For other versions of this document, see http://wikileaks.org/wiki/CRS-RL31327 ------------------------------------------------------------------------------ Order Code RL31327 CRS Report for Congress Received through the CRS Web Internet Banking: Changing Expectations and Regulations March 12, 2002 Walter W. Eubanks Specialist in Economic Policy Government and Finance Division Congressional Research Service ~ The Library of Congress Internet Banking: Changing Expectations and Regulations Summary Despite the surge in customers singing up for Internet banking in the aftermath of the 911 attacks on New York and Washington and the anthrax scare that followed, Internet banking is not growing as fast as expected before or after the attacks. A main reason is consumer confidence in and familiarity with the paper-based payment methods of cash and checks. Many smaller banking institutions viewed the prospect of Internet banking as providing opportunities to expand their services beyond their brick and mortar establishments and compete with larger banks. But the fixed cost of establishing transaction Internet sites is having a greater impact on the bottom lines of smaller banks. To overcome this problem, Internet bankers might be waiting until they have a critical mass of users before imposing or raising the user fees on this channel to banking services, as they did with automated teller machines (ATMs). Congress and regulators have been moving rapidly to set up regulations and oversight to protect consumers from the new risks Internet banking has introduced. The Gramm-Leach-Bliley Act of 1999 (P.L. 106-102) and the Electronic Signatures in Global and National Commerce Act of 2000 (P.L. 106-229) both address regulatory issues pertaining to electronic banking. Since the 911 attacks Congress passed the USA PATRIOT Act (107-56) that makes it easier for law enforcement to monitor Internet activities, including banking. Regarding innovations in Internet banking technology, banking regulators have taken the stance not to interfere with the innovation process for fear of stifling them. Despite the stance, regulatory agencies have implemented rules which tend to make Internet banking more costly. This report will be updated as legislative and economic developments warrant. Contents Internet Banking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Bankers Lower Their Growth Expectations . . . . . . . . . . . . . . . . . . . . . . . . 2 Bank Costs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Consumer Adoption Is Slower Than Expected . . . . . . . . . . . . . . . . . . . . . . . . . . 3 The Paper-based are still preferred . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Internet Banking Profitability Is Below Expectations . . . . . . . . . . . . . . . . . . . . . 4 Internet-Only Banks Are in Difficulty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Large Banks' Internet Banking Profitability is Unclear . . . . . . . . . . . . . . . . 6 The "Critical Mass" Problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Regulatory Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Congress and Federal Regulatory Agencies . . . . . . . . . . . . . . . . . . . . . . . . 7 The Regulatory Agencies' Stance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Regulatory Examination of Internet Banking Operations . . . . . . . . . . . . . . 9 Internet Banking: Changing Expectations and Regulations Internet Banking The term Internet banking refers to conducting banking business over the Internet. Depository institutions use this channel to offer their customers a range of services that very widely among institutions. The services offered include examining balances, transferring funds between accounts, applying for credit, making electronic bill payments, and bill presentations (where payees send their bills via the Internet to a payer's bank, which pays them). Some also offer insurance and brokerage services. In addition, business Internet banking enables businesses to apply for loans, initiate wire transfers, and use cash management and payroll services over the Internet. Most depository institutions conducting Internet banking are depository institutions with physical offices, but some Internet bankers are Web-based, Internet- only banks.1 Internet-only banks are also called "virtual banks." At the heart of these virtual banks are computer servers that may or may not be located at the legal address of the virtual bank. Virtual banks take deposits and make payments primarily through automatic teller machines and through the mail. In the mid-1990s, Internet banking supplanted but did not eliminate personal computer (PC) banking, where the bank's proprietary software resides on each customer's PC and business is conducted over private networks. PC banking provides basic banking and billpaying services but relies heavily on the U.S. Postal Service for the delivery of many payment checks. In contrast, Internet banking relies heavily on "e-pay," which electronically transfers money directly into the accounts of the payees in other depository institutions through electronic networks. Internet banking, however, also uses the mail to deliver payments when an institution uses checks instead of paying electronically. PC banking is more costly than Internet banking for the depository institutions and their customers because it requires maintaining a costly, proprietary network infrastructure of hardware and software. By contrast, some of the Internet banking infrastructure is in the freely accessible public domain, which accounts for its lower costs relative to PC banking. 1 Robert DeYoung, "The Internet's Place in the Banking Industry," Chicago Fed News Letter, The Federal Reserve Bank of Chicago, vol. 163, March 2001, p. 2. CRS-2 Bankers Lower Their Growth Expectations Almost 20% of the customers of a few major depository institutions are banking online over the Internet. However, Internet banking has made some depository institutions (especially smaller ones) less profitable, and half of the Internet banking-only banks have gone out of business.2 A September 2000 study conducted by the Office of Comptroller of the Currency (OCC) concluded that five banks account for about 36% of Internet bank users. Most banks that offer Internet banking are currently serving a relatively small share of their customer base. In late 1999, about 5 million households used online banking. These customers had been expected to grow to about 32 million by the end of 2002, one-third of the 93 million households with a banking relationship. These predictions have been revised downward. In 2000, just 6% of banking transactions were done online. Bankers now expect the same rate for 2001, having earlier projected 9% for 2001.3 In the aftermath of the 911 attacks it is estimated and the anthrax scare, it was estimated that there were about 7.5 million Internet banking customers. "Whether people are anxious about cross contaminated mail or about delays that could result in late mortgage and credit-card payments, more customers are turning to online banks."4 However, most banking transactions continue to be conducted at branches, through the mail, by telephone, or over the automated teller machine (ATM) networks. Bank Costs Banking via World Wide Web sites offers depository institutions and their customers advantages over traditional banking. To customers, the convenience of accessing their financial information 24 hours a day has a strong appeal. The institutions benefit from cost savings that occur when customers perform the transactions without tellers or telephone representatives. Driven on by the reported low variable cost, many smaller banking institutions saw Internet banking as an opportunity to expand services beyond brick and mortar establishments to compete with larger banks. According to one variable cost estimate, branch banking cost about $1.07 per transactions, telephone cost about $0.55 per transaction, ATM banking cost about $0.27 per transaction, and Internet banking cost about $.01 per transaction.5 However, there are also disadvantages. For the depository institutions, there are the fixed costs of building infrastructures of hardware, software, and personnel. Designing an Internet banking Web site costs on average around $25,000, but the 2 Jeremy Quittner, "Internet-Only Banking: A Game of Survivor,"in The American Banker Special Report: Retail Delivery Innovation in Marketing and Technology, Sept. 11, 2001, p. 8A. 3 Lauren Weber, "Reality Check: Less Expected of Web Banking," Ibid., p. 17A. 4 "Should you Bank online?" Consumer Reports, Feb. 2002. p. 28. 5 DeYoung, p. 2. CRS-3 costs of a transaction distribution and customer service web site for a medium size bank could be as high a $150 million.6 Consumer Adoption Is Slower Than Expected For the customers, Internet banking offers fewer opportunities for personal interaction with banking personnel and places more responsibilities on the customer, which some customers clearly do not want. Customers are responsible for the physical security of computers, personal identification numbers, and the accuracy of a transaction entry.7 Consumers are increasingly concerned about identity theft and depository institutions' privacy policy.8 Most consumers are concerned that hackers may break into computers servers and get their personal information and account numbers, according to Consumer Reports. " Once hackers have your Social Security number and date of birth, both of which may be attached to your bank account, they can open credit cards in your name, run up bills and wreak havoc with your financial life. Fortunately, security breaches have been rare."9 Even so, the concern has prevented bank customers from banking online. Internet banking costs may discourage potential customers. The monthly fees for basic Internet banking services run from free to $10.00 in the Consumer Reports sample of 15 Internet banking providers.10 Basic service enables the customer to check account balances and transfer funds between accounts. In addition, minimum required account balances vary from none to $3,000, and the monthly costs can be higher for additional services such as billpaying services. In the case of Bank of America, there is a monthly fee of $5.00 for the basic service and an additional $5.95 fee for billpaying services. For other Internet bank customers, the price of some services are on a per transaction basis. There are other reasons for consumer resistance to using Internet banking. The number one reason for customers who signed up for online banking but stop using it is that it was "too complicated"(27%). The second reason was that they were "dissatisfied with services"(25%). Of those discontinued users in the surveyed 52% gave these two reasons for having stopped using online banking. Other reasons given were "no need/not interested" (21%), "security concerns" (11%), "cost too much" (11%), and "privacy concern"(5%).11 An explanation for the small percentage with 6 Weber, p. 15A. 7 CRS Report 98-67 STM, Internet: An Overview of Key Technology Policy Issues affecting its Use and Growth, by Marcia S. Smith, et al. 8 See CRS Report RS20185, Privacy Protection for Customer Financial Information, M. Maureen Murphy; and CRS Report RS20035, Internet Privacy: Overview and Pending Legislation, by Marcia S. Smith. 9 Consumer Report, p. 29. 10 Ibid., p. 31. 