Future of Finance Report

FUTURE
OF FINANCE
REVIEW ON THE OUTLOOK
FOR THE UK FINANCIAL SYSTEM:
WHAT IT MEANS FOR
THE BANK OF ENGLAND
Chaired by Huw van Steenis
June 2019
CONTENTS
Foreword 2
Executive Summary 6
Summary of recommendations 18
Recommendations for the Bank
1 Shape tomorrow’s payment system 25
2 Enable innovation through modern financial infrastructure 41
3 Support the data economy through standards and protocols 56
4 Champion global standards for finance 67
5 Promote the smooth transition to a low-carbon economy 80
6 Adapt to the needs of a changing demographic 90
7 Safeguard the financial system from evolving risks 102
8 Enhance protection against cyber-risks 116
9 Embrace digital regulation 129
Appendix
Glossary 144
Acknowledgements 145
FOREWORD
The Governor asked me last year to lead a review of the future of the UK’s financial system, and what it
might mean for the Bank of England’s agenda, toolkit and capabilities over the coming decade.
We agreed this work should be grounded in how finance serves the economy. And in turn, how the
Bank can enable innovation, empower competition and build resilience. The team and I have kept this
uppermost in our minds.
Over the past nine months, I have met with over 300 entrepreneurs, financiers, tech firms, global
investors, consumer groups, charities, policymakers and business leaders across the United Kingdom and
overseas.
At each roundtable or meeting I asked for workable suggestions for how to improve finance and what
we can learn from other markets or pilots. For example, CEO Tom Blomfield and his team at Monzo
are harnessing technology to authenticate and provide basic bank accounts for people who have been
granted asylum in the UK. Better digital identification in the UK, he argued, could help reduce the cost
of finance to less advantaged groups. At OakNorth, co-founder Rishi Khosla is using machine learning to
bring large business lending techniques to underserved small and mid-sized businesses. Permissioned
sharing of public data, such as tax returns, he thought could help unlock savings for small businesses.
I also looked at how data standards and protocols can improve the plumbing of capital markets and
empower competition. It is striking from my meetings that the world’s largest asset owners, insurance
companies, asset managers and index providers don’t yet feel they have sufficiently robust data to assess
whether individual companies are transition-ready for climate change.
I have investigated new vulnerabilities and evolving risks. Do UK financials have top cyber-security and
how can it improve? What could happen if the big tech firms that are dipping their toes in financial
services dive in? What can we learn from the Chinese experience of leading online platforms moving into
financial services? Where are the vulnerabilities from a decade of ultra-low rates around the world? I have
sought to balance cutting-edge thinking with evidence and realism. For instance, the CEO of Visa Europe,
Charlotte Hogg, described how their teams are using artificial intelligence to drive reductions in fraud
and friction in payments. The payment system could be more resilient if firms had pre-agreed plans to
‘step in’ for each other if they had outages, she argued.
Throughout, I have kept a critical eye on whether the many new rules and bodies in the past decade
work in practice and are efficient. What are the unintended consequences? Is Open Banking achieving
its ambitions? Could the UK’s highly complex payments regulation improve? Has an uncoordinated
regulatory landscape added cost or held back innovation? For instance, the Executive Chair of Santander,
Ana Botin, argued payments regulation needs to be reviewed for the digital age, as it has inadvertently
created an unlevel playing field. Instead she argued that to enable financial services to bring their
customers the full benefits of the digital age, data sharing should be reciprocal. Davide Serra, founder
of Algebris, stressed the importance of scenario analysis to explore financial stability risks from large
technology platforms entering financial services — if they are not treated in an equivalent way for the
same activity.
PRIORITIES
Let me highlight a few priorities in the recommendations.
The first section explores how the Bank can support the digital economy to enable innovation and
empower competition, while ensuring monetary and financial stability.
One example is the payments system. In Sweden, cash payments have fallen by 80% over the past
decade. Our analysis suggests the UK may only be four to six years behind. ATM usage is down 9% so
far this year, an acceleration on 2018. Digital payments bring many benefits. But the Swedish experience
shows that without a co-ordinated plan, the pace of change risks excluding some groups in society. That’s
why a joined-up roadmap for payments infrastructure without leaving anyone behind — alongside next
generation payments regulation — should be a priority.
FUTURE OF FINANCE 2
Another priority should be for financial services to embrace cloud technologies, which have matured
to the point they can meet the high expectations of regulators and financial institutions. Shifting from
in-house data storage and processing to cloud environments can speed up innovation, enable use of the
best analytical tools, increase competition and build resilience. For mid-sized firms in particular upgrading
to the cloud can materially improve cyber-security. The CEO of Finastra, Simon Paris, told me that 43% of
UK financials believe complex regulatory requirements are the main barrier to adopting cloud technology.
To enable UK and international financial firms to innovate and compete on a level playing field, the Bank
should play a leading role in taking advantage of public cloud in a resilient way in the financial sector.
The second section addresses financing major transitions, such as changes in demographics, climate
change or addressing the shifts in global markets.
The transition to a low-carbon economy is vital for the planet. It poses risks and opportunities for the
financial sector and the economy. The Bank is already a world leader in focusing on climate change.
Roundtables highlighted that investors, lenders and insurers lack a clear view of how companies will fare
as the environment changes, regulations evolve, new technologies emerge and customer behaviour
shifts. Without this information, financial markets can’t price climate-related risks and opportunities
effectively. The Task Force on Climate-related Financial Disclosures has made important progress
in fashioning a standard. The Bank should champion the mainstreaming of decision useful climate
disclosures to help stakeholders assess if a company is transition-ready. Armed with this data, it should
also undertake a climate change stress test of UK financial institutions.
The third section explores how the financial system can build resilience and address the unbundling of
financial services.
The Bank should be a world leader in the use of digital regulation. Machine learning and new data
sets can strengthen the Bank’s armoury to spot irregularities and get a better picture of the system’s
overall health and emerging risks. There is huge scope to use advanced analytics and new data sets for
macroeconomic trends, financial surveillance and supervision. The explosion in data in finance demands
new techniques. Supervisory teams now receive the equivalent of twice the entire works of Shakespeare
of reading each week. This is going to continue to increase. The COO of HSBC, Andy Maguire, told me the
amount of data HSBC stores on its servers doubles every two to three years. It is up to 240 petabytes.
Regulation is complex. The Bank’s rulebook is longer than the Old Testament. No one individual can keep
up with its frequent updates. And current practices are expensive. McKinsey and Company estimates
that regulatory reporting for UK banks costs the industry £2 billion–£4.5 billion per year in run costs and
risk change costs alone. When considering a new data strategy, I recommend the Bank should explicitly
consider both the cost to the regulator and the efficiency of the overall system, including the costs to
the private sector. That’s why the Bank should embrace digital regulation to become more efficient and
effective.
The financial system is under almost constant cyber-attack. Firms, in collaboration with authorities, are
preventing the overwhelming majority of incidents and investing to stay ahead. Individual institutions
cannot prevent all attacks, yet in our connected world a paralysing attack on one firm could potentially
cause loss of confidence in others. To protect customers, financial institutions and public confidence, the
Bank and private sector should look to enhance data recovery in the event of a major incident, including a
mechanism for firms to step in for each other. This should ideally be led by the private sector. Meanwhile,
the Bank will want to continue to help up the game of individual institutions alongside other authorities.
WHERE NEXT?
The UK has long played a highly influential role in charting the course of finance. The recommendations
in this review will, I hope, create substantial benefits for UK consumers and businesses and underpin
a more resilient, effective and efficient wholesale and retail financial system. I hope they will also prove
useful to the many central banks around the world wrestling with similar challenges.
My remit was to look beyond the immediate challenges posed by the UK’s withdrawal from the EU. I
have sought to identify longer-term trends shaping the economy and finance and how the Bank can
support this evolution for the good of the people of the United Kingdom. Brexit will be a critical context
for the Bank’s decisions going forward. But Brexit or no Brexit, there are many areas where the Bank,
with others, can make progress in the years ahead. For instance, the Bank will want to continue to be a
FUTURE OF FINANCE 3
leader of global regulatory standards supporting a safe global economy and the UK remaining at least as
influential in the years to come as it has been since the crisis.
All forecasts demand humility. To make my recommendations as all-weather as possible, I have taken
a dual approach developing scenarios, including with help from industry experts, while also analysing
developments elsewhere in the world.
I am delighted that many of my recommendations are already being taken forward by the Bank, some
before publishing this report. But there remains much to do in the years ahead. The job of protecting the
financial system is never done.
THANKS
I would like to thank the Governor for his generous support and vision in establishing this review. I would
also like to thank Sir Dave Ramsden, Sir Jon Cunliffe, Ben Broadbent and Sam Woods for their guidance,
and my Advisory Group: Sandy Boss (Chair), Alex Brazier, Andy Haldane, Mark Yallop, Sarah Breeden,
Sonya Branch, David Bailey, Victoria Cleland, James Proudman, David Rule, Vicky Saporta, Rob Elsey and
Andrew Hauser.
This review has benefited from a collaborative spirit and a wide variety of inputs across the Bank, public
and private sectors. I would like to express my thanks for everyone’s contribution and challenge, as well
as the hosts of our regional and overseas roundtables. I would also like to thank the following for their
research and support on scenario analysis: McKinsey & Company on payments and digital regulation;
The Boston Consulting Group on retail/SME banking and insurance; and Oliver Wyman on wholesale and
capital markets and asset management. Finally, I would like to thank all colleagues at the Bank, and in
particular, Tom Mutton, Varun Paul and Julia Kowalski who have been tireless and highly effective in their
efforts.
Huw van Steenis

June 2019
FUTURE OF FINANCE 4
APPROACH AND RECOMMENDATIONS AT A GLANCE
Forces shaping What it means What it means

the economy for finance for the Bank
Shift to digital
Platform-based 1 Shape tomorrow’s payments system

economy
Gig and sharing Serve the 2 Enable innovation through

economy digital economy modern financial infrastructure
3 Support the data economy through

Big data standards and protocols
Automation &
machine learning
Integrating 4 Champion global standards for finance

emerging markets
Support the 5 Promote the smooth transition to
Low-carbon major transitions a low-carbon economy
economy
6 Adapt to the needs of a changing
Demographic demographic
changes
Unbundling of
business models
7 Safeguard the financial system
from evolving risks
Cyber-crime
Increase finance’s
resilience 8 Enhance protection against cyber-risks
New laws and
regulations
9 Embrace digital regulation
Technology
improving efficiency
FUTURE OF FINANCE 5
EXECUTIVE SUMMARY
SCOPE AND APPROACH
At his Mansion House speech entitled “New Economy, New Finance, New Bank” June 2018, the Governor
announced a review: “to set out a vision for the medium-term future of the UK financial system, with a
particular focus on what this might mean for the Bank, and what steps the Bank’s Executive might take to
ensure the institution is able to provide appropriate support to that vision, both now and in the future”.
The approach has been to look at how the economy is changing; how finance can serve and support
these changes; and what it could mean for the Bank of England.
Forces shaping What it means What it means

