being used, say, to infer criminality from faces. And 
so the level of advances in AI means that there are so many 
different data sources, and the opacity of these is really a 
challenge to fair lending.
    Senator Cortez Masto. Thank you. And I know you have 
written extensively on data brokers, and I think that is 
important. I think it is important for all of us to understand 
there is so much data out there and the concern when it comes 
to credit or how we determine somebody's creditworthiness, if 
we are going to take all of that data into consideration, might 
at times create some sort of bias unintentionally because of 
the data we are collecting. Is that what you are saying?
    Mr. Pasquale. Absolutely, and I think Federal Trade 
Commissioner Edith Ramirez was a real intellectual leader here 
in terms of pointing this out as an issue, getting the FTC to 
write some good reports on it, and the White House big data 
report from last year.
    Senator Cortez Masto. OK. Thank you.
    Mr. Turner--and this is for Mr. Pasquale as well--how 
should policymakers think about balancing both the innovation 
provided by fintech companies and also ensuring that the same 
rules of the road that apply to traditional lenders also apply 
in this space?
    Mr. Turner. Yeah, I think that is actually a very important 
question right now, and I think, you know, things like the OCC 
charter are a step in the right direction. If you look at these 
lenders and, you know, if their primary business is lending, 
they should be treated like other lenders. And right now, you 
know, there are about three different ways that digital lenders 
operate. You know, they are either partnering with the 
federally regulated bank, they are going State by State and 
getting licensed, or they are doing, you know, kind of a mix of 
both. So I think that if you want to talk about a fair and 
level playing field, you know, while continuing to promote 
innovation, it needs to be something where both the incumbent 
financial institutions and the lenders feel like they are 
getting a fair deal. And I think, you know, something that has 
been mentioned before that is important is as we start to have 
some sort of regulatory framework for these digital lenders, 
you know, it is important to make sure that you do not have a 
very high interest rate lender just setting up a website and 
calling themselves a digital lender. I think it is important 
that you probably define what those lenders actually are first.
    Senator Cortez Masto. And then can you also address--and I 
will open it up to Mr. Pasquale as well--State preemption. 
Obviously, the crisis that we just came through--and I was 
working in the State of Nevada as Attorney General--the Federal 
regulators I think failed us to some extent. And so I am always 
concerned about some sort of State preemption in this space. 
And along with that--let me put my law enforcement hat on--
fraud and money laundering when it comes to fintech companies 
and FinCEN and how that interaction should be involved with 
this process as well. So let me just throw that outcome there.
    Mr. Pasquale. I completely agree with your concerns about 
preemption, and in my written testimony, I have talked a bit 
about some of the critiques of the potential for OCC to preempt 
some of the relevant State laws, including usury laws, because 
there are already some worries in exactly that area. And we saw 
even the Supreme Court reconsidering its embrace of preemption 
in Watters v. Wachovia in the later case Cuomo. And I think 
that that sort of signal from the Supreme Court should be a 
signal to regulators and to Congress in terms of exactly the 
type of concerns that you are raising.
    Senator Cortez Masto. OK. Thank you. I notice my time is 
up. Thank you, gentleman. I appreciate the comments.
    Chairman Crapo. Thank you.
    Senator Tillis.
    Senator Tillis. Thank you, Mr. Chair. Gentlemen, thank you 
for being here.
    I want to go back. I have got a couple of things I hope I 
have time to ask about, but, Mr. Evans, I think you mentioned 
in response to the Chair's questions about the sandboxes some 
of the other countries are experimenting with that, you know, 
you want to be in an environment where you can move fast and 
break things, but maybe do it with the right rails in place.
    Number one, you said that you are going to do a report that 
is due out in the winter of next year.
    Mr. Evans. That is right.
    Senator Tillis. That is about a dog year in technical 
terms. So one question I have is: What can we do now to 
potentially look at this with the right kind of safeguards and 
not wait 2 or 3 years where a lot of things will be different, 
as they were 2 or 3 years ago?
    Mr. Evans. Very good question. I think you are going to see 
some competing interests on both sides of the issue when you 
think about what the appropriate regulatory approach is in the 
U.S. and what we can actually glean from other economies.
    Senator Tillis. And do you think the current regs make it 
difficult for a large traditional bank to even really get into 
this mode of where they could move fast and break things? Or 
are they at a decided disadvantage until we have some sort of 
rationalization?
    Mr. Evans. Yes, and I do not think that that is the 
appropriate model in the financial services space because we 
are not talking about apps. We are talking about access to 
credit. And so the more appropriate model is maybe move fast, 
be careful, think through what the landscape looks like.
    Senator Tillis. Yeah, and I meant it actually in a more 
positive light, I think, in innovation. What you are trying to 
do is innovate, particularly for our U.S.-based entities and 
innovators to be globally competitive. So I am trying to find a 
sweet spot where you do that but it does not become disruptive.
    Mr. Evans. Right.
    Senator Tillis. I hope that if--the report takes as long as 
a report takes, but I hope that we have other information that 
is instructive to Congress so that, to the extent that 
regulatory or legislative action is required, we are able to 
move more quickly than a dog year in technology.
    Mr. Evans. Yes, sir, and this will be early----
    Senator Tillis. Early winter?
    Mr. Evans. Early 2018.
    Senator Tillis. Oh, OK. Good. There are two winters in 
2018, so you are talking about the early part.
    Mr. Evans. That is right.
    Senator Tillis. Good. One question I have is whether or not 
we have got a bubble with respect to cryptocurrencies, and, you 
know, you have got a thousand different cryptocurrencies out 
there. Can you talk a little bit about the need for regulation 
and watching how the industry is moving? We will start with 
you, Mr. Pasquale, and just go down the line.
    Mr. Pasquale. Yes, Senator Tillis, I think that is a really 
powerful concern right now. I have seen stories, for example, 
of people trying to puff a certain cryptocurrency by saying, 
``I am a taxi driver. I took my money out of the bank. I put it 
into the cryptocurrency and now I am rich.'' And I think that 
when you look particularly at the diversity of the initial coin 
offerings and how they are proliferating, even boosters of the 
cryptocurrency industry like CoinDesk have published articles 
saying here are massive governance deficits with respect to how 
these ICOs work and how some of the cryptocurrencies work.
    So I do hope that--I think that our regulators are trying 
to catch up with it, but I think it is going to take a lot more 
coordinated, concentrated effort to do so.
    Senator Tillis. I have got limited time. If you want to 
briefly comment.
    Mr. Turner. So I think that when you look at 
cryptocurrencies, you need to realize, you know, the entire 
market is only a little more than $100 billion, and this is 
globally. So, you know, you cannot really call a bubble or 
anything like that, but it is not that much compared to other 
asset classes. I think that as Dr. Pasquale mentioned, you 
know, there needs to be some sort of regulation around initial 
coin offerings or token offerings, and whether that involves, 
you know, offering them only to accredited investors or setting 
up some sort of governance agency or having a current regulator 
look at them, I do not know. But there definitely needs to be 
something.
    Senator Tillis. I am sorry, Mr. Evans. I want to get to a 
final question, and it relates to some of your opening 
comments, Mr. Pasquale, or maybe I inferred incorrectly from 
it. But with respect to the algorithms that are being used by 
some of the players and the concern with maybe the risk of 
predatory lending practices, is there any information out there 
that would suggest that the rates on the whole that are being 
charged by people that are in the fintech space or there are 
substantial outliers based on the underlying risk using maybe 
factors that have not traditionally been used in the 
underwriting model? In other words, is there a real clear base 
of evidence that suggests that they are engaged in any kind of 
unfair lending practices? I infer that maybe you thought there 
was or there was a potential for it, so I was curious. That 
will be my final question.
    Mr. Pasquale. I would put it more on the potential side 
right now, Senator. I think that the issue in terms of--I 
briefly cited this 2016 Federal credit survey--or a credit 
survey by the Fed of some small businesses, and there was also 
an interesting story cited in my written testimony by David 
Lazarus about certain people had used the fintech platform and 
then later found out that the Small Business Administration had 
suggested--or someone from the SBA had suggested that if they 
have used certain lenders vetted by the SBA, they could have 
gotten a much better deal. But I would say that it is very--we 
are still in early days.
    Senator Tillis. More of a risk than a measured reality.
    Mr. Evans, and then I will finish.
    Mr. Evans. Certainly if you look at some of the enforcement 
actions--and there have only been a few--there was one case 
where the entity was a bit more aspirational than they should 
have been, and they promised benefits that did not actually pan 
out, and they were cited by the CFPB. But in terms of 
widespread evidence, I will say no, and in some cases you do 
see lower rates relative to some other higher-cost alternatives 
like payday lending.
    Senator Tillis. Thank you.
    Chairman Crapo. Senator Warren.
    Senator Warren. Thank you, Mr. Chairman.
    So we are here talking about innovative new financial 
services companies, and in that context, I want to ask some 
questions about the data on the cost of financial advice.
    Dr. Evans, you are the Director of the Financial Markets 
Group at the Government Accountability Office and an expert on 
all things financial markets, and you look at a whole lot of 
the data in this area. Is it your sense that it is now harder 
or easier for middle-income savers to access investment advice?
    Mr. Evans. So I would say easier, and that is a qualitative 
assessment and is based on consensus, because if you look at 
traditional wealth management, it takes $250,000 to get in the 
game; whereas, the digital wealth platforms require no minimum 
or a small amount, say $500. And some of these are automated 
platforms that do things like automatically rebalance the 
portfolio, which means lower fees. Examples of these include 
Betterment and Wealthfront.
    Senator Warren. Good, so getting easier. And, Mr. Turner, 
you are a research analyst at S&P Global Market Intelligence. 
You are also an expert on all things financial markets. In your 
expert opinion, is financial advice getting more expensive or 
