Banks have traditionally been the institutions with the most information on their customers. It has enabled them to understand creditworthiness, and to price the risk accordingly in terms of interest rates and fees.
The era of big data, however, is rapidly changing that.
Already in Australia, retailers such as Coles and Woolworths have huge amounts of information on their customers. But the amount of data they hold is eclipsed several times over by the data held by leading technology companies such as Facebook, Apple and Amazon.
Most of that data is still not being used. But when it is, the impact will be the biggest fundamental challenge to banking in the past 400 years, according to Ross Buckley, a scientia professor and the King & Wood Mallesons chair of international finance law at UNSW.
For a glimpse into the future, look to China – where new e-commerce companies such as Alibaba have moved into financial services as providers of loans. Alibaba says that in any loan application it is able to access as many as 20,000 data points in its assessment.
When the situation progresses to this point in Australia, it will not only require a significant response from banks, but also from regulators which will have to balance up issues such as data use and ownership, privacy and competition in a new framework appropriate to digital finance.
With colleagues from the universities of Hong Kong and Luxembourg, Buckley has analysed the impending changes in From FinTech to TechFin: The Regulatory Challenges of Data-Driven Finance.
FinTechs are generally small start-up businesses created to solve niche issues for consumers and businesses, whereas TechFins are large and established technology companies that are inexorably becoming involved in financial services.
More and more, FinTechs are collaborating with banks and are often being acquired by them, becoming part of their service capabilities – while TechFins have the potential to evolve into major challengers.
"The party that is best equipped to price a loan to you is the party who knows the most about you," says Buckley. "Increasingly, this is not going to be a bank."
'The FinTechs today are often digitising money but the longer-term game is about monetising data'
– ROSS BUCKLEY
New financial players
The first step for TechFins is as a "conduit" to the banks.
"I can see a time when Facebook will become the way young people access financial services, but Facebook won't provide the services," notes Buckley.
"There will be a bank in the background and there will probably be several of them, but you won't care too much about which bank it is."
This shift will bring Facebook into the focus of financial regulators as a significant new channel. Already in the US, Facebook users are able to transfer funds to other users for free, and the range of services is only set to grow.
"Beyond working as a conduit, the next issue is whether these TechFins will use the data they have to go into financial services themselves," says Buckley.
"As one of my Hong Kong colleagues says, the FinTechs today are often digitising money but the longer-term game is about monetising data."
If the regulatory regime does not change and adapt, banks will not be competing on a level playing field. They will continue to be subject to regulation and hefty compliance obligations which their newest competitors, the TechFins, will avoid.
"They will be financial services players without falling subject to regulation," says Buckley.
"All of a sudden they will be significant in the financial system, but if they are not taking deposits or making loans directly then they won't trip the current triggers that have prudential regulation applied to them.
"But they could develop into major players in financial services and become central to it well before the regulators say, 'wait a minute you need to be regulated as a bank'."
The comprehensive right
As banks face what is an "existential threat" to their dominance, another big and disruptive influence may come in insurance.
Data from health monitoring devices such as Fitbit could be fed into calculations of health insurance premiums, along with weekly shopping bills which would allow assessments of healthy or unhealthy eating patterns.
"In this scenario some people will get a lower premium as a result, but that will mean a higher premium for someone else," says Buckley.
"Disaggregating risks and giving people premiums suited to their own risks will mean that affluent people will pay less and disadvantaged people will pay more, so that would fundamentally turn the whole thing upside down."
Australia is moving in this direction as the financial system moves to embrace the concept of 'open banking' where banks share customer data with third parties, while at the same time giving people access to the data held on them. This is known as the comprehensive right.
The Productivity Commission released an interim report on data in early 2017, and the federal government has followed up with an independent review, commissioned in July, led by Scott Farrell of King & Wood Mallesons.
At the Australian Securities and Investments Commission (ASIC), the regulator is supportive of the changes, but in balance.
"The proposed comprehensive right may enable the creation of more tailored or new products and services which help make better decisions," says ASIC's submission to the Productivity Commission.
These new products, says ASIC, are likely to come from making aggregated data available to third parties.
While this could foster product innovation, such as "personalised recommendations based on revealed preferences drawn from data about a consumer's past behaviour", there would also be risks that would require further regulation.
"These issues are most acute where the third party's interests may not be aligned with consumers' interests and consumers may not be aware of the consequences," the ASIC submission says.
'When we talk about sharing and use of data, we want to be clear on the parameters, and any restrictions on sharing'
– JOHN WALLACE
Buckley believes it is clear that Australia is moving to open banking, and advises the banks to "get on board with this".
"This is an existential threat to them, and they need to be more savvy about using the data they have got and acquiring more data," he says.
As for the regulators, Buckley says they are "working hard to understand what they need to do" because they understand the magnitude of the impending change.
There is another category of start-up, the so-called RegTechs, which are leveraging technology to assist banks to meet their regulatory requirements and respond to new regulations around anti-money laundering and Know Your Customer requirements, potentially saving the banking system globally up to $20 billion a year in the process.
"However, the real future of RegTech is empowering regulators in close to real time," says Buckley.
"At the moment they are getting so much information but it sits on their books and when there is a problem they trawl back through it, but that is very low value use.
"High value use would be to have artificial intelligence and machine learning scanning across it as it comes in and giving regulators real time guidance on where stresses are occurring."
ASIC has responded with its own data strategy, which outlines how the regulator will "transition into a more data driven and intelligence led organisation" as part of the "One ASIC" strategy to "connect the dots" to achieve better regulatory outcomes.
Recent initiatives have been to establish the position of chief data officer, create a data science laboratory, and build frameworks to strengthen governance for its own data.
"When we talk about sharing and use of data, we want to be clear on the parameters, and any restrictions on sharing," says John Wallace, ASIC's chief data officer.
"Organisations today are becoming more technology and data driven. Innovation and the pace of change in these areas is really unprecedented, so for ASIC it is the right time."