the economy for finance for the Bank
The
Shiftrecommendations
to digital in this report cover:
• what the Bank has direct responsibility for, particularly how it could change its hard and soft
infrastructure to support innovation and promote resilience
Platform-based in finance;
1 Shape tomorrow’s payments system
economy
• areas of interest to the Bank where it is not the primary actor, and so may wish to collaborate or
Serve the 2 Enable innovation through modern
Gigcontribute
and sharing expert advice to affect change; and
digital economy financial infrastructure
economy
• where the private sector will lead.
3 Support data economy through
Over the past nine months, I have engaged with entrepreneurs,
Big data investors,
data standardsconsumer groups, charities,
business leaders, and policymakers across the country and overseas. I have looked beyond the
immediate
Automation & challenges posed by the UK’s withdrawal from the EU to identify longer-term trends shaping
the economy
machine learningand finance — and how the Bank can support this evolution for the good of the people
of the United Kingdom. I have sought to be ambitious, but not idealistic, and leverage existing initiatives
4 Champion global standards for markets
where possible
Intergrating to focus on better outcomes and to maximise the impact of my recommendations.
emerging
markets
Support the 5 Promote the smooth transition to a
FORCES SHAPING THE NEW ECONOMY
major transitions low-carbon economy
Demographic changes
A new economy is emerging driven by changes in technology, 6 Adapt todemographics and the
the needs of a changing
environment. demographic
Low-carbon economy
Technology is changing how we work, spend and live. It has major implications for the UK’s economy
and, in turn, finance. Consumers are increasingly shopping online. Platforms connect businesses to
Unbundling ofacross the country and overseas. This is generating vast quantities of data that can be used to
consumers
business models
improve services. But this data also raises numerous hazards 7 of misuse
Safeguard theand abuse
financial of privacy.
system from
evolving risks
We increasingly
Cyber crime collaborate through the sharing economy. And the freelance and gig economy work are
growing in importance. Increase finance’s
8 Enhance protection against cyber risks
resilience
Technology
New laws and is enabling us to be ever more closely connected to the rest of the world through global trade
regulations
and communications.
New business models are disrupting industries — and allowing an unbundling of business models with
Technology
improving efficiency
profound consequences. Automation, including machine learning, is taking on more tasks.
The UK is also undergoing several major transitions that finance has to respond to. We’re
living longer. We better understand the value and importance of sustainability. We’re starting to reduce
emissions and shifting to a low-carbon economy with major implications for business and investment.
And the need for efficiency and lower costs in finance is an ongoing challenge. Britain’s role as a financial
trading hub will evolve as emerging markets grow and political decisions on the UK’s relationship with the
EU are made.
All of these factors will drive significant changes in the economy and, in turn, finance. They also raise
some fundamental challenges to traditional models of regulation, economic modelling and central
banking as a result of these technological and economic changes.
FUTURE OF FINANCE 6
Shift to digital Low-carbon economy
19% of retail sales are online compared to 11% The transition to a low-carbon economy will
five years ago. require infrastructure investments of more than
US$90 trillion globally over the next decade.
Platform-based economy Demographic changes
83% of SMEs use a mobile banking app. 3 million more people will be over 55 years
in the UK by 2025.
Gig and sharing economy
One third of UK adults are expected to be Unbundling of business models
self-employed by 2025, up from 20% today. Over 40% of financial services may be
cloud hosted in a decade.
Big data
The UK data economy could be worth £95 billion Cyber-crime
in 2025 from £73 billion in 2016. Global cyber-premiums are predicted to rise to
US$8.2bn in 2020 from US$4.8bn last year.
Automation & machine learning
New laws and regulations
Up to 30% of jobs in the UK are at risk of
Post-crisis regulatory reforms have meant that
automation by 2030, likely offset by a range of
the BCBS published twice as many regulatory
new jobs.
standards between 2009–17 than in the 20 years
Integrating emerging markets before.
Emerging markets’ share of external financial Technology improving efficiency
assets globally could reach a third by 2030, Machine learning could increase efficiency
up from 10% today. delivering a 20% uplift in firms’ financial
performance.
WHAT DOES THIS MEAN FOR FINANCE?
Finance will help households and businesses adjust to and take advantage of the new economy, if firms
and policymakers rise to the challenge.
Finance enables people and businesses to save, borrow, invest, transfer risks and make payments. It
also helps safeguarding finances and financial identities. It fuels economic growth by putting savings to
use and allocating capital to optimal projects. All of the above can foster competition and innovation and
contribute to rising prosperity.
I’ve kept the “purpose of finance” uppermost in the work, as I consider how the system may evolve and
the implications for the Bank.
• Finance can harness technology to make services more personalised, accessible, instantaneous and
secure.
• Finance can help support the transition to a lower-carbon economy by financing clean energy
infrastructure and embracing better disclosure on carbon footprint to help price risks and measure
progress.
• Finance and regulation will have to adapt to an ageing society as well as help those entering the
workforce, especially those in the gig and sharing economies.
• Innovation can support financial inclusion and help the vulnerable. This includes through building
financial literacy, giving more control over finances and supporting more effective digital identification
to help with inclusion.
• Finance can help businesses take advantage of international opportunities. It can reduce the cost of
cross-border transactions and bring access to new markets.
Finance is likely to undergo intense change over the coming decade. The shift to
digitally-enabled services and firms is already profound and appears to be accelerating.
• Today the world’s largest financial service firm is China’s Ant Financial with over one billion clients —
without any branch. A decade ago it was Citigroup with 200m customers.
• In the US, 38% of unsecured personal lending was issued by new fintechs in 2018, up from 5% in 2013,
according to Transunion, and nothing a decade ago.
• The cost of investing in major stock markets via ETFs and index funds has fallen by well over 50% over
the past decade, according to Oliver Wyman.
• In Sweden, one of the most cash-light economies, the number of retail cash payment transactions per
person has fallen 80% since 2008. New work for this report shows the UK may be only four to six years
behind Sweden.
FUTURE OF FINANCE 7
The shift from banks to market-based finance is likely to grow further.
• Half of all financial intermediation globally now happens outside the banking system according to the
Financial Stability Board. The assets of non-bank financial institutions have grown by over 50% since
2008.
• 45% of lending to UK companies comes from market-based finance today compared to just 37% in
2006 according to think tank New Financial.
• In Sweden, 60% of consumer finance comes from specialist players, whereas one decade ago it was
one third.
Ultra low rates, new regulations and the need to invest in updating their businesses mean
many UK and global banks are struggling to make their cost of capital. This will drive changes
to firms’ business models as they look to improve efficiency, resilience and customer experience.
Technology is enabling unbundling of activities which historically were done under one roof. While a more
distributed model has many advantages, it is a far more complex system to oversee. For instance, many
players which have historically not been regulated or held to the same standards are becoming active
in core financial services processes. The Bank, and others, will wish to ward against this to realise the
benefits.
Brexit and political and policy changes around the world will also impact the shape of financial
services. It will also be critical context against which the Bank will need to make decisions going forward.
But Brexit or no Brexit, there are numerous areas where the Bank can make progress in the years ahead.
Risks are likely to shift. Innovation can solve problems but also bring new risks — as well as old risks
in new forms. Online fraud and cyber-hacking of digital accounts have surpassed traditional theft of
banknotes and gold. Cyber-risk was cited as the biggest threat to finance after Brexit/’UK political risks’ in
the latest Bank of England Systemic Risk Survey. Ultra low rates around the globe have changed investor
behaviour and may lead to new vulnerabilities in markets. Firms and regulators will need to be agile and
constantly look out for risks. They also have to update their toolkit and take advantage of a huge increase
in effectiveness from data science and new technologies.
Regulators and the private sector have to collaborate in new ways as technology breaks
down barriers. Moving to digital payments without leaving anyone behind will require significant
upgrades to broadband and mobile telephony networks. Open finance will require competition
authorities, data regulators, financial regulators and lawmakers to think about problems holistically, as
opening up data may create unintended risks. The large number of regulatory projects requiring major
technology upgrades would benefit from being co-ordinated so firms can invest in their own technology
infrastructure.
Finance is hugely important to the UK. It provided over £300bn of real-economy finance in the UK
last year, helping 700,000 people buy homes. It represents 11% of tax revenues and over one million
financial services jobs, two thirds of which are outside Greater London. The UK’s role as a global hub
and market for buyers and sellers of securities and insurance is unique and offered a trade surplus of
3% of GDP in 2017. The UK’s fintech sector is a world leading centre of innovation. It generates almost
£7bn in revenues annually, according to Innovate Finance. Given the size and dynamism of this sector,
little wonder that fieldwork underscored firms’ interest in hiring talented staff, both home grown and
from overseas: 42% of those working in fintech are from overseas, of which two thirds are from Europe
according to WPI Economics. But there was also a passion for improving skills at UK schools and
universities.
The right infrastructure can support new finance. The private sector will offer services for
consumers and businesses. But it needs the right conditions to innovate and thrive. This means creating
appropriate hard infrastructure, such as state-of-the-art systems to support new products and services,
including through renewing the Bank’s RTGS system. And the right soft infrastructure, including a
well-respected legal and judicial system, rules, regulations and standards to empower competition and
ensure safety and soundness.
FUTURE OF FINANCE 8
WHAT DOES IT MEAN FOR THE BANK?
The Bank has already taken many important steps in the past few years to adapt its capabilities, policies
and shape markets. So in many cases our recommendations are building on a very strong foundation
and initiatives under way.
1 Shape tomorrow’s payment system
As our payment habits shift, we need a joined-up strategy to improve our payments
infrastructure and regulation — which doesn’t leave anyone behind.
The proportion of transactions using cash has fallen from six in 10 payments a decade ago to just under
three in 10 last year. It could approach one in 10 in a decade, according to UK Finance. The pace of
change seems to be accelerating as we use cards and our phones more: for instance, withdrawals from
ATMs are down 9% on last year. As we use less cash, the costs of running the network are likely to require
changes in how it operates and is funded.
Joint roadmap for payments
First, the Bank should help shape a joint roadmap for cash and digital payments which reflects society’s
choices. Simply put, a National Payments Strategy Council. It should critically include broadband and
mobile telephony in addition to financial services firms and regulators, building on some of the findings
of the recent and well argued Access to Cash Review. The Bank, with others, needs to consider options
to improve the sustainability of the cash payment model including considering merits of a “utility” cash
distribution model similar to Finland, Sweden and the Netherlands. The Bank should contribute to a
debate about whether cash distribution over the longer term may require State support if the current
model becomes uneconomic.
Next generation payments regulation
Second, the Bank should help prompt next generation payments regulation to oversee a far more
complex system and reflect the shifting risks. Payments are the number one area of interest for big
tech platforms and new entrants. The UK is already one of the most open to new players in the world:
>10% of UK card revenues, as estimated for 2017 revenue pools, have been captured by firms who have
entered the market in the past 10 years. In light of increasing fragmentation of the payments chain and
new entrants, the review should include the merits of tiering of regulation, adequacy of supervision of the
entire payments value chain, and ways to simplify the highly complex regulatory structure. In Chapter 8
payments is also included as a focus area for ever greater cyber-resilience.
Infrastructure to improve cross-border payments
Third, the Bank should continue to promote a more robust and innovative payments infrastructure
domestically and across borders. The UK has been a leader in innovation in the wider payments
ecosystem. It will want to keep pace with customer demands for payments that are seamless, reliable,
cheap, and secure. It will wish to keep abreast of developments such as new messaging standards and
the developments of digital tokens. Crypto assets that are not backed by currency are an unreliable
store of value, inefficient medium of exchange and simply won’t cut the mustard. In light of the potential
for continued innovation, the Bank with other authorities will need to keep on top of developments
for tokenisation of fiat currency for payments to make sure the regulatory, legal and infrastructure
implications are understood, and monetary and financial stability safeguarded. This review does not
see a compelling case for a central bank digital currency given numerous uncertainties. These include
legal uncertainties, risks around deploying the technology at scale, the potential impact on monetary
transmission, and critically the risk of diverting attention away from improving today’s systems for
customers. Improving efficiency and cyber-security and enabling the core payment systems to be a
platform for private sector innovation should remain the priority.
2 Enable innovation through modern financial infrastructure
Innovative payments infrastructure to enable alternative payments

