Quote of the Day: KYC --> EPS

An organization that positively knows its clients can obtain a commercial advantage over rivals.
- KPMG, Anti-Money Laundering Compliance in a Changing Risk and Regulatory World

Food for New Years Thought: The Future of Banking

Every consultant worth his salt is busy trying to write something prescient on the future business model for banks. GLG Research recently published a report calling out the following key parameters, with a focus on retail banking:

1. Peer-to-Peer (P2P) Lending: An advanced technology that eliminates middlemen and directly connects borrowers and lenders.

2. Prepaid General Purpose Reloadable (GPR) cards: In return for modest commissions, a global agency network of convenience stores and retailers are now enabling cards to be “loaded” with cash. When equipped with remote deposit check capture, direct deposit, bill payment and ancillary credit, savings and investment accounts, these cards make traditional bank branching redundant. eWallets such as those touted by ISIS, Google, Visa, Amex, Paypal and FaceCash are the offspring of GPR built on the same infrastructure; similar economics but a different, arguably more convenient, access device.

3. Social Media: Social media like Facebook and LinkedIn can offer insight into customer behavior that can be applied to enhance customer acquisition, retention, and even underwriting (http://www.freepatentsonline.com/20110112957.pdf).

Banks which are early movers in this area have a great opportunity to reverse the post-2007 profitability decline. Success, in my opinion, will depend on three things:

• Getting it done quickly
• Getting the customer experience right
• Getting the risk management right

Those aims are, in many areas, conflicting. A balancing act is required. Wading too timidly into these areas might cause impatient "early adopter" customers to defect, or at least decrease their activity level. Making a big splash in these areas without consideration of risk factors invites the wrong kind of customers and is sure to balloon losses.

Critical to all three of these emerging trends are the "Three Risk-Management A's of Next-Generation Banking"

1. Analytics: Collecting the necessary data about behavior as well as customer preferences to objectively understand and address behavior in a consolidated, risk-based, customer-centric manner 
2. Authorization: Making an informed, risk-based decision about what the bank allows the customer to do
3. Authentication: Making sure the transaction is being done by the customer, not a fraudster

Periodically on this blog, I will individually look at these trends, highlighting the risk implications for the future banking business model.

Employee Fraud Thanks to the Cloud

Peer-to-peer and cloud-based file sharing may have been designed by punk kids to get free music, but now some of those punk kids are punk employees of the world's financial institutions. They have not forgotten their craft, according to the Federal Trade Commission:

"when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the P2P network. ... we found health-related information, financial records, and drivers’ license and social security numbers--the kind of information that could lead to identity theft."
 -- FTC Chairman Jon Leibowitz on the FTC's website.

A very small fraction may intentionally use these technologies to steal sensitive or private information about the institution or its clients, but a far larger number are unwittingly exposing this information to the open Internet.


Coverage also at the Washington Post.
Many of my clients block P2P clients and websites as well as related traffic on company-owned PCs within the institution's firewall. PCs on desks in offices are probably safe. But before you pat yourself on the back, though, make sure you're looking at all potential exposure points. Wherever there's a hole punched in your corporate firewall, there's a potential loss. Ask yourself two questions:

1. Is the same level of protection and surveillance being placed on VPN, email, webmail, virtual web conferencing, mobile email, and all other devices which span across your firewall DMZ?
   
2. Is your monitoring / blocking technology based solely on the sources and destinations of traffic (ex. "safe" and "prohibited" IPs) or does it also monitor content? Perfectly benign channels such as email or virtual web conferencing usually allow files to be transmitted outside the institution in order to facilitate essential communication and collaboration. Can you, without killing these valuable tools, control WHAT data is transmitted?

 If not ... time to make a little space on the roadmap for new controls.

What the C-suite Needs to Know about Fraud: Elevator Pitch #4

What the C-suite Needs to Know about Fraud: Elevator Pitch #3

What the C-suite Needs to Know about Fraud: Elevator Pitch #2

What the C-suite Needs to Know about Fraud: Elevator Pitches

Over the coming weeks, I'll be using this blog to suggest a set of "elevator pitches" relating to bank fraud management. This episode gives some background, as well as Pitch #1.

For most of my colleagues in banking, this is a stressful time of year. Yeah, the holidays are upon us. Yeah, the kids have holiday shows and final projects to prepare for. Yeah, there is a long list of presents to buy. Yeah, the home team is one game away from a bowl. For bankers, atop all of that, this is prime-time budget and planning season. Their fate is determined for at least the next 12 months through a gauntlet of analysis and discussion about prioritization, roadmaps, and funding.

The same is equally true for my colleagues in the software industry as they determine what the future holds for their products. Even us consultants get together for tealeaf-reading sessions, trying to anticipate the coming needs of our clients.

This period can be exhausting, but one great side-effect is that a bunch of senior people put their heads together. This is a perfect opportunity for people across the organization to educate each other and especially the C-suite on "whats hot" in their area.

In between discussions, in halls, elevators, conference rooms, and on conference calls, there is inevitably some idle time. If you find yourself in one of those moments with your boss's boss's boss, don't blow the moment by hiding in your Blackberry to avoid the awkward silence. Tell them something that will stick with them ... give them your elevator pitch!