less expensive for investors?
    Mr. Turner. Thanks, Senator. I think just echoing those--
you know, as you continue to see the growth in digital 
advisors, you know, with much lower fees, consensus seems to be 
that advice is getting less expensive.
    Senator Warren. So here you are; you are both independent 
experts. I appreciate your opinions. They reflect the data. 
They reflect the facts as best we know them. But the National 
Chamber of Commerce apparently disagrees with you, and they 
think they have bought some facts to back them up.
    Last week, they hosted a meeting to complain about a new 
Department of Labor rule that prevents Americans who are saving 
for retirement from being cheated by their investment advisors. 
It is called the fiduciary rule. I know you are all familiar 
with it. And it requires investment advisors to offer advice 
that is good for the customers, not advice that makes more 
money for the investment advisor.
    Now, the Chamber was hyping a new study which they had 
bought and paid for claiming to show that the new rule made 
financial services more expensive for families.
    Now, my first guess when I saw this is that they were 
pushing around this so-called study because under the new 
fiduciary rule, financial advisors are hurting for profits.
    So, Mr. Turner, this is your area of expertise. With the 
new fiduciary rule in place, are investments shrinking and are 
financial advisors hurting for profits?
    Mr. Turner. Yes, so that is an interesting question. I 
think if you actually look in what I submitted for my written 
testimony, we predict by 2021 there will be $450 billion in 
digital advisors. That is a fourfold increase from where it was 
at the end of last year, and a lot of that growth is actually 
being driven by incumbent investment advisors who are looking 
toward these new technologies. So no longer is it the startups, 
but it is actually the larger firms that are offering these 
products.
    Senator Warren. So this is really interesting. So startups 
are doing well. That is part of what we are learning here. And 
the CEOs for the large financial firms like UBS and Charles 
Schwab actually have now told their shareholders in earnings 
calls that their profits are great and going up with the 
fiduciary rule in place. So the new rule is obviously lowering 
prices for consumers. It is shutting down cheating. It is 
letting investors access new markets. It is great for new 
financial startups like Betterment. It is good for big guys 
like UBS. And yet the Chamber of Commerce is running around 
like a chicken with its head cutoff trying to kill the rule.
    I get it. There are some investment advisors who built 
their profit models on kickbacks and on tricking their 
customers. But the fiduciary rule is good for consumers. It is 
good for markets. It is good for competition. It is good for 
startups. And it is even good for some of the biggest 
investment companies.
    Even so, the lobbyists and the trade associations like the 
National Chamber of Commerce are sucking down billions of 
dollars every year in this town, and those dollars do not keep 
flowing unless there is a fight somewhere. So the lobbyists and 
the trade associations keep right on fighting, whether it makes 
any sense or not.
    If I ran one of these companies, I would take a long, hard 
look at all of the shareholder money that is wasted on trade 
associations and membership in the National Chamber of 
Commerce. I think they are being taken for a ride.
    Chairman Crapo. Senator Van Hollen.
    Senator Van Hollen. Thank you, Mr. Chairman, and I thank 
all of you for your testimony.
    Mr. Pasquale, we are very proud to have you at the 
University of Maryland, and let me start with a question for 
you, because in your written testimony you have a section 
entitled ``The Problems of Extant Data Collectors are a Reason 
for More Scrutiny of Fintech, Not Less'', and you talk about 
different kinds of problems with a lot of the data that is 
being collected, accuracy, relevancy, and some other 
provisions.
    I just want to focus on accuracy for a moment because in 
this fintech world--and then I am going to ask you about the 
existing rule that is already more regulated. It seems that the 
burden is always on the consumer from inaccurate data, and the 
question is if a consumer is being harmed because of inaccurate 
information about them, why should they be paying the penalty? 
Why not the provider of bad information?
    So let me ask you, first, in the fintech world, is it still 
the Wild West? Do we need to have some provisions that say that 
those people who provide bad information that causes harm to 
consumers should have to pay some penalty rather than the 
burden on the consumer?
    Mr. Pasquale. I think that is an excellent proposal, and it 
really would rebalance things, because one of the things that I 
think is so tragic about the Equifax data breach or several 
data breaches is the amount of lost time, I mean people having 
to spend time haggling over the phone just trying to 
reestablish the basics of their identity to protect it from 
being exploited. And I think trying to rebalance the playing 
field--I mean, I know in Europe they have talked about a data 
levy, because the idea is that data--you know, we have often 
heard data is the new oil. But we also know that oil has some 
wonderful sides and has some terrible sides. And we try to deal 
with the environment consequences of oil.
    I think very similarly, when we have these large quantities 
of data that can create such harms once they are released, we 
need to sort of be storing up some level of reserve for 
regulatory efforts that would put the burden and the cost on 
the person that causes the accident, not the victims of it.
    Senator Van Hollen. All right. So let me follow up with 
Equifax, because most of the focus understandably right now is 
on breach of privacy, everyone's very personal information 
being exposed to the public and people who may want to do bad 
things with it. But you raised the issue that I hear constantly 
from our consumers, even before the data breach, which is that 
they get a question on--you know, they are denied a loan or 
their bank tells them there is a problem or whatever it may be. 
You mentioned an Arkansas woman in here who was denied a job.
    So even under those more regulated systems like Equifax, 
you have these problems today where consumers are stuck with 
the costs of bad information. Do you have any suggestions about 
how we can deal with that? Because if we can get it right with 
Equifax and the already more regulated entities, those sort of 
models could also be applied to fintech. I do not want to 
suppress the benefits of fintech. I just want to make sure it 
is not the consumers who are paying the costs for inaccurate 
information about them.
    Mr. Pasquale. Right, and I think one idea that I have 
explored in past work is requiring certain push notifications 
to consumers if they are put in a certain suspect category. And 
some of those suspect categories could be, for example, as I 
discuss in the written testimony, lists of people with certain 
illnesses. There are lists of people with diabetes, with AIDS, 
HIV-positive, mentally ill, et cetera. If you are on one of 
these lists, perhaps you should have to get a push notification 
so you could dispute it or at least you could understand what 
was happening. And also, I think there should be further 
regulatory effort on the use of the data, so not only putting 
the burden on the consumer but also restricting certain usages 
of data that may have, say, illicit provenance or have not 
sufficiently been vetted by, say, outside auditors or others.
    So I think that those would be two options, you know, both 
a consumer-facing option and an option of restrictions on use 
without proper vetting and auditing.
    Senator Van Hollen. All right. I look forward to working 
with you on it. There are two issues. One is the relevancy of 
the data, right? I mean, is a health condition relevant to 
whether you get a loan or something? The other is the accuracy. 
And they are both important, but it does drive me crazy when 
something that is just dead wrong gets on a credit report and 
the credit rating agency, whoever it may be, does not pay any 
penalty other than the fact that after months and months of 
work, they may say, ``Oh, yeah, we were wrong,'' even though it 
has created incredible economic and other kind of pain to 
consumers. So I look forward to working with you on that.
    Just a quick question you can answer for the record, if you 
want. With respect to bank loans, for example, we have FDIC 
protection. We have got this great new area in fintech where 
people have, you know, a lot of their--you know, not a lot of 
wealth but they have money stored in these areas that are not 
really insured.
    For the record, Mr. Chairman, any thoughts any of you have 
about how we deal with that issue? If I have money in my bank 
account and it is lost, I have the FDIC. What is the recourse 
for a consumer who uses fintech and their money is lost? So I 
would appreciate any answers you have for the record since it 
looks like my time is out.
    Chairman Crapo. Senator Schatz.
    Senator Schatz. Thank you, Mr. Chairman. Thank you to the 
witnesses for this important hearing.
    This is a question for all the witnesses. We hope that 
financial innovation breaks down barriers and increases 
financial inclusion and ultimately does good, but sort of 
pursuant to Senator Tillis' line of questions and what the 
panel has been talking about, the risks are real. There are 
security issues. As we saw with Equifax, our most sensitive 
personal information can be vulnerable, and there is the risk 
of creating a platform for predatory actors entrenching social 
and racial biases. And so innovation is disruptive, but it can 
be disruptive in positive and negative ways.
    I think we have an opportunity here. We can choose to lift 
up innovation that creates economic opportunity. We can make 
consumer protection a core value of what we do in fintech. When 
someone asks for regulatory flexibility, we can ask how is this 
innovation going to actually help people.
    As a starting point, I think it would be helpful to have a 
dedicated Innovation Office that is thinking comprehensively 
about these questions. This could be a one-stop shop in the 
Government for fintech businesses to figure out which 
regulations apply to them and a mechanism for coordinating 
among the regulators. It will be a Wild West without some 
attempt to coordinate.
    You already have regulators with varying degrees of 
aggressiveness in this space and enthusiasm for this space. But 
we need someone who is thinking around a few corners rather 
than just sort of narrow questions of compliance for particular 
companies.
    I would like to get each one of the panelists' views on the 
potential for an Innovation Office and a one-stop shop, 
starting with Mr. Evans.
    Mr. Evans. I will just quickly say that it is something 
that should strongly be considered. It is envisioned in the 
bill that is before the House. The regulators have talked about 
these type of initiatives, and it is worth full consideration.
    Mr. Turner. I think it is a great idea. I think as we start 
to look at potential regulation for the industry, having some 
sort of Innovation Office, having some sort of sandbox program 
in place could help fintechs and regulators really figure out, 
you know, what they are working toward. And I think if you look 
at large banks today, they all have Innovation Offices.