The Bank will wish to introduce an innovative infrastructure to enable alternative payment methods. The
Bank was the first G20 central bank to open up access to its payment services to non-bank payment
service providers. A review may include how new providers can access the Bank’s infrastructure and
FUTURE OF FINANCE 9
application programming interfaces (APIs) to allow improved information retrieval and sharing from
payment systems. Ideally, this should coincide with new tiering of payments regulation, as well as very
high standards and a clear “package” at the Bank, to ensure companies with access are appropriately
regulated.
Support better digital identification
Better digital identification will be essential for households and firms to benefit from the digital economy.
The high cost of identification means finance is expensive and underserved. I realise this goes well
beyond the remit of the Bank. But considering how central identification is to accessing finance, curbing
cyber-fraud and reducing costs the Bank may wish to be an influential champion of better trusted
digital identification where the UK has lagged. The Netherlands and the Nordics have voluntary digital
identification schemes, all built in co-operation with financial services, which have 75%–90% take up
versus less than 5% in the UK. This is likely to include supporting ways to build upon and open up
high-quality data sources, tagged with unique identifying numbers, such as passports, driving licences,
social security and tax numbers. It is also likely to require a change in how the government thinks
about the liability and reliability of using these data sources. More broadly the role of financial firms
collaborating on digital identification merits consideration.
Embrace the cloud
The Bank should embrace cloud technologies, which have matured to the point they can meet the
high expectations of regulators and financial services. It offers the advantages of business agility, faster
innovation and cyber-defences to provide better services to households and businesses. It also enables
large firms to take advantage of the skills and talent in small and medium-sized businesses. Research
suggests up to a quarter of the activities of largest global banks may already be on the public cloud or
software hosted on the cloud. UK banks and insurers lag global leaders, and many firms I met are keen
to take advantage of cloud at scale. Forty-three per cent of UK financials said they thought complex
regulatory requirements were the key barrier to adopting cloud collaboration according to a new Finastra
survey.
This said, given almost every vendor to financial services, and many fintechs, are cloud hosted, indirectly
the UK system is already highly reliant on cloud. Looking forward, up to 40%–90% of banks‘ workloads
globally could be hosted on public cloud or software as a service in a decade, according to
McKinsey & Company. Policies will need to respond to this emerging reality. If the UK wishes to remain a
leading venue for international finance, and ensure UK financial firms are competitive and are on a level
playing field to new business models, the Bank will need to build expertise and play a leading role, in
collaboration with other authorities, shaping use of public cloud in the financial sector.
Air traffic control for major projects
To improve resilience and support innovation, I recommend the Bank and all financial regulators create
an “air traffic control” forum to map out and identify critical junctures for ongoing and major new
regulatory projects and their implications for firms’ IT/operational resilience — as well as their impact on
innovation. Flurries of uncoordinated demands from regulators with tight deadlines add cost and risk.
They also can reinforce the patching up of old systems at the expense of long-term investments in new
infrastructure. Every regulator has its own objectives and independence, but sharing information could
create a common understanding of challenges and through feedback a better understanding of the
complexity of implementation.
3 Support the data economy through standards and protocols
Automated decision-making based on machine learning is one of the most important trends in
technology today.
Machine learning and AI are expected to become widespread in financial services. So how customers’
data is used — and its privacy — will take on ever greater prominence. While financial services are
arguably already one of the most heavily regulated sectors for the use of data, rules must be revised to
keep pace with the emergence of new data sets (including social media), developments in data science
and new analytical techniques. Data privacy and the responsible and legal use of algorithms is going to be
a huge topic in finance and the UK will wish to be at the leading edge of its development in finance.
FUTURE OF FINANCE 10
Responsible AI principles
To get ahead of these issues and encourage responsible use of machine learning/AI in financial services,
the Bank and FCA should create a working group for the use of ethical AI principles in finance. These
responsible AI principles — such as fairness, accountability, transparency, security and responsible
usage — could then guide where rules need refreshing. Ideally this should be across wholesale markets,
banking and insurance. This should also include consideration of the possibility of collaborations, for
example with the FMSB in wholesale market standards for the use of AI.
Support richer credit files for small and medium-sized business lending
Data standards and protocols are the bedrock of a robust and dynamic financial system. They can enable
innovation, open up markets and boost the efficiency and effectiveness of finance. The portability of
individual and business data generated online and through platforms, and the incorporation of this data
into lending decisions has the potential to make the flow of finance more efficient, fair and accessible.
The biggest beneficiary of open banking may prove to be businesses, not individuals. I recommend the
Bank adds its voice to supporting data-sharing via APIs and enrichening of credit files to help households
and small and medium-sized enterprises access a broad range of finance. Field work highlights the single
most helpful thing to open up SME finance would be company permissioned use of tax data. This is likely
to coincide with better identification including the wider use of legal entity identifiers (LEIs).
4 Champion global standards for finance
Strong international standards are vital to underpin the efficient and safe flow of capital.
As one of the largest international financial centres, the UK has more to gain, and lose, than other
countries from the prosperity of the global economy, how it hosts markets, and developments in the
financial system. The UK’s withdrawal from the EU is likely to have a profound change in the shape of
cross-border business, but my remit has been to look beyond this to other areas of focus. The Bank
continuing to play a world leading position shaping standards with the private sector and other policy
makers will be a critical tool.
Champion global standards
The Bank already plays a highly influential role to promote strong international standards and deep
supervisory co-operation to underpin efficient and safe global finance. Irrespective of Brexit, the Bank
should have the ambition to be at least as influential and well represented in a decade as it is today. It will
also want to play a leading role on emerging topics, such as data localisation.
In addition to the direct influence the Bank exerts on standards developed by the public sector, the Bank
will also want to use its convening power to focus attention on road blocks to more effective finance by
exploring the adoption of private sector standards. Particularly focusing on data standards in “post trade”
infrastructure. A good place to start would be the swaps and collateral markets around ISDA’s common
domain model.
Engage on the evolving needs of emerging markets
Over the coming decade, the risk of fragmentation in global financial flows, or data, looms. But seams
of opportunity are likely, as cross-border flows are expected to increase from the long-term growth
potential of China and other emerging economies. The Bank should continue to engage internationally
to explore ways in which the UK can use its expertise to meet the needs of global markets — such as by
providing green finance, greater insurance for cyber-risk and supporting offshore local currency bonds.
Future of financial services
The confluence of a number of factors means the current or any future government may to wish to
explore the competitiveness and shape of the UK financial sector in the decade ahead. These include
Brexit, the opportunities afforded by fintech and a reassessment as a decade of regulatory reform nears
its end, whether the rules are working as intended, are as efficient as possible and what unintended
consequences there are. If so, the Bank, within the scope of its mandate, should be open minded to
contribute, or respond, if the Treasury wants to explore pro-growth changes to financial services
regulation and other policies to be a world leading centre for fintech.
5 Promote the smooth transition to a low-carbon economy
The transition to a low-carbon economy poses both risks, and opportunities, for the economy,
and the financial sector.
Investors, lenders and insurers don’t yet have a clear view of which companies will struggle, endure
or prosper as the environment changes, regulations evolve, new technologies emerge and customer
behaviour shifts. Without this information, financial markets can’t price climate-related risks and
opportunities effectively.
The transition to a low-carbon economy will require large-scale reallocations of capital and investments
in infrastructure — on some estimates more than US$90 trillion globally over the next decade. The Bank
could continue to use its convening power to support standards and ensure incentives are appropriate
for this transition.
Mainstream climate change disclosure
The Bank should encourage the widespread adoption of the recommendations of the Task Force on
Climate-related Financial Disclosures (TCFD) and monitor climate-related disclosures among supervised
firms. It should also advocate their inclusion in mainstream financial reporting, ideally in the next five
years, as well as enhanced disclosures across the real estate sector. Consideration of the appropriate
base line and disclosure of firms’ strategy will be the priority.
The Bank may, of course, wish to lead by example and hold itself to the same standards and publish its
own climate disclosure, risk management and any internal targets for reducing energy usage.
Embed climate risk management
The Bank will want to build on current momentum to embed a climate risk management culture in
financial services firms, including the successful Climate Forum. The Bank should ensure that firms are
“transition ready” for a lower-carbon economy including working on best practice scenarios with firms
and explore a new climate-risk scenario to explore transition readiness in a future biennial exploratory
stress test.
6 Adapt to the needs of a changing demographic
Each generation’s different financial needs and circumstances will have implications for the
provision of finance.
As people live longer and bear more of the risk for funding their own retirement, finance should be able
to help share longevity risk. Budgeting for old age is incredibly difficult, not least with growing health costs
and uncertainty about how long you may live. Low prospective returns compound this. Making access
to products which help people to save for their old age, and provide an income in an increasingly long
retirement, are of paramount importance.
Security in retirement
The prudential regime for insurance companies has a significant bearing on the availability and price of
risk-sharing products. As this is harmonised across Europe it leaves modest scope for interpretation or
discretionary choices by the Bank about how those regulations work. However other jurisdictions such
as the Netherlands and France have found ways to start to sharing longevity risk in new ways. The Bank
should explore if the risk margin should be examined in the light of sharing longevity risk.
Support wider investment choices
Rates remaining ultra low for even longer could also raise questions about investment choices and
suitable long-term assets to fund pensions, such as infrastructure. The Bank may wish to argue for wider
investment choices including providing its expertise to help challenge firms and authorities to consider
what financial products or protections gig and sharing economy employees need and the implications for
firm risk management.
7 Safeguard the financial system from evolving risks
Innovations and regulatory change can solve problems, but also bring new risks — or old risks
in new forms.
That can be from changing business models, new ways of working or how the system as a whole
interacts. Meanwhile, the implications of technological developments are likely to be immense. History
suggests the balance between financial stability and the desire to promote innovation and competition is
unlikely to ever be entirely successful. Stability will require constant vigilance, an open mind and
co-ordination.
The unbundling of the banking system could raise some fundamental challenges to traditional models of
regulation, modelling the economy and how central banks operate.
Ensure regulation and infrastructure keep pace with innovative business models
The Bank will want to ensure regulation and infrastructure keep pace with innovative business models.
The Bank should review who can access its infrastructure, including reserves accounts, to support
greater innovation, focusing also on the “regulatory package” for access. It should keep evaluating how
financial innovation and changing business models will impact financial stability. This includes the growth
in market-based finance (ie funding via the bond and stock markets) and the unbundling of financial
services value chains.
The Bank will also need to consider in depth the implications of separation of payments and lending
from deposit-taking and the implications for the core banking system. A healthy financial system is a
profitable one, and there are numerous risks to navigate. Regulators have to watch out for new
platform-based businesses outside finance entering parts of financial services if they take on risks
deemed as regulated activities. For instance, today the Big Tech firms are only dipping their toes in
financial waters. The implications if they dive in could be profound. This could shift the focus from the
current entity to greater emphasis on activity-based approaches. Policymakers will also need to consider
the implications for monetary policy of a different banking model.
And regulators will want to continue to explore the implications of a very different wholesale market
structure as central banks around the world seek to exit a decade of quantitative easing and in some
jurisdictions negative rates.
Dynamic regulatory regime
Rules will need to be written, struck off and adjusted to ensure they work in practice. The Bank could
establish a dedicated ‘regulatory evaluation and response’ unit to assess how effective major policies
are throughout their life cycle. This would include reviewing their impact such as anomalies, unintended
consequences and continued relevance.
Open Banking policy framework
Open Banking is a powerful idea to give customers more control over their finances in the next decade.
But it also poses issues around security, who bears the costs, system structure, level playing field on
data sharing and legal liability. The UK is the first country in the world to undertake this experiment, so
the onus is on regulators to get it right, or adapt fast. UK Finance estimates it has already cost the nine
largest banks up to £1.5bn to kick-start. Yet Boston Consulting argue data available through
Open Banking does not enable the most attractive use cases and few customers are using Open Banking.
Law firms have told us concerns around the legal liability model remain unsatisfactorily resolved for a
scaled initiative. Many across industries also think data exchange should not just be from bank to others,
but a broader plan for sharing data smartly, as Jason Furman recently argued in his review on unlocking
digital competition. The Bank should work with the FCA, OBIE and others to suggest a Treasury-led
review of lessons learned from the first 18 months of Open Banking and how to mitigate risks, make
adjustments and galvanise opportunities. And see how open banking may dovetail with smart data
initiatives across the economy.
8 Enhance protection against cyber-risks
The financial system is under almost constant cyber-attack.

Firms are preventing the overwhelming majority and invest to stay ahead. Co-ordination between
National Cyber Security Centre, the Bank and the private sector is yielding results. They run
industry-leading cyber-penetration tests with regulators and share intelligence. But cyber-incidents are
growing rapidly in number, scope and sophistication.
Enhance data recovery
Regulatory and private sector initiatives must keep evolving to safeguard the system from this dynamic
threat. I recommend the Bank should look to enhance data recovery across the system in the event of
an incident. This would include mapping the mechanisms for data recovery and firms ‘stepping in’ in
the event of a major cyber-incident. This should include exploring lessons from the US cyber-resilience
initiative, ‘Sheltered Harbor’.
Conduct cyber-exercises
Second, the Bank in combination with others may wish to enhance the frequency of domestic and
international cyber-penetration tests. Payments and the full value chain of providers should be a growing
focus. So should the consequences of the more open financial system.
Data to build the cyber-insurance market
Third, the Bank could encourage better information disclosure on cyber-threats domestically and
internationally to help develop the data required for a more effective cyber-insurance market. Insurance
can help businesses manage the mounting risks in the digital economy by providing greater protection
against the potentially devastating costs of a cyber-incident.
The Bank will want to embrace regtech and data science techniques to improve its
productivity and effectiveness.
There is huge scope for the Bank to use analytics for analysis of macroeconomic trends, financial
surveillance and supervision. Machine learning and new data sets can strengthen the Bank’s armoury
to spot irregularities and get a better picture of the system’s overall health and emerging risks. Routine
tasks should increasingly be automated. Supervisors spend more time on relatively manual gathering
and manipulation of information than they do on value-adding activities like analysis, interpretation
and recommendations. A shift will free up resources to focus on value-added analysis. New tools will
be essential to digest the extraordinary growth in data. Over the longer term, the Bank will also want to
decide whether to reach out for data rather than waiting for it to be submitted.
A mindset shift in the approach to investment needs to occur — away from just the cost to the
regulator of compliance, to efficiency of the overall system, including the costs to the private sector.
McKinsey & Company estimates regulatory reporting for UK banks costs the industry
£2 billion–£4.5 billion per year in run costs and risk change costs alone. There is a strong public interest
in the efficiency of the financial system. A strategic plan and joined-up process would help unlock cost,
prioritise spending better, and also enable firms and tech vendors to include new functionality in their
own package upgrades. This could include some aspirational targets — for instance the Monetary
Authority of Singapore has announced an aim to achieve zero duplication in data requests to financial
institutions.
The Bank will need to make practical investments in data and processes to address clear pain points
with industry. A more substantial joint effort and significant industry investment could transform how
regulatory data is managed. It would also have a meaningful impact on the big end-to-end cost of
regulation.
The Bank could also embrace new techniques in how its rule book is structured and used over time. At
over 638,000 words, the PRA Rulebook is longer than the Old Testament. Machine-readable rules could
ensure better adherence and save the private sector a significant amount.
Digital data strategy
So I recommend: first, the Bank develops and consults on a new medium-term regulatory data strategy
(ideally three to five years) with specific initiatives to improve how it captures, shares and uses data
under a new Chief Data Officer. An industry advisory panel will be an important leg to this. The Bank
should foster its data science capabilities and deliver a medium-term roadmap for the Bank’s digital
transformation. This includes a recruitment and training strategy that meets the need of a central bank of
the future. It should include a pilot to retrain economists with strong probability maths to become data
scientists. When considering a new data strategy, the Bank should explicitly consider both the cost to the
regulator and the efficiency of the overall system, including the costs to the private sector.
Digitalisation of supervision
Second, the Bank should digitalise processes within the regulatory area and bring ever more data science
to underpin its toolkit. This should include considering how new regulatory and supervisory technologies
could make data capture and analysis of firm information less resource-intensive, and educating staff on
the value and potential uses of data.
WHAT COULD THIS VISION MEAN?
Looking back in a decade — what would one ideally like to see a result of this vision and these
steps? I have the humility to know none of us can predict the future, but I have thought about
outcomes the Bank and others may want to see.
Finance can support the emerging digital and platform economy by developing
diverse payment options that are efficient, fast, secure, low-cost
and cross-border. Integration into e-commerce and mobile apps will allow
households and businesses to pay conveniently and securely around the world.
Digital payment options will develop alongside rather than in place of cash to
ensure that no-one is left behind.
The portability of individual and business data generated online and
through platforms and the incorporation of this into lending decisions will make
the flow of finance more efficient, fair and accessible.
I Finance is
serving the Accessing big data and using AI and machine learning technology
digital economy will make finance innovative, effective and inclusive. It will offer more
customised and keenly priced products. This could include providing financial
products to individuals and businesses in the gig economy and small and
medium-sized enterprises who are traditionally underserved by the financial
system.
The Bank’s own infrastructure decisions have helped catalyse innovation,
competition and provided a key backbone to the economy.
More effective digital identification has reduced fraud, costs and friction.
And UK is seen as one of the world’s fintech centres of expertise.
The broad-based growth and further opening of emerging market economies

create an opportunity for the UK as a global financial centre to support
their integration into the financial system. The UK’s wholesale finance sector
has a long heritage in bringing buyers and sellers together in trusted market
places. The UK’s markets and infrastructure can help meet emerging markets’
domestic financing needs and investment through local currency issuance.
Finance can also help firms export and facilitate cross-border supply chains.
II Finance has
Investment products will need to evolve to provide greater security in
supported
retirement and to allow individuals to manage the longevity risk associated with
major
living longer. They will also take into account changing customer preferences
transitions in
by offering investment and savings products that measure up against
society
sustainable, impactful and ethical metrics.
A smooth transition to the low-carbon economy will require support from the
financial sector to mobilise private finance for projects and infrastructure
that reduce carbon emissions. Improving the quality of information available
to stakeholders and investors is critical to breaking down barriers to informed
investment, unlocking better decision-making and enabling more effective risk
management.
Embracing new technology and making data accessible can make finance
more dynamic by helping to create new services and products that meet
customer demands. Technological innovation, an evolving market landscape
and new regulation have led to pressures of changing business models and an
unbundling of activities. Incumbent firms will need to be responsible for and
manage the risks of unbundling business models. They must also consider how
they can innovate or partner with new providers to deliver a better service for
customers.
III The system A dynamic regulatory framework that safeguards the system against new and
has become evolving risks. Regulation proportionate to risks. And rules updated to the new
more resilient economy and old rules, which no longer fitted, rethought or removed
to old and new
risks Finance will need to work together to ensure it is resilient to cyber-risks.
Insurance can help businesses manage the mounting risks in the digital economy
by providing greater protection against the potentially devastating costs of a
cyber-incident. Mitigating the impact of cyber-risk helps to prevent disruption to
economic activity and sustain employment.
And finance can work with authorities to improve the efficiency and
effectiveness of compliance, regulation and supervision. New technology
and aligning systems will allow cost savings, which will provide a more efficient
service.
SUMMARY OF RECOMMENDATIONS
This represents a summary of the recommendations contained in this report. The order in which these are
presented reflects the structure of the report and not any kind of suggested prioritisation.
To help finance serve the digital economy, the Bank should:
1 Shape tomorrow’s payment system