11 Doug Johnson, "Trend in Technology: Internet Banking, (continued...) CRS-4 privacy concerns is that concerns about privacy would be greater for customers actually using Internet banking than those who have stopped using this channel of banking services. The Paper-based are still preferred A dominant reason for the slow growth of Internet banking is the satisfaction of the public with the paper-based methods of payments. In 2000, approximately 70% of total consumer transactions used paper-based methods of payments of cash and checks. Payments by check are first in terms of value and second only to cash in terms of the number of transactions, and almost half of all consumer expenditure payments were made by checks in 2000.12 According to a Federal Reserve Study, nearly 50 billion transactions in 2000 involved checks, with a value totaling $47 trillion.13 Some analysts argue that banking customers prefer checks because the float enables the payer to earn interest income while the check is being cleared and settled. But there are other important reasons for the popularity of checks. Checks offer the users greater flexibility and control of payment initiation, legal standing, user familiarity, and an automatic receipt in the form of a canceled check. Together these characteristics probably explain the dominance of checks over more efficient methods of payment like credit cards and Internet banking. Cash is preferred and more efficient particularly for small purchases. For small payments cash is the only method that requires no promises to pay, or confirmation of payment. Internet payments involve costs of confirming payments; even though they are small in most cases, sometimes they are quite high in terms of time and bank fees. For these reasons Internet banking is not expected to replace a significant part of paper-based payments system in the near future. Internet Banking Profitability Is Below Expectations Bankers are discovering that developing and maintaining a transaction Internet Web site is more costly than expected in light of slower than expected customer acceptance.14 These costs have had a severe impact on some smaller banks offering Internet banking. Smaller brick and mortar banks offering online banking have had high expenses and large losses. An OCC study concluded that "Internet banking may be a 11 (...continued) [http://www.aba.com/aba/PDF/TrendinTechnolgy.pdf] , visited March 6, 2002. 12 See "Consumer Payment System," The Nilson Report, issue 753, Dec. 2001, p. 3. 13 Financial Services Policy Committee, Fed Announce Results of Study of the Payments System First Authoritative Study in 20 Years, Federal Reserve of Boston, [http://www.frsbservices.org], last visited December 1, 2001. 3p. 14 Alan Kline, "Pro-online Despite Bad Bottom-Line Data," American Banker, March 5, 2002. [http://www.americanbanker.com], last visited March 6, 2002. p. 2. CRS-5 primary reason why small particularly de novo institutions are unprofitable."15 However, some smaller banks offering Internet banking have been able to generate sufficient revenues from fee income on other banking business lines to overcome their high expenses. The lower than expected profitability is the direct result of greater than expected expenses to install online banking applications. In addition, Internet banking customers are not as self-sufficient as anticipated. The result is that while the infrastructure expenses are higher than expected, the variable costs exceed expectations as well. Internet banking customers still want contact with human beings while conducting banking over the Internet. Installing Internet banking was expected to cut back bank operating personnel hours and to produce significant savings. Instead, Internet banking has extended banking hours around the clock, "always on," and increased expenses such as hiring e-banking specialists whose duties include visiting customers who might need instructions in paying bills online.16 Internet-Only Banks Are in Difficulty Virtual or Internet-only banks have been racking up losses for so many years that some owners have had to close their doors. "Many industry analysts and observers predict a continuation of the consolidation wave and do not expect the bulk of the estimated 50 Internet-only banks in the United States to survive the next three to five years."17 Analysts believe that Internet bank customers need branches where customers can speak to representatives about complicated transactions such as mortgages. Without offices, Internet-only banks, for example, have to pay for the use of other banks' ATMs. Similarly, on the other side of the balance sheet, because Internet-only banks offer better interest rates on deposits than the competition, they attract less reliable and less profitable customers, who are shopping only for the best rates, and are uninterested in a long-term banking relationship. Under strangling costs, many Internet-only banks have consolidated with brick and mortar banks that offer online services. For example, Wingspan.com was folded into Bank One after tremendous losses and Citigroup ultimately terminated Citi f/i as an Internet-only bank because of losses. The surviving Internet-only banks, like E-Trade bank, have found a niche for themselves. E-Trade bank offers brokerage customers financial products that complement its parent company, E-Trade Groups (an Internet equities brokerage firm). 15 Richard J. Sullivan, "How Has the Adoption of Internet Banking Affected Performance and Risk in Banks?" Federal Reserve Bank of Kansas City, Financial Industry Perspectives 2000, December 2000, pp. 1-3., and Karen Furst et al., "Internet Banking: Developments and Prospects," Office of the Comptroller of the Currency, Economic and Policy Working Paper 2000-9, Sept. 2000, 57 pp. 16 Kline, p.2. 17 Quittner, p. 8A. CRS-6 Large Banks' Internet Banking Profitability is Unclear For the larger banks, the correlation between profitability and Internet banking is not clear. The unprofitability of new, smaller, Internet-only banks is linked to the cost of providing Internet banking. Large banking institutions have not released information on their different banking activities, nor can the information be easily derived from the consolidated data they release. Some analysts believe that Internet banking has also had a negative impact on some large commercial banks' profits; however, revenues from other profit centers overwhelm their losses on Internet banking. The "Critical Mass" Problem Both the benefits and the costs of using Internet banking depend on the number of users. Because Internet banking is conducted over the World Wide Web network, it is subject to network externalities. Network externalities arise when the benefit a consumer expects to receive from a good or service depends on the number of consumers using the good or service. The fax machine is the classic example: If only one business owned a fax, the machine would have no practical value. The existence of a second machine would increase the benefits to the first machine's owner by activating the potential for sending and receiving faxes. Each additional fax installation in a different location would increase the benefits to existing users. The benefits to a new fax machine purchaser would depend on the number of machines already installed. This interdependency of demand means that the market for network goods such as Internet banking services must meet a minimum size before the network can break even or achieve a sustainable equilibrium. This minimum size of the network is called "critical mass."18 The problem this concept poses for Internet banking providers and all networks is that it is not very helpful in determining the size of the market. After the beforehand unknown critical mass is reached, market dynamics usually change considerably. The market for Internet banking might grow slowly until reaching critical mass and then suddenly begin expanding at a very rapid rate. An example to illustrate this market behavior is the credit card market in the 1960s and 1970s. The growth rate of the credit card market was slow, but began growing very rapidly in the 1980s and 1990s. Another example is electronic funds transfer at point-of-sale terminals, which are currently at almost every major supermarket checkout counter. This method of payment grew very slowly up to the 1990s, when it took off. Without knowing the size of the market Internet banking providers are unable to determine their share of the market and thus unable to determine the optimal Internet banking capacity needed. Bankers don't believe Internet banking has reached its critical mass with only roughly 6% of bank customers using Internet banking. However, they are not able to forecast the size of the Internet banking market at critical mass or after critical mass is reached. Banking analysts believe that once critical mass is reached, the up-front fixed 18 See Nicholas Economides and Charles Himmelberg, "The Economics of Networks," International Journal of Industrial Organization, Vol. 14, Oct. 1996, pp. 673 ­99. CRS-7 costs, including infrastructure, security, and regulatory compliance costs will be distributed over a larger number of customers, and the variable costs per Internet banking transaction will be negligible. These analysts argue that banks are planning to recoup their losses in the long term when they are expected to raise the price of providing Internet banking services. This strategy is the same as what the industry used with their automated teller machines. Depository institutions first offered ATM services free, or below cost, to build customer use to a critical level and then imposed fees.19 Customers accustomed to using ATMs continued to use them despite the greater cost. The same strategy is expected eventually to make Internet banking a major profit center. Regulatory Policy Congress and Federal Regulatory Agencies Congress has left it to the federal regulatory agencies to make sure that electronic financial transactions are in compliance with regulations governing traditional paper-based transactions. However, as illustrated by a number of congressional hearings concerning the Internet and Internet banking, Congress has relied on its oversight responsibilities to monitor developments. Congress has passed only two laws that are significantly related to Internet banking. The Gramm-Leach-Bliley Act of 1999 (P.L. 106-102) requires federal regulators to issue guidelines to ensure that electronic banking activities are conducted in keeping with safety and soundness regulations. The regulatory agencies were able to issue these guidelines by January 2001. The Electronic Signatures in Global and National Commerce Act of 2000 (P.L. 106-229) provides that no contract, signature, or record may be denied legally binding status only because it is in electronic form. It also placed similar disclosure requirements on electronic banking as there are on paper-based payments. Congress is expected to continue to monitor regulatory developments under its oversight responsibilities. The Regulatory Agencies' Stance. In certain respects, the federal regulatory stance toward electronic financial transactions meets the expectations of neither consumers nor the banking industry. On one hand, the regulatory stance is not to interfere with the introduction of new technologies because electronic banking regulations could stifle such innovations by locking the banking industry into fewer beneficial technologies. On the other hand, federal and state regulatory agencies have developed procedures and examinations for Internet banking that are costly for Internet bankers to comply with. As Fed Chairman Alan Greenspan stated, "If we wish to foster financial innovation, we must be careful not impose rules that inhibit it. I am especially concerned that we not attempt to impede unduly our newest innovation, electronic money, or more generally, our increasingly broad electronic payments system.... To 19 When ATMs were first introduced, there were no fees for using other banks' ATMs to encourage widespread usage. It was in the mid-1990s when ATMs became very popular that banks began imposing fees for using "foreign ATMs" ­ other banks' ATMS. Consumer advocates accused the banking industry of exploiting consumers with these fees. CRS-8 develop new forms of payment, the private sector will need the flexibility to experiment, without broad interference by government."20 However, some analysts interpret this stance as a wait-and-see policy, allowing the industry to do what it wants. Regulators, they argue, should be more proactive in helping consumers make choices among new technologies through which banking services are being offered. Neither individual consumers nor consumer advocacy organizations have the resources to participate in all the standard-setting projects now underway.21 Without input on behalf of consumers in standard-setting projects, genuine consumer preferences may not be taken into account. Consumers look to the regulators to intervene on their behalf before new forms of electronic banking are introduced. Some argue that regulators' sensitivity to consumers could lessen consumer resistance to changes in the U.S. electronic payments infrastructure. Risk Management Regulators are concerned about the new risks that accompany Internet banking. The Bank for International Settlements (BIS) has published special risk management guidelines for banks and the regulators who supervise providers of Internet banking.22 The overarching concern for banks offering Internet banking is security control, which begins with authentication and access to privileged financial data. A security breach can lead to significant losses in a short period of time because of the dynamic environment in which Internet banking activities take place. Internet banking providers have greater risk exposure than traditional banking because Internet banking providers are more reliant on third party services. For many banks, third parties supply the expertise and technologies that run the day-to-day Internet banking operations. Operational risks of fraud exist, and technical problems can lead to costly bottlenecks and result in significant losses and inconvenience for customers. Consequently, the central theme of the BIS guidelines is that the boards and senior management of depository institutions should not permit an institution to engage in electronic banking activities unless it has the necessary expertise to provide competent risk management oversight. 20 Remarks at the U.S. Treasury Conference on Electronic Money and Banking: the Role of Government, Washington, D.C., Sept.19, 1996. [http://www.federalreserve.gov/boarddocs/speeches/1996/19960919.htm], last visited Oct. 31, 2001. 21 Standard-setting projects refers to establishing uniform requirements, procedures, and capabilities when introducing new technologies. For Internet banking, an example of a standard would be the number and type of identifications required to enter an Internet banking account and the kinds of transactions that a customer is allowed conduct within that account. 22 Paul Allan Schott, "The New Basle Risk Principles for Electronic Banking," Electronic Banking Law and Commerce Report, July/ Aug. 2001, p. 9. CRS-9 Regulatory Examination of Internet Banking Operations Federal and state regulatory agencies have developed examination procedures to protect Internet banking consumers against these risks but these procedures tend to increase compliance costs. The aim of these examination procedures is to determine whether the depository institutions have taken steps to control risk in Internet banking and whether the institutions are in compliance with relevant laws and regulations. Because higher-skilled employees are necessary to keep an institution in regulatory compliance, regulatory compliance in Internet banking is often more financially burdensome than traditional banking. Internet banking examinations are conducted by bank examiners and information technology specialists, who evaluate institutions' safety and soundness within a risk assessment framework. This framework includes a determination whether the compliance management program in the depository institutions has been updated to control the compliance risks of Internet banking. To illustrate, Internet banking, if newly implemented or significantly changed since the last examination, is reviewed in the following subject areas:23 ! Broad oversight and strategic planning; ! Appropriate policies and procedures; ! Adequate internal controls, including internal and external audits; ! Attention to the unique security issues on electronic banking; ! Due diligence and oversight of vendors and outsourcing arrangements; ! Reporting systems that allow monitoring of electronic banking activity; and ! Personnel with acceptable knowledge and technical skills. In addition, consumer compliance specialists examine a depository institution's Web site for compliance with regulations. For example, the advertisement terminology must be consistent with Truth in Savings and Truth in Lending requirements. While the costs of regulatory compliance are not the major costs driving depository institutions' losses from their Internet banking activities, they are a factor. Moreover, the expense to institutions is not enough to prevent regulators from making sure that Internet banking providers are in compliance with appropriate laws and regulations. In the past, the banking industry has asked Congress for regulatory relief for traditional banking activities because the cost of compliance is high. According to some bankers, the cost of compliance for Internet banking is several times higher than traditional banking. Despite the regulatory compliance and other costs, analysts believe that the Internet bankers' strategy is focused on increasing Internet banking customers to develop a critical mass. According to that interpretation, the full costs of Internet banking would then be capitalized after this critical mass was reached, even if it required charging those customers additional fees. 23 Sullivan, p. 12. ------------------------------------------------------------------------------ For other versions of this document, see http://wikileaks.org/wiki/CRS-RL31327