    Mr. Pasquale. Yes, and I would agree. I think that the 
problem of interagency cooperation is a really profound one, 
and the Dodd-Frank Act took certain steps in that direction 
with respect to the Financial Stability Oversight Council. And 
we see also in terms of data sharing and the governance of data 
sharing and the intelligence apparatus there are some efforts 
to sort of understand exactly what is going on in the overall 
ecosystem. And I think you are absolutely right that that is 
going to be the big agenda item, I think, over the next decade, 
is how you can get these agencies to cooperate around something 
like an Office of Innovation.
    Senator Schatz. Let me just ask another question not on my 
prepared list of questions. You know, the challenge, I think, 
with this Committee, at least to a certain extent, is that the 
public's eyes glaze over, even though all of these issues 
impact them directly. It is hard to describe why this panel and 
this topic matters to folks that we all represent, and yet it 
does.
    So could you just describe as concisely as you can, each 
one of you, the best opportunity when it comes to fintech and 
sort of the worst of a parade of horribles when it comes to 
fintech?
    Mr. Evans. So I think that the best opportunity, of course, 
is enhanced and sustained financial inclusion. The horror story 
is fintech companies being used as a platform to market high-
cost loans to individuals that further undermine access to 
credit.
    Senator Schatz. Mr. Turner.
    Mr. Turner. I pretty much echo that. I think fintech really 
offers access. It offers ease of use. It offers reduced 
frictions. It offers reduced costs. And the only downside I 
could see in the future is bad actors parading as fintechs and 
trying to get fit into regulation that might be formed.
    Senator Schatz. Just as a quick follow-up, do we have a 
statutory framework that prevents those bad actors? Or are we 
just hoping they will not take advantage of this new aperture?
    Mr. Turner. I think if there is to be any sort of fintech-
specific regulation, you will need to define what a digital 
lender is, what a peer-to-peer payment company is. It needs to 
be--you know, this is probably step one in doing that.
    Senator Schatz. And this becomes hard because banks are 
going to be in this space already.
    Mr. Turner. I think it could be difficult, but I think it 
is definitely necessary.
    Senator Schatz. OK. Mr. Pasquale.
    Mr. Pasquale. Yes, I think, you know, on the bright side, I 
do think when I look--I listen to a lot of podcasts on fintech, 
like the Wharton Fintech or Fintech Insider, and you often hear 
on these podcasts very interesting entrepreneurs who are 
bringing to people, say, the opportunity to buy insurance for 
an hour if they want to borrow their friend's car or something. 
And those sorts of things, like insurer tech, those sorts of 
things, are really, I think, filling a gap for consumers and 
might ultimately, if the market is structured correctly, lead 
to much better competition for financial services if options 
are transparent and understandable.
    For the downside, I would just reference there is a British 
science fiction series called ``Black Mirror'', and it has a 
terrific episode where someone finds that their score--they 
keep having negative social interactions, and their score, 
which also acts as a credit score, keeps going down and ruins 
their life.
    Senator Schatz. For the record, can I find that on Netflix 
or----
    Mr. Pasquale. Yes.
    [Laughter.]
    Chairman Crapo. Senator Warner.
    Senator Warner. Thank you, Mr. Chairman. I will tell you, 
Dr. Pasquale, I listen to a lot of podcasts as well. I am not 
sure Wharton Insider has been on my list recently. But let me 
compliment my friend Senator Schatz. I think the idea of this 
Innovation Office, this kind of one-stop shop makes an enormous 
amount of sense. I would love to help you on the--I do not--to 
try to accomplish that since we think about FSOC and other 
efforts. This notion of having some single point of reference 
in this area is a great idea. How we implement it is going to 
be a real challenge because I think, as Mr. Turner talked about 
a little bit, my old business used to be mobile telephony. I 
mean, mobile payments are a part of the fintech world. This is 
going to continue to grow in a number of ways, but I think it 
is a great idea.
    I want to come back to--I am going to try to get in two 
items. One, on the whole question of what Senator Reed raised 
in terms of trying to elevate this whole question around data 
protection at a higher level, I would simply point out I think 
we have got like 9,000 public companies. Even Yahoo, when it 
had its massive data breach, did not really view that as a 
material fact in terms of how do you not have a billion users 
hacked into and that not be material. Now, we whacked Yahoo, 
but the fact is I think less than 100 companies in the last 
decade have ever reported on a data breach in an SEC filing. So 
some of the things that Senator Reed has suggested are very 
important.
    Another piece I think is very important is--and this is not 
one that is a partisan issue. We have been working for 3\1/2\ 
years trying to get a common standard around data breach. We 
have got 49 different State laws now on data breach. So the 
fact that Equifax took 6 weeks before they notified consumers 
was a reflection of the fact that we do not have a single 
standard around data breach. And the problem has not been 
actually lack of need for a standard. It has been individual 
industries, and in many cases my old industry, telecom wanted 
to try to exempt themselves from the requirements of 
notification.
    I know this is a little bit off topic, but because Equifax 
is kind of in the news and as we think about fintech being a 
brave new world, do you guys have a sense about the need--and I 
know, Dr. Pasquale, you had some concerns about Federal 
preemption. But in the case of the data breach, I strongly 
believe that we need a single national standard here. Do you 
have a view on any of that?
    Mr. Pasquale. I guess I would say that there are 
certainly--it is a very tough question because I do think that 
I want to preserve the ability of certain States to be on the 
cutting edge in terms of expansive requirements, and I think 
that, you know, California to some extent has had a very 
forward-thinking privacy office there in the Office of the 
Attorney General. But I also do see your point that it could 
become very costly for companies to comply with all the 
different standards, try to understand them all.
    And I think that, you know, I would have to study it 
further to know whether the benefit of uniformity----
    Senator Warner. I would love to get some--because we are 
very close. The challenge has not been trying to get a standard 
or the standard has to evolve. It also has notification 
requirements. But I think the challenge in a lot of data 
breaches is everybody blames somebody else. You know, is it the 
institution? Is it the financial institution? Is it the telecom 
companies? Is it some other player? And we end up now having 
these circumstances where, again, in the Equifax case we wait 6 
weeks before the public is notified.
    Mr. Turner and Mr. Evans, quickly, because I have got one 
other area I want to raise.
    Mr. Turner. Yeah, I just want to point out that I think, as 
you mentioned, just a national standard is probably step one. 
So I do not know if it is going to be specific Federal 
regulation or harmonized State regulation. But if everybody is 
on the same page, you know, at least it can start down that 
path.
    Senator Warner. Mr. Evans.
    Mr. Evans. And I would just echo those sentiments. What you 
want is consistent treatment.
    Senator Warner. One area that I have been intrigued with--
and, again, there is a little poor guy who had all these other 
great, very specific fintech questions who is going to be upset 
I am not asking them, but this is another area. I think there 
is a real opportunity in fintech. One of the things I have 
looked at over the last 2 years is the transformation in the 
nature of work and the transformation in the notion of 
employment. You know, back in the 1990s, about 90 percent of 
Americans worked full-time in a W-2 type environment, yet we 
are the only industrial country in the world that makes all of 
our social insurance dependent upon your labor status. So that 
social contract that said if you work full-time, you get 
unemployment, health care, workmen's comp, disability, 
retirement, that world is changing. A third of the workforce 
right now is not in traditional work. They are in contingent 
work. You know, they are part-time, they are temp workers, they 
are 1099 independent contractors, the kind of sexy areas, the 
gig workers. All of that workforce, a third of the American 
workforce--the estimates are it is going to go to half--have no 
social insurance at all.
    One of the things we have looked at is the notion of 
portable benefits, and I think fintech offers an enormous 
opportunity, as long as it is properly regulated, to have the 
ability to have that portable benefit system that would allow 
you to move from firm to firm and carry those benefits with 
you.
    Any quick comments on that, right down the path, 
recognizing I am already out of time?
    Mr. Evans. I will pass.
    Mr. Turner. I think technology will be a great enabler of 
anything that does happen in that area.
    Mr. Pasquale. And I would agree with you. I follow some of 
the work on platform cooperativism, which are a lot of groups 
that are trying to create fairer forums of platform----
    Senator Warner. Stride Health and others, et cetera.
    Mr. Pasquale. Yeah, and I think that the portable benefits 
via some of these fintech firms could help them--could help 
individuals to get out of job lock, which I think is really a 
big drain on entrepreneurialism.
    Senator Warner. I would only say, Mr. Chairman--I know my 
time is up--that, you know, I do not think we are going to be 
able to force an economy back into a 20th century model where 
everybody works for the same company for 38 years the way my 
Dad did. But we are going to have to recognize that we need a 
social insurance platform or new social contract that meets the 
workforce where they are at and, again, as Dr. Pasquale said, 
allows people to move from job to job, and part of that means 
portability of benefits. So I think fintech offers a great 
opportunity here.
    Thank you, Mr. Chairman.
    Chairman Crapo. Thank you, Senator Warner. And that 
concludes our questions. We have finished the hearing with 2 
minutes to spare, so I thank our witnesses for being concise in 
your testimony and also for your testimony. You will probably 
get additional questions from Senators, and the Senators should 
note that they have until Tuesday, September 19th, to submit 
questions. I urge our witnesses to respond to those questions, 
if you receive them, as quickly as you can.
    This is a very critical issue, and your testimony has been 
very helpful to us. We will probably look forward to working 
with you in the future to get further help from you.
    With that, the hearing is adjourned.
    [Whereupon, at 11:28 a.m., the hearing was adjourned.]
    [Prepared statements, responses to written questions, and 
additional material supplied for the record follow:]
                PREPARED STATEMENT OF LAWRANCE L. EVANS
   Director, Financial Markets and Community Investment, Government 
                         Accountability Office
                           September 12, 2017
                           