2 Enable innovation through modern financial infrastructure
3 Support the data economy through standards and protocols
1 SHAPE TOMORROW’S PAYMENT SYSTEM
The Bank should:

• Join a group of regulators (including non-financial ones such as Ofcom) and the
private sector convened by the Treasury to fashion a co-ordinated response
to society’s shift to digital, without leaving anyone behind. In effect, a national
payments strategy council.
• This could include a roadmap to:
- foster cost-effective and resilient payments for the future;
- understand dependencies such as broadband and mobile coverage;
1.1 PRODUCE
A ROADMAP - ensure that no one is left behind through ‘digital exclusion’;
FOR PAYMENTS - consider with the private sector options to improve the sustainability
OPTIONS of the cash payment model, including potential merits of a ‘utility’
distribution model similar to Finland, Sweden and the Netherlands; and
- contribute to a longer-term debate about whether cash distribution may
require state support if the current model becomes uneconomic for the
private sector.
• Explore any hurdles to faster, cheaper and more widespread peer-to-peer and
inter-bank payment options — especially those powered by mobile apps —
with the Financial Conduct Authority and the Payment Systems Regulator. This
should include the role of appropriate fees for PSD2 transactions.
The Bank should:

• Suggest the Treasury lead a cross-authority review of payments regulation to
1.2 evaluate:
CONTRIBUTE
TO THE NEXT - the appropriateness of the regulatory framework for the risks posed by
GENERATION different payment activities, including tiering of firms;
OF PAYMENT - how to ensure effective supervision of the overall payments value chain;
REGULATION
- the role of data-sharing between platforms and payment companies; and
- ways to reduce fragmentation and complex regulation in the UK.
1 SHAPE TOMORROW’S PAYMENT SYSTEM
The Bank should:

• Implement richer messaging standards and common identifiers to facilitate
1.3 DEVELOP THE more effective and accurate global co-ordination.
INFRASTRUCTURE • Open access to a broader range of payment providers who operate across
TO MAKE
borders.
CROSS-BORDER
PAYMENTS MORE • Continue to work with international bodies, such as the Committee on
EFFICIENT AND Payments and Market Infrastructures, to explore opportunities to make
CHEAPER cross-border payments more efficient and cheaper.
• Keep abreast of digital tokens and explore greater interoperability with other
central banks to improve payments for households and companies.
2 ENABLE INNOVATION THROUGH MODERN FINANCIAL INFRASTRUCTURE
The Bank should:

2.1 BUILD AN • Consider how alternative providers might access the Bank’s infrastructure
INNOVATIVE including balance sheet and payment systems, and an appropriate package
PAYMENT for obligations which come with these rights. This will need to dovetail with
INFRASTRUCTURE
new payments regulation to ensure any new members are appropriately
TO ENABLE
ALTERNATIVE capitalised and supervised. Careful thought would also need to be given to the
PAYMENT implications for monetary and financial stability of any further extension.
METHODS • Create an API to allow improved information retrieval and sharing from
payment systems.
The Bank should:

• Engage with the financial sector to establish its requirements for a digital ID,
including discerning the features that would:
- help reduce fraud in financial transactions;
2.2 CHAMPION
TRUSTED - reduce costs of on-boarding new customers and anti-money laundering
DIGITAL and Know Your Customer processes; and
IDENTIFICATION - expand access to those excluded from the financial system.
• Champion these requirements in broader engagement with public and private
sector participants. The government should consider the merits of secure and
efficient information gateways to trusted official sources, so the private sector
can improve the effectiveness of identification verification.
The Bank should:

• Work with the private sector to help firms realise the benefits of public cloud
usage without compromising resilience by:
2.3 EMBRACE - understanding and mapping concentration risks and interoperability, as

SAFE CLOUD well as building expertise within the Bank;
USAGE - testing operational resilience, including to cyber-risk;
- setting standards and guidelines for cloud usage; and
- collaborating with international regulators on a longer-term approach to
cloud oversight.
2 ENABLE INNOVATION THROUGH MODERN FINANCIAL INFRASTRUCTURE
The Bank should:

• Argue for a new forum with all major regulatory bodies to map and identify
2.4 SUPPORT critical junctures for ongoing and new regulatory projects. These include:
AN “AIR The Payment Systems Regulator, the Financial Conduct Authority, the
TRAFFIC Open Banking Implementation Entity and the Competition and Markets
CONTROL” Authority. While respecting each institution’s statutory duties, sharing
OF MAJOR information on the timing and impact of major projects would reduce risk to
PROJECTS operational resilience. It would also limit the risk of crowding out innovation
through the bunching of regulatory initiatives. Indirectly, it may build a richer
roadmap of tech transformation for financial infrastructure.
3 SUPPORT THE DATA ECONOMY THROUGH STANDARDS AND PROTOCOLS
The Bank should:

• Establish a public-private financial sector working group with the Financial
Conduct Authority to:
- monitor developments in the use of machine learning to understand
possible micro and macroprudential implications of widespread adoption;
3.1 PROMOTE
THE - develop principles, and share best practice, for the responsible,
RESPONSIBLE explainable and accountable use of machine learning in finance;
USE OF
- explore the intersection with current rules (including Senior Managers
MACHINE
Regime) and where old rules need updating; and
LEARNING
AND AI - feed into the Centre for Data Ethics and Innovation’s work on
maximising the benefits of artificial intelligence and managing the risks
in finance.
• A wholesale working group (or subgroup) should also involve or could be
championed by the Fixed Income, Currencies and Commodities Markets
Standards Board.
The Bank should:

• Use its knowledge of LEIs in finance to support wider adoption.
3.2 SUPPORT
• Contribute analysis on the value of better credit files for small and
BETTER CREDIT
medium-sized enterprises and individuals. This could include considering
FILES FOR SMES
permissioned access to high-level company tax data. The Treasury may wish to
establish a competition for private innovators to help build better credit files
for the gig and sharing economy.
To help finance support the major transitions, the Bank should:
4 Champion global standards for finance

5 Promote the smooth transition to a low-carbon economy
6 Support adaption to the needs of a changing demographic
4 CHAMPION GLOBAL STANDARDS FOR FINANCE
The Bank should:

• Promote strong public sector standards and deep supervisory co-operation,
including through maintaining and optimising influence in forums such as the
Financial Stability Board, the Basel Committee on Banking Supervision and the
4.1 CHAMPION International Monetary Fund.
GLOBAL
• Convene and catalyse private sector standards through discussions on road
STANDARDS
blocks to more effective finance, particularly in post-trade and deepening
supervisory co-operation. A good place to start would be the swap and
collateral markets along the lines of the International Swaps and Derivatives
Association common domain protocols. The Fixed Income, Currencies and
Commodities Markets Standards Board can play a useful role on this.
4.2 ENGAGE ON The Bank should:

THE EVOLVING • Continue to engage internationally to explore ways in which the UK, as a
NEEDS OF global financial centre can use its expertise to meet the needs of international
EMERGING markets. This includes through providing green finance, greater insurance for
MARKETS cyber-risk and offshore local currency bonds.
4.3 ENGAGE The Bank should:

WITH FUTURE • Contribute within the scope of its mandate, if the Treasury wants to explore
OF FINANCIAL pro-growth changes to financial services regulation and other policies to be a
SERVICES competitive vibrant centre of financial services and be a leader in fintech, not
INITIATIVES least as Brexit choices become clearer.
5 PROMOTE THE SMOOTH TRANSITION TO A LOW-CARBON ECONOMY
The Bank should:

• Encourage widespread adoption of the Task Force on Climate-related Financial
Disclosures’ (TCFD) recommendations.
5.1 ADVANCE
THE ADOPTION • Monitor climate-related disclosures among supervised firms.
OF CLIMATE
• Work with the Department for Business, Energy and Industrial Strategy and
CHANGE
relevant authorities to explore the merits of making climate-related financial
DISCLOSURE
disclosures mandatory in mainstream financial disclosures, ideally within
five years.
• Consider climate disclosure for its own operations.
The Bank should:

• Ensure that the firms the Bank supervises are embedding scenario analysis in
their risk management.
5.2 EMBED
CLIMATE RISK • Engage internationally to develop templates for scenario analysis.
MANAGEMENT
• Facilitate the sharing of best practices in the management of climate-related
financial risks.
• Include a new climate-risk scenario for the Biennial Exploratory Scenario (BES).
6 ADAPT TO THE NEEDS OF A CHANGING DEMOGRAPHIC
The Bank should:

6.1 CONSIDER
FORCES • Consider what opportunities finance presents to share longevity risk.
DETERMINING
• Explore any regulatory impediments to security in retirement, starting with the
SECURITY IN
treatment of risk-sharing products and products that help protect savers from
RETIREMENT
outliving their savings if they live longer.
The Bank should:

• Provide its expertise to help challenge firms and authorities to consider what
financial products or protections gig and sharing economy employees may
6.2 SUPPORT need and the implications for firms’ risk management.
WIDER
INVESTMENT • Assess how firms are responding to the changing investment desires of
CHOICES younger demographics and whether they are strategically resilient to changing
preferences.
• Share expertise from climate-disclosure work to help investors develop
principles for broader sustainability metrics.
To ensure that finance increases resilience to new risks, the Bank should:
7 Safeguard the financial system from evolving risks

8 Enhance protection against cyber-risks
7 SAFEGUARD THE FINANCIAL SYSTEM FROM EVOLVING RISKS
The Bank should:

7.1 ENSURE • Remain vigilant to developments in the financial system and be ready to
REGULATION AND act to protect resilience when needed. To do so, regulatory approaches
INFRASTRUCTURE
and macroprudential tools may need to evolve. This report can provide
KEEP PACE WITH
suggestions on topics and risks to watch closely.
INNOVATIVE
BUSINESS • Evaluate the appropriate level of access to central bank infrastructure,
MODELS including its balance sheet, for non-banks in order to support greater
innovation while safeguarding monetary and financial stability.
7.2 FOSTER A The Bank should:

DYNAMIC AND
RESPONSIVE • Establish a dedicated ‘regulatory evaluation and response’ unit to assess the
REGULATORY effectiveness and impact of major policies across their life cycles. This includes
REGIME anomalies, unintended consequences and continued relevance.
7.3 CONTRIBUTE The Bank should:

TO AN OPEN • Work with the Financial Conduct Authority to suggest a Treasury-led review of
BANKING lessons learned from the first 18 months of Open Banking. The Bank should
POLICY consider how to mitigate risks and galvanise opportunities, including the
FRAMEWORK implications of unclear liability for data loss and failed payments.
8 ENHANCE PROTECTION AGAINST CYBER-RISKS
The Bank should:
8.1 ENHANCE • Map the mechanisms for data recovery and the potential for firms
DATA RECOVERY ‘stepping in’ in the event of a major cyber-incident.
• Consider the merits of the US private sector ‘Sheltered Harbor’ initiatives.
The Bank should:

8.2 CONDUCT • Enhance the frequency of domestic and international cyber-penetration
CYBER-EXERCISES tests. Growing focus should be on payments from traditional and new
entrants and the full value chain of providers.
8.3 ENCOURAGE The Bank should:

BETTER • Encourage better disclosure on cyber-threats domestically and
INFORMATION internationally to help develop the data required for developing a more
SHARING effective cyber-insurance market.
9 EMBRACE DIGITAL REGULATION
The Bank should:

• Develop and consult on a medium-term regulatory data strategy, ideally
for three to five years, with specific initiatives to embrace data-driven and
intelligence-led risk monitoring.
9.1 CONSULT ON • Foster data science capabilities and deliver a medium-term roadmap for its
A NEW DIGITAL digital transformation. This includes a recruitment and training strategy that
DATA STRATEGY meets the need of a central bank of the future.
• Consider making its rulebook machine-readable so it can be interpreted
more efficiently and accurately.
• Consider not just the cost of its own regulatory functions but the total cost
of regulation for the UK financial system.
The Bank should:

• Consider which new regulatory and supervisory technologies could
9.2 ENHANCE RISK make the data capture and analysis of information from firms less
MONITORING resource-intensive.
THROUGH
DIGITALISATION • Increasingly automate routine tasks and so free up resources to focus more
OF SUPERVISION on value-added processes.
• Over the longer term, make a choice about reaching out for data rather
than ask for it to be submitted.
1 SHAPE TOMORROW’S PAYMENT
SYSTEM
THE OUTCOME WE SEEK
An effective UK payment system which is fit for the future — secure, resilient, inclusive, innovative and
reliably serving households and businesses across the UK at an affordable cost.
• Our payment habits are shifting as we increasingly use our cards, phones and electronic
wallets instead of cash. The underlying infrastructure will need to adapt to these changes.
• Business models are also changing: fintechs, start-ups and big technology companies are
moving into payments.
• As our payment habits shift, we need a national payments strategy to improve our payments
infrastructure and regulation — which doesn’t leave anyone behind. Payments regulation also
needs to be updated to reflect how risks are shifting and to reduce complexity.
KEY DEVELOPMENTS
The shift from cash to digital

The defining trend around the world is the growth of electronic payments for every day purchases and
the consequent decline in the use of cash for basic transactions. Technology is allowing customers to pay
in new ways, with mobile payments becoming increasingly important.
The number of retail cash payments per person made in the UK has been falling at an estimated rate
of 10% pa in the five years between 2012–2017, according to McKinsey & Company. The UK is already
amongst the most cash-light economies globally. Some economies, such as Denmark, Norway and
Sweden, have seen even faster rates of cash decline (Figures 1 and 2). Norway is the lowest, where cash
usage is only six percent of value and eleven percent of number of transactions at point of sale.1
Figure 1: The UK is one of the countries which is shifting fastest from cash
Proportion of total transactions in cash 2016 (Vol/Vol)

Norway
Cash and 20% Denmark
mobile Luxembourg
France UK Sweden
payments Canada
40% Finland
Hong Kong Australia Netherlands
Belgium
Estonia
Korea
Switzerland
60% Singapore
Average Germany Ireland
Chile Brazil
Argentina
80%
Malaysia
Italy
Greece
Cash heavy
100% Philippines
India Morocco
0% -1% -2% -3% -4% -5% -6% -7% -8% -9% -10%
Slowest reduction Average Fastest reduction
Source: McKinsey & Company, Bank for International Settlements, European Central Bank, central banks, Euromonitor, Retail Banking reports, McKinsey Global
Payments Map.
Figure 2: Number of retail cash payment transactions per capita
Number of retail cash transactions per person

Korea announces plan
to go cashless by 2020
500
Swish
launches Korea
400
TfL accepts contactless, US
300 limit increases to £30

Canada
200 Netherlands
UK
Denmark launches Denmark
100
Instant Payments
system Sweden
0
2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
Source: McKinsey & Company, McKinsey Global Payments Map, press search.
The value of withdrawals from the UK’s largest ATM network LINK is seeing the largest decline in its
50-year history (Figure 3). Last year, the number of withdrawals fell by more than 6%.2 This has sped up
to 9% so far in 2019. Based on current trends, this would imply a fall by a third over the next
five years. Meanwhile debit card transactions overtook cash payments for the first time in 2017,
according to UK Finance.3
Figure 3: The decline in ATM transactions is accelerating
Indexed ATM transactions

120
100 UK
80
60
Sweden
40
2009 2011 2013 2015 2017 2019 e
Source: LINK, Sveriges Riksbank.
Analysis and interviews with major retailers and payment firms suggest the share of cash usage is
falling at a modestly accelerating rate. Changes in consumer behaviour have been reinforced by greater
penetration of contactless on mass transit and the high costs of handling cash for banks (c.5–10%
of operating costs for some retail banks, according to research by McKinsey & Company). The UK
Access to Cash review suggests a direct cost of £5bn for cash infrastructure but one estimate suggests
approximately double this when including indirect costs.4 Given the scale of this cost at a time when UK
banks are not making their return targets, it is likely that retailers, payment firms and banks will all look to
make savings. Without a coordinated plan, the pace of change could accelerate even faster and there is a
risk of some groups in society being at a disadvantage.
Whilst these factors may reinforce each other, experience elsewhere suggests the rate of decline in cash
may not move dramatically unless prompted by major interventions, often made by policymakers, such
as the transportation system going contactless, or the introduction of new payment services (eg Swish in
Sweden, Box 3). London/South East was an early adopter of contactless travel in terms of its transport
network — but Edinburgh, Manchester, Liverpool and Leeds just have or are about to go contactless, too.
Whatever happens, cash is likely to be used significantly less than digital payments over the next decade.
UK Finance estimate just over six in 10 transactions were in cash a decade ago — and just under one in
three last year.5 They forecast only one in 10 will be made with cash in a decade. Therefore, as the shift to
digital payments occurs, it will be important to ensure that it does not lead to financial exclusion.
Technological advances may not always be available to vulnerable groups. As the UK Access to
Cash Review argues, businesses don’t always focus on those who are the least affluent and least
commercially attractive, but arguably most in need. In addition, mobile and broadband connectivity could
create large regional disparities in the use of mobile and electronic payments, with rural communities
most at risk.
The rise of new business models
Technology companies are increasingly moving into the payments industry. They have a variety of
economic motivations and business models but offer choice and convenience to customers. Often their
services are overlays or bundled with existing ones.
The transformation from cash to digital in the UK has so far been led by card networks which have
provided secure and largely reliable means of payment; consumer protection; and financial incentives for
issuers and consumers. Nearly half of all payments (47%) were made with credit and debit cards in 2018.6
However, new payment providers have sprung up across the payment cycle, ranging from fintech
start-ups to established global technology firms. New analysis for this report from McKinsey & Company
suggests that an estimated >10% of 2017 UK card revenues have been taken by new firms — most of
which did not exist a decade ago. According to McKinsey & Company, approximately 35% of the total
number of fintechs and financial innovations in the UK relate to payments.
New firms, such as Stripe and Square, seek to address pinch points for merchants processing card
payments and handling cash. They make revenue by offering fast onboarding for customers, data
analytics and e-commerce functionality. Some of the world’s biggest tech companies now also offer
payment services (Figure 4). These developments underscore the considerable strategic value in
payments.
Figure 4: Overview of selected payment providers
Ant
Tencent Google Facebook Amazon Apple PayPal
Financial
Type of Online Social Online Electronic

Tech Tech Tech
firm retail media retail payments
Google Pay Facebook

(previously Messenger PayPal,
WeChat Pay
Payment Google Payments Amazon Venmo,
Alipay (previously Apple Pay
solutions Checkout, and Pay Braintree,
Tenpay)
Android Pay, Whatsapp Xoom
Tez (India)) Pay (India)
Launched 2004 2005 2011 2015 2007 2014 1999
2.4 billion
Estimated 33 million+
active
number made a
Facebook
of users 1 billion purchase
1 billion 25 million usersd 383 million 250 million
(data users (of via a
usersa usersc 210 million usersg usersh
cannot WeChat)b “Pay with
active
directly be Amazon”
Whatsapp
compared) buttonf
India userse
Balance
Embeds
stored in Payment
Balance payment E-money
a digital cards linked
stored in cards; Payment account can
wallet to and
a digital Debit cards credit cards linked be funded
linked to authenticated
How it wallet linked to transfers; to and through
a bank by mobile
works linked to Facebook direct authenticated cards, credit
account phone;
a bank Messenger debits; by mobile transfers,
or card. Credit
account or e-money phone and direct
QR codes transfers
card online debits
initiate
payments
a See intl.alipay.com/.
b See www.statista.com/statistics/255778/number-of-active-wechat-messenger-accounts/.
c See economictimes.indiatimes.com/small-biz/startups/newsbuzz/google-pay-now-has-25m-monthly-active-users/article-
show/65865946.cms.
d See www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/.
e See www.ft.com/content/e045cdd2-0503-11e9-99df-6183d3002ee1.
f See www.forbes.com/sites/greatspeculations/2017/02/14/heres-how-amazon-payments-can-drive-profitability-for-the-compa-
ny/#63fc70a4d228.
g See www.statista.com/statistics/911914/number-apple-pay-users/.
h See www.paypal.com/uk/webapps/mpp/personal.
E-commerce and social media ecosystems
Some firms offer seamless payments within their own ecosystems. And they have been able to use the
additional information from the ecosystem to offer customised commercial and financial products, such
as loans and insurance. This can increase financial inclusion. China is a good example of this
(Box 1). Several large e-commerce and social media companies have integrated financial services into
their platforms. Alipay and WeChat Pay, had an estimated 94% share of the mobile payments market in
China in 2017.7
Box 1: Innovation in Chinese payments
China has transitioned from a cash-based society services and online and mobile phone usage.
into a leader in mobile payment services and Regulation has also played a role. Until recently,
cashless transactions in a few years.1 In 2017, e-money was not backed fully as is the case in the
mobile payment transactions in China totalled UK. In 2019, the People’s Bank of China (PBoC)
US$15.4tn.2 This is significantly more than the raised backing requirements to 100%.3
combined total global transactions processed by
Several “big techs” have now integrated financial
Visa and Mastercard (US$12.5tn).
services, including payments, into their platforms.
The shift to mobile payments was enabled in
part by a significant growth in online retail
Figure 5: Consumer payments in China
Consumer payments by value ($ trillion)
2012 $10tn $3tn
Wallet P2P, purchased Cash, cheques, Credit and Wallet merchant

financial products e-transfers debit card payments
2017
$13tn $9tn $10tn $2tn
estimate
$0tn $10tn $20tn $30tn $40tn

Source: McKinsey & Company, McKinsey Global Payments Map, McKinsey Payments Practice, iResearch, PROC, press search.
1 www.ft.com/content/539e39b8-851b-11e8-a29d-73e3d454535d.
2 www.wsj.com/articles/china-tech-giants-costly-wars-to-go-cashless-1528977600.
3 www.reuters.com/article/china-pboc-payments/china-cbank-to-raise-reserve-funds-ratio-for-payment-firms-to-100-pct-idUSB-
9N1TE02O.
Box 1 continued: Innovation in Chinese payments
Alipay them to obtain credit from traditional financial

Alipay is an online and mobile payment platform institutions. Alibaba’s Zhima Credit
of ANT Financial that grew out of the Chinese (Sesame Credit) creates a credit score based
e-commerce giant Alibaba. It has a market share on social networks and payments history, which
of 35% of all Chinese electronic payments and allows lenders and merchants to establish a
54% of mobile payments.1 Chinese customers borrower’s creditworthiness.5
can use Alipay outside of China.
Ecosystems like Alibaba and WeChat harness
WeChat Pay huge data and leverage scale. The Chinese
WeChat Pay is an integrated digital wallet experience emerged in a different policy context
within Tencent’s WeChat application. WeChat to that in the UK with Chinese authorities strongly
Pay accounts for 15% of all Chinese electronic promoting financial deepening, including through
payments and 39% of all Chinese mobile faster payments. It nevertheless shows that the
payments.2 WeChat Pay now allows the use of traditional link between consumers and banks
Hong Kong dollars in mainland China.3 can break down, if new players successfully
integrate payments into their lifestyle proposition.
Alibaba and WeChat have used the data gathered
The Chinese firms are also world leaders in the
through payments for credit scoring their
use of machine learning to help curb fraud, drive
customers.4 Millions of Chinese citizens lack
business and personalise offerings.6
traditional credit histories making it difficult for
Figure 6: Payment providers in China
Market share of online payment services, Q4 2017
Alipay
Union Pay
Wechat Pay
99Bill
Others
China PnR
YeePay
Huanxun IPS
0% 10% 20% 30%

Source: Chinese SEO Shifu.
1 See www.ft.com/content/b472f73c-859e-11e8-96dd-fa565ec55929.
2 See www.ft.com/content/b472f73c-859e-11e8-96dd-fa565ec55929.
3 See www.chinadaily.com.cn/a/201809/27/WS5bac4168a310eff30327fc06.html.
4 See technode.com/2019/01/11/wechat-credit-score-sesame-credit/.
5 See www.ft.com/content/ba163b00-fd4d-11e8-ac00-57a2a826423e.
6 See www.inc.com/magazine/201809/amy-webb/china-artificial-intelligence.html.
Peer-to-peer payments
The UK has not experienced the significant growth of peer-to-peer payments some other countries have.
In the Netherlands around 60% of all e-commerce transactions are made through iDeal
(see Box 2).8 Penetration is also very high in Sweden, Norway and Denmark. In other European markets
the development of a mobile peer to peer app was often championed by the largest banks and
authorities sometimes worked to help. Furthermore, the cost of peer-to-peer payments is often cheaper
than using card networks. It also enables the bank to retain data on customers spending patterns.
Box 2: Account-to-account payments
Some countries — such as the Netherlands, Swish (mobile account-to-account solution)

Sweden, Denmark — have seen considerable Swish is a account-to-account mobile payment
success from the introduction of peer-to-peer apps app launched by six large Swedish banks in
— to enable sending money between individuals. In collaboration with the Riksbank in 2012.2 It allows
most markets the success has been huge and led consumers to pay quickly, securely and easily,
to incredibly fast adoption as an alternative option sending money to a recipient’s mobile phone.
to cash. And as a way to enable cheap, trusted The payment is authenticated using an electronic
payments, there could be a clear benefit for ID issued by a consortium of Swedish banks that
UK consumers. links to the national ID system.3
The Swedish and Dutch experiences show that Swish started as a person-to-person (P2P)
for account-to-account payments to take off, a platform, but expanded to business-to-customer
consortium of banks, often with support from (B2C) in 2014. It has grown rapidly with 60% of the
authorities, has to coalesce around a solution. Swedish population using Swish today (up from
This solution — built on the necessary payment 10% in 2014).4 Similar solutions exist elsewhere,
infrastructure — often provides a convenient eg MobilePay in Denmark and Finland, Venmo
customer interface and a recognisable brand in the US and PayPal.
in order to build momentum and encourage
Factors that may have additionally contributed
adoption.
to the expansion of Swish include a national
iDeal (e-commerce solution) digital ID leveraged across institutions, high levels
iDeal is a an account-to-account payment solution of mobile connectivity, financial literacy and trust
that was launched as an initiative by the three among the population on consumer privacy.
largest Dutch banks in 2005. It enables consumers Person-to-person transactions, especially among
to pay online direct from their bank account. younger people, were first to take off with Swish,
Payments are in real-time and consumers enter followed by adoption from merchants.
their bank details using a two-factor authentication
Several other countries have seen high growth of
model.
mobile payments. In Hong Kong, HSBC and Hang
Today around 60% of all e-commerce transactions Seng, the largest bank, have developed PayMe
in the Netherlands are made through iDEAL.1 Like and over one in seven citizens have downloaded
Swish, it has expanded its functionality to include the app.5
point-of-sale payments in retailers.
1 See www.ideal.nl/cms/files/Factsheet_iDEALpayments_UK.pdf.
2 See www.getswish.se/about-swish/.
3 See medium.com/@etiennebr/swish-the-secret-swedish-fintech-payment-company-created-by-nordic-banks-and-used-by-50-of-
swedes-cfcf06f59d6f.
4 Payment Patterns in Sweden, Riksbank, (2018). This is based on the question “Have you used Swish in the last month?”.
5 See payme.hsbc.com.hk/personal.
Cross-border payments
Cross-border payments are an area where frictions and inefficiencies continue to exist. McKinsey &
Company research shows that processing a cross-border payment is, on average, ten times more costly
than processing a domestic Automated Clearing House (ACH) payment.9 Each payment has to cross
multiple jurisdictions and infrastructures through the correspondent banking network which makes it
slow, costly and lacking transparency. Manual reconciliation of transactions with unclear payee details
further contribute to the costs. 63% of corporates report that they are unsatisfied with the time taken to
process cross-border payments.10
Regulation and the changes in the payments landscape
The payments landscape has undergone significant changes, including thorough regulations and policy
making. The advent of PSD2 and Open Banking (see Chapter 7) was designed to accelerate the trend
towards greater diversification in payments in the UK, catalysing the emergence of payment initiation and
aggregation service providers (PISPs/ASPs) and offering greater choice and lower costs for customers.
While potentially transformative, a number of challenges will need to be addressed — notably around
liability, reciprocity of data, incentives for banks, cyber-security and operational resilience. These are
embedded in wider questions about the take up and medium term viability of some of the providers and
design of the programme.
By definition, payments have strong network effects. Technological change has accelerated firms’ ability
to leverage these effects, as the collection of greater amounts of customer data has allowed firms to gain
valuable insights into consumer preferences and behaviour. Policy makers and authorities have been
monitoring these developments and should continue to do so in the future to account for changes in
market structure.
New electronic payment chains consist of an increasing number of parties that are interdependent but
do not always have the same interests. They may be under the supervision of various authorities or even
under no supervision at all. For example new businesses have emerged providing front end services
to help customers initiate payments. These lengthen the payments chain. Depending on whether the
initiated payments move from account to account or though card rails different regulatory regimes may
apply.
Some other jurisdictions are recognising the need to evolve payment regulation to keep up with new
business models. Switzerland has a broader range of payment firm licences than the UK.11 Singapore has
recently introduced a three tiered regulation for payment firms’.12
Crypto-assets and digital currencies
Technological developments and the fall in confidence in the banking system in the crisis have
contributed to the cryptocurrency revolution. Simon Gleeson, author of The Legal Concept of Money,
divides crypto-assets into three broad buckets, although many permutations are possible.13 Independent
of the technological design, benefits and challenges, each has quite profound different legal, regulatory,
and monetary consequences.
• First, a “true cryptocurrency”, which has no “issuer”. Ie it is not backed by any assets and exists merely
in the form of an entry on the ledger. Examples include Bitcoin.
• Second, an “asset-backed crypto-asset”. Each registered unit carries an entitlement to a share of an
underlying “property” which could be backed by one of one by fiat currency (so called stable coins) or
a basket of investments. They can be issued for settlement convenience, payment processing or as an
investment.
• Third, a “sponsor-issued cryptocurrency”, mostly backed by a bank. This is a permissioned register
operated by a sponsor manager or issuer and generally fully backed with assets. Each carries a right
to redeem value by submitting a claim to the issuer. As a result, there is credit risk involved. Use cases
suggested include making capital market settlement simpler.
For the first category, supporters argue that a fixed supply (in some cases), being outside of the traditional
banking system and anonymity make it appealing to a range of users. Set against this, crypto-assets, fail
the classic “tests of money” — or of good innovation.14 Their volatility which in many cases arises because
they are not backed by assets, mean that they are not a good store of value. Moreover, so far, they are an
inefficient medium of exchange. The technology limitations of some crypto-assets mean the networks do
not have the capacity nor reliability to be widely used in day to day transactions.15 On top of this, scams
were rife in some networks.16 This does not appear a particularly fertile area for today’s payments.
For innovation in retail payments and wholesale markets, much attention is currently focused on the
second category of “stablecoins”17 or their near cousins which are backed by a basket of investments.
They seek to offer the benefits of crypto-assets but without the price volatility. So far, the stability of such
coins is unproven, and subject to considerable scrutiny. If not fully backed by a single currency, but for
example a basket of backing instruments, they would also display a degree of volatility against the unit
used to price goods, and that depending on the volatility. This may discourage their use as a payment to
some extent.18
To displace existing payments systems with a new one would require it to be dramatically better than
today’s set up to justify the expense of a shift. That means cheaper, faster or simpler to use. In general,
retail transactions are already very fast and benefits would probably be linked to cost or convenience
especially for the remittance market. Increasing the speed of corporate and wholesale market
transactions could free up cash and collateral.19
There is close interest in the potential of technology to offer new ways to pay and transact. Use cases
being piloted include wholesale markets, trade finance, and domestic and cross border payments.
The optimism around such technologies for payments is based on the potential to create efficient and
resilient distributed networks, enabling multiple parties (or “nodes”) to transact in a frictionless way. DLT
based payment networks also offer potential benefits in transparency and security, and the integration
of the network with other technologies such as “smart contracts” which could automate aspects of the
operation of financial transactions, boosting speed and efficiency.20
If receiving money in exchange for tokens is seen as a form of deposit banking (which is a policy choice
still to be made), then the only possible providers are either commercial banks or the central bank.
Given rapid payments innovations and growing maturity in the available technology, the Bank should
ensure it remains at the forefront of research into these topics. It should also increase its engagement
with financial institutions who wish to use DLT in their business models; and to understand their needs
from a policy and infrastructure perspective. The use of digital currencies has societal and economic
implications that a broad range of policy makers will have to address.
Central bank digital currencies (CBDCs)
The exploration of new technology for payments and settlement is not confined to the private sector.
Central Banks, from Sweden to Cambodia have announced they are exploring the potential of so called
“Central Bank Digital Currencies” (CBDC), offering individuals access to central bank money in electronic
form.21 Motivations for CBDC experiments include exploring the potential benefits for financial inclusion,
adding diversity in payment options, and responding to falling cash volumes.22 However, the concept of a
CBDC available to individuals raises significant policy questions relating to the transmission of monetary
policy, financial stability and operational feasibility.23 Many of these unanswered questions relate to
the potential for a CBDC to “disintermediate” the banking sector, a process whereby bank deposits are
switched into CBDC, with implications for the provision of credit to the economy, and how changes in
interest rates are passed on to savers and borrowers.24 Moreover, if one reason for providing a CBDC
is as an alternative to today’s digital payments if the system went down, it is not entirely obvious a CBDC
would be more resilient, for example to power outages or a cyber-attack. This rationale may therefore not
justify a shift.
At present the Bank of England states that it does not plan to issue a CBDC, preferring to focus on
policy and infrastructure choices that could enable diversity and resilience in the next generation of
electronic payments.25 This review does not see a compelling case for a central bank digital currency
given numerous uncertainties. These include legal uncertainties, risks around deploying the technology
at scale, the potential impact on monetary transmission, and critically the risk of diverting attention away
from improving today’s systems for customers. Improving efficiency and cyber-security and enabling the
core payment systems to be a platform for private sector innovation should remain the priority.
LOOKING TO THE FUTURE
A number of scenarios can help to explore the implications of changes in payments for consumers and
policy makers. The scenarios are based on the expectation that cash use will continue to fall. They are
extrapolated from trends in the UK and abroad.
As illustrated for Sweden (Box 3), a further decline in cash has many important implications for policy
makers. They must observe what replaces cash and whether it adds diversity or increases concentration
in the payment system. And they need to ensure that cash distribution across the country is maintained
even if cash is used far less to ensure the inclusion of those who rely on cash.
The extent to which traditional payment value chains are “unbundled” with implications for the business
model viability and resilience of providers, whether they are banks, NBPSPs or bigtechs, will be of interest
to policymakers.
The UK Access to Cash Review (ACR) commissioned by LINK and chaired by Natalie Ceeney published
a number of recommendations in February 2019 which seek to ensure that access to cash and/or
payments is maintained in the next 10–15 years.26 These include providing a guarantee to the public
that they will have access to cash, an efficient cash distribution infrastructure and digital solutions that
are designed to allow their provision across a wide customer base. It also identified the need for a
coordinated oversight of cash through HM Treasury (HMT).
Several scenarios for the future of payments may be plausible (see Figure 7). Cash use may fall at the
measured rate we have observed over the past five years with card networks remaining the most popular
electronic payment method, offering consumer protection and familiarity. In this scenario, card networks
might consolidate their value chain by expanding their capabilities and making mergers and acquisitions.
This might cause little disruption but would pose questions about the implications of concentration of
payment methods.
Figure 7: The use of cash could follow different paths

Proportion of total payments made in cash
60%
TFL accepts contactless
and limit rises to £30
Sweden
introduces
40% Swish
Continuing UK
five-year trend
UK Finance 2019
forecast
20%
0% 2018 UK decline continues

2010 2015 2020 2025 2030
Source: Sveriges Riksbank, UK Finance June 2019, Bank of England calculations.
Note: UK actuals include consumer and business payments. The Bank’s direct involvement in cash distribution is limited to issuing new banknotes,
withdrawing banknotes following the launch of a new series and destroying banknotes that are no longer fit for circulation. Notes are distributed by members
of the Note Circulation Scheme (NCS) who have a contractual relationship with the Bank.
Box 3: The decline of cash in Sweden
Swedish households are increasingly using banks do not have to offer cash services and
electronic means of payment such as bank cards retailers do not have to accept cash in return for
and the mobile payment system Swish.1 Cash use purchases made.
has declined significantly in the last five years to
Competition authorities opposed a proposal
13% in 2018.2
in 2018 to force the country’s largest banks to
The total value of ATM cash withdrawals, an handle cash to try to limit the rapid decline of
alternative measure of cash, has also materially cash.4 This was on the grounds that it would
declined in Sweden (from SEK270bn in 2006 to distort competition. They also argued that
SEK110bn in 2016) in a similar fashion as the UK’s securing access to cash should be a responsibility
number of withdrawals has declined since 2017. of the state. The Riksbank suggested that all
banks and other credit institutions that offer
Policy makers raised concerns around financial
payment accounts should be obliged to handle
inclusion and the viability of the cash distribution
cash.5 Going further, they also suggested
system in 2016, when it became increasingly
important activities for society — such
difficult to maintain cash services in sparsely-
pharmacies, special transport services, food
populated areas and have since introduced
shops, petrol stations — should be compelled to
distribution thresholds to maintain inclusion.3
take cash.6 The discussions are ongoing.
When policy measures were taken it was largely
felt that the pace of change had accelerated The lesson from Sweden is that it is important
too far and authorities needed to push back to to get ahead of trends, as once infrastructure is
prevent further decline. In 2018 the number of closed, it becomes inaccessible. Furthermore, it
coins and notes issued increased again for the may be necessary for the state to support the
first time in a decade. cash economy as a public good, as without this,
the incentives for many actors will be to reduce
The decline in cash has been facilitated by
the use of cash.
Swedish legislation, whereby no central authority
is responsible for the distribution of cash;
Figure 8: Cash usage in Sweden vs UK
2010 2012 2014 2016 2018
Sweden 39% 33% 23% 15% 13%
UK 56% 54% 48% 40% 34%
Source: UK Finance, Sveriges Riksbank, Bank of England. UK actuals (% of transactions) include consumer and business payments. Swedish data refers to
retail payments only (% of those surveyed indicating having used cash in the last year).
1 Payment patterns survey, Riksbank, (2018).

2 Payment Patterns in Sweden, Riksbank, (2018).
3 See www.riksbank.se/en-gb/press-and-published/notices-and-press-releases/notices/2018/all-banks-should-be-obliged-to-han-
dle-cash/.
4 See www.bloomberg.com/news/articles/2018-10-22/swedish-atm-operator-says-cash-provision-is-state-responsibility.
5 See www.riksbank.se/en-gb/press-and-published/notices-and-press-releases/notices/2018/all-banks-should-be-obliged-to-han-
dle-cash/.
6 Consultation response on Secure access to cash, Riksbank, (2018).
Cash use may fall faster, as electronic payments and new mobile interfaces integrate payments into
e-commerce and lifestyle platforms. This might engender more competition for incumbents, including
from outside the traditional financial sector. In the UK, this could happen if many people start using
payment services offered by big techs, such as Google, Apple, Amazon or Facebook.
Alternatively cash may fall faster due to a shift to account-to-account payments, like in Sweden and
the Netherlands. New entrants could create a direct-to-account solution with a major brand that has a
convenient interface and is used by all major financial institutions and vendors.
Policy actions will have to be tailored to the trends observed and authorities will have to find new ways
of maintaining access to and the distribution of cash if the rate of decline accelerates. This would be
necessary if more bank branches close and customers can’t access cash services at their local post offices
or shops via cash back or smart ATMs, which can receive deposits.
In anticipation of changes in the payments landscape several countries are, or have recently, undertaken
reviews of their regulatory regimes for payments in the light of developments in the sector. For example,
• the Canadian Department of Finance is consulting on amending Canada’s approach to payments
oversight so that it defines the payments industry and its players by what they do versus what type
of organisation that they are in order to allow for innovation to happen in a safe and predictable
environment;27
• the Dutch Central Bank (DNB) is considering whether they have adequate powers and/or need to
introduce new or different types of supervision of payments to reflect the increasing fragmentation
of the payment chain and to be able to supervise effectively from a chain-oriented perspective.28 The
DNB has committed to “formulate a vision with respect to these important questions in the coming
years”.
IMPLICATIONS FOR THE BANK
As payments transitions from cash to electronic payments this can produce a range of benefits for
consumers, merchants, banks and the economy, including:
• Convenience of digital payments and personalisation achieved through increased integration;
• Increased economic efficiency through a decline in the costs of transacting and risks of cash handling.
In order to achieve these benefits, payments innovations have to be resilient and the shift away from
cash orderly and inclusive. Several lessons can be learnt from Sweden and the UK’s own experience
which show that there is a continued need to understand the risks to resilience from increased diversity
of electronic payments and consider interventions that can help shape a payments system that serves all
customers.
The transition to digital payments poses three fundamental questions for the Bank’s oversight of
payments systems and the provision of central bank infrastructure:
(i) Does the infrastructure for electronic payments have the capacity, durability and reliability needed?
(ii) Are there implications both for the Bank’s “hard” and “soft” infrastructure, e.g. the Bank’s high
value payment systems and what does it mean for “soft” infrastructure (rules, regulations)?
(iii) What implications does a potential acceleration in the decline of cash have on the viability of
existing structures to distribute cash?
Some key issues to consider in shaping the payment system of tomorrow:
• The payments sector must be resilient to increasingly sophisticated cyber-attacks. The complexity of
payment networks including the growing dependence on shared solutions, such as APIs, can create
common vulnerabilities.
• The Bank should ensure the framework for cash distribution is sustainable.
• Greater clarity on who holds liability and carries risks for consumer redress under new market
structures will help the market to innovate. This includes the areas of AML/KYC, fraud, failed
transactions, mis-selling, cyber-risks and privacy where an equitable market needs to provide certainty
of expectations to all participants. Whether the liability and risks sit with incumbents or new payment
providers has implications for innovation and market stability.
• The regulatory framework for firms involved in the payment chain may need amendments to make
sure providers have enough financial resources to protect their customers if things go wrong,
irrespective of their size or maturity. This is likely to require changes to payment regulation
• The Bank together with other authorities will continue to provide the hard and soft infrastructure to
enable innovation, ease frictions and provide resilient payment networks.
• Increasing competition could impact banks’ business models and financial stability in more extreme
scenarios. If banks can’t harness technology for their products and services, it could erode fee income
and lower overall profitability, reinforcing a cycle of low profitability (see Chapter 7).
• In the next few years, the Bank will have to closely watch developments around the introduction of
central bank as well as private sector digital currencies as these may pose more profound questions
for payments oversight.
RECOMMENDATIONS
Why does the Bank need to act?

• While moving to a cash light (not cashless) economy brings many benefits
for consumers, businesses and financial institutions, it also has implications
for inclusion and the viability of the current cash distribution network. These
could be compounded by large regional challenges from poor broadband and
mobile connectivity.
• The well-argued Access to Cash Review (ACR) commissioned by LINK and
chaired by Natalie Ceeney MBE published a number of recommendations
which seek to ensure that access to cash and/or payments is maintained in the
next 10–15 years.
• As a result of concerns raised in Sweden, the government decided to intervene
in the payments market in 2016. Given the UK may only be 4–6 years behind
Sweden in the trajectory towards a decline in cash, similar issues may need to
be considered in the UK in the next few years.
• Currently there is no single authority responsible for overseeing cash or digital
payments, and payments depend upon enabling technologies well beyond
finance, such as broadband and mobile. Authorities would benefit from a more
detailed roadmap to inform discussions on the likely reduction in cash. The
current regulatory framework for payments is fragmented and may lead to
inefficient outcomes.
1.1 Produce
a roadmap
for payments What can the Bank (and others) do?
options The Bank should:
• Join a group of regulators (including non-financial ones such as Ofcom) and the
private sector convened by the Treasury to fashion a co-ordinated response
to society’s shift to digital, without leaving anyone behind. In effect, a national
payments strategy council.
• This could include a roadmap to:
- foster cost-effective and resilient payments for the future;
- understand dependencies such as broadband and mobile coverage;
- ensure that no one is left behind through “digital exclusion”;
- consider with the private sector options to improve the sustainability
of the cash payment model, including potential merits of a “utility”
distribution model similar to Finland, Sweden and the Netherlands; and
- contribute to a longer-term debate about whether cash distribution may
require state support if the current model becomes uneconomic for the
private sector.
• Explore any hurdles to faster, cheaper and more widespread peer-to-peer and
inter-bank payment options — especially those powered by mobile apps —
with the Financial Conduct Authority and the Payment Systems Regulator. This
should include the role of appropriate fees for PSD2 transactions.
• The regulatory framework for payments involves multiple authorities, which
may not deliver the best outcomes overall as transactions become more digital
and new players grow in size.
• As payment methods are evolving, it can be difficult to establish where they
sit in existing regulatory frameworks. New types of activities and services may
have to be brought into the regulatory perimeter, or their regulatory treatment
amended.
1.2 Contribute
to the next
generation What can the Bank (and others) do?
of payment The Bank should:
regulation
• Suggest the Treasury lead a cross-authority review of payments regulation to
evaluate:
- the appropriateness of the regulatory framework for the risks posed by
different payment activities, including tiering of firms;
- how to ensure effective supervision of the overall payments value chain;
- the role of data-sharing between platforms and payment companies; and
- ways to reduce fragmentation and complex regulation in the UK.

• McKinsey & Company research shows that processing a cross-border
payment is, on average, ten times more costly for banks than processing a
domestic ACH payment. Each payment has to cross multiple jurisdictions and
infrastructures through the correspondent banking network which makes it
slow, costly and lacking transparency. 63% of corporates report that they are
unsatisfied with the time taken to process cross-border payments.
• The main challenges include effective messaging standards to identify and
authenticate recipients; complex KYC/AML regulations and high capital and
liquidity cost of settlement.
1.3 Develop the • Given the importance of cross border payments to trade, investment and
infrastructure
remittances, they are a matter of priority which requires ongoing coordination
to make
between public and private bodies.
cross-border
payments more
efficient and What can the Bank (and others) do?
cheaper The Bank should:
• Implement richer messaging standards and common identifiers to facilitate
more effective and accurate global co-ordination.
• Open access to a broader range of payment providers who operate across
borders.
• Continue to work with international bodies, such as the Committee on
Payments and Market Infrastructures, to explore opportunities to make
cross-border payments more efficient and cheaper.
• Keep abreast of digital tokens and explore greater interoperability with other
central banks to improve payments for households and companies.
ENDNOTES
1 See www.europeanpaymentscouncil.eu/news-insights/insight/taking-closer-look-norways-payment-landscape.
2 LINK Statistics, (2019).
3 UK Payment Markets Study 2019, UK Finance, (2019).
4 Access to Cash Review, (2019).
7 Chinaeconomicreview.com/unionpay-struggling-mobile-payments-era/.
8 See www.ideal.nl/cms/files/Factsheet_iDEALpayments_UK.pdf.
9 Global Payments 2016: Strong Fundamentals Despite Uncertain Times, McKinsey & Company, 2016). ACH payments are electronic
payments made through Automated Clearing House (ACH) Network.
10 Webcache.googleusercontent.com/search?q=cache:zO7rzD_qFSIJ:https://www.saxopayments.com/wp-content/uploads/2015/11/
Saxo-Payments-Infographic-Branded.pdf+&cd=3&hl=en&ct=clnk&gl=uk.
11 Competitivecompliance.co/fintech-license-comes-in-effect-in-switzerland-on-january-1st-2019/.
12 Strengthening Singapore’s payment services through regulation, PWC, (2018).
13 The Legal Concept of Money, Simon Gleeson, (2019).
14 Five reasons why bitcoin fails the innovation test, Financial Times, (2018).
15 See www.bankofengland.co.uk/knowledgebank/what-are-cryptocurrencies.
16 The Future of Money, speech given by Mark Carney, Inaugural Scottish Economics Conference, March 2018.
17 Can “stablecoins” be stable, Bank Underground, Ben Dyson (2019).
18 Crypto-asset markets: Potential channels for future financial stability implications, Financial Stability Board (FSB), (2018).
19 See www.finextra.com/blogposting/17238/blockchain-and-stable-coins-opening-the-crypto-markets.
20 Cryptoassets Taskforce final report, HM Treasury, FCA, Bank of England, (2018).
21 Proceeding with caution - a survey on central bank digital currency, BIS Papers No 101, Bank for International Settlements (BIS),
(2019).
22 E-krona project, report 2, Riksbank, (2018).
23 Central banks and digital currencies, speech by Ben Broadbent, London School of Economics, March 2016.
24 Broadening narrow money: monetary policy with a central bank digital currency, Staff Working Paper No. 724, Barker et al., 2018.
25 See www.bankofengland.co.uk/research/digital-currencies.
26 Access to Cash Review, (2019).
27 See www.fin.gc.ca/activty/consult/rcpa-elcp-eng.asp.
28 DNB Payments Strategy 2018-2021, De Nederlandsche Bank, (2018).
2 ENABLE INNOVATION THROUGH
MODERN FINANCIAL INFRASTRUCTURE
THE OUTCOME WE SEEK
Modern public and private financial infrastructure that enables innovation and resilience. This includes
upgrades in convenience, cost, speed and security.
• T
he next generation of financial firms will likely widely use public cloud technology.
Firms should be able to benefit from the agility, cyber-security and platform for
innovation that this technology offers. The Bank will need to build expertise and
play a leading role in making sure firms use it in a safe and sustainable way.
• L
ess costly and more reliable digital identification will be essential to harness the
benefits and opportunities of the digital economy for UK households and firms.
• B
etter co-ordination of major regulatory projects could help innovation and improve
resilience, while increasing operational effectiveness of firms.
KEY DEVELOPMENTS
Modern infrastructure
Markets and innovation thrive with the right public and private infrastructure. Hard infrastructure ranges
from transport to payments architecture, while soft infrastructure includes the rule of law, market
practices, codes of conduct and regulatory frameworks. The Bank of England works to keep the financial
system safe and to ensure the public financial infrastructure allows innovation and competition to
prosper.
Cloud technology is increasingly mainstream
Financial businesses are increasingly likely to be hosted online by third-party providers. This is known as
public cloud technology and ranges from pure infrastructure services through to data applications and
analytics.
Cloud services are increasingly important for the digital economy. They have potential to reduce
technology infrastructure costs by 30%–50% according to McKinsey & Company.1 In finance, a quarter of
major banks’ core banking activities are cloud hosted,2 and 14% of banking workloads use public cloud or
software as a service.3 Synergy Group Research estimate the public cloud infrastructure market at $70bn
for 2018 globally, up 48% year on year.4
Cloud computing can spur innovation.5 It provides flexible and agile infrastructure and reduces barriers
to entry for smaller players who might not be able to invest in their own solutions.6 Combined with digital
business services, it offers ready-made platforms for early-stage companies, including fintechs to cut their
time (and cost) to market.
McKinsey & Company estimate that 40%–90% of banks’ workloads globally could be hosted on public
cloud or use software as a service in a decade (Figure 7). Finastra has found that 30% of financial
institutions surveyed in the UK and 33% in the US have moved towards payments or collaboration in the
cloud, behind Singapore with 42%.7
Banks primarily use the cloud for customer relationship management, human resources and financial
accounting.8 But a growing number could expand to consumer payments, credit scoring and asset
management.9 And increasingly, financial firms’ technology vendors are dependent on the cloud, creating
reliance in the supply chain.
Many fintechs and nearly all major technology providers to banks and insurers are hosted to some
degree on the cloud.10 Therefore policies will need to reflect that the financial system already indirectly
relies on the cloud. If the UK wants to stay ahead in international finance with competitive financial firms
that are on a level playing field to new business models, it will need to revise and shape new cloud usage
guidelines.
The cloud could enhance cyber-resilience, especially for smaller financial firms with fewer technology
resources. Cyber-attacks are becoming more common and sophisticated (see Chapter 8). But fieldwork
for the review suggests that even the best-resourced financial firms invest less in cyber-defences than
cloud providers, which have:11
• Leading security capabilities.
• Diversified storage and multiple back-ups limiting the potential for wholesale outages.
• Cutting edge tools to protect against distributed denial-of-service attacks (DDoS).
• Automated network-wide updates reducing the risk of outdated software.
While the benefits of cloud are increasingly clear, the cloud services market is dominated by a few large
firms.12 Two providers, AWS and Microsoft, account for nearly half of all revenues from public cloud
infrastructure. This brings scale and efficiency, but also concerns about dependence on a small number
of critical suppliers, as shown by Figure 1.
There are some important trade-offs to make. But the benefits to customers and firms of moving from
their own practically private cloud storage to public cloud at scale is persuasive.
Figure 1: Public cloud is big business
Cloud infrastructure services market share 2018 Q4 (IaaS, PaaS, hosted private cloud)
Amazon
Microsoft
Google
IBM
Alibaba
Next 10
providers
Rest of market
0% 10% 20% 30%

Source: Synergy Research Group.
Identity in a digital world

Better electronic identification will be essential for UK households and firms to benefit from the digital
economy. Customers and businesses need to prove who they are many times a day for a whole host of
purchases and transactions, using a range of identity attributes (Figure 2). Most financial firms consulted
bemoaned the cost and inefficiency of identity verification. Digital IDs could make this process seamless,
providing the convenience of integration into platforms and e-commerce.
A digital ID could also help reduce cyber-crime.13 UK banks spend £5bn fighting cyber-crime and online
fraud annually, according to UK Finance.14 Not having a national digital ID strategy may result in increased
fraud, higher costs of finance and more exclusion than in other markets. Secure digital identification
would allow financial firms to better identify and authenticate customers, reducing fraud and facilitating
compliance with “know your customer” (KYC) and anti-money laundering (AML) requirements.15
Figure 2: A number of different “attributes” can uniquely identify an individual or entity
For individuals For legal entities For assets
Inherent
Date of birth Industry Nature of the asset
(intrinsic to and
Fingerprint Business status Asset issuer
individual)
Accumulated Health records

Business record Ownership history
(gathered/developed Preferences and
Tax record Transaction history
over time) behaviours
Legal Entity
National identifier
Assigned Identifiers (“LEIs”) Identifying numbers
number
(attached to the entity) Legal jurisdiction Custodianship
E-mail address
Directors
Source: McWaters, J, Robson, C (2016) “A Blueprint for Digital Identity The Role of Financial Institutions in Building Digital Identity”, World Economic Forum.
Figure 3: Digital identification is established through several layers
Each layer of identity of serves a different purpose, and suffers from a distinct set of
problems in today’s identity landscape
Goals Problems
Providing efficient,
Inefficient or unsuited
effective and seamless Service Delivery
service delivery
services to users
Provisioning what services Complex

users are entitled to authorisation
Authorisation
access based on their rules and
attributes relationships
Providing mechanisms Insecure and privacy

for exchanging attributes Attribute exchange compromising
between parties attribute exchange
Weak or
Providing mechanisms for
Authentication inconvenient
linking users to attributes
authentication
Inaccurate or
Capturing and storing
Attribute collection insufficient
user attributes
attribute collection
Developing Lack of
standards to govern Standards co-ordination
system operation and consistency
Source: McWaters, J, Robson, C (2016) “A Blueprint for Digital Identity The Role of Financial Institutions in Building Digital Identity”, World Economic Forum.
Traditionally, identity has been established based on physical interactions and documents. A digital
identity could offer a means of electronic verification, providing a wider range of services in real time
(Box 1). But transactions require documents of varying standard and quality — for example for
authorising payments and verifying credit histories (see Figure 3 for an illustration of the different layers
of identification).16
Many good ideas have been suggested from the private sector to address the UK’s lack of a national
digital ID. For instance, Monzo suggested the UK issue an even cheaper provisional driving licence with no
driving privileges — as done in New South Wales — to less advantaged groups to help move them online,
which can also be used to open a bank account. Another idea was to install mobile-readable chips in
driving licences and passports to help financial firms verify customers.
The experts consulted said a private digital ID solution was more likely to succeed in the UK than a public
only one. They stressed that access to sources such as the Passport Office and the Driver and Vehicle
Licensing Agency (DVLA) would be useful. The field work has suggested that information from Companies
House could be too but may be of lower value as the information is self-certified and can be up to
nine months out of date. Access to tax records would also be valuable.
A successful digital ID solution needs certain characteristics. First, those who use identity providers
will need to trust their accuracy, reliability and safety.17 Second, digital identification must meet liability
requirements for financial services and other firms who use the information. And third, it should be
embedded in a user-friendly interface for customers that encourages take-up and use.
Better digital identification could overhaul cumbersome verification processes and expand access to
finance.18 Small and medium-sized enterprises (SMEs) have to provide a large amount of information to
financial firms, encountering fragmented and inconsistent processes across providers (see Figure 4). This
creates a barrier to accessing finance, increases costs and limits productivity.
Organisations use different data sets to make their proprietary decisions, which makes it difficult to
harmonise requirements without reducing lending to the simplest common factor. Many lenders are
trying to improve the quality of their decisions through blending in even more datasets. Having a clear
way to digitally identify an entity would help this process. Assigning Legal Entity Identifiers (LEIs) can
further help firms to provide identification.19 Similarly, APIs can help with exchanging different attributes
for authorisation.20
Figure 4: SMEs face multiple questions when opening an account in the UK

Common questions by bank Common questions by industry
Lloyds
Energy Telco
16
2
HSBC
Barclays 13 5
9 2
3 0
7 0 1
41 3
0 5 13
0
3
4
19 10 3 4
4
2
4
0 2
1 0
1
5 0 1
12
12
16
Santander Natwest Banks

Source: Whitechapel Think Tank/UK Finance.
Box 1: Digital identification across the world
Across the globe, countries have taken different 2003 and is now used across a range of sectors.
approaches to establishing digital ID schemes. Similar public-private partnerships exist in Norway
and Denmark.
India’s Aadhaar is a unique biometric ID (UID)
given to each individual. Citizens must have it to UK digital ID schemes underwhelm. In 2014,
access social benefits such as healthcare.1 More the government launched the voluntary Verify
than 99% of the adult population is enrolled in scheme.3 It is primarily used for accessing
the mandatory programme, launched by the government services online. It has had low
government in 2016. adoption (<5% of adults) and seen significant
criticism from the National Audit Office.4 By 2020,
Sweden’s BankID is an electronic ID allowing
the scheme had expected to have over 20m users
companies, banks, and the government to
but only has 3.4m today. This is in contrast to
authenticate and transact with individuals online.2
countries such as the Netherlands which has over
It was developed by a consortium of banks in
70% usage of voluntary schemes (Figure 5).
Figure 5: The most successful digital ID schemes are built on national ID systems
Digital private and public and public ID schemes globally Not based on national ID
Population Based on national ID
100m+
Indonesia India
(pop. 261m) (pop. 1,300m)
80m Germany
France
60m
Italy
Spain South Korea
40m
Algeria
Canada
Netherlands
20m Australia Chile
Singapore Denmark UAE
Bahrain Slovakia
0m
0% 20% 40% 60% 80% 100%

% using digital ID
Source: McKinsey & Company press search.
1 Case study: Aadhaar — India, Embracing Innovation in Government: Global Trends 2018, OECD, (2018).
2 See https://www.bankid.com/en/.
3 See www.gov.uk/government/publications/introducing-govuk-verify/introducing-govuk-verify.
4 Investigation into Verify, National Audit Office (NAO), (2019).
Investing in the future

Firms must be able to make strategic investments in their technology infrastructure. This will ensure the
efficiency, responsiveness and security of financial services in a digital age.
Uncoordinated and overlapping regulatory demands may hold back innovation and encourage tactical
fixes rather than strategic solutions to technology challenges. Most financial services firms highlighted
how coinciding regulatory timetables and the intensity of such projects added to complexity, costs and
limited innovation. This is partly due to regulators failing to co-ordinate and in some cases not fully
understanding the technology impacts of their initiatives. As importantly, national regulators do not
always have control over the timescale and scope of regulation and legislation (see Chapter 9).
The flurry of regulatory demands with short deadlines may mean firms patch up existing legacy systems
rather than invest in longer-term improvements. Regulators should co-operate more closely to avoid
bunching and crowding out innovation at the expense of the operational resilience of the overall industry.
BASEL IV Q1 2020 VULNERABILITY/
Payment Systems Regulator FINANCIAL INCLUSION
Q4 2019
TIMELINE
Payment Strategy Forum
* Improving conduct and
Pay.UK communications in payment
Q3 2019 services and e-money firms.
Request to PAYMENTS Strategic Review

Pay
Q2 2019 of Retail
Banking Business
SAVINGS*Price
Confirmation Discrimination in
Payment Services Directive 2018 Models (R2B2)
of Payee the Cash Savings
Further regulatory standards
Market
expected - Value chain in payments
BREXIT Q1 2019 - Aspects of SME Banking
- Monitoring retail banking business models’
`
Payment Systems Regulator –
Market Review of Card Acquiring
ECJ Judgements *Basic Savings Rate
RING FENCING Q4 2018
WHOLESALE
CRIME
PRUDENTIAL
FINANCE
ECONOMIC
BASEL III *Authorised Push Credit Data Sharing

RESILIENCE
DATA ETHICS
COMMERCIAL
OPERATIONAL
Payment
CAPITAL MARKETS AND
MACROPRUDENTIAL TIMELINE
Scams/Contingent *Unfair Terms in
Q3 2018 Reimbursement Model Consumer
TECHNOLOGY AND CYBER RISK
IIRBB
Contracts
PPI Deadline (Aug 2019)
Open Banking
and Litigation FOS Complaints Jurisdiction
Q2 2018
CITIZENS ADVICE
Communication of CMCs SUPER COMPLAINT
*Fair Pricing
Q1 2018
Credit Card Market Study *Mortgage Market Study

CREDIT
Consumer Credit
Directive *High Cost Credit/Overdrafts
FOS – Standard Variable Rate
Complaints
CCA retained provision
*Management of long Second Charge
term arrears Complaints
* FCA led papers
*Trapped Borrowers
Figure 6: Regulatory change is complex and overlapping — better co-ordination would help
UK Finance have highlighted this complexity in Figure 6 which shows a snapshot of regulatory demands.
FUTURE OF FINANCE
Source: UK Finance, 16 April 2019.
46
Providing the right central bank infrastructure

Public infrastructure can lower costs of production, give business the confidence to invest and enable
them to use their resources more productively. It can also catalyse competition by providing a level
playing field for firms to innovate and access the marketplace.
The Bank is an infrastructure provider. This includes hard infrastructure such as the Real-Time Gross
Settlement system (RTGS). This infrastructure underpins payments and settlements that are vital to
households and businesses — processing on average £650bn of value a day.21
The Bank was the first G20 central bank to give non-bank payment service providers (NBPSPs) access
to settlement accounts in the payment system, thereby enabling competition.22 This first and foremost
promotes financial stability by reducing dependence on a small number of banks and reducing credit
exposures between those who are members and those who only have indirect access. But it also serves
to support competition and innovation in a payments landscape that is seeing significant change.
The Bank is upgrading its infrastructure for a digital age by rebuilding the RTGS system.23 It is
future-proofing the system by:
• Exploring “plug and play” functionality with distributed ledger technology-based business models and
synchronisation with other payment ledgers;24
• Embracing global data standards through the use of the Legal Entity Identifiers (LEIs) which uniquely
identify firms, and the ISO20022 payments messaging standard, which standardises transactions
information; and
• Enabling members to apply data analytics to transaction data through an Application Programming
Interface (API).
The economy and finance are changing rapidly. Data, platforms and e-commerce are re-shaping the
economy. Climate change, demographics and the increasing integration of emerging markets into trade
and commerce are creating new financial and investment needs (see Chapters 4–6). And the make-up
of the financial system is changing as innovation occurs and new business models challenge incumbent
institutions. From the growth in market-based finance to alternative lenders and new payment providers,
the financial system is fast evolving (see Chapter 7).
The Bank should keep the infrastructure needs of a dynamic UK financial sector under review. Through
its work on RTGS renewal the Bank has already shown leadership in understanding the infrastructure
needs of a financial system that is innovating and changing. Given the expectation of continued change
— as new payments providers emerge and if the traditional banking business model is “unbundled” —
the Bank should continue to engage broadly to understand the implications of these developments for
central bank policy and operations. This could include consideration of what level of access to the central
bank payment systems infrastructure, and the Bank’s balance sheet, may be appropriate for fintechs and
innovative business models.
Any review should be based on a thorough understanding of the business model of these companies
and their implications for financial stability and monetary policy. Opening infrastructure to new types of
business models is a major decision for the Bank. It would inevitably need to be preceded by a thorough
exploration of whether there is a substantive case for access, and, crucially, what safeguards would
need to be in place for this to happen safely, including an appropriate regulatory framework for those
companies (see Chapter 7).
Removing barriers to cloud adoption
The adoption of cloud technology depends on many factors, including what choices regulators make.
A significant part of the demand will likely come from software that users can subscribe to and access
online rather than download (software as a service — or SaaS).25
Financial institutions have been slower at adopting the public cloud than other industries. This can be
explained by cautious regulators, management teams taking time to gain trust and see use cases and the
cost of migrating systems.26 Nearly half (43%) of UK firms surveyed by Finastra cite complex regulatory
requirements as a key barrier to adopting new technologies, such as the cloud.27
Firms want a clearer and more detailed conversation with regulators about which critical services they
might outsource to the cloud. They also wish to know about requirements and what oversight they
should expect from authorities. A lack of clear regulatory expectations will stifle adoption of cloud
technology and the benefits it could bring. UK Finance have worked with the wider industry and cloud
providers on a series of practices that might enable cloud computing at scale in finance (Box 2).28
A range of plausible scenarios may describe how cloud use will evolve in financial services over the
coming decade with a range of plausible outcomes for cloud adoption (Figure 7). The scale of adoption
and the level of market concentration versus diversity of service providers will pose different risks for
firms and regulators.
In a scenario of gradual change, concerns about the cloud prevail and firms’ migration remains slow. The
existing service providers consolidate their position and continue to dominate the market.
In an alternative scenario, many financial institutions migrate to the cloud and existing service providers
maintain their market share. This would involve financial institutions “buying in” to the benefits of cloud
infrastructure and regulators permitting increased use. It would require safeguards for the dependence
on a few providers of cloud services.
Market structures might also shift with a wider range of providers emerging alongside broader adoption.
This could be accompanied by greater layers of interoperability in cloud infrastructures, aiding the
migration of more systems and easier switching between providers. This might reduce concentration risk
but poses new questions about maintaining oversight of many providers.
Enabling digital identification
Several countries have had success in implementing digital ID schemes that the UK could learn from.
Policy objectives and design choices vary between countries, but these case studies can provide valuable
information.
Australia has established a federated model where private (government-accredited) firms provide
identification services under the Trusted Digital Identity Framework (Box 3).29
Figure 7: Cloud usage could boom given the right conditions
Share of workloads globally hosted on public cloud or using software as a service
Traditional hosting Public cