[Senate Hearing 115-95]
[From the U.S. Government Publishing Office]
S. Hrg. 115-95
EXAMINING THE FINTECH LANDSCAPE
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON
BANKING,HOUSING,AND URBAN AFFAIRS
UNITED STATES SENATE
ONE HUNDRED FIFTEENTH CONGRESS
FIRST SESSION
ON
EXAMINING THE INNOVATIVE TECHNOLOGIES BEING USED TO CHANGE THE WAY
FINANCIAL SERVICES ARE PROVIDED AND THE WAY THE FINANCIAL SYSTEM
OPERATES
__________
SEPTEMBER 12, 2017
__________
Printed for the use of the Committee on Banking, Housing, and Urban
Affairs
Available at: http: //www.fdsys.gov /
__________
U.S. GOVERNMENT PUBLISHING OFFICE
27-749 PDF WASHINGTON : 2017
----------------------------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Publishing Office,
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free).
E-mail, [email protected].
COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS
MIKE CRAPO, Idaho, Chairman
RICHARD C. SHELBY, Alabama SHERROD BROWN, Ohio
BOB CORKER, Tennessee JACK REED, Rhode Island
PATRICK J. TOOMEY, Pennsylvania ROBERT MENENDEZ, New Jersey
DEAN HELLER, Nevada JON TESTER, Montana
TIM SCOTT, South Carolina MARK R. WARNER, Virginia
BEN SASSE, Nebraska ELIZABETH WARREN, Massachusetts
TOM COTTON, Arkansas HEIDI HEITKAMP, North Dakota
MIKE ROUNDS, South Dakota JOE DONNELLY, Indiana
DAVID PERDUE, Georgia BRIAN SCHATZ, Hawaii
THOM TILLIS, North Carolina CHRIS VAN HOLLEN, Maryland
JOHN KENNEDY, Louisiana CATHERINE CORTEZ MASTO, Nevada
Gregg Richard, Staff Director
Mark Powden, Democratic Staff Director
Elad Roisman, Chief Counsel
Travis Hill, Senior Counsel
Kristine Johnson, Professional Staff Member
Elisha Tuku, Democratic Chief Counsel
Laura Swanson, Democratic Deputy Staff Director
Phil Rudd, Democratic Legislative Assistant
Dawn Ratliff, Chief Clerk
Cameron Ricker, Hearing Clerk
Shelvin Simmons, IT Director
Jim Crowell, Editor
(ii)
C O N T E N T S
----------
TUESDAY, SEPTEMBER 12, 2017
Page
Opening statement of Chairman Crapo.............................. 1
Opening statements, comments, or prepared statements of:
Senator Brown................................................ 2
WITNESSES
Lawrance L. Evans, Director, Financial Markets and Community
Investment, Government Accountability Office................... 4
Prepared statement........................................... 30
Responses to written questions of:
Senator Menendez......................................... 82
Eric W. Turner, Financial Technology Research Analyst, S&P Global
Market Intelligence............................................ 6
Prepared statement........................................... 48
Responses to written questions of:
Senator Menendez......................................... 83
Frank Pasquale, Professor of Law, University of Maryland Francis
King Carey School of Law....................................... 7
Prepared statement........................................... 66
Responses to written questions of:
Senator Brown............................................ 87
Senator Menendez......................................... 90
Additional Material Supplied for the Record
Statement submitted by the Independent Community Bankers of
America........................................................ 95
Letter submitted by the Electronic Privacy Information Center.... 97
Letter submitted by the Milken Institute Center for Financial
Markets........................................................ 100
(iii)
EXAMINING THE FINTECH LANDSCAPE
----------
TUESDAY, SEPTEMBER 12, 2017
U.S. Senate,
Committee on Banking, Housing, and Urban Affairs,
Washington, DC.
The Committee met at 10:02 a.m., in room SD-538, Dirksen
Senate Office Building, Hon. Mike Crapo, Chairman of the
Committee, presiding.
OPENING STATEMENT OF CHAIRMAN MIKE CRAPO
Chairman Crapo. The Committee will come to order.
Before we proceed with the hearing today, I wanted to just
indicate that last night the Senate passed six securities bills
that we marked up earlier this year, bills that will improve
economic growth and investor protections. And I want to thank
you, Senator Brown, for working with me to get these bills
through the Committee, and thanks to all of the Committee for
your work in getting these pieces of legislation through the
Senate.
These bills were introduced in past Congresses with broad
bipartisan support, with the House most recently passing
similar bills last spring. And I want to thank our colleagues
on the House Financial Services Committee for their work on
this as well. I look forward to seeing these bills signed into
law.
Senator Brown. Could I say a word now?
Chairman Crapo. Yes.
Senator Brown. Thank you, Mr. Chairman, for your
partnership on these bills to improve the securities markets
and investor protections. I am pleased they passed the Senate
last night as well. I thank the members of this Committee and
others in the Senate especially for their work on this bill,
Senators Heller and Peters, off the Committee; Senators
Heitkamp, who is here, and Toomey on the Committee, and
Donnelly, also on the Committee, Menendez, Hatch, Warner, and
Tillis, and others on this Committee for moving the bill
forward.
Thank you, Mr. Chairman.
Chairman Crapo. Thank you.
This morning, we will receive testimony on the growing
financial technology, or fintech, industry. Fintech is
providing new and innovative products and services in areas
such as marketplace lending, digital payments and currencies,
wealth management, insurance, and more.
Technological innovation has brought about improvements in
virtually every sector of the economy, and the financial sector
is no exception. Technology advances are nothing new to the
financial world; inventions such as the ATM and the credit card
led to significant improvements in consumer welfare.
Today new innovations by fintech companies have similar
potential to make financial services faster, cheaper, and more
accessible. For example, marketplace lending has the potential
to expand the availability of credit to consumers and small
businesses at lower costs.
In particular, with the use of alternative data and
technology, the business models of marketplace lenders may
enable them to reach underbanked populations. Innovations in
the payments space can offer enhanced speed, convenience, and
efficiency in transactions.
Fintech startups are not the only ones embracing this
opportunity and responding to changing consumer demand.
Traditional banks and other established financial institutions
are increasingly participating in the fintech space through
partnerships, incubators, investments, and more.
Fintech firms may also reap the mutual benefits of
partnering with banks who have well-established operations and
comparative advantages in certain areas. But with all the
potential for fintech to improve the financial services sector,
the industry is still relatively new.
Uncertainty remains around questions like data security and
the proper regulatory treatment to ensure that consumers and
the financial system are safeguarded. The recent Equifax data
breach reminds us of the critical need to ensure that areas
like cyber and data security are given the proper attention.
The tremendous growth in this sector over the past few
years has gained the attention of market participants,
regulators, and other stakeholders. The OCC, for example, has a
proposal to provide special purpose national bank charters for
fintech companies.
Other Governments are exploring options such as a
regulatory sandbox approach that encourages innovation by
allowing firms to test products and services in a supervised
environment.
In response to this Committee's call for economic growth
proposals, we received a number of fintech-related submissions
that will also help us as we think about these issues.
Today I look forward to learning more about the
opportunities fintech may bring, the various ways fintech is
interacting with and impacting the financial system, and the
current regulatory supervision of the fintech industry.
Senator Brown.
STATEMENT OF SENATOR SHERROD BROWN
Senator Brown. Thank you, Mr. Chairman. I appreciate your
holding this hearing on financial technology. It has been too
long since our Committee considered this important topic. I do
not think any of us knew how timely this hearing would be until
we got news of the Equifax data breach, apparently after some
executives at Equifax also knew, although they deny that was
the case.
While financial technology covers many different
activities, all of those activities rely on the responsible use
and careful protection of data.
In the case of Equifax, that did not happen. Americans are
now forced to worry whether the information that hackers stole
will have lasting impacts, from outright theft to damaged
credit. We just cannot cancel a credit card to fix this
problem. Equifax has let criminals get their hands on the most
private and valuable pieces of millions of Americans' financial
identities.
Credit reports also include other deeply personal
information. A history of our medical debt can reveal
information we do not share with anyone but our doctors and
families.
More and more, new financial technologies rely on the
collection of vast troves of data no longer limited to our
financial transactions. Data aggregators collect information
regarding our associates, what kind of products we buy, and
maybe even how often we check Facebook.
The collection and use of this alternative data may promise
some benefits by providing access to credit for people in
communities that traditional lenders overlook. But as recent
data breaches have shown, the risks are clear and substantial.
It will take us a long time to assess the impact of the
Equifax data breach on 143 million Americans. Businesses,
consumers, and Government watchdogs will have to be even more
vigilant about identifying fraud, possibly making it harder for
Americans to get access to credit.
It is bad enough that the Equifax breach included important
personally identifiable information--names, dates of birth,
Social Security numbers, addresses, and credit card numbers--
the building blocks for your financial identity. Future
breaches at firms that use alternative data might include far
more personal information with far-reaching consequences.
Today I want to hear how we can improve Federal oversight
of data collection and data security to protect working
American families. I hope we can work together to make sure
companies that use our private data are held accountable for
its protection.
If a college student in Columbus misses a credit card
payment or a family in Toledo is forced into bankruptcy because
of medical debt, Equifax would undoubtedly ding their credit
scores. So now that this breach has left millions of people
vulnerable to criminals, what should be done to hold Equifax
accountable?
At a minimum, customers should have the right to use the
court system to help make them whole. That is why I appreciate,
under apparently some public pressure, Equifax answered my
call, and that of others on the Committee, to remove forced
arbitration clauses from its free credit monitoring product.
This is a step in the right direction, but customers cannot
be sure their rights are truly protected until Equifax makes
this policy clear for all products and on all of its websites.
One year of credit monitoring cannot be expected to undo
the damage of this breach. After the 2015 breach of the Office
of Personnel Management put information of Government employees
at risk, this body passed 10 years of free credit monitoring.
We cannot accept any less for the people we serve.
Today's hearing is focused on new products and markets. I
am interested in how Congress can encourage fintech innovation
to make it easier for community banks to serve their customers,
to comply with important safety and soundness and anti-money-
laundering rules.
If we can encourage banks to partner with each other or
innovative startups, we may be able to cut down on red tape
without exposing consumers or the financial system to
additional risk.
I am also interested in how these new technologies can help
Americans who are currently underserved by the traditional
banking system. We have already seen how mobile payments have
expanded access for many to the financial system, both at home
and abroad. But we need to fully understand the risks and
ensure that oversight gaps do not exist for bad actors to
exploit American customers.
I thank the witnesses for joining us.
Chairman Crapo. Thank you, Senator Brown. We will now move
to our witnesses.
First we will hear testimony from Mr. Lawrance Evans,
Director of Financial Markets at the U.S. Government
Accountability Office.
Then we will hear testimony from Mr. Eric Turner, research
analyst at S&P Global Market Intelligence.
And then, finally, we will hear testimony from Mr. Frank
Pasquale, professor of law at the University of Maryland
Francis King Carey School of Law.
I would remind each of our witnesses that your full
testimony has been made a part of the record. We ask you to
limit your presentation orally to 5 minutes. There will be
plenty of opportunity for further follow-up with questions from
the Committee.
With that, Mr. Evans.
STATEMENT OF LAWRANCE L. EVANS, DIRECTOR, FINANCIAL MARKETS AND
COMMUNITY INVESTMENT, GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Evans. Thank you very much, Mr. Chairman. I am pleased
to appear before you, Ranking Member Brown, and the other
Members of the Committee to discuss the fintech landscape,
which currently finds a number of potentially disruptive and
foundational technologies, and innovative firms that are
transforming the financial industry. Calling this hearing
represents the type of forward thinking that is essential to
effectively harnessing the opportunities these developments
bring.
My testimony today is based on our April 2017 report
produced as a partial response to a request from the Ranking
Member and others. The report covers a high-level look at four
commonly referenced fintech subsectors: marketplace lending,
mobile payments, digital wealth management, and distributive
ledger technology, which I will refer to as ``DLT.'' While this
report is largely based on secondary sources, we are able to
glean some useful findings and observations for consideration.
Considering the benefits, our sources suggest that
technological innovation is occurring throughout the financial
ecosystem, driven by large technology firms and smaller
technology-driven new entrants known as ``fintechs'' or
``fintech firms.'' One of the primary potential benefits
include expanded access to financial services.
For example, digital wealth platforms, which rely on data-
driven algorithms and minimize human interaction, provide
services to a class of investors previously frozen out of
traditional wealth management. Other potential benefits include
convenience, speed, and lower costs across a range of financial
services.
On the flip side, new technologies and new entrants into
the financial services industry, while bringing much needed
innovation, bring potential risk. For example, the data-driven
algorithms marketplace lenders rely on to assess
creditworthiness and underwrite loans raise concerns about the
use of nontraditional data and the risk for potential fair
lending violations. Moreover, data security and privacy risks
may exist with these newer technologies.
It is important to note that these concerns are real, but
they are not unique to these innovations. And there are also
features in mobile payments in DLT that may produce benefits in
the area of data security. Losing sight of the benefits and
overreacting to risk could stifle financial inclusion and much
needed innovation in the area of payments, value transfer, and
recordkeeping. Therein lies the great challenge for
policymakers and regulators. There is always a need to manage
the risk-reward balance of innovation; that is, managing risk
without stifling innovation, ensuring consistent regulation and
a level playing field, and encouraging socially beneficial
innovation without picking winners or losers.
On the one hand, advances in technology are occurring in a
heavily regulated and mature financial ecosystem. On the other
hand, the financial regulatory structure in the U.S. is
complex, with responsibilities fragmented among multiple
Federal and State agencies that have overlapping authorities.
This has raised concerns about gaps in coverage, inconsistent
regulation, compliance challenges for new and incumbent firms,
and whether the existing regulatory framework might slow or
otherwise harm innovation.