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

               RESPONSES TO WRITTEN QUESTIONS OF
            SENATOR MENENDEZ FROM LAWRANCE L. EVANS

Q.1. The Equifax data breach which impacted more than 143 
million U.S. consumers revealed weaknesses in the company's 
data security protocols. In your opinion, do consumer reporting 
agencies have sufficient data security standards and 
infrastructure to effectively protect the sensitive personal 
data they hold? Are there any existing legislative or 
regulatory gaps that contribute to this problem?

A.1. While we cannot opine on the sufficiency of data security 
standards and infrastructure at consumer reporting agencies at 
this time, we are initiating work in response to a request from 
the Ranking Member of the Subcommittee on Financial 
Institutions and Consumer Protection that will allow GAO to 
address these concerns. Based on our existing body of work we 
can comment on infrastructure, data security and the regulatory 
landscape more broadly.
    Regarding oversight of critical infrastructure (which 
includes 16 key sectors, including the financial services 
sector) the National Institute of Standards and Technology 
Cybersecurity Framework is a voluntary standard intended to 
establish a common taxonomy for building cybersecurity 
programs. Outside of that, each industry is driven by its own 
regulatory requirements and Federal/State oversight structures.
    Current regulations impose requirements on financial 
institutions to protect consumer data and these safeguards 
explicitly apply to consumer reporting agencies. Specifically, 
the Gramm-Leach-Bliley (GLB) Act restricts, with some 
exceptions, the disclosure of nonpublic information by 
companies defined under the law as ``financial institutions''. 
The Act also requires the Federal Trade Commission (FTC) and 
certain other Federal agencies to establish standards for 
financial institutions relating to administrative, technical, 
and physical information safeguards. As part of its 
implementation of the GLB Act, the FTC issued the Safeguards 
Rule, which requires financial institutions under FTC 
jurisdiction to have measures in place to secure customer 
information and ensure affiliates and services providers also 
safeguard this information. \1\ The Rule applies to many 
companies of all sizes that are significantly engaged in 
financial products and services, including consumer reporting 
agencies. FTC has also used its statutory authority to address 
unfair and deceptive acts and practices under section 5 of the 
FTC act to enforce data security compliance.
---------------------------------------------------------------------------
     \1\ For additional information on the Rule see https://
www.ftc.gov/tips-advice/business-center/guidance/financial-
institutions-customer-information-complying.
---------------------------------------------------------------------------
    Currently, there is no Federal law that governs breach 
reporting but the prudential banking regulators have issued 
interpretive guidance requiring their regulated institutions to 
report breaches promptly to allow breach victims to take steps 
to protect themselves. Similarly, the Securities and Exchange 
Commission and the Commodity Futures Trading Commission have 
also issued rules that require compliance with the notification 
requirements of GLB Act.
    Moreover, States have varying laws associated with privacy/
data breach notification. It is important to note that the FTC 
Safeguards Rule establishes standards but does not place 
requirements on institutions to notify customers within a 
specified timeframe. \2\ While banks are subject to regular 
examination of their information security practices, the 
nationwide consumer reporting companies (Equifax, TransUnion, 
and Experian) may not receive the same level of supervisory 
scrutiny. The Bureau of Consumer Financial Protection (CFPB) 
has supervisory and enforcement authority over the national 
consumer reporting companies but the extent to which this 
oversight includes regular examinations of information security 
practices will be the subject of future GAO work. CFPB does not 
have authority to enforce the GLB Act's data security 
provisions, but the agency has taken an enforcement action 
under its unfair, deceptive or abusive acts or practices 
authority against a payments company for allegedly deceptive 
statements about data security practices.
---------------------------------------------------------------------------
     \2\ The FTC is seeking comment on the Safeguards Rule, including 
whether the elements of an information security program should include 
a breach response plan. See 81 FR 61,632.
---------------------------------------------------------------------------
                                ------                                


               RESPONSES TO WRITTEN QUESTIONS OF
              SENATOR MENENDEZ FROM ERIC W. TURNER

Q.1. The Federal Deposit Insurance Corporation (FDIC) found 
that in 2013 nearly 30 percent of Americans households were 
``unbanked'' or ``underbanked,'' with the highest rates among 
non-Asian minorities, low income households, and unemployed 
households. What technological advancements in the Fintech 
industry can promote financial inclusion among the ``unbanked'' 
and underbanked''?

A.1. Innovations in financial technology can provide increased 
financial inclusion through the ability to obtain services and 
the use of alternative data sources or underwriting 
methodologies.
    Traditionally consumers have obtained financial services 
from physical branch locations. As banks continue to close 
branches, many consumers have lost access to important 
financial services. U.S. bank branches decreased by 1,981 
locations during the period between June 30, 2016, and June 30, 
2017. As this trend continues, fintech innovations are filling 
the gap by providing traditional banking services such as 
deposit accounts, payments, and lending through digital 
channels.
    Regardless of their location, users can now access these 
services through online or mobile channels. This especially 
benefits people in rural or other areas that have a low number 
of bank branches due to the economics of keeping a physical 
location. Mobile banking technology can also help community 
banks serve more customers even without the extensive branch 
networks of large banks.
    According to a survey fielded by S&P Global Market 
Intelligence earlier this year, 65.5 percent of mobile banking 
users had an annual income of less than $75,000 and 54.2 
percent of users held less than $10,000 in their combined 
checking and savings accounts.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    These statistics are similar to those of mobile payment 
users, who instead of using cash or checks to complete 
transactions rely on mobile applications to do things such as 
pay a bill, send money to another individual, or complete a 
purchase. According to S&P Global Market Intelligence survey 
results, 63.7 percent of mobile payment users had an annual 
income of less than $75,000.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

    In both cases, it is clear that lower income individuals 
have found mobile banking and payment technologies beneficial 
to their financial well being.
    Furthermore, increased access to term loans, as opposed to 
payday loans, can benefit the traditionally unbanked or 
underbanked. Digital lenders rely on mobile or web-based 
platforms and nontraditional underwriting models to deliver 
loans to consumers and small businesses that may otherwise be 
denied credit by traditional banks. Square Capital, for 
instance, sees 54 percent of loans go to women, compared to the 
16 percent quoted by the Small Business Administration. \1\
---------------------------------------------------------------------------
     \1\ https://www.snl.com/web/client?auth=inherit#news/
article?id=42127613&KPLT=6&s_data=si%3D2%26kpa%3D4db0879a-62d3-40e0-
b6fd-9e14f2ab7bee%26sa%3D
---------------------------------------------------------------------------
    Digital lenders offer credit to borrowers based on advanced 
analytics, nontraditional underwriting, and alternative data. 
These platforms leverage quantitative models that look to 
create proprietary credit scores outside of those provided by 
models such as FICO or even Vantage scores. While some 
platforms use inputs from national credit reporting bureaus, 
they may also include alternative data or weight credit factors 
differently than more well known models.
    Alternative data presents the opportunity to gain a more 
holistic view of a borrower. For example, information such as 
utility or rent payments can be included in the underwriting 
decision. For low-income borrowers who may choose to rent 
housing and where utility bills may be a large monthly expense, 
these are important and likely more predictive factors when it 
comes to the ability to repay.
    According to a Federal Reserve research paper published in 
July 2017, alternative data sources allowed borrowers with few 
or inaccurate credit records to access credit. \2\ This report 
further reinforced that these borrowers were from areas that 
lacked access to credit due to low income levels or 
disproportionate branch closings.
---------------------------------------------------------------------------
     \2\ https://www.philadelphiafed.org/-/media/research-and-data/
publications/working-papers/2017/wp17-17.pdf

Q.2. Fintech companies are subject to anti-discrimination laws 
related to the services and products they provide. However, 
there are concerns that using new data and algorithms could 
result in a company unintentionally discriminating against a 
protected group. What steps are companies taking to ensure that 
their services and products do not discriminate against 
---------------------------------------------------------------------------
protected classes?

A.2. The use of new data and algorithms primarily applies to 
providing credit to individuals in the digital lending space. 
These lenders have sought ways to provide credit to previously 
underserved individuals using alternative sets of data. As the 
industry has matured, there have been numerous cases where it 
was decided that some data sets could potentially discriminate 
against protected classes. For example, offering personal loans 
based on the college from which you graduated was largely 
considered a valid input for lenders years ago, but many have 
shifted away from this. Other inputs like social media usage 
were once considered but never ultimately made it into 
underwriting criteria due to similar concerns.
    Digital lenders have made great effort to ensure that 
underwriting algorithms are accurate and provide the best 
financial inclusion possible. In order to ensure that this 
continues, regulators should create a friendly environment for 
innovation. This could be through a regulatory sandbox or 
innovation office. The recent no-action letter from the CPFB to 
personal-focused digital lender Upstart is a good example of 
how regulators can better understand the space. \3\
---------------------------------------------------------------------------
     \3\ https://www.consumerfinance.gov/about-us/newsroom/cfpb-
announces-first-no-action-letter-upstart-network/
---------------------------------------------------------------------------
    Many of the underwriting inputs used by fintech startups 
today are similar to those used by traditional lenders, but in 
cases where alternative data is used, it will be up to the 
lenders and regulators to closely monitor adherence to fair 
lending practices.
    Thank you again for the questions; I hope that our response 
has been useful.
                                ------                                


        RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
                      FROM FRANK PASQUALE

Q.1. Senator Crapo asked about regulatory sandboxes that would 
allow financial technology companies to experiment in real 
markets, and you mentioned some pilot programs have ``proven 
their worth in health care policy.'' Can you describe the types 
of pilot programs that have worked in other sectors; how such 
programs navigated conflicts between State and Federal law; and 
under what parameters or considerations a financial technology 
pilot program would need to operate in order to protect 
consumers and the marketplace?

A.1. Pilot programs can be important tools for gathering data 
necessary to evaluate products and services in various sectors, 
such as the health care and financial sectors. \1\ Regulators 
in these sectors need to understand more fully what technology 
firms are doing and how they are performing to ensure proper 
regulations are in place that safeguard individuals but do not 
stifle innovation; pilot programs can be a tool to do this. 
Effective pilot programs support ``responsible innovation'' and 
provide transparency of process necessary to expose any 
potential pitfalls or unanticipated issues. \2\
---------------------------------------------------------------------------
     \1\ This answer was prepared by Jennifer Smith, Ryan H. Easley 
Research Fellow at the University of Maryland School of Law, after a 
request with initial guidance from Frank Pasquale, the witness. 
Professor Pasquale has reviewed the response and believes it to be a 
fully responsive response to the question.
     \2\ Press Release, Off. Comptroller of the Currency, Dept. of the 
Treasury, ``OCC Issues Responsible Innovation Framework'' (Oct, 26, 
2016), https://www.occ.gov/news-issuances/news-releases/2016/nr-occ-
2016-135.html.
---------------------------------------------------------------------------
    Pilot programs are particularly important in gathering 
information from sectors that are not apt to be transparent 
with data. As in health care, where the average consumer does 
not have the information necessary to `` `second guess' his or 
her [medical] provider about the amount or nature of care 
needed, \3\'' the average consumer does not know how his or her 
financial and personal data is being used, or what data is even 
being mined, in order to make informed decisions and protect 
his or her financial health. Due to this knowledge gap, 
consumers of both health care and financial services depend on 
regulations that are based on a thorough and thoughtful 
understanding of the industry being regulated. Pilot programs 
can provide State and Federal regulators with the data and 
information necessary to formulate thorough and thoughtful 
regulations that do not stifle innovation and protect 
consumers.
---------------------------------------------------------------------------
     \3\ Frank Pasquale, ``Ending the Specialty Hospital Wars: A Plea 
for Pilot Program as Information-Forcing Regulatory Design'', in The 
Fragmentation of U.S. Health Care: Causes and Solutions 235, 272 (Einer 
Elhauge, ed., 2010).
---------------------------------------------------------------------------
    In the health care sector, pilot programs are used to 
promote innovation and test new models of patient care and 
service. Although the health care and financial industries have 
their own unique issues and obstacles, health care pilot 
programs provide lessons that can assist the development and 
implementation of fintech pilots. For a recent example, the 
Food and Drug Administration (FDA) announced the launch of the 
Pre-Cert for Software Pilot Program in July 2017 and in 
September announced the nine companies selected to take part in 
the pilot program. \4\ One of the pilot program goals is to 
``enable [the FDA] to develop a tailored approach toward 
regulating [digital health] technology by looking first at the 
software developer and/or digital health technology developer, 
rather than primarily at the product, which is what [the FDA] 
currently [does] for more traditional medical devices. \5\'' 
Although this pilot program is in the beginning stages, the 
impetus, framework, and eventual outcomes may serve as guidance 
for developing pilot programs for fintech firms and regulators.
---------------------------------------------------------------------------
     \4\ Scott Gottlieb, ``FDA Announces New Steps To Empower Consumers 
and Advance Digital Healthcare'', FDA Voice (July 27, 2017), https://
blogs.fda.gov/fdavoice/index.php/2017/07/fda-announces-new-steps-to-
empower-consumers-and-advance-digital-healthcare/; Press Release, U.S. 
Food & Drug Admin, ``FDA Selected Participants for New Digital Health 
Software Precertification Pilot Program'' (Sept. 26, 2017), https://
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm577480.htm. The 
nine companies selected are Apple, Fitbit, Johnson & Johnson, Pear 
Therapeutics, Phosphorus, Roche, Samsung, Tidepool, and Verily. Id.
     \5\ Digital Health Software Precertification (Precert) Program, 
U.S. Food & Drug Admin. (Sept. 27, 2017), https://www.fda.gov/
MedicalDevices/DigitalHealth/DigitalHealthPreCertProgram/default.htm.
---------------------------------------------------------------------------
    An example of a completed health care pilot program that 
may provide guidance for fintech pilots is a program testing a 
bundled payment model for care. \6\ This program was through 
the Agency for Healthcare Research and Quality (AHRQ) at the 
Department of Health and Human Services (HHS). Some of the 
takeaways that may inform the development and implementation of 
fintech pilot programs are: ensure the number of stakeholders 
and volume of participants are sufficient to provide good data; 
build consensus around key definitions and issues, such as 
assumption of risk; and build trust among participants. 
Additionally, the bundled payment model pilot program faced 
``delays and uncertainty related to State regulations.'' \7\ 
Specifically, California hospitals and health care plans 
participating in the pilot program worried physician payments 
through the bundled payment contracts would violate California 
regulations prohibiting the ``corporate practice of medicine. 
\8\'' In response to this concern a model contract template was 
created and participants in California developed a split-bundle 
model. The ``development and successful deployment of a common 
contracting template that largely satisfied the contracting 
parties and State regulators'' is cited as one of the programs' 
successes. \9\
---------------------------------------------------------------------------
     \6\ In a bundled payment model ``a group of providers receives a 
fixed payment from participating health plans. The payment is designed 
to cover the average cost of a defined `bundle' of services related to 
a procedure or course of treatment.'' M. Susan Ridgely et al., ``The 
IHA Bundled Episode Payment and Gainsharing Demonstration'', AHRQ 
Delivery System Research: Study Snapshot 1 (AHRQ Pub. No. 15-0016-2-EF, 
2015).
     \7\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and 
Gainsharing Demonstration'', AHRQ Delivery System Research: Study 
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
     \8\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and 
Gainsharing Demonstration'', AHRQ Delivery System Research: Study 
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
     \9\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and 
Gainsharing Demonstration'', AHRQ Delivery System Research: Study 
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
---------------------------------------------------------------------------
    In addition to examining domestic pilot programs in various 
sectors, it is informative to look at international regulatory 
sandbox and pilot programs. Internationally, regulatory 
sandboxes/pilot programs are utilized to promote innovation in 
fintech and develop regulations. \10\ The United Kingdom's 
Financial Conduct Authority (FCA) is often cited as a model for 
regulatory sandbox programs. \11\ To date, the FCA has 
completed one cohort of testing, is in the process of testing 
for the second cohort, and is reviewing applications for 
inclusion in cohort three. \12\ Hong Kong also utilizes 
supervisory sandboxes to ``encourag[e] financial institutions 
to make use of Fintech and support[] initiatives that drive 
Fintech adoption and innovation. \13\'' Hong Kong's supervisory 
sandboxes are run through three regulators: the Hong Kong 
Monetary Authority, \14\ the Securities and Futures Commission, 
\15\ and the Insurance Authority. \16\ Additionally, the 
Monetary Authority of Singapore (MAS) supports regulatory 
sandboxes that ``provide appropriate regulatory support by 
relaxing specific legal and regulatory requirements . . . for 
the duration of the sandbox. \17\''
---------------------------------------------------------------------------
     \10\ See Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017); ``Monetary 
Authority Singapore, Fintech Regulatory Sandbox'', http://
www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/
FinTech-Regulatory-Sandbox.aspx (last visited Oct. 3, 2017); Fin. 
Conduct Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8, 
2017), https://www.fca.org.uk/firms/regulatory-sandbox.
     \11\ Stephanie Forshee, ``OCC Has Banking Sandbox-like `Pilot' for 
Fintechs in the Works'', Law.com (Aug. 10, 2017), http://www.law.com/
sites/almstaff/2017/08/10/occ-has-banking-sandbox-like-pilot-for-
fintechs-in-the-works/?slreturn=20170902083457. See also Fin. Conduct 
Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8, 2017), 
https://www.fca.org.uk/firms/regulatory-sandbox.
     \12\ Fin. Conduct Authority (U.K.), ``Financial Conduct Authority 
Provides Update on Regulatory Sandbox'' (June 15, 2017), https://
www.fca.org.uk/news/press-releases/financial-conduct-authority-
provides-update-regulatory-sandbox.
     \13\ Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017).
     \14\ Hong Kong Monetary Authority, ``Fintech Supervisory Sandbox'' 
(FSS) (Sept. 29, 2017), http://www.hkma.gov.hk/eng/key-functions/
international-financial-centre/fintech-supervisory-sandbox.shtml. The 
Hong Kong Monetary Authority operates a Fintech supervisory sandbox for 
``Fintech and other technology initiatives intended to be launched in 
Hong Kong by banks.'' Id.
     \15\ Sec. & Futures Comm'n, ``SFC Regulatory Sandbox'' (Sept. 29, 
2017), http://www.sfc.hk/web/EN/sfc-fintech-contact-point/sfc-
regulatory-sandbox.html. The Securities and Futures Commission operates 
a regulatory sandbox ``to provide a confined regulatory environment for 
qualified firms.'' Id. Qualified firms are ``both licensed corporations 
and start-up firms that intend to carry on a regulated activity under 
the [Securities and Futures Ordinance].'' Id.
     \16\ Ins. Auth. (H.K.), ``Insurtech Corner'', https://
www.ia.org.hk/en/aboutus/insurtech_corner.html (last visited Oct. 3, 
2017). The Insurance Authority's ``Insurtech Sandbox'' was created to 
``facilitate a pilot run of innovative Insurtech applications by 
authorized insurers to be applied in their business operations.'' Id.
     \17\ Monetary Authority Sing., ``Understanding and Applying to the 
Sandbox'', http://www.mas.gov.sg/Singapore-Financial-Centre/Smart-
Financial-Centre/FinTech-Regulatory-Sandbox/Understanding-and-applying-
to-the-sandbox.aspx (last visited Oct. 3, 2017). See also ``Monetary 
Authority Sing., Fintech Regulatory Sandbox Guidelines'' (Nov. 2016), 
http://www.mas.gov.sg//media/Smart%20Financial%20Centre/Sandbox/
FinTech%20Regulatory%20Sandbox%20Guidelines.pdf.
---------------------------------------------------------------------------
    In conclusion, pilot programs can be important tools for 
gathering data necessary to evaluate and refine fintech. 
Regulators need to understand how fintech firms operate and how 
they perform in order to properly regulate fintech and ensure 
innovation is supported and consumers are protected; pilot 
programs can support and advance responsible innovation.
                                ------                                


               RESPONSES TO WRITTEN QUESTIONS OF
              SENATOR MENENDEZ FROM FRANK PASQUALE

Q.1. The Federal Deposit Insurance Corporation (FDIC) found 
that in 2013 nearly 30 percent of Americans households were 
``unbanked'' or ``underbanked,'' with the highest rates among 
non-Asian minorities, low income households, and unemployed 
households. \1\ As new companies begin to market products and 
services to unbanked and underbanked households, what actions 
should Federal or State regulators pursue to ensure that 
consumers receive sufficient protections?
---------------------------------------------------------------------------
     \1\ Fed. Deposit Ins. Corp., ``2013 FDIC National Survey of 
Unbanked and Underbanked Households: Executive Summary'' (2014), 
https://www.fdic.gov/?householdsurvey?/2013??execsumm.pdf.

A.1. Fintech can be a means of building financial inclusion, 
especially for those Americans currently unbanked or 
underbanked; but there must be proper protections to ensure 
consumers are protected and information is obtained and used in 
a secure manner and in a way that does not unintentionally 
discriminate. \2\ Federal and State regulators need to ensure 
consumers are protected from technical and privacy issues we 
know about now, as well as those we have yet to encounter. In 
order to build consumer trust and ensure protections, Federal 
and State regulators can take a number of actions, including: 
addressing regulatory confusions; extending privacy protections 
in other areas of the law to cover consumer data compiled and 
used by data brokers and fintech firms; require data brokers 
register with the Federal Trade Commission (FTC); and empower 
and expand funding to Federal agencies like the Consumer 
Financial Protection Bureau (CFPB) and the Office of Financial 
Research (OFR). But State and Federal regulators should not 
rush to deregulate in order to spur innovation and, further, 
the Federal Government should not preempt State laws aimed at 
protecting consumers, especially the unbanked and underbanked.
---------------------------------------------------------------------------
     \2\ This answer was prepared by Jennifer Smith, Ryan H. Easley 
Research Fellow at the University of Maryland School of Law, after a 
request with initial guidance from Frank Pasquale, the witness. 
Professor Pasquale has reviewed the response and believes it to be a 
fully responsive response to the question.
---------------------------------------------------------------------------
    Consumers encounter confusion regarding regulations of the 
traditional banking sector and fintech sector. For example, Rob 
Nichols, president and chief executive of the American Banker 
Association stated: ``consumers [] face potential confusion 
when dealing with two sectors that have differing regulatory 
regimes'' and Nichols views this confusion as ``leading to gaps 
in consumer protections.'' \3\ As more consumers use fintech 
services regulatory confusion is likely to grow. \4\ Regulatory 
confusion may be particularly acute with the unbanked and 
underbanked, who are more likely to have lower levels of 
education than banked individuals. \5\ Addressing regulatory 
confusion on the State and Federal level is necessary to ensure 
consumers are protected.
---------------------------------------------------------------------------
     \3\ Rob Nichols, ``BankThink: Bank or No Bank, Fintech Must Be 
Regulated'', Am. Banker (Feb. 18, 2016, 9:30 AM), https://
www.americanbanker.com/opinion/bank-or-no-bank-fintech-must-be-
regulated.
     \4\ A recent global survey on fintech adoption by EY found the 
global average of fintech adoption as 33 percent, up from 16 percent in 
2015. EY, ``EY Fintech Adoption Index 2017'' 6 (2017).
     \5\ Fed. Deposit Ins. Corp., ``2015 FDIC National Survey of 
Unbanked and Underbanked Households'' 15-16 (Oct. 20, 2016).
---------------------------------------------------------------------------
    Unbanked and underbanked individuals who may utilize 
fintech services instead of traditional banking services can 
benefit from extension of existing privacy protections. 
Specifically, the Health Insurance Portability and 
Accountability Act (HIPAA) \6\ and the Fair Credit Reporting 
Act \7\ can be modernized to apply to all companies that peddle 
sensitive personal information. For example, HIPAA protections 
do not govern health profiles compiled and traded by data 
brokers and fintech firms. Further, Congress should require 
data brokers to register with the FTC and allow individuals to 
request immediate notification once they have been placed on 
lists that contain sensitive data. In addition to expanding 
already existing regulations, Congress should empower and 
expand funding to Federal agencies, including the CFPB and the 
OFR, to ensure these agencies have the resources necessary to 
come to grips with a rapidly changing financial landscape.
---------------------------------------------------------------------------
     \6\ Health Insurance Portability and Accountability Act of 1996, 
Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered 
sections of 18, 26, 29, and 42 U.S.C.).
     \7\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
---------------------------------------------------------------------------
    Fintech can be a means of opening up the financial industry 
to unbanked and underbanked consumers but Federal and State 
legislatures must be cautious about rushing to deregulate as a 
means of spurring innovation. Some fintech may promote 
competition and create new options for consumers, but it must 
be fair competition. Further, Federal authorities should not 
preempt State law meant to protect consumers. Although 
preemption may be aimed at ensuring financial inclusion and 
innovation, preemption of consumer protections can have 
disastrous unintended consequences, as we saw in the mortgage 
crisis of 2008. \8\ For example, the Office of the Comptroller 
of the Currencys' (OCC) proposed plan to charter fintech 
companies could have unintended consequences, such as enabling 
regulatory arbitrage around State restrictions on pay day 
lending. \9\ Regulatory arbitrage around State restrictions 
could have negative impacts on the unbanked and underbanked 
individuals the OCC is attempting to open the financial 
industry to. \10\
---------------------------------------------------------------------------
     \8\ For a discussion of regulatory arbitrage and opaque business 
practices that sparked the 2008 mortgage crisis, see Frank Pasquale, 
``The Black Box Society'' (2015), specifically Chapters 4 and 5.
     \9\ ``Exploring Special Purpose National Bank Charters for Fintech 
Companies'', Off. Comptroller Currency (Dec. 2016). For comments to the 
OCC's paper, see ``Public Comments On Exploring Special Purpose 
National Bank Charters For Fintech Companies'', Off. Comptroller 
Currency, https://www.occ.gov/topics/responsible-innovation/fintech-
charter-comments.html (last visited Oct. 3, 2017).
     \10\ See Comment, ``New Economy Project on Behalf of Signees, Re: 
Exploring Special Purpose National Bank Charters for Fintech 
Companies'' (Jan. 13, 2017), https://www.occ.gov/topics/responsible-
innovation/comments/comment-new-economy-project-fintech-charters.pdf 
(comment letter from over 200 consumer, civil rights, and community 
groups opposing the proposed OCC nonbank lending charters, stating that 
``[s]tate laws often operate as the primary line of defense for 
consumers and small businesses'' and they ``have also seen costly 
payday lenders hide behind the costume of `fintech.' ''); Comment, 
``Am. For Fin. Reform, Re: Exploring Special Purpose National Bank 
Charters for Fintech Companies'' (Jan. 15, 2017), https://www.occ.gov/
topics/responsible-innovation/comments/comment-americans-for-financial-
reform.pdf (comment letter ``urging the OCC to refrain from issuing 
charters to nondepository fintech lenders'' and explaining a broad 
array of legal and policy issues that could arise); Comment, ``Ctr. For 
Digital Democracy & U.S. Pub. Int. Res, Group, Re: Exploring Special 
Purpose National Bank Charters for Fintech Companies'' (Jan. 15, 2017), 
https://www.occ.gov/topics/responsible-innovation/comments/comment-cdd-
uspirg.pdf (comment letter opposing the proposed OCC nonbank lending 
charters, stating ``lack of transparency around the processing of data 
and automated algorithms may lead to increasing information asymmetries 
between the financial institution and the individual and thus consumers 
are left with less awareness and a lack of understanding and control 
over important financial decisions.'').
---------------------------------------------------------------------------
    It is important to remember consumer protections build 
consumer trust. Consumer trust is an essential factor in 
encouraging the unbanked and underbanked to utilize financial 
services in general. For example, research by the FDIC reveals 
unbanked and underbanked households have limited trust or a 
complete lack of trust in the banking industry, which 
influences how and if they utilize banking or other financial 
services. \11\ Additionally, ``concern over security--real or 
perceived--is one of the most significant barriers to [mobile 
financial services] adoption for consumers.'' \12\ 
Deregulation, even if it is done with the goal of innovation 
and inclusion, can lead to unintended consequences that weaken 
trust in the financial system and eventually lead to more 
unbanked and underbanked Americans.
---------------------------------------------------------------------------
     \11\ Kristopher M. Rengert and Sherrie L.W. Rhine, Fed. Deposit 
Ins. Corp., ``Bank Efforts To Serve Unbanked And Underbanked 
Consumers'' (May 25, 2016), https://www.fdic.gov/consumers/community/
research/qualitativeresearch_may2016.pdf; Fed. Deposit Ins. Corp., 
``2015 FDIC National Survey of Unbanked and Underbanked Households'' 
(Oct. 20, 2016), https://www.fdic.gov/householdsurvey/2015/
2015report.pdf. According to the FDIC 2015 survey of unbanked and 
underbanked households, one in four unbanked households ``do not trust 
banks'' and ``[l]ack of trust in banks was the second most frequently 
cited main reason for being unbanked.'' Id. at 60.
     \12\ Mobil Financial Services, Consumer Fin. Protection Bureau 
(Nov. 2015), http://files.consumerfinance.gov/f/201511_cfpb_mobile-
financial-services.pdf.
---------------------------------------------------------------------------
    In conclusion, fintech can help build financial inclusion, 
especially for the unbanked and underbanked; but there must be 
proper protections to build and sustain consumer trust and 
ensure consumers are protected. Diminishing regulatory 
confusion, extending existing privacy protections, and 
providing resources to agencies to keep abreast of the evolving 
financial sector are all ways Federal and State regulators can 
help protect the unbanked and underbanked and build consumer 
trust. But regulators should not rush to deregulate to spur 
innovation, nor should Federal regulators preempt State laws 
aimed at protecting consumers, especially the unbanked and 
underbanked.

Q.2. Are you concerned that fintech companies' use of new data 
and algorithms could result in unintentional discrimination 
against protected classes under Federal anti-discrimination 
laws? If so, should Congress or Federal regulators consider 
legislation or regulatory guidance to ensure compliance?

A.2. The breadth and scope of data being accumulated and used 
by companies to determine broad aspects of a person's life is 
expanding, often without consumers' knowledge. \13\ Further, 
algorithms utilizing this data are opaque and consumers cannot 
easily determine the types of data being used or if the data is 
correct. The opaque process coupled with more varied datasets 
has the potential to produce ``discriminatory scoring.'' \14\ 
The potential for discriminatory results is especially 
troublesome in the fintech industry, where discrimination, even 
if unintended, can have far reaching financial implications.
---------------------------------------------------------------------------
     \13\ This answer was prepared by Jennifer Smith, Ryan H. Easley 
Research Fellow at the University of Maryland School of Law, after a 
request with initial guidance from Frank Pasquale, the witness. 
Professor Pasquale has reviewed the response and believes it to be a 
fully responsive response to the question.
     \14\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the 
Era of Big Data'', 18 Yale J.L. & Tech. 148, 149 (2017). This article 
is the result of collaboration among lawyers and data scientists on the 
issues of big data's use in credit scoring.
---------------------------------------------------------------------------
    Fintech companies' use of new and nontraditional data and 
algorithms could result in unintentional discrimination against 
protected classes under Federal anti-discrimination laws. A 
firm's best intentions to abide by fair lending, 
nondiscriminatory practices may be usurped by machine learning 
systems that use neutral data but ``treat them as proxies for 
immutable or sensitive characteristics,'' such as gender, race, 
or socioeconomic status. \15\ For example, Penny Crosman, 
Editor at Large at American Banker, recently wrote about the 
potential threats to fair lending by machine learning systems 
and artificial intelligence, stating ``a system that considers 
college data could start recognizing that graduates of a 
particular school are a good credit risk, and those students 
may be from mostly privileged socioeconomic backgrounds.'' \16\ 
Further, Privacy International recently reported on types of 
nontraditional data being used to determine creditworthiness, 
which many consumers may not realize is being accumulated, 
including people's networks on social media, \17\ the manner in 
which a person fills out an online form, \18\ and if a person 
posts about political issues on social media. \19\ As Mikella 
Hurley and Julius Adebayo acknowledge an ``overabundance of 
data points . . . may lead to increased accuracy in the 
modeling, [but] it can also increase the incidence of spurious 
correlations.'' \20\
---------------------------------------------------------------------------
     \15\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the 
Era of Big Data'', 18 Yale J.L. & Tech. 148, 190 (2017).
     \16\ Penny Crosman, ``Is AI a Threat to Fair Lending?'', Am. 
Banker (Sept. 7, 2017, 4:21 PM), https://www.americanbanker.com/news/
is-artificial-intelligence-a-threat-to-fair-lending.
     \17\ ``Case Study: Fintech and the Financial Exploitation of 
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Bethy Hardeman, 
``Lenddo's Social Credit Score: How Who You Know Might Affect Your Next 
Loan'', Huffpost (June 15, 2012, 9:30 AM), http://
www.huffingtonpost.com/bethy-hardeman/lenddos-social-credit-
sco_b_1598026.html (describing Lenddo's use of a person's ``Trusted 
Network'' and an algorithm ``to measure truthfulness, behavioral and 
demographic clues'' to determine if a person qualifies for a loan).
     \18\ ``Case Study: Fintech and the Financial Exploitation of 
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Jeff John Roberts, 
``Bad Credit Is a Bonanza for Online Lender, But Critics Cry Foul'', 
Fortune (July 9, 2015), http://fortune.com/2015/07/09/elevate-online-
loans/ (describing Elevate's tool, Rise, which uses a person's FICO 
score and nontraditional data, such as if ``someone appears too hasty 
to fill out the loan form,'' to assess creditworthiness).
     \19\ ``Case Study: Fintech and the Financial Exploitation of 
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Mugdha Variyar and J. 
Vignesh, ``The New Lending Game, Post-Demonetisation'', Econ. Times: 
Tech. (Jan. 6, 2017, 3:05 PM), http://
tech.economictimes.indiatimes.com/news/technology/the-new-lending-game-
post-demonetisation/56367457 (quoting a lending platform's founder as 
stating ``[i]f someone is politically active and engages in political 
campaigns, which are visible through their social media profiles, it is 
not a good sign.'').
     \20\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the 
Era of Big Data'', 18 Yale J.L. & Tech. 148, 177 (2017).
---------------------------------------------------------------------------
    Congress and regulators need to understand the types of 
data being used by fintech firms as well as how the data is 
being used. Knowledge of what fintech firms are doing is very 
important, especially relating to data collection, data use, 
and security and privacy. Based on this knowledge Congress and 
regulators should develop guidance and/or legislation to ensure 
suspect sources of data are not influencing fintech firms' 
decisions in discriminatory ways. Machine learning and 
predictive analytics are not too complex to regulate. 
Regulations should make firms more accountable. Specifically, 
firms should have ``algorithmic accountability,'' meaning firms 
are transparent with what data is being used and how algorithms 
use the data. \21\ Further, although a computational process 
may be complex, regulators can demand to know what datasets are 
used in the process.
---------------------------------------------------------------------------
     \21\ See Megan Rose Dickey, ``Algorithmic Accountability'', 
Techcrunch (Apr. 30, 2017), https://techcrunch.com/2017/04/30/
algorithmic-accountability/;
---------------------------------------------------------------------------
    Existing privacy protections in other areas of the law can 
and should be extended to cover the consumer data now fueling 
fintech underwriting. Specifically, the Health Insurance 
Portability and Accountability Act (HIPAA) \22\ and the Fair 
Credit Reporting Act \23\ can be modernized to apply to all 
companies that peddle sensitive personal information. For 
example, currently, HIPAA protections do not govern health 
profiles compiled and traded by data brokers and fintech firms. 
A data broker could obtain information concerning a consumer's 
health related purchases, such as diabetic testing strips, 
pregnancy tests, or medications. \24\ This data could create 
``inferences about sensitive consumer preferences and 
characteristics.'' \25\
---------------------------------------------------------------------------
     \22\ Health Insurance Portability and Accountability Act of 1996, 
Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered 
sections of 18, 26, 29, and 42 U.S.C.).
     \23\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
     \24\ See ``Fed. Trade Comm'n, Data Brokers: A Call For 
Transparency And Accountability'' 14 (May 2014).
     \25\ ``Fed. Trade Comm'n, Data Brokers: A Call For Transparency 
And Accountability'' viii (May 2014).
---------------------------------------------------------------------------
    Congress should require data brokers to register with the 
Federal Trade Commission and allow individuals to request 
immediate notification once they have been placed on lists that 
contain sensitive data. Regulations can help make consumers 
aware of the vast information landscape their data is being 
brokered and used in and the potential for unintentional 
discrimination based on this data. Further, consumers should 
have the ability to challenge and amend incorrect data. The 
right to be notified about the use of one's data and the right 
to challenge and correct data errors is fundamental.
    In addition to the above, Congress and Federal regulators 
should empower and expand funding to Federal agencies like the 
Consumer Financial Protection Bureau (CFPB) and the Office of 
Financial Research (OFR). These agencies require the resources 
necessary to come to grips with a rapidly changing financial 
landscape. Empowering and expanding funding will allow the CFPB 
and OFR to develop and implement strategies to ensure 
compliance with Federal anti-discrimination laws and consumer 
protections.
    In conclusion, Fintech companies' use of new and 
nontraditional data and algorithms could result in 
unintentional discrimination against protected classes under 
Federal anti-discrimination laws. Use of expanding and varied 
datasets and new algorithms can be beneficial and may ``force[] 
decisions onto a more reliable empirical foundation by 
formalizing decision-making processes, thus limiting the 
opportunity for individual bias to affect important 
assessments.'' \26\ But there is also the real potential for 
unintentional discrimination. Congress and Federal regulators 
need to understand the types of data being used by fintech 
firms as well as how the data is being used in order to 
determine appropriate regulations that will protect consumers 
from inappropriate and inadvertent discrimination.
---------------------------------------------------------------------------
     \26\ Solon Barocas and Andrew D. Selbst, ``Big Data's Disparate 
Impact'', 104 Cal. L. Rev. 671, 676 (2016).
              
              Additional Material Supplied for the Record
  
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
                         
                         [all]