As you know, there are a number of issues being considered
today that will impact the regulatory landscape going forward,
such as the appropriate charter type for fintech firms
conducting bank-like activities. It will be important to
carefully sort through the various competing interests to
settle on a regulatory framework that is truly in the public
interest.
Putting the public first and developing a regulatory
framework that is best positioned to achieve it is essential to
getting the risk-reward balance of innovation correct. As one
Federal Reserve official recently noted, ``it would be a lost
opportunity if instead of expanding access in a socially
beneficial way, some fintech products merely provided a vehicle
to market high-cost loans to the underserved, exacerbating
rather than ameliorating financial access inequalities.''
Similarly, it would also be unfortunate if the regulatory
framework served as a barrier to entry to innovative firms with
socially beneficial products. GAO is currently undertaking work
that will support congressional efforts to strike the
appropriate balance in this area.
Chairman Crapo, Ranking Member Brown, and Members of the
Committee, this concludes my prepared statement. I look forward
to questions and further dialog.
Chairman Crapo. Thank you, Mr. Evans.
Mr. Turner.
STATEMENT OF ERIC W. TURNER, FINANCIAL TECHNOLOGY RESEARCH
ANALYST, S&P GLOBAL MARKET INTELLIGENCE
Mr. Turner. Thank you, Chairman Crapo, Ranking Member
Brown, Members of the Committee. Good morning, and thank you
for inviting me to testify today. My name is Eric Turner, and I
am a research analyst with S&P Global Market Intelligence,
where I cover financial technology.
S&P Global Market Intelligence is a division of S&P Global.
We provide actionable intelligence on the global financial
markets and the companies and industries that comprise those
markets. We support economic growth by providing market- and
sector-specific data, news, and research to help investors
identify opportunities and manage risk when providing financing
to businesses and job creators. S&P Global Market Intelligence
closely follows the fintech sector, which we view as pivotal to
economic growth and innovation.
Financial institutions have long used technology, but
startups have broken new ground during the past decade. These
companies have created what we know as fintech today.
Leveraging advances in technology and the ubiquity of the
Internet, these companies offer new and cutting-edge financial
products. Expansive data sets, advanced analytics, and
automation have made accessing financial services faster and
less expensive for millions of people.
Incumbent institutions are increasingly looking to fintechs
not as competitors but as partners for improving operations and
reaching new consumers.
Through our research, we have identified five key areas
that impact consumers in the financial industry today. These
include digital lending, mobile payments, digital investment
management, insurance technology, and distributed ledger
technology, which includes blockchain. These innovations
present enormous opportunities to consumers accompanied by
unique challenges in implementation.
Digital lending has increased access to credit and made
borrowing more efficient. Automation and a lack of physical
offices allow digital lenders to reduce processing time and
costs. This allows them to offer competitive rates, potentially
saving borrowers thousands of dollars in interest, while small
businesses seeking access to working capital are able to obtain
funds much more quickly.
Mobile payments services are used by millions of consumers
because they reduce transaction costs and frictions, while
offering an enhanced user experience. For international
transfers, specialized peer-to-peer apps charge low fees for
the conversion and transfer of funds across borders and
currencies. This benefits underbanked and immigrant
communities.
Mobile wallets create more secure transactions by
preventing fraudsters from skimming card data or stealing PIN
information. Additional features, like biometric and two-factor
authentication, have further enhanced security.
Digital investment management has given retail investors
new access to professional investment services, and insurance
technology has made it easier and more affordable to protect
against risk. If implemented properly, distributed ledger
technology, including blockchain, will revolutionize many parts
of our financial system, reducing costs and settlement times
while enhancing transparency.
Despite the benefits discussed today, the industry is still
young and challenges remain. Regulation has been unevenly
applied to the sector, and in many ways the introduction of a
clear regulatory framework could help boost innovation. This
may require firms to define their stake in the financial system
and could lead to technology-only platforms exiting certain
lines of business like lending. Overall, this will lead to a
more fair and defined playing field for startups and incumbents
alike.
Issues such cybersecurity, data ownership, and data privacy
are important not just to fintechs but to the financial
industry as a whole. Clear standards and regulation can provide
clarity in these areas as well. Understanding the fintech
landscape as well as the benefits and challenges presented by
this growing industry can help shape a clear framework for
responsible innovation.
Thank you again for inviting me to testify, and I would be
happy to answer any questions for the Committee.
Chairman Crapo. Thank you, Mr. Turner.
Mr. Pasquale.
STATEMENT OF FRANK PASQUALE, PROFESSOR OF LAW, UNIVERSITY OF
MARYLAND FRANCIS KING CAREY SCHOOL OF LAW
Mr. Pasquale. Chairman Crapo, Ranking Member Brown, and
distinguished Members of this Committee, thank you for the
opportunity to testify today. My name is Frank Pasquale, and I
am a professor of law at the University of Maryland.
The financial technology, or fintech, landscape ranges from
the very simple to the tremendously complex. Regulators at the
OCC's Office of Innovation and the CFPB's Project Catalyst are
energetically helping entrepreneurs to comply with existing
consumer protections and other Federal mandates. Fintech may
promote competition and create new options for consumers, but
we should ensure that it is fair competition and that these
options do not have hidden pitfalls.
In my research on the finance and Internet sectors over the
past decade, I have explored patterns of regulatory arbitrage
and opaque business practices that sparked the mortgage crisis
of 2008. I am afraid I see some similar themes emerging today.
In the run-up to the crisis, Federal authorities preempted
State law meant to protect consumer borrowers. Their stated aim
was to ensure financial inclusion and innovation, but the
unintended consequences were disastrous. Federal authorities
were not adequately staffed to monitor, let alone deter or
punish, widespread fraudulent practices. They also flattened
diverse State policies into a one-size-fits-all, cookie-cutter
approach. We all know the results. Millions of families lost
their homes to foreclosure, and the economy suffered a
permanent output gap.
That history should make us cautious about legislative or
regulatory efforts to federally preempt State laws now applying
to fintech. Why should consumers lose important protections
provided by their own States simply because they engage with
fintech firms? Think, for instance, of restrictions on payday
lending. As the New Economy Project and hundreds of community,
labor, military, and veterans groups have argued earlier this
year, 90 million Americans live in jurisdictions where payday
lending is illegal. These State laws help consumers save
billions of dollars each year in predatory payday loan fees
that could trap people in long-term devastating cycles of debt.
OCC should not strip these consumers of these protections.
Advocates for deregulation will likely argue that imposing
a level playing field on fintech and non-fintech firms might
harm innovation in the fintech sector. But innovation is not
good in itself. The toxic assets at the core of the financial
crisis were innovative in many ways, but ultimately posed
unacceptable risks.
Promoters of fintech deregulation may claim that such
worries are anecdotal. But many tech firms prevent more robust
analysis as they obscure what we know about the sector. As I
explain in my book ``The Black Box Society'', aggressive
assertion of trade secrecy claims--both about data collection
and use, and the algorithms used to make judgments about us--
keep regulators and legislators in the dark about the full
range of risks in finance in general and fintech in particular.
A key message I hope to convey to the Committee today is to
empower agencies like CFPB and OFR and to expand their funding
as they try to come to grips with a rapidly financial
landscape.
Data gathering is important because nearly every story of
technologized ``financial inclusion'' can be countered with
other stories of exclusion, via digital redlining. As Cathy
O'Neil's book ``Weapons of Math Destruction'' shows, consumers
often are in the dark about what new algorithms are judging
them and how they can respond if they think they have been
treated unfairly. Regulators must more full understand what
firms are doing and how they are performing. Moreover, as the
recent Equifax hack shows, concentration of information in
almost any firm creates great risks to consumers. Improving
financial cybersecurity should be an essential goal in fintech
policy, and I applaud the GAO for highlighting security issues
in its report, as well as proposals by Senator Reed to require
cybersecurity expertise at large firms.
We should not have faith that accelerated deregulation will
free the financial sector to solve important social problems.
There is a difference between exploiting an existing problem in
credit provision and addressing the root causes. For example,
if fintechs can make hefty profits by refinancing student debts
owed to the U.S. Government, perhaps that is less an indication
of fintechs' business prowess than it is evidence that the
Government is overcharging students for loans. If consumers are
desperate for marketplace lending to cover next month's utility
bills, maybe we need to ensure work pays more fairly. I am
confident that a system of postal banking would do far more
than the fintech sector to ensure financial inclusion to
millions of Americans without adequate access to deposit
accounts, as Mehrsa Baradaran has helped prove in her book
``How the Other Half Banks''.
In conclusion, fintech should not be an excuse for
stripping safeguards from consumers. We need far more
information about how fintech firms are gathering, processing,
and protecting data. And we should be wary about the ability of
technology alone to solve much larger social problems of
financial inclusion, opportunity, and nondiscriminatory credit
provision.
Thank you for the opportunity to testify today.
Chairman Crapo. Thank you, Mr. Pasquale.
This is a question for the entire panel, so I would like to
ask you to each be brief in your responses. But could each of
you discuss, as we move forward, what are some of the most
significant risks that we should evaluate? And in your
response, if you have an opinion on whether there should be a
specific charter for fintech companies separate from other
types of charters that we deal with in a regulatory context, I
would appreciate your thoughts on that. Mr. Evans.
Mr. Evans. So I think you see many of the risks that are
commonly witnessed when you think about innovation, and there
is, I think, a disconnect between the ``move fast and break
things'' approach that you might see in the technology industry
with the more conservative approach in the banking industry.
And so I think there could be some significant compliance
challenges going forward as they grapple with the various rules
and regulations that are in place.
I will punt on the issue of a Federal or a State charter. I
know it is a critical issue. There are pros and cons on both
sides, and I think other witnesses might----
Chairman Crapo. I figured you might pass on that part of
it.
Mr. Turner.
Mr. Turner. Thanks, Senator. I think as you mentioned,
probably the biggest risk right now is a fractured regulatory
system. I think when people look at fintech companies, they
kind of assume that, you know, when you hear things like
regulatory arbitrage and lack of regulation, that these
companies are operating, you know, like it is the Wild West.
And that is really not the case. These companies have looked
for regulation wherever they can, and right now it seems that
they are just trying to fit themselves into a system that was
not made for them.
Chairman Crapo. Thank you.
Mr. Pasquale.
Mr. Pasquale. Yes, thank you, Senator. I would cite
problems in three areas, one being an area of opaque algorithms
being used to assess credit. I think that we are entering into
a new world, and we do not quite understand fully how many
different types of data sources could enter into, say, emerging
credit decision making. And I give some examples in my written
testimony of how fintech firms, say, outside of the U.S. have
used some types of data that might be troubling, I think, to
people, like political activity or other issues like that.
I would also say that with respect to looking at the 2016
Fed survey on small business credit, the Fed found that there
were lots of small businesses that distrusted fintech firms
more than they distrusted small banks, or even large banks.
With respect to high interest rates, they felt they were being
overcharged, and I think that that highlights some concerns
about the potential overextension of credit into, say, marginal
communities or into marginal business opportunities.
And I would finally highlight the cybersecurity concerns
because I do think that as more and more--even Jamie Dimon and
other folks were sort of concerned about consumers sharing too
much of their data with unvetted apps.
Chairman Crapo. Thank you very much.
Mr. Turner, in the United Kingdom, the Financial Conduct
Authority has implemented a regulatory sandbox that allows
firms to operate on a limited basis to test different ideas
while under the FCA's supervision, but without needing to
comply with the full regulatory enforcement regime. Could you
just discuss your thoughts on whether that is a good idea or
something that we should possibly pursue here?
Mr. Turner. Yes. Thanks, Senator. So just a little
background. Whenever I speak to somebody in the industry, you
know, they do say that the U.S. is pretty far behind on this,
and there are other countries with these regulatory sandboxes
that are beating us in innovation. And I think as we look at
some sort of specific regulatory framework, a sandbox not only
will let fintechs continue to innovate, but it will also give
regulators a way to actually test new ideas and learn a little
bit more about the process.
Chairman Crapo. Thank you.
Mr. Pasquale, do you have a thought on the sandbox
approach?
Mr. Pasquale. You know, I have written in the past in favor
of pilot programs, and I think that they have proven their
worth in some areas, for example, in health care policy. And I
think that a very--we would have to do a very careful
assessment of it, but there may be some promise there in terms
of experimenting to learn more about exactly how this
innovation might play out in certain contexts.
Chairman Crapo. Thank you.
Mr. Evans, do you have anything to add?
Mr. Evans. We have a report that will be released in the
winter of 2018 that actually looks at various regulatory
approaches to fintech. And, in fact, our teams have traveled to
Singapore, U.K., and Hong Kong and will be reporting out on
ones that we think are more applicable to the United States.
It is important to point out that the CFPB does have
Project Catalyst, which allows fintech firms to pilot
innovations that are deemed consumer-friendly.
Chairman Crapo. Thank you.
Senator Brown.
Senator Brown. Thank you, Mr. Chairman. Thank you to all
three of you for joining us.
Professor Pasquale, the Equifax breach showed why CFPB's
arbitration rule is so important. Had it not been for sharp-
eyed consumer advocates and lots of public pressure, millions
of scared consumers may have accidentally signed away their
right to a day in court. But Americans should not have to go to
court to defend themselves from companies that never got
permission to collect their data. Big companies like Equifax
got to hold Americans accountable for mistakes of every size.
Now that this breach has left 143 million people around our
country vulnerable to criminals, what should the Government do
to hold them accountable at this point?
Mr. Pasquale. So I think that this breach really ought to
be a watershed and that we ought to really reconceive how we
regulate this area. I think existing approaches are failing. I
know that the Federal Trade Commission and the SEC are trying
very hard with existing approaches, but I do not think they are
really protecting people.
And what I like to analogize the situation to is if you
have a doctor, for example, in a State that repeatedly commits
malpractice, they lose their license. If you have a lawyer
that, you know, shirks duties to clients, et cetera, they will
lose their license. And I think we really have to think
seriously about licensing certain entities, as we do at the
corporate level, with respect to the consumer finance
information because we have seen so many instances of failure
here. And I think repeated instances of failure should lead to
a revocation of such a license. But I know that is a long way
off.
Senator Brown. Thank you.
Mr. Turner, the Equifax breach exposed, as we have said
repeatedly, 143 million Americans' financial data to potential
fraudsters. Do you have an opinion as a market analyst on what
its impact may be for the broader economy when this happens?
Mr. Turner. I do not have an exact opinion related to this
case. I think when you look at cybersecurity, you need to look
at a few factors. You know, it is not only the technology that
actually is in place to protect against a breach, but also a
culture around compliance. So I think if we did have some sort
of nationwide standard around cybersecurity, we could prevent
instances like this in the future.
Senator Brown. So because this has been so front and center
in the Nation's media and people are increasingly concerned and
in some cases have a pretty good belief that they were
breached, does this make consumers less likely to give their
data to new fintech platforms? Will established banks and
financial firms think twice before partnering with a fintech
and sharing their consumer data? Take that out and its impact
on the economy that way, answer that directly, and then in a
broader way, its impact on the economy through those portals,
if you will.
Mr. Turner. Yeah, so I think that fintech companies in
general are pretty advanced when it comes to cybersecurity. I
think if you look at, as I mentioned, culture, the cultures are
all really based around the technology. People are very aware
of the risks. And in many cases, these companies actually just
use an API to get information from a bank that has created this
data trail in the past.
So I think maybe a more important question needs to be when
we create data, whether it is financial transactions, whatever
it may be, who owns that data? Is it the consumer that owns
that data or is it the institution that created it? And should
consumers have the ability to own their data and only display
it when it is actually needed?
Senator Brown. So what happens if banks decide that they
just do not want to partner with a fintech and share this data?
Understanding what you just said, but what happens then?
Mr. Turner. Yeah, I think that has actually been an area of
concern because there has been some back and forth between
large banks and fintechs. And I think that depending on the
platform and the implementation, you know, if you look at a
company that needs your bank account information in order to
process payments or needs access to, you know, your bank
account, those companies will not exist and that innovation
will go away if there is not some sort of agreement on how to
share data.
Senator Brown. OK. Mr. Evans, under Section 1033 of Dodd-
Frank, the CFPB is ordered to create rules granting consumers
more control over their financial data. The law specifically,
as I think you know, exempts sharing data about algorithms or
other methods companies use to create risk scores or make other
predictions about a consumer's financial performance. Should
these algorithms be exempt?
Mr. Evans. That is a tough question because, on the one
hand, these algorithms might represent proprietary information
that gives institutions their advantage in whatever space they
are operating.
On the other hand, these algorithms and the use of
nontraditional data could be important in determining whether
or not a person gets credit or not, and we do not have a lot of
information about the algorithms.
I think one of the critical issues, though, is that this
aggregation of information fuels some of the novel fintech
approaches. For example, it is based on the aggregation of
accounts across an individual's life to give a holistic picture
of what the financial situation is.
If knowledge of the algorithm has a chilling effect on
that, that could be problematic for some models. So it is
tough, Senator Brown. It could go both ways.
Senator Brown. But it is pretty hard to argue, in light of
the data breach, that consumers should not know exactly how
their data is being used.
Mr. Evans. Absolutely.
Senator Brown. All right. Thank you.
Chairman Crapo. Senator Perdue.
Senator Perdue. Mr. Evans, this is off point, but would you
agree the same thing applies to the CFPB?
Mr. Evans. Could you clarify, Senator?
Senator Perdue. That the data that the CFPB is collecting
should meet the same standards of the data that we are talking
about here?
I will withdraw the question. I have got a more relevant
question.
Mr. Evans. OK. Thank you.
Senator Perdue. We will talk offline about that.
Mr. Evans. OK.
Senator Perdue. I am concerned about the fact that this
area has no borders. Forty-seven percent of all global online
transactions, retail transactions, are made in China, are from
China, and 40 percent of all Chinese consumers are using new
payment systems like we are talking about today. They are
talking about WeChat, Ant Financial, and others. This is a very
rapidly growing sector over there, and I am very concerned that
we have our regulatory environment here, but we have a lot of
transactions going on around the world that come and go across
borders.
What recommendations, given the global impact--and I would
like all three of you to comment on it. What do you recommend
that we--what should we be doing here to get ahead of this?
Mr. Evans. Excellent question, and I think it goes back to
something Eric pointed out before and we have pointed out in
this report, that our regulatory system in the United States is
quite fragmented. It could stifle innovation to some degree.
And so that should be job number one for Congress and
regulators, to make sure we have the right regulatory framework
given these novel approaches being taken across the financial
landscape.
Senator Perdue. Mr. Turner.
Mr. Turner. Thank you, Senator, and I think I just want to
clarify something here. When you look at China, you know, in
some ways we actually are at a disadvantage because we are so
advanced in our financial system. They are coming into a time
where they did not have a lot of the infrastructure we have, so
if you look at--you mentioned WeChat and payment systems like
that. It is because there was not a robust card network
presence or an ACH system like we have. So if you look at what
we have in terms of peer-to-peer payment systems, global
payment systems, those for the most part actually still, you
know, as you would say, ride the rails. They still process
through the same systems of the large card networks or ACH. I
think that, you know, that is going back to regulation because
these payment companies know that they are doing--they are
complying with the way things need to be done. They are using
systems that are in place. So, you know, I think as everybody
has mentioned, if we want to push that innovation forward and
you want to see us on par with, you know, the innovation in
China or something like that, there just needs to be more
clarity on where fintechs can go. So if that is a regulatory
sandbox or some sort of specific regulatory framework, I am not
sure, but it is going to be something like that.
Senator Perdue. Dr. Pasquale.
Mr. Pasquale. Yes, I think you are absolutely right,
Senator, to point to China as a place where there is a great
deal of innovation here. It is very cutting edge. I remember
Connie Chung's piece for a16z on WeChat and describing just how
many things you can do within the app. And I am sure that
consumers would find it extremely convenient. And global
cooperation among regulators could enable similar types of apps
to arise in the U.S.
My only caution would be that I think looking at some of
the literature on the Chinese social credit scoring system,
which I cite in my written testimony, I do have concerns that
the integration of information across so many sectors into one
app could raise both concerns about competition and about
privacy. So I think we should work with global regulators, but
we should be cognizant of some of the risks.
Senator Perdue. Mr. Turner, in the time remaining, talk to
us about tokenization. Is this a way of the future relative to
EMV chips and PIN efforts right now in terms of privatization
and security of data?
Mr. Turner. Yeah, I think we are seeing--you know, again,
this is kind of an area where the U.S. is catching up on a lot
of this. If you look at the U.K., the most popular form of
payment is contactless card payments. So, you know, we are just
getting to the point where we are upgrading to EMV systems, and
there is no doubt that those are more secure than what we had
with magnetic strips.
I think that, you know, if we continue to see growth in
payments being moved outside of the traditional network, so as
we see cards go away, as we see cash go away, you know,
tokenization will be how everything is processed, and that will
either be with our mobile wallets, if we are doing some sort of
contactless transaction in a store, or if we are sending
payments person to person.
Senator Perdue. Do you see this as a rising capability that
makes some of--well, let us just say the terrorist network in
terms of shadow banking and so forth. I mean, we have heard
testimony here in other committees about that. Do you have any
insights into that?
Mr. Turner. Really, I think that as we continue to have
growth in digital payments, a lot of people do not realize that
is probably good for controlling things like AML, anti-money-
laundering. I think that it creates an audit trail, and as we
see things like blockchain technology start to take off, you
know, those transactions are recorded in an immutable ledger.
You cannot go back and change them. You can trace them, and you
can actually do AML compliance in real time. So I think the way
that we are moving in digital payments in the future is
actually going to be a lot easier for companies to control
these compliance costs.
Senator Perdue. Thank you.
Thank you, Mr. Chairman.
Chairman Crapo. Senator Reed.
Senator Reed. Well, thank you very much, Mr. Chairman. And
thank you, gentlemen, for your testimony.
Professor Pasquale, thank you for citing my proposed
legislation along with Senator Warren and Senator Collins. It
is a response really to all of what we are seeing in terms of
the Equifax breaches and everything else. And the underlying
principle is it is a disclosure bill. I think shareholders
should be aware of what their investment--or their company is
doing in terms of cybersecurity. And it leads to the question
that I think a lot of people are asking now: Are companies at
the proper level focusing proactively on avoiding major and
costly cybersecurity attacks? So I will ask you, in your
opinion, are most companies doing that now, or is it the
exception?
Mr. Pasquale. Thank you, Senator. I do think it is the
exception. Based on the work of Kristin Johnson on managing
cyber risks, I think she has done some very interesting
analysis of how the problem is that when these types of cyber
risks arise, there can be a huge leak of data, but the full
consequences may not be known for years or even decades
afterward. And the problem is, as your bill anticipates, how do
you sort of front-load awareness of these problems and try to
engage the board so that we are thinking about it not after the
fact, not requiring disclosure after something bad has
happened, but actually requiring something that happened
beforehand.
So, yes, I do think that it is an area that needs much more
attention from corporate boards.
Senator Reed. Let me ask you, Mr. Turner, your experience
too in terms of looking across the spectrum of both private and
publicly held companies. Is suitable attention being paid to
cybersecurity issues, in your view?
Mr. Turner. I think if we are looking at the fintech sector
in particular, as I mentioned before, cybersecurity is a big
focus. But, you know, as you start to take a step back and look
at the economy as a whole, especially just the financial system
we have today, cybersecurity is definitely a big focus. But I
think a lot of the problems lie in the fact that our banking
system really is a product of decades' worth of consolidation.
There are a lot of, you know, fractured technology systems,
physical servers, and things where, you know, it is hard to
comply and keep an eye on cybersecurity when you are really
just trying to keep these old systems running on a day-to-day
basis. And I think we see some of the more innovative
institutions moving toward things like cloud storage and cloud
computing. And as we start to get there, I think it will be
easier for firms to take a good look at cybersecurity and put
some good measures in place.
Senator Reed. But it would seem appropriate to have the
Securities and Exchange Commission lead that effort to try to
get them to that position. That is fair?
Mr. Turner. Yeah, again, I mean, you know, an actual
cybersecurity law or regulatory framework is really up to
Congress and the regulators. But I do think, you know, it is
not only that but just a--you know, if you had some sort of
national standardization even in what these terms mean, you
know, if NIST or someone like that could come out as well, I
think those are all good steps in the right direction.
Senator Reed. You actually raised a very profound question,
and the best parts of these hearings are not the answers but
the questions that we have to think about, like who owns the
data, which has to be done on an international basis,
obviously, since it flows so freely across the globe. But that
is an issue that we have to confront, I think, in Congress, at
least for the United States. I think there are other questions
like that. Are there data that should be off limits, you know,
no one can have it or the person has to give an affirmative
thumbs up or thumbs down? Should data be purged rapidly so that
you do not accumulate this vast holding stretching back that is
more transactional than archaeological, if that is a term? And
I think there is a whole series of questions that you have
raised which I find very, very helpful, so thank you very much.
Mr. Evans, thank you and your colleagues at GAO. Just a
final point. I have just a few seconds. Your response to the
perception of how well prepared or well versed most companies
are with respect to cyber, is it----
Mr. Evans. Yes, so my team did not look at that as part of
this work.
Senator Reed. Yes, sir.
Mr. Evans. But it is something that we are considering, and
we do have folks that have given great thought to cybersecurity
and the innovative technologies that might lead to improvements
in this space. But, unfortunately, I have nothing to add to
that question.
Senator Reed. Thank you very much. Thank you, gentlemen.
Chairman Crapo. Senator Cotton.
Senator Cotton. Thank you, gentleman, for your appearance
and your testimony this morning on this important topic.
Estimates from a 2015 FDIC survey indicated that 7 percent
of households in our country are unbanked; another 20 percent
were underbanked, which means they have access to a bank but
also used products outside the traditional banking sector. So
that is over a quarter of our fellow citizens who do not have
the kind of traditional banking relationships that the rest of
Americans do.
Mister--is it ``Pascal''?
Mr. Pasquale. Pasquale. Thank you.
Senator Cotton. I apologize. ``Pascal'' is how we pronounce
it in Arkansas.
[Laughter.]
Senator Cotton. Along with other innovative pronunciations
of different words. Do you think that the growing fintech
market has the potential to help these unbanked and underbanked
Arkansans access the digital economy and achieve greater
financial security? And if so, please elaborate on how exactly.
Mr. Pasquale. You know, I do think that when we look around
the world, we have seen fintech used as a tool of financial
inclusion. For example, with M-Pesa in Kenya and some other
areas around the world, you see an effort there. And I do think
that that is--you know, there could be some inspiring
opportunities in order to sort of create that sort of tier of
opportunity.
But I think one of the very difficult questions for
Senators and for the regulators now is: Do you want to create
sort of a two-track system, sort of a system that, say, is
maybe a higher tier, that has higher levels of protection and
regulatory standards, and then a lower level? Or to what extent
do we want to maintain sort of a more unitary set of
protections?
So I do think that, yes, there are definitely global
examples of inclusion, but I am also cautious about, you know,
what we might be giving up in order to bring them to the U.S.
Senator Cotton. What, if anything, is inherent in fintech
that would lead to that kind of two-tier system that we should
have on our minds as we craft policy?
Mr. Pasquale. I think that one of the things is that if you
have, for example, fintech firms wanting to avoid, say,
consolidated supervision or other sorts of requirements that go
along with some of the benefits of, say, certain forms of
regulation, that could be one aspect of the problem. But I
think the other aspect is that I think sometimes fintech is
confused because--the term itself leads to confusion because a
lot of the technology ideally would be sort of an adjunct to
existing banks that might be required to do what we want them
to do in terms of serving the underbanked as opposed to itself
providing those services.
Senator Cotton. OK. Mr. Evans, you look like you might have
something to add on that point?
Mr. Evans. Yes, so I was just thinking through some of what
Dr. Pasquale was discussing. Certainly I think there are great
possibilities in this particular area, and of course, great
risks that we detailed in the report. And it is almost too soon
to know. We have not seen a full credit cycle. And we have
seen, you know, earlier episodes where we have seen spikes in
homeownership rates that were not sustainable. And so we want
responsible, sustainable access to credit, and so those are
some of the things we need to shake through when we think about
marketplace lending.
Senator Cotton. Mr. Turner, would you like to round out
these thoughts?
Mr. Turner. Yeah, I think it is important to note when we
are talking about, you know, the unbanked and the underbanked,
and when we say fintech can promote inclusion, you know, there
are really two parts to that. There is the idea just of access,
you know, as we continue to see bank branches closing, it is
harder for people to actually have that local bank that they
can go to and get financial services. So if we have, you know,
mobile applications where people can bank on their phone, I
think that is access.
And then I think the second part of that is the inclusion
that comes with, you know, expanded services that might use
alternative data or something like that to make a decision on a
loan that a FICO score might show a borrower is, you know, a
risk, where if you include some additional data, you can get a
better picture, and that person actually can get credit.
So I think there is a lot to consider, and I think that,
you know, as we move forward and we look at regulation, it is
important to remember and it is important to make sure that
fintechs kind of have a framework where, you know, they need to
decide are they going to be deposit-taking institutions and be
like a real bank or are they going to continue as they are now
and then need some sort of defined regulatory structure
specific to fintechs.
Senator Cotton. Thank you.
Mr. Pasquale, I would like to look at fintech from another
perspective now. We were looking at it from the customer's
perspective, now from the perspective of jobs and investors. A
CEO of a London-based company called ``TransferWise'' recently
said that he was recruited by Silicon Valley venture
capitalists, but he chose the U.K. because of their regulatory
structure. That is disappointing from the standpoint of
American jobs. What, if anything, can we do to prevent future
companies from making that decision and seeing the United
States is the best, most favorable climate in which to start
their companies and create new jobs?
Mr. Pasquale. You know, I do think that the problem of is
the U.S. sort of falling behind sort of the awareness of other
countries like the U.K., that is a key problem. I also would
note, though, in terms of the work involved, I think that we do
have such a great advantage in terms of some of our sources of
strength in Silicon Valley and in New York in terms of the
funding of institutions there of education and other areas that
sort of led to a big advantage there.
So I guess my thought would be that I would not necessarily
want to see the U.S. regulatory infrastructure be rapidly
chipped away at to sort of keep up with this, with, say, what
is going on other countries. But I do think that we should keep
in mind that if there is a certain level of divergence, maybe
that should lead to some more international cooperation to lead
to more convergence, as we were talking earlier with Senator
Perdue with some of the Chinese apps.
Senator Cotton. Thank you.
Mr. Turner and Mr. Evans, I regret my time has expired. We
would welcome your comments on that question for the record,
though. Thank you.
Chairman Crapo. Thank you.
Senator Cortez Masto.
Senator Cortez Masto. Thank you, Mr. Chair, and thank you,
gentlemen. This is an important discussion we are having, so I
appreciate your comments today.
Mr. Pasquale, let me start with you because Chairman Crapo
had asked you, all of you, what the risks are, and one of the
things that you talked about was the opaque algorithms to
assess credit, and that was one of my questions. Can you
elaborate on that a little bit, please?
Mr. Pasquale. Sure. So one of the big problems in the U.S.
credit industry is that there are lots of people who either
have no file or a thin file, and so they are very hard for a
bank to extend credit to because it sees them not having
adequate--we do not have adequate background information on
them. And so the answer from a lot of fintech firms is to say,
``Well, why don't we look at other sources of data?'' And there
was a think tank called ``UpTurn'' that divided these into
traditional, alternative, and fringe sources of data. So
alternative data could be like your utility bill or rent bill,
how often you pay your rent, et cetera. That seems pretty
legitimate to me. But some of the fringe data could be things
like how do you fill out a form online. Did you look at it for
too long?
In the others, reports of lenders saying if they see
political activity on someone's Twitter account, they say,
``Oh, wow, well, maybe we should not lend to them. Maybe they
are getting mixed up in things that we do not want to be
involved in.'' And sometimes even the content of someone's
smartphone, like the deal might be offered, just let us
download everything on your smartphone and maybe we will give
you a loan.
And I think that these sort of business models could lead
to what I call ``big data proxies.'' So the problem is that the
companies involved may not necessarily be looking to
intentionally discriminate against individuals, but as we know
from ACOA, that is not the touchstone of liability there. The
really key issue is: Could you use that sort of data like
locational, other aspects of data to discriminate against
people?
And a final version of this could be that, for example, you
might have very sophisticated algorithms that could from
someone's face, say, tell their age or tell different medical
conditions from them. This sort of face recognition software is
already being used, say, to infer criminality from faces. And
so the level of advances in AI means that there are so many
different data sources, and the opacity of these is really a
challenge to fair lending.
Senator Cortez Masto. Thank you. And I know you have
written extensively on data brokers, and I think that is
important. I think it is important for all of us to understand
there is so much data out there and the concern when it comes
to credit or how we determine somebody's creditworthiness, if
we are going to take all of that data into consideration, might
at times create some sort of bias unintentionally because of
the data we are collecting. Is that what you are saying?
Mr. Pasquale. Absolutely, and I think Federal Trade
Commissioner Edith Ramirez was a real intellectual leader here
in terms of pointing this out as an issue, getting the FTC to
write some good reports on it, and the White House big data
report from last year.
Senator Cortez Masto. OK. Thank you.
Mr. Turner--and this is for Mr. Pasquale as well--how
should policymakers think about balancing both the innovation
provided by fintech companies and also ensuring that the same
rules of the road that apply to traditional lenders also apply
in this space?
Mr. Turner. Yeah, I think that is actually a very important
question right now, and I think, you know, things like the OCC
charter are a step in the right direction. If you look at these
lenders and, you know, if their primary business is lending,
they should be treated like other lenders. And right now, you
know, there are about three different ways that digital lenders
operate. You know, they are either partnering with the
federally regulated bank, they are going State by State and
getting licensed, or they are doing, you know, kind of a mix of
both. So I think that if you want to talk about a fair and
level playing field, you know, while continuing to promote
innovation, it needs to be something where both the incumbent
financial institutions and the lenders feel like they are
getting a fair deal. And I think, you know, something that has
been mentioned before that is important is as we start to have
some sort of regulatory framework for these digital lenders,
you know, it is important to make sure that you do not have a
very high interest rate lender just setting up a website and
calling themselves a digital lender. I think it is important
that you probably define what those lenders actually are first.
Senator Cortez Masto. And then can you also address--and I
will open it up to Mr. Pasquale as well--State preemption.
Obviously, the crisis that we just came through--and I was
working in the State of Nevada as Attorney General--the Federal
regulators I think failed us to some extent. And so I am always
concerned about some sort of State preemption in this space.
And along with that--let me put my law enforcement hat on--
fraud and money laundering when it comes to fintech companies
and FinCEN and how that interaction should be involved with
this process as well. So let me just throw that outcome there.
Mr. Pasquale. I completely agree with your concerns about
preemption, and in my written testimony, I have talked a bit
about some of the critiques of the potential for OCC to preempt
some of the relevant State laws, including usury laws, because
there are already some worries in exactly that area. And we saw
even the Supreme Court reconsidering its embrace of preemption
in Watters v. Wachovia in the later case Cuomo. And I think
that that sort of signal from the Supreme Court should be a
signal to regulators and to Congress in terms of exactly the
type of concerns that you are raising.
Senator Cortez Masto. OK. Thank you. I notice my time is
up. Thank you, gentleman. I appreciate the comments.
Chairman Crapo. Thank you.
Senator Tillis.
Senator Tillis. Thank you, Mr. Chair. Gentlemen, thank you
for being here.
I want to go back. I have got a couple of things I hope I
have time to ask about, but, Mr. Evans, I think you mentioned
in response to the Chair's questions about the sandboxes some
of the other countries are experimenting with that, you know,
you want to be in an environment where you can move fast and
break things, but maybe do it with the right rails in place.
Number one, you said that you are going to do a report that
is due out in the winter of next year.
Mr. Evans. That is right.
Senator Tillis. That is about a dog year in technical
terms. So one question I have is: What can we do now to
potentially look at this with the right kind of safeguards and
not wait 2 or 3 years where a lot of things will be different,
as they were 2 or 3 years ago?
Mr. Evans. Very good question. I think you are going to see
some competing interests on both sides of the issue when you
think about what the appropriate regulatory approach is in the
U.S. and what we can actually glean from other economies.
Senator Tillis. And do you think the current regs make it
difficult for a large traditional bank to even really get into
this mode of where they could move fast and break things? Or
are they at a decided disadvantage until we have some sort of
rationalization?
Mr. Evans. Yes, and I do not think that that is the
appropriate model in the financial services space because we
are not talking about apps. We are talking about access to
credit. And so the more appropriate model is maybe move fast,
be careful, think through what the landscape looks like.
Senator Tillis. Yeah, and I meant it actually in a more
positive light, I think, in innovation. What you are trying to
do is innovate, particularly for our U.S.-based entities and
innovators to be globally competitive. So I am trying to find a
sweet spot where you do that but it does not become disruptive.
Mr. Evans. Right.
Senator Tillis. I hope that if--the report takes as long as
a report takes, but I hope that we have other information that
is instructive to Congress so that, to the extent that
regulatory or legislative action is required, we are able to
move more quickly than a dog year in technology.
Mr. Evans. Yes, sir, and this will be early----
Senator Tillis. Early winter?
Mr. Evans. Early 2018.
Senator Tillis. Oh, OK. Good. There are two winters in
2018, so you are talking about the early part.
Mr. Evans. That is right.
Senator Tillis. Good. One question I have is whether or not
we have got a bubble with respect to cryptocurrencies, and, you
know, you have got a thousand different cryptocurrencies out
there. Can you talk a little bit about the need for regulation
and watching how the industry is moving? We will start with
you, Mr. Pasquale, and just go down the line.
Mr. Pasquale. Yes, Senator Tillis, I think that is a really
powerful concern right now. I have seen stories, for example,
of people trying to puff a certain cryptocurrency by saying,
``I am a taxi driver. I took my money out of the bank. I put it
into the cryptocurrency and now I am rich.'' And I think that
when you look particularly at the diversity of the initial coin
offerings and how they are proliferating, even boosters of the
cryptocurrency industry like CoinDesk have published articles
saying here are massive governance deficits with respect to how
these ICOs work and how some of the cryptocurrencies work.
So I do hope that--I think that our regulators are trying
to catch up with it, but I think it is going to take a lot more
coordinated, concentrated effort to do so.
Senator Tillis. I have got limited time. If you want to
briefly comment.
Mr. Turner. So I think that when you look at
cryptocurrencies, you need to realize, you know, the entire
market is only a little more than $100 billion, and this is
globally. So, you know, you cannot really call a bubble or
anything like that, but it is not that much compared to other
asset classes. I think that as Dr. Pasquale mentioned, you
know, there needs to be some sort of regulation around initial
coin offerings or token offerings, and whether that involves,
you know, offering them only to accredited investors or setting
up some sort of governance agency or having a current regulator
look at them, I do not know. But there definitely needs to be
something.
Senator Tillis. I am sorry, Mr. Evans. I want to get to a
final question, and it relates to some of your opening
comments, Mr. Pasquale, or maybe I inferred incorrectly from
it. But with respect to the algorithms that are being used by
some of the players and the concern with maybe the risk of
predatory lending practices, is there any information out there
that would suggest that the rates on the whole that are being
charged by people that are in the fintech space or there are
substantial outliers based on the underlying risk using maybe
factors that have not traditionally been used in the
underwriting model? In other words, is there a real clear base
of evidence that suggests that they are engaged in any kind of
unfair lending practices? I infer that maybe you thought there
was or there was a potential for it, so I was curious. That
will be my final question.
Mr. Pasquale. I would put it more on the potential side
right now, Senator. I think that the issue in terms of--I
briefly cited this 2016 Federal credit survey--or a credit
survey by the Fed of some small businesses, and there was also
an interesting story cited in my written testimony by David
Lazarus about certain people had used the fintech platform and
then later found out that the Small Business Administration had
suggested--or someone from the SBA had suggested that if they
have used certain lenders vetted by the SBA, they could have
gotten a much better deal. But I would say that it is very--we
are still in early days.
Senator Tillis. More of a risk than a measured reality.
Mr. Evans, and then I will finish.
Mr. Evans. Certainly if you look at some of the enforcement
actions--and there have only been a few--there was one case
where the entity was a bit more aspirational than they should
have been, and they promised benefits that did not actually pan
out, and they were cited by the CFPB. But in terms of
widespread evidence, I will say no, and in some cases you do
see lower rates relative to some other higher-cost alternatives
like payday lending.
Senator Tillis. Thank you.
Chairman Crapo. Senator Warren.
Senator Warren. Thank you, Mr. Chairman.
So we are here talking about innovative new financial
services companies, and in that context, I want to ask some
questions about the data on the cost of financial advice.
Dr. Evans, you are the Director of the Financial Markets
Group at the Government Accountability Office and an expert on
all things financial markets, and you look at a whole lot of
the data in this area. Is it your sense that it is now harder
or easier for middle-income savers to access investment advice?
Mr. Evans. So I would say easier, and that is a qualitative
assessment and is based on consensus, because if you look at
traditional wealth management, it takes $250,000 to get in the
game; whereas, the digital wealth platforms require no minimum
or a small amount, say $500. And some of these are automated
platforms that do things like automatically rebalance the
portfolio, which means lower fees. Examples of these include
Betterment and Wealthfront.
Senator Warren. Good, so getting easier. And, Mr. Turner,
you are a research analyst at S&P Global Market Intelligence.
You are also an expert on all things financial markets. In your
expert opinion, is financial advice getting more expensive or
less expensive for investors?
Mr. Turner. Thanks, Senator. I think just echoing those--
you know, as you continue to see the growth in digital
advisors, you know, with much lower fees, consensus seems to be
that advice is getting less expensive.
Senator Warren. So here you are; you are both independent
experts. I appreciate your opinions. They reflect the data.
They reflect the facts as best we know them. But the National
Chamber of Commerce apparently disagrees with you, and they
think they have bought some facts to back them up.
Last week, they hosted a meeting to complain about a new
Department of Labor rule that prevents Americans who are saving
for retirement from being cheated by their investment advisors.
It is called the fiduciary rule. I know you are all familiar
with it. And it requires investment advisors to offer advice
that is good for the customers, not advice that makes more
money for the investment advisor.
Now, the Chamber was hyping a new study which they had
bought and paid for claiming to show that the new rule made
financial services more expensive for families.
Now, my first guess when I saw this is that they were
pushing around this so-called study because under the new
fiduciary rule, financial advisors are hurting for profits.
So, Mr. Turner, this is your area of expertise. With the
new fiduciary rule in place, are investments shrinking and are
financial advisors hurting for profits?
Mr. Turner. Yes, so that is an interesting question. I
think if you actually look in what I submitted for my written
testimony, we predict by 2021 there will be $450 billion in
digital advisors. That is a fourfold increase from where it was
at the end of last year, and a lot of that growth is actually
being driven by incumbent investment advisors who are looking
toward these new technologies. So no longer is it the startups,
but it is actually the larger firms that are offering these
products.
Senator Warren. So this is really interesting. So startups
are doing well. That is part of what we are learning here. And
the CEOs for the large financial firms like UBS and Charles
Schwab actually have now told their shareholders in earnings
calls that their profits are great and going up with the
fiduciary rule in place. So the new rule is obviously lowering
prices for consumers. It is shutting down cheating. It is
letting investors access new markets. It is great for new
financial startups like Betterment. It is good for big guys
like UBS. And yet the Chamber of Commerce is running around
like a chicken with its head cutoff trying to kill the rule.
I get it. There are some investment advisors who built
their profit models on kickbacks and on tricking their
customers. But the fiduciary rule is good for consumers. It is
good for markets. It is good for competition. It is good for
startups. And it is even good for some of the biggest
investment companies.
Even so, the lobbyists and the trade associations like the
National Chamber of Commerce are sucking down billions of
dollars every year in this town, and those dollars do not keep
flowing unless there is a fight somewhere. So the lobbyists and
the trade associations keep right on fighting, whether it makes
any sense or not.
If I ran one of these companies, I would take a long, hard
look at all of the shareholder money that is wasted on trade
associations and membership in the National Chamber of
Commerce. I think they are being taken for a ride.
Chairman Crapo. Senator Van Hollen.
Senator Van Hollen. Thank you, Mr. Chairman, and I thank
all of you for your testimony.
Mr. Pasquale, we are very proud to have you at the
University of Maryland, and let me start with a question for
you, because in your written testimony you have a section
entitled ``The Problems of Extant Data Collectors are a Reason
for More Scrutiny of Fintech, Not Less'', and you talk about
different kinds of problems with a lot of the data that is
being collected, accuracy, relevancy, and some other
provisions.
I just want to focus on accuracy for a moment because in
this fintech world--and then I am going to ask you about the
existing rule that is already more regulated. It seems that the
burden is always on the consumer from inaccurate data, and the
question is if a consumer is being harmed because of inaccurate
information about them, why should they be paying the penalty?
Why not the provider of bad information?
So let me ask you, first, in the fintech world, is it still
the Wild West? Do we need to have some provisions that say that
those people who provide bad information that causes harm to
consumers should have to pay some penalty rather than the
burden on the consumer?
Mr. Pasquale. I think that is an excellent proposal, and it
really would rebalance things, because one of the things that I
think is so tragic about the Equifax data breach or several
data breaches is the amount of lost time, I mean people having
to spend time haggling over the phone just trying to
reestablish the basics of their identity to protect it from
being exploited. And I think trying to rebalance the playing
field--I mean, I know in Europe they have talked about a data
levy, because the idea is that data--you know, we have often
heard data is the new oil. But we also know that oil has some
wonderful sides and has some terrible sides. And we try to deal
with the environment consequences of oil.
I think very similarly, when we have these large quantities
of data that can create such harms once they are released, we
need to sort of be storing up some level of reserve for
regulatory efforts that would put the burden and the cost on
the person that causes the accident, not the victims of it.
Senator Van Hollen. All right. So let me follow up with
Equifax, because most of the focus understandably right now is
on breach of privacy, everyone's very personal information
being exposed to the public and people who may want to do bad
things with it. But you raised the issue that I hear constantly
from our consumers, even before the data breach, which is that
they get a question on--you know, they are denied a loan or
their bank tells them there is a problem or whatever it may be.
You mentioned an Arkansas woman in here who was denied a job.
So even under those more regulated systems like Equifax,
you have these problems today where consumers are stuck with
the costs of bad information. Do you have any suggestions about
how we can deal with that? Because if we can get it right with
Equifax and the already more regulated entities, those sort of
models could also be applied to fintech. I do not want to
suppress the benefits of fintech. I just want to make sure it
is not the consumers who are paying the costs for inaccurate
information about them.
Mr. Pasquale. Right, and I think one idea that I have
explored in past work is requiring certain push notifications
to consumers if they are put in a certain suspect category. And
some of those suspect categories could be, for example, as I
discuss in the written testimony, lists of people with certain
illnesses. There are lists of people with diabetes, with AIDS,
HIV-positive, mentally ill, et cetera. If you are on one of
these lists, perhaps you should have to get a push notification
so you could dispute it or at least you could understand what
was happening. And also, I think there should be further
regulatory effort on the use of the data, so not only putting
the burden on the consumer but also restricting certain usages
of data that may have, say, illicit provenance or have not
sufficiently been vetted by, say, outside auditors or others.
So I think that those would be two options, you know, both
a consumer-facing option and an option of restrictions on use
without proper vetting and auditing.
Senator Van Hollen. All right. I look forward to working
with you on it. There are two issues. One is the relevancy of
the data, right? I mean, is a health condition relevant to
whether you get a loan or something? The other is the accuracy.
And they are both important, but it does drive me crazy when
something that is just dead wrong gets on a credit report and
the credit rating agency, whoever it may be, does not pay any
penalty other than the fact that after months and months of
work, they may say, ``Oh, yeah, we were wrong,'' even though it
has created incredible economic and other kind of pain to
consumers. So I look forward to working with you on that.
Just a quick question you can answer for the record, if you
want. With respect to bank loans, for example, we have FDIC
protection. We have got this great new area in fintech where
people have, you know, a lot of their--you know, not a lot of
wealth but they have money stored in these areas that are not
really insured.
For the record, Mr. Chairman, any thoughts any of you have
about how we deal with that issue? If I have money in my bank
account and it is lost, I have the FDIC. What is the recourse
for a consumer who uses fintech and their money is lost? So I
would appreciate any answers you have for the record since it
looks like my time is out.
Chairman Crapo. Senator Schatz.
Senator Schatz. Thank you, Mr. Chairman. Thank you to the
witnesses for this important hearing.
This is a question for all the witnesses. We hope that
financial innovation breaks down barriers and increases
financial inclusion and ultimately does good, but sort of
pursuant to Senator Tillis' line of questions and what the
panel has been talking about, the risks are real. There are
security issues. As we saw with Equifax, our most sensitive
personal information can be vulnerable, and there is the risk
of creating a platform for predatory actors entrenching social
and racial biases. And so innovation is disruptive, but it can
be disruptive in positive and negative ways.
I think we have an opportunity here. We can choose to lift
up innovation that creates economic opportunity. We can make
consumer protection a core value of what we do in fintech. When
someone asks for regulatory flexibility, we can ask how is this
innovation going to actually help people.
As a starting point, I think it would be helpful to have a
dedicated Innovation Office that is thinking comprehensively
about these questions. This could be a one-stop shop in the
Government for fintech businesses to figure out which
regulations apply to them and a mechanism for coordinating
among the regulators. It will be a Wild West without some
attempt to coordinate.
You already have regulators with varying degrees of
aggressiveness in this space and enthusiasm for this space. But
we need someone who is thinking around a few corners rather
than just sort of narrow questions of compliance for particular
companies.
I would like to get each one of the panelists' views on the
potential for an Innovation Office and a one-stop shop,
starting with Mr. Evans.
Mr. Evans. I will just quickly say that it is something
that should strongly be considered. It is envisioned in the
bill that is before the House. The regulators have talked about
these type of initiatives, and it is worth full consideration.
Mr. Turner. I think it is a great idea. I think as we start
to look at potential regulation for the industry, having some
sort of Innovation Office, having some sort of sandbox program
in place could help fintechs and regulators really figure out,
you know, what they are working toward. And I think if you look
at large banks today, they all have Innovation Offices.
Mr. Pasquale. Yes, and I would agree. I think that the
problem of interagency cooperation is a really profound one,
and the Dodd-Frank Act took certain steps in that direction
with respect to the Financial Stability Oversight Council. And
we see also in terms of data sharing and the governance of data
sharing and the intelligence apparatus there are some efforts
to sort of understand exactly what is going on in the overall
ecosystem. And I think you are absolutely right that that is
going to be the big agenda item, I think, over the next decade,
is how you can get these agencies to cooperate around something
like an Office of Innovation.
Senator Schatz. Let me just ask another question not on my
prepared list of questions. You know, the challenge, I think,
with this Committee, at least to a certain extent, is that the
public's eyes glaze over, even though all of these issues
impact them directly. It is hard to describe why this panel and
this topic matters to folks that we all represent, and yet it
does.
So could you just describe as concisely as you can, each
one of you, the best opportunity when it comes to fintech and
sort of the worst of a parade of horribles when it comes to
fintech?
Mr. Evans. So I think that the best opportunity, of course,
is enhanced and sustained financial inclusion. The horror story
is fintech companies being used as a platform to market high-
cost loans to individuals that further undermine access to
credit.
Senator Schatz. Mr. Turner.
Mr. Turner. I pretty much echo that. I think fintech really
offers access. It offers ease of use. It offers reduced
frictions. It offers reduced costs. And the only downside I
could see in the future is bad actors parading as fintechs and
trying to get fit into regulation that might be formed.
Senator Schatz. Just as a quick follow-up, do we have a
statutory framework that prevents those bad actors? Or are we
just hoping they will not take advantage of this new aperture?
Mr. Turner. I think if there is to be any sort of fintech-
specific regulation, you will need to define what a digital
lender is, what a peer-to-peer payment company is. It needs to
be--you know, this is probably step one in doing that.
Senator Schatz. And this becomes hard because banks are
going to be in this space already.
Mr. Turner. I think it could be difficult, but I think it
is definitely necessary.
Senator Schatz. OK. Mr. Pasquale.
Mr. Pasquale. Yes, I think, you know, on the bright side, I
do think when I look--I listen to a lot of podcasts on fintech,
like the Wharton Fintech or Fintech Insider, and you often hear
on these podcasts very interesting entrepreneurs who are
bringing to people, say, the opportunity to buy insurance for
an hour if they want to borrow their friend's car or something.
And those sorts of things, like insurer tech, those sorts of
things, are really, I think, filling a gap for consumers and
might ultimately, if the market is structured correctly, lead
to much better competition for financial services if options
are transparent and understandable.
For the downside, I would just reference there is a British
science fiction series called ``Black Mirror'', and it has a
terrific episode where someone finds that their score--they
keep having negative social interactions, and their score,
which also acts as a credit score, keeps going down and ruins
their life.
Senator Schatz. For the record, can I find that on Netflix
or----
Mr. Pasquale. Yes.
[Laughter.]
Chairman Crapo. Senator Warner.
Senator Warner. Thank you, Mr. Chairman. I will tell you,
Dr. Pasquale, I listen to a lot of podcasts as well. I am not
sure Wharton Insider has been on my list recently. But let me
compliment my friend Senator Schatz. I think the idea of this
Innovation Office, this kind of one-stop shop makes an enormous
amount of sense. I would love to help you on the--I do not--to
try to accomplish that since we think about FSOC and other
efforts. This notion of having some single point of reference
in this area is a great idea. How we implement it is going to
be a real challenge because I think, as Mr. Turner talked about
a little bit, my old business used to be mobile telephony. I
mean, mobile payments are a part of the fintech world. This is
going to continue to grow in a number of ways, but I think it
is a great idea.
I want to come back to--I am going to try to get in two
items. One, on the whole question of what Senator Reed raised
in terms of trying to elevate this whole question around data
protection at a higher level, I would simply point out I think
we have got like 9,000 public companies. Even Yahoo, when it
had its massive data breach, did not really view that as a
material fact in terms of how do you not have a billion users
hacked into and that not be material. Now, we whacked Yahoo,
but the fact is I think less than 100 companies in the last
decade have ever reported on a data breach in an SEC filing. So
some of the things that Senator Reed has suggested are very
important.
Another piece I think is very important is--and this is not
one that is a partisan issue. We have been working for 3\1/2\
years trying to get a common standard around data breach. We
have got 49 different State laws now on data breach. So the
fact that Equifax took 6 weeks before they notified consumers
was a reflection of the fact that we do not have a single
standard around data breach. And the problem has not been
actually lack of need for a standard. It has been individual
industries, and in many cases my old industry, telecom wanted
to try to exempt themselves from the requirements of
notification.
I know this is a little bit off topic, but because Equifax
is kind of in the news and as we think about fintech being a
brave new world, do you guys have a sense about the need--and I
know, Dr. Pasquale, you had some concerns about Federal
preemption. But in the case of the data breach, I strongly
believe that we need a single national standard here. Do you
have a view on any of that?
Mr. Pasquale. I guess I would say that there are
certainly--it is a very tough question because I do think that
I want to preserve the ability of certain States to be on the
cutting edge in terms of expansive requirements, and I think
that, you know, California to some extent has had a very
forward-thinking privacy office there in the Office of the
Attorney General. But I also do see your point that it could
become very costly for companies to comply with all the
different standards, try to understand them all.
And I think that, you know, I would have to study it
further to know whether the benefit of uniformity----
Senator Warner. I would love to get some--because we are
very close. The challenge has not been trying to get a standard
or the standard has to evolve. It also has notification
requirements. But I think the challenge in a lot of data
breaches is everybody blames somebody else. You know, is it the
institution? Is it the financial institution? Is it the telecom
companies? Is it some other player? And we end up now having
these circumstances where, again, in the Equifax case we wait 6
weeks before the public is notified.
Mr. Turner and Mr. Evans, quickly, because I have got one
other area I want to raise.
Mr. Turner. Yeah, I just want to point out that I think, as
you mentioned, just a national standard is probably step one.
So I do not know if it is going to be specific Federal
regulation or harmonized State regulation. But if everybody is
on the same page, you know, at least it can start down that
path.
Senator Warner. Mr. Evans.
Mr. Evans. And I would just echo those sentiments. What you
want is consistent treatment.
Senator Warner. One area that I have been intrigued with--
and, again, there is a little poor guy who had all these other
great, very specific fintech questions who is going to be upset
I am not asking them, but this is another area. I think there
is a real opportunity in fintech. One of the things I have
looked at over the last 2 years is the transformation in the
nature of work and the transformation in the notion of
employment. You know, back in the 1990s, about 90 percent of
Americans worked full-time in a W-2 type environment, yet we
are the only industrial country in the world that makes all of
our social insurance dependent upon your labor status. So that
social contract that said if you work full-time, you get
unemployment, health care, workmen's comp, disability,
retirement, that world is changing. A third of the workforce
right now is not in traditional work. They are in contingent
work. You know, they are part-time, they are temp workers, they
are 1099 independent contractors, the kind of sexy areas, the
gig workers. All of that workforce, a third of the American
workforce--the estimates are it is going to go to half--have no
social insurance at all.
One of the things we have looked at is the notion of
portable benefits, and I think fintech offers an enormous
opportunity, as long as it is properly regulated, to have the
ability to have that portable benefit system that would allow
you to move from firm to firm and carry those benefits with
you.
Any quick comments on that, right down the path,
recognizing I am already out of time?
Mr. Evans. I will pass.
Mr. Turner. I think technology will be a great enabler of
anything that does happen in that area.
Mr. Pasquale. And I would agree with you. I follow some of
the work on platform cooperativism, which are a lot of groups
that are trying to create fairer forums of platform----
Senator Warner. Stride Health and others, et cetera.
Mr. Pasquale. Yeah, and I think that the portable benefits
via some of these fintech firms could help them--could help
individuals to get out of job lock, which I think is really a
big drain on entrepreneurialism.
Senator Warner. I would only say, Mr. Chairman--I know my
time is up--that, you know, I do not think we are going to be
able to force an economy back into a 20th century model where
everybody works for the same company for 38 years the way my
Dad did. But we are going to have to recognize that we need a
social insurance platform or new social contract that meets the
workforce where they are at and, again, as Dr. Pasquale said,
allows people to move from job to job, and part of that means
portability of benefits. So I think fintech offers a great
opportunity here.
Thank you, Mr. Chairman.
Chairman Crapo. Thank you, Senator Warner. And that
concludes our questions. We have finished the hearing with 2
minutes to spare, so I thank our witnesses for being concise in
your testimony and also for your testimony. You will probably
get additional questions from Senators, and the Senators should
note that they have until Tuesday, September 19th, to submit
questions. I urge our witnesses to respond to those questions,
if you receive them, as quickly as you can.
This is a very critical issue, and your testimony has been
very helpful to us. We will probably look forward to working
with you in the future to get further help from you.
With that, the hearing is adjourned.
[Whereupon, at 11:28 a.m., the hearing was adjourned.]
[Prepared statements, responses to written questions, and
additional material supplied for the record follow:]
PREPARED STATEMENT OF LAWRANCE L. EVANS
Director, Financial Markets and Community Investment, Government
Accountability Office
September 12, 2017
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR MENENDEZ FROM LAWRANCE L. EVANS
Q.1. The Equifax data breach which impacted more than 143
million U.S. consumers revealed weaknesses in the company's
data security protocols. In your opinion, do consumer reporting
agencies have sufficient data security standards and
infrastructure to effectively protect the sensitive personal
data they hold? Are there any existing legislative or
regulatory gaps that contribute to this problem?
A.1. While we cannot opine on the sufficiency of data security
standards and infrastructure at consumer reporting agencies at
this time, we are initiating work in response to a request from
the Ranking Member of the Subcommittee on Financial
Institutions and Consumer Protection that will allow GAO to
address these concerns. Based on our existing body of work we
can comment on infrastructure, data security and the regulatory
landscape more broadly.
Regarding oversight of critical infrastructure (which
includes 16 key sectors, including the financial services
sector) the National Institute of Standards and Technology
Cybersecurity Framework is a voluntary standard intended to
establish a common taxonomy for building cybersecurity
programs. Outside of that, each industry is driven by its own
regulatory requirements and Federal/State oversight structures.
Current regulations impose requirements on financial
institutions to protect consumer data and these safeguards
explicitly apply to consumer reporting agencies. Specifically,
the Gramm-Leach-Bliley (GLB) Act restricts, with some
exceptions, the disclosure of nonpublic information by
companies defined under the law as ``financial institutions''.
The Act also requires the Federal Trade Commission (FTC) and
certain other Federal agencies to establish standards for
financial institutions relating to administrative, technical,
and physical information safeguards. As part of its
implementation of the GLB Act, the FTC issued the Safeguards
Rule, which requires financial institutions under FTC
jurisdiction to have measures in place to secure customer
information and ensure affiliates and services providers also
safeguard this information. \1\ The Rule applies to many
companies of all sizes that are significantly engaged in
financial products and services, including consumer reporting
agencies. FTC has also used its statutory authority to address
unfair and deceptive acts and practices under section 5 of the
FTC act to enforce data security compliance.
---------------------------------------------------------------------------
\1\ For additional information on the Rule see https://
www.ftc.gov/tips-advice/business-center/guidance/financial-
institutions-customer-information-complying.
---------------------------------------------------------------------------
Currently, there is no Federal law that governs breach
reporting but the prudential banking regulators have issued
interpretive guidance requiring their regulated institutions to
report breaches promptly to allow breach victims to take steps
to protect themselves. Similarly, the Securities and Exchange
Commission and the Commodity Futures Trading Commission have
also issued rules that require compliance with the notification
requirements of GLB Act.
Moreover, States have varying laws associated with privacy/
data breach notification. It is important to note that the FTC
Safeguards Rule establishes standards but does not place
requirements on institutions to notify customers within a
specified timeframe. \2\ While banks are subject to regular
examination of their information security practices, the
nationwide consumer reporting companies (Equifax, TransUnion,
and Experian) may not receive the same level of supervisory
scrutiny. The Bureau of Consumer Financial Protection (CFPB)
has supervisory and enforcement authority over the national
consumer reporting companies but the extent to which this
oversight includes regular examinations of information security
practices will be the subject of future GAO work. CFPB does not
have authority to enforce the GLB Act's data security
provisions, but the agency has taken an enforcement action
under its unfair, deceptive or abusive acts or practices
authority against a payments company for allegedly deceptive
statements about data security practices.
---------------------------------------------------------------------------
\2\ The FTC is seeking comment on the Safeguards Rule, including
whether the elements of an information security program should include
a breach response plan. See 81 FR 61,632.
---------------------------------------------------------------------------
------
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR MENENDEZ FROM ERIC W. TURNER
Q.1. The Federal Deposit Insurance Corporation (FDIC) found
that in 2013 nearly 30 percent of Americans households were
``unbanked'' or ``underbanked,'' with the highest rates among
non-Asian minorities, low income households, and unemployed
households. What technological advancements in the Fintech
industry can promote financial inclusion among the ``unbanked''
and underbanked''?
A.1. Innovations in financial technology can provide increased
financial inclusion through the ability to obtain services and
the use of alternative data sources or underwriting
methodologies.
Traditionally consumers have obtained financial services
from physical branch locations. As banks continue to close
branches, many consumers have lost access to important
financial services. U.S. bank branches decreased by 1,981
locations during the period between June 30, 2016, and June 30,
2017. As this trend continues, fintech innovations are filling
the gap by providing traditional banking services such as
deposit accounts, payments, and lending through digital
channels.
Regardless of their location, users can now access these
services through online or mobile channels. This especially
benefits people in rural or other areas that have a low number
of bank branches due to the economics of keeping a physical
location. Mobile banking technology can also help community
banks serve more customers even without the extensive branch
networks of large banks.
According to a survey fielded by S&P Global Market
Intelligence earlier this year, 65.5 percent of mobile banking
users had an annual income of less than $75,000 and 54.2
percent of users held less than $10,000 in their combined
checking and savings accounts.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
These statistics are similar to those of mobile payment
users, who instead of using cash or checks to complete
transactions rely on mobile applications to do things such as
pay a bill, send money to another individual, or complete a
purchase. According to S&P Global Market Intelligence survey
results, 63.7 percent of mobile payment users had an annual
income of less than $75,000.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
In both cases, it is clear that lower income individuals
have found mobile banking and payment technologies beneficial
to their financial well being.
Furthermore, increased access to term loans, as opposed to
payday loans, can benefit the traditionally unbanked or
underbanked. Digital lenders rely on mobile or web-based
platforms and nontraditional underwriting models to deliver
loans to consumers and small businesses that may otherwise be
denied credit by traditional banks. Square Capital, for
instance, sees 54 percent of loans go to women, compared to the
16 percent quoted by the Small Business Administration. \1\
---------------------------------------------------------------------------
\1\ https://www.snl.com/web/client?auth=inherit#news/
article?id=42127613&KPLT=6&s_data=si%3D2%26kpa%3D4db0879a-62d3-40e0-
b6fd-9e14f2ab7bee%26sa%3D
---------------------------------------------------------------------------
Digital lenders offer credit to borrowers based on advanced
analytics, nontraditional underwriting, and alternative data.
These platforms leverage quantitative models that look to
create proprietary credit scores outside of those provided by
models such as FICO or even Vantage scores. While some
platforms use inputs from national credit reporting bureaus,
they may also include alternative data or weight credit factors
differently than more well known models.
Alternative data presents the opportunity to gain a more
holistic view of a borrower. For example, information such as
utility or rent payments can be included in the underwriting
decision. For low-income borrowers who may choose to rent
housing and where utility bills may be a large monthly expense,
these are important and likely more predictive factors when it
comes to the ability to repay.
According to a Federal Reserve research paper published in
July 2017, alternative data sources allowed borrowers with few
or inaccurate credit records to access credit. \2\ This report
further reinforced that these borrowers were from areas that
lacked access to credit due to low income levels or
disproportionate branch closings.
---------------------------------------------------------------------------
\2\ https://www.philadelphiafed.org/-/media/research-and-data/
publications/working-papers/2017/wp17-17.pdf
Q.2. Fintech companies are subject to anti-discrimination laws
related to the services and products they provide. However,
there are concerns that using new data and algorithms could
result in a company unintentionally discriminating against a
protected group. What steps are companies taking to ensure that
their services and products do not discriminate against
---------------------------------------------------------------------------
protected classes?
A.2. The use of new data and algorithms primarily applies to
providing credit to individuals in the digital lending space.
These lenders have sought ways to provide credit to previously
underserved individuals using alternative sets of data. As the
industry has matured, there have been numerous cases where it
was decided that some data sets could potentially discriminate
against protected classes. For example, offering personal loans
based on the college from which you graduated was largely
considered a valid input for lenders years ago, but many have
shifted away from this. Other inputs like social media usage
were once considered but never ultimately made it into
underwriting criteria due to similar concerns.
Digital lenders have made great effort to ensure that
underwriting algorithms are accurate and provide the best
financial inclusion possible. In order to ensure that this
continues, regulators should create a friendly environment for
innovation. This could be through a regulatory sandbox or
innovation office. The recent no-action letter from the CPFB to
personal-focused digital lender Upstart is a good example of
how regulators can better understand the space. \3\
---------------------------------------------------------------------------
\3\ https://www.consumerfinance.gov/about-us/newsroom/cfpb-
announces-first-no-action-letter-upstart-network/
---------------------------------------------------------------------------
Many of the underwriting inputs used by fintech startups
today are similar to those used by traditional lenders, but in
cases where alternative data is used, it will be up to the
lenders and regulators to closely monitor adherence to fair
lending practices.
Thank you again for the questions; I hope that our response
has been useful.
------
RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
FROM FRANK PASQUALE
Q.1. Senator Crapo asked about regulatory sandboxes that would
allow financial technology companies to experiment in real
markets, and you mentioned some pilot programs have ``proven
their worth in health care policy.'' Can you describe the types
of pilot programs that have worked in other sectors; how such
programs navigated conflicts between State and Federal law; and
under what parameters or considerations a financial technology
pilot program would need to operate in order to protect
consumers and the marketplace?
A.1. Pilot programs can be important tools for gathering data
necessary to evaluate products and services in various sectors,
such as the health care and financial sectors. \1\ Regulators
in these sectors need to understand more fully what technology
firms are doing and how they are performing to ensure proper
regulations are in place that safeguard individuals but do not
stifle innovation; pilot programs can be a tool to do this.
Effective pilot programs support ``responsible innovation'' and
provide transparency of process necessary to expose any
potential pitfalls or unanticipated issues. \2\
---------------------------------------------------------------------------
\1\ This answer was prepared by Jennifer Smith, Ryan H. Easley
Research Fellow at the University of Maryland School of Law, after a
request with initial guidance from Frank Pasquale, the witness.
Professor Pasquale has reviewed the response and believes it to be a
fully responsive response to the question.
\2\ Press Release, Off. Comptroller of the Currency, Dept. of the
Treasury, ``OCC Issues Responsible Innovation Framework'' (Oct, 26,
2016), https://www.occ.gov/news-issuances/news-releases/2016/nr-occ-
2016-135.html.
---------------------------------------------------------------------------
Pilot programs are particularly important in gathering
information from sectors that are not apt to be transparent
with data. As in health care, where the average consumer does
not have the information necessary to `` `second guess' his or
her [medical] provider about the amount or nature of care
needed, \3\'' the average consumer does not know how his or her
financial and personal data is being used, or what data is even
being mined, in order to make informed decisions and protect
his or her financial health. Due to this knowledge gap,
consumers of both health care and financial services depend on
regulations that are based on a thorough and thoughtful
understanding of the industry being regulated. Pilot programs
can provide State and Federal regulators with the data and
information necessary to formulate thorough and thoughtful
regulations that do not stifle innovation and protect
consumers.
---------------------------------------------------------------------------
\3\ Frank Pasquale, ``Ending the Specialty Hospital Wars: A Plea
for Pilot Program as Information-Forcing Regulatory Design'', in The
Fragmentation of U.S. Health Care: Causes and Solutions 235, 272 (Einer
Elhauge, ed., 2010).
---------------------------------------------------------------------------
In the health care sector, pilot programs are used to
promote innovation and test new models of patient care and
service. Although the health care and financial industries have
their own unique issues and obstacles, health care pilot
programs provide lessons that can assist the development and
implementation of fintech pilots. For a recent example, the
Food and Drug Administration (FDA) announced the launch of the
Pre-Cert for Software Pilot Program in July 2017 and in
September announced the nine companies selected to take part in
the pilot program. \4\ One of the pilot program goals is to
``enable [the FDA] to develop a tailored approach toward
regulating [digital health] technology by looking first at the
software developer and/or digital health technology developer,
rather than primarily at the product, which is what [the FDA]
currently [does] for more traditional medical devices. \5\''
Although this pilot program is in the beginning stages, the
impetus, framework, and eventual outcomes may serve as guidance
for developing pilot programs for fintech firms and regulators.
---------------------------------------------------------------------------
\4\ Scott Gottlieb, ``FDA Announces New Steps To Empower Consumers
and Advance Digital Healthcare'', FDA Voice (July 27, 2017), https://
blogs.fda.gov/fdavoice/index.php/2017/07/fda-announces-new-steps-to-
empower-consumers-and-advance-digital-healthcare/; Press Release, U.S.
Food & Drug Admin, ``FDA Selected Participants for New Digital Health
Software Precertification Pilot Program'' (Sept. 26, 2017), https://
www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm577480.htm. The
nine companies selected are Apple, Fitbit, Johnson & Johnson, Pear
Therapeutics, Phosphorus, Roche, Samsung, Tidepool, and Verily. Id.
\5\ Digital Health Software Precertification (Precert) Program,
U.S. Food & Drug Admin. (Sept. 27, 2017), https://www.fda.gov/
MedicalDevices/DigitalHealth/DigitalHealthPreCertProgram/default.htm.
---------------------------------------------------------------------------
An example of a completed health care pilot program that
may provide guidance for fintech pilots is a program testing a
bundled payment model for care. \6\ This program was through
the Agency for Healthcare Research and Quality (AHRQ) at the
Department of Health and Human Services (HHS). Some of the
takeaways that may inform the development and implementation of
fintech pilot programs are: ensure the number of stakeholders
and volume of participants are sufficient to provide good data;
build consensus around key definitions and issues, such as
assumption of risk; and build trust among participants.
Additionally, the bundled payment model pilot program faced
``delays and uncertainty related to State regulations.'' \7\
Specifically, California hospitals and health care plans
participating in the pilot program worried physician payments
through the bundled payment contracts would violate California
regulations prohibiting the ``corporate practice of medicine.
\8\'' In response to this concern a model contract template was
created and participants in California developed a split-bundle
model. The ``development and successful deployment of a common
contracting template that largely satisfied the contracting
parties and State regulators'' is cited as one of the programs'
successes. \9\
---------------------------------------------------------------------------
\6\ In a bundled payment model ``a group of providers receives a
fixed payment from participating health plans. The payment is designed
to cover the average cost of a defined `bundle' of services related to
a procedure or course of treatment.'' M. Susan Ridgely et al., ``The
IHA Bundled Episode Payment and Gainsharing Demonstration'', AHRQ
Delivery System Research: Study Snapshot 1 (AHRQ Pub. No. 15-0016-2-EF,
2015).
\7\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
Gainsharing Demonstration'', AHRQ Delivery System Research: Study
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
\8\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
Gainsharing Demonstration'', AHRQ Delivery System Research: Study
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
\9\ M. Susan Ridgely et al., ``The IHA Bundled Episode Payment and
Gainsharing Demonstration'', AHRQ Delivery System Research: Study
Snapshot 2 (AHRQ Pub. No. 15-0016-2-EF, 2015).
---------------------------------------------------------------------------
In addition to examining domestic pilot programs in various
sectors, it is informative to look at international regulatory
sandbox and pilot programs. Internationally, regulatory
sandboxes/pilot programs are utilized to promote innovation in
fintech and develop regulations. \10\ The United Kingdom's
Financial Conduct Authority (FCA) is often cited as a model for
regulatory sandbox programs. \11\ To date, the FCA has
completed one cohort of testing, is in the process of testing
for the second cohort, and is reviewing applications for
inclusion in cohort three. \12\ Hong Kong also utilizes
supervisory sandboxes to ``encourag[e] financial institutions
to make use of Fintech and support[] initiatives that drive
Fintech adoption and innovation. \13\'' Hong Kong's supervisory
sandboxes are run through three regulators: the Hong Kong
Monetary Authority, \14\ the Securities and Futures Commission,
\15\ and the Insurance Authority. \16\ Additionally, the
Monetary Authority of Singapore (MAS) supports regulatory
sandboxes that ``provide appropriate regulatory support by
relaxing specific legal and regulatory requirements . . . for
the duration of the sandbox. \17\''
---------------------------------------------------------------------------
\10\ See Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017); ``Monetary
Authority Singapore, Fintech Regulatory Sandbox'', http://
www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/
FinTech-Regulatory-Sandbox.aspx (last visited Oct. 3, 2017); Fin.
Conduct Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8,
2017), https://www.fca.org.uk/firms/regulatory-sandbox.
\11\ Stephanie Forshee, ``OCC Has Banking Sandbox-like `Pilot' for
Fintechs in the Works'', Law.com (Aug. 10, 2017), http://www.law.com/
sites/almstaff/2017/08/10/occ-has-banking-sandbox-like-pilot-for-
fintechs-in-the-works/?slreturn=20170902083457. See also Fin. Conduct
Authority (U.K.), ``Regulatory Sandbox'', (last updated Aug. 8, 2017),
https://www.fca.org.uk/firms/regulatory-sandbox.
\12\ Fin. Conduct Authority (U.K.), ``Financial Conduct Authority
Provides Update on Regulatory Sandbox'' (June 15, 2017), https://
www.fca.org.uk/news/press-releases/financial-conduct-authority-
provides-update-regulatory-sandbox.
\13\ Hong Kong Fintech, ``Sandboxes'', http://www.hongkong-
fintech.hk/en/sandboxes.html (last visited Oct. 3, 2017).
\14\ Hong Kong Monetary Authority, ``Fintech Supervisory Sandbox''
(FSS) (Sept. 29, 2017), http://www.hkma.gov.hk/eng/key-functions/
international-financial-centre/fintech-supervisory-sandbox.shtml. The
Hong Kong Monetary Authority operates a Fintech supervisory sandbox for
``Fintech and other technology initiatives intended to be launched in
Hong Kong by banks.'' Id.
\15\ Sec. & Futures Comm'n, ``SFC Regulatory Sandbox'' (Sept. 29,
2017), http://www.sfc.hk/web/EN/sfc-fintech-contact-point/sfc-
regulatory-sandbox.html. The Securities and Futures Commission operates
a regulatory sandbox ``to provide a confined regulatory environment for
qualified firms.'' Id. Qualified firms are ``both licensed corporations
and start-up firms that intend to carry on a regulated activity under
the [Securities and Futures Ordinance].'' Id.
\16\ Ins. Auth. (H.K.), ``Insurtech Corner'', https://
www.ia.org.hk/en/aboutus/insurtech_corner.html (last visited Oct. 3,
2017). The Insurance Authority's ``Insurtech Sandbox'' was created to
``facilitate a pilot run of innovative Insurtech applications by
authorized insurers to be applied in their business operations.'' Id.
\17\ Monetary Authority Sing., ``Understanding and Applying to the
Sandbox'', http://www.mas.gov.sg/Singapore-Financial-Centre/Smart-
Financial-Centre/FinTech-Regulatory-Sandbox/Understanding-and-applying-
to-the-sandbox.aspx (last visited Oct. 3, 2017). See also ``Monetary
Authority Sing., Fintech Regulatory Sandbox Guidelines'' (Nov. 2016),
http://www.mas.gov.sg//media/Smart%20Financial%20Centre/Sandbox/
FinTech%20Regulatory%20Sandbox%20Guidelines.pdf.
---------------------------------------------------------------------------
In conclusion, pilot programs can be important tools for
gathering data necessary to evaluate and refine fintech.
Regulators need to understand how fintech firms operate and how
they perform in order to properly regulate fintech and ensure
innovation is supported and consumers are protected; pilot
programs can support and advance responsible innovation.
------
RESPONSES TO WRITTEN QUESTIONS OF
SENATOR MENENDEZ FROM FRANK PASQUALE
Q.1. The Federal Deposit Insurance Corporation (FDIC) found
that in 2013 nearly 30 percent of Americans households were
``unbanked'' or ``underbanked,'' with the highest rates among
non-Asian minorities, low income households, and unemployed
households. \1\ As new companies begin to market products and
services to unbanked and underbanked households, what actions
should Federal or State regulators pursue to ensure that
consumers receive sufficient protections?
---------------------------------------------------------------------------
\1\ Fed. Deposit Ins. Corp., ``2013 FDIC National Survey of
Unbanked and Underbanked Households: Executive Summary'' (2014),
https://www.fdic.gov/?householdsurvey?/2013??execsumm.pdf.
A.1. Fintech can be a means of building financial inclusion,
especially for those Americans currently unbanked or
underbanked; but there must be proper protections to ensure
consumers are protected and information is obtained and used in
a secure manner and in a way that does not unintentionally
discriminate. \2\ Federal and State regulators need to ensure
consumers are protected from technical and privacy issues we
know about now, as well as those we have yet to encounter. In
order to build consumer trust and ensure protections, Federal
and State regulators can take a number of actions, including:
addressing regulatory confusions; extending privacy protections
in other areas of the law to cover consumer data compiled and
used by data brokers and fintech firms; require data brokers
register with the Federal Trade Commission (FTC); and empower
and expand funding to Federal agencies like the Consumer
Financial Protection Bureau (CFPB) and the Office of Financial
Research (OFR). But State and Federal regulators should not
rush to deregulate in order to spur innovation and, further,
the Federal Government should not preempt State laws aimed at
protecting consumers, especially the unbanked and underbanked.
---------------------------------------------------------------------------
\2\ This answer was prepared by Jennifer Smith, Ryan H. Easley
Research Fellow at the University of Maryland School of Law, after a
request with initial guidance from Frank Pasquale, the witness.
Professor Pasquale has reviewed the response and believes it to be a
fully responsive response to the question.
---------------------------------------------------------------------------
Consumers encounter confusion regarding regulations of the
traditional banking sector and fintech sector. For example, Rob
Nichols, president and chief executive of the American Banker
Association stated: ``consumers [] face potential confusion
when dealing with two sectors that have differing regulatory
regimes'' and Nichols views this confusion as ``leading to gaps
in consumer protections.'' \3\ As more consumers use fintech
services regulatory confusion is likely to grow. \4\ Regulatory
confusion may be particularly acute with the unbanked and
underbanked, who are more likely to have lower levels of
education than banked individuals. \5\ Addressing regulatory
confusion on the State and Federal level is necessary to ensure
consumers are protected.
---------------------------------------------------------------------------
\3\ Rob Nichols, ``BankThink: Bank or No Bank, Fintech Must Be
Regulated'', Am. Banker (Feb. 18, 2016, 9:30 AM), https://
www.americanbanker.com/opinion/bank-or-no-bank-fintech-must-be-
regulated.
\4\ A recent global survey on fintech adoption by EY found the
global average of fintech adoption as 33 percent, up from 16 percent in
2015. EY, ``EY Fintech Adoption Index 2017'' 6 (2017).
\5\ Fed. Deposit Ins. Corp., ``2015 FDIC National Survey of
Unbanked and Underbanked Households'' 15-16 (Oct. 20, 2016).
---------------------------------------------------------------------------
Unbanked and underbanked individuals who may utilize
fintech services instead of traditional banking services can
benefit from extension of existing privacy protections.
Specifically, the Health Insurance Portability and
Accountability Act (HIPAA) \6\ and the Fair Credit Reporting
Act \7\ can be modernized to apply to all companies that peddle
sensitive personal information. For example, HIPAA protections
do not govern health profiles compiled and traded by data
brokers and fintech firms. Further, Congress should require
data brokers to register with the FTC and allow individuals to
request immediate notification once they have been placed on
lists that contain sensitive data. In addition to expanding
already existing regulations, Congress should empower and
expand funding to Federal agencies, including the CFPB and the
OFR, to ensure these agencies have the resources necessary to
come to grips with a rapidly changing financial landscape.
---------------------------------------------------------------------------
\6\ Health Insurance Portability and Accountability Act of 1996,
Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered
sections of 18, 26, 29, and 42 U.S.C.).
\7\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
---------------------------------------------------------------------------
Fintech can be a means of opening up the financial industry
to unbanked and underbanked consumers but Federal and State
legislatures must be cautious about rushing to deregulate as a
means of spurring innovation. Some fintech may promote
competition and create new options for consumers, but it must
be fair competition. Further, Federal authorities should not
preempt State law meant to protect consumers. Although
preemption may be aimed at ensuring financial inclusion and
innovation, preemption of consumer protections can have
disastrous unintended consequences, as we saw in the mortgage
crisis of 2008. \8\ For example, the Office of the Comptroller
of the Currencys' (OCC) proposed plan to charter fintech
companies could have unintended consequences, such as enabling
regulatory arbitrage around State restrictions on pay day
lending. \9\ Regulatory arbitrage around State restrictions
could have negative impacts on the unbanked and underbanked
individuals the OCC is attempting to open the financial
industry to. \10\
---------------------------------------------------------------------------
\8\ For a discussion of regulatory arbitrage and opaque business
practices that sparked the 2008 mortgage crisis, see Frank Pasquale,
``The Black Box Society'' (2015), specifically Chapters 4 and 5.
\9\ ``Exploring Special Purpose National Bank Charters for Fintech
Companies'', Off. Comptroller Currency (Dec. 2016). For comments to the
OCC's paper, see ``Public Comments On Exploring Special Purpose
National Bank Charters For Fintech Companies'', Off. Comptroller
Currency, https://www.occ.gov/topics/responsible-innovation/fintech-
charter-comments.html (last visited Oct. 3, 2017).
\10\ See Comment, ``New Economy Project on Behalf of Signees, Re:
Exploring Special Purpose National Bank Charters for Fintech
Companies'' (Jan. 13, 2017), https://www.occ.gov/topics/responsible-
innovation/comments/comment-new-economy-project-fintech-charters.pdf
(comment letter from over 200 consumer, civil rights, and community
groups opposing the proposed OCC nonbank lending charters, stating that
``[s]tate laws often operate as the primary line of defense for
consumers and small businesses'' and they ``have also seen costly
payday lenders hide behind the costume of `fintech.' ''); Comment,
``Am. For Fin. Reform, Re: Exploring Special Purpose National Bank
Charters for Fintech Companies'' (Jan. 15, 2017), https://www.occ.gov/
topics/responsible-innovation/comments/comment-americans-for-financial-
reform.pdf (comment letter ``urging the OCC to refrain from issuing
charters to nondepository fintech lenders'' and explaining a broad
array of legal and policy issues that could arise); Comment, ``Ctr. For
Digital Democracy & U.S. Pub. Int. Res, Group, Re: Exploring Special
Purpose National Bank Charters for Fintech Companies'' (Jan. 15, 2017),
https://www.occ.gov/topics/responsible-innovation/comments/comment-cdd-
uspirg.pdf (comment letter opposing the proposed OCC nonbank lending
charters, stating ``lack of transparency around the processing of data
and automated algorithms may lead to increasing information asymmetries
between the financial institution and the individual and thus consumers
are left with less awareness and a lack of understanding and control
over important financial decisions.'').
---------------------------------------------------------------------------
It is important to remember consumer protections build
consumer trust. Consumer trust is an essential factor in
encouraging the unbanked and underbanked to utilize financial
services in general. For example, research by the FDIC reveals
unbanked and underbanked households have limited trust or a
complete lack of trust in the banking industry, which
influences how and if they utilize banking or other financial
services. \11\ Additionally, ``concern over security--real or
perceived--is one of the most significant barriers to [mobile
financial services] adoption for consumers.'' \12\
Deregulation, even if it is done with the goal of innovation
and inclusion, can lead to unintended consequences that weaken
trust in the financial system and eventually lead to more
unbanked and underbanked Americans.
---------------------------------------------------------------------------
\11\ Kristopher M. Rengert and Sherrie L.W. Rhine, Fed. Deposit
Ins. Corp., ``Bank Efforts To Serve Unbanked And Underbanked
Consumers'' (May 25, 2016), https://www.fdic.gov/consumers/community/
research/qualitativeresearch_may2016.pdf; Fed. Deposit Ins. Corp.,
``2015 FDIC National Survey of Unbanked and Underbanked Households''
(Oct. 20, 2016), https://www.fdic.gov/householdsurvey/2015/
2015report.pdf. According to the FDIC 2015 survey of unbanked and
underbanked households, one in four unbanked households ``do not trust
banks'' and ``[l]ack of trust in banks was the second most frequently
cited main reason for being unbanked.'' Id. at 60.
\12\ Mobil Financial Services, Consumer Fin. Protection Bureau
(Nov. 2015), http://files.consumerfinance.gov/f/201511_cfpb_mobile-
financial-services.pdf.
---------------------------------------------------------------------------
In conclusion, fintech can help build financial inclusion,
especially for the unbanked and underbanked; but there must be
proper protections to build and sustain consumer trust and
ensure consumers are protected. Diminishing regulatory
confusion, extending existing privacy protections, and
providing resources to agencies to keep abreast of the evolving
financial sector are all ways Federal and State regulators can
help protect the unbanked and underbanked and build consumer
trust. But regulators should not rush to deregulate to spur
innovation, nor should Federal regulators preempt State laws
aimed at protecting consumers, especially the unbanked and
underbanked.
Q.2. Are you concerned that fintech companies' use of new data
and algorithms could result in unintentional discrimination
against protected classes under Federal anti-discrimination
laws? If so, should Congress or Federal regulators consider
legislation or regulatory guidance to ensure compliance?
A.2. The breadth and scope of data being accumulated and used
by companies to determine broad aspects of a person's life is
expanding, often without consumers' knowledge. \13\ Further,
algorithms utilizing this data are opaque and consumers cannot
easily determine the types of data being used or if the data is
correct. The opaque process coupled with more varied datasets
has the potential to produce ``discriminatory scoring.'' \14\
The potential for discriminatory results is especially
troublesome in the fintech industry, where discrimination, even
if unintended, can have far reaching financial implications.
---------------------------------------------------------------------------
\13\ This answer was prepared by Jennifer Smith, Ryan H. Easley
Research Fellow at the University of Maryland School of Law, after a
request with initial guidance from Frank Pasquale, the witness.
Professor Pasquale has reviewed the response and believes it to be a
fully responsive response to the question.
\14\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
Era of Big Data'', 18 Yale J.L. & Tech. 148, 149 (2017). This article
is the result of collaboration among lawyers and data scientists on the
issues of big data's use in credit scoring.
---------------------------------------------------------------------------
Fintech companies' use of new and nontraditional data and
algorithms could result in unintentional discrimination against
protected classes under Federal anti-discrimination laws. A
firm's best intentions to abide by fair lending,
nondiscriminatory practices may be usurped by machine learning
systems that use neutral data but ``treat them as proxies for
immutable or sensitive characteristics,'' such as gender, race,
or socioeconomic status. \15\ For example, Penny Crosman,
Editor at Large at American Banker, recently wrote about the
potential threats to fair lending by machine learning systems
and artificial intelligence, stating ``a system that considers
college data could start recognizing that graduates of a
particular school are a good credit risk, and those students
may be from mostly privileged socioeconomic backgrounds.'' \16\
Further, Privacy International recently reported on types of
nontraditional data being used to determine creditworthiness,
which many consumers may not realize is being accumulated,
including people's networks on social media, \17\ the manner in
which a person fills out an online form, \18\ and if a person
posts about political issues on social media. \19\ As Mikella
Hurley and Julius Adebayo acknowledge an ``overabundance of
data points . . . may lead to increased accuracy in the
modeling, [but] it can also increase the incidence of spurious
correlations.'' \20\
---------------------------------------------------------------------------
\15\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
Era of Big Data'', 18 Yale J.L. & Tech. 148, 190 (2017).
\16\ Penny Crosman, ``Is AI a Threat to Fair Lending?'', Am.
Banker (Sept. 7, 2017, 4:21 PM), https://www.americanbanker.com/news/
is-artificial-intelligence-a-threat-to-fair-lending.
\17\ ``Case Study: Fintech and the Financial Exploitation of
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Bethy Hardeman,
``Lenddo's Social Credit Score: How Who You Know Might Affect Your Next
Loan'', Huffpost (June 15, 2012, 9:30 AM), http://
www.huffingtonpost.com/bethy-hardeman/lenddos-social-credit-
sco_b_1598026.html (describing Lenddo's use of a person's ``Trusted
Network'' and an algorithm ``to measure truthfulness, behavioral and
demographic clues'' to determine if a person qualifies for a loan).
\18\ ``Case Study: Fintech and the Financial Exploitation of
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Jeff John Roberts,
``Bad Credit Is a Bonanza for Online Lender, But Critics Cry Foul'',
Fortune (July 9, 2015), http://fortune.com/2015/07/09/elevate-online-
loans/ (describing Elevate's tool, Rise, which uses a person's FICO
score and nontraditional data, such as if ``someone appears too hasty
to fill out the loan form,'' to assess creditworthiness).
\19\ ``Case Study: Fintech and the Financial Exploitation of
Customer Data'', Privacy Int'l (Aug. 30, 2017), https://
www.privacyinternational.org/node/1499. See also Mugdha Variyar and J.
Vignesh, ``The New Lending Game, Post-Demonetisation'', Econ. Times:
Tech. (Jan. 6, 2017, 3:05 PM), http://
tech.economictimes.indiatimes.com/news/technology/the-new-lending-game-
post-demonetisation/56367457 (quoting a lending platform's founder as
stating ``[i]f someone is politically active and engages in political
campaigns, which are visible through their social media profiles, it is
not a good sign.'').
\20\ Mikella Hurley and Julius Adebayo, ``Credit Scoring in the
Era of Big Data'', 18 Yale J.L. & Tech. 148, 177 (2017).
---------------------------------------------------------------------------
Congress and regulators need to understand the types of
data being used by fintech firms as well as how the data is
being used. Knowledge of what fintech firms are doing is very
important, especially relating to data collection, data use,
and security and privacy. Based on this knowledge Congress and
regulators should develop guidance and/or legislation to ensure
suspect sources of data are not influencing fintech firms'
decisions in discriminatory ways. Machine learning and
predictive analytics are not too complex to regulate.
Regulations should make firms more accountable. Specifically,
firms should have ``algorithmic accountability,'' meaning firms
are transparent with what data is being used and how algorithms
use the data. \21\ Further, although a computational process
may be complex, regulators can demand to know what datasets are
used in the process.
---------------------------------------------------------------------------
\21\ See Megan Rose Dickey, ``Algorithmic Accountability'',
Techcrunch (Apr. 30, 2017), https://techcrunch.com/2017/04/30/
algorithmic-accountability/;
---------------------------------------------------------------------------
Existing privacy protections in other areas of the law can
and should be extended to cover the consumer data now fueling
fintech underwriting. Specifically, the Health Insurance
Portability and Accountability Act (HIPAA) \22\ and the Fair
Credit Reporting Act \23\ can be modernized to apply to all
companies that peddle sensitive personal information. For
example, currently, HIPAA protections do not govern health
profiles compiled and traded by data brokers and fintech firms.
A data broker could obtain information concerning a consumer's
health related purchases, such as diabetic testing strips,
pregnancy tests, or medications. \24\ This data could create
``inferences about sensitive consumer preferences and
characteristics.'' \25\
---------------------------------------------------------------------------
\22\ Health Insurance Portability and Accountability Act of 1996,
Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered
sections of 18, 26, 29, and 42 U.S.C.).
\23\ Fair Credit Reporting Act, 15 U.S.C. 1681 (1970).
\24\ See ``Fed. Trade Comm'n, Data Brokers: A Call For
Transparency And Accountability'' 14 (May 2014).
\25\ ``Fed. Trade Comm'n, Data Brokers: A Call For Transparency
And Accountability'' viii (May 2014).
---------------------------------------------------------------------------
Congress should require data brokers to register with the
Federal Trade Commission and allow individuals to request
immediate notification once they have been placed on lists that
contain sensitive data. Regulations can help make consumers
aware of the vast information landscape their data is being
brokered and used in and the potential for unintentional
discrimination based on this data. Further, consumers should
have the ability to challenge and amend incorrect data. The
right to be notified about the use of one's data and the right
to challenge and correct data errors is fundamental.
In addition to the above, Congress and Federal regulators
should empower and expand funding to Federal agencies like the
Consumer Financial Protection Bureau (CFPB) and the Office of
Financial Research (OFR). These agencies require the resources
necessary to come to grips with a rapidly changing financial
landscape. Empowering and expanding funding will allow the CFPB
and OFR to develop and implement strategies to ensure
compliance with Federal anti-discrimination laws and consumer
protections.
In conclusion, Fintech companies' use of new and
nontraditional data and algorithms could result in
unintentional discrimination against protected classes under
Federal anti-discrimination laws. Use of expanding and varied
datasets and new algorithms can be beneficial and may ``force[]
decisions onto a more reliable empirical foundation by
formalizing decision-making processes, thus limiting the
opportunity for individual bias to affect important
assessments.'' \26\ But there is also the real potential for
unintentional discrimination. Congress and Federal regulators
need to understand the types of data being used by fintech
firms as well as how the data is being used in order to
determine appropriate regulations that will protect consumers
from inappropriate and inadvertent discrimination.
---------------------------------------------------------------------------
\26\ Solon Barocas and Andrew D. Selbst, ``Big Data's Disparate
Impact'', 104 Cal. L. Rev. 671, 676 (2016).
Additional Material Supplied for the Record
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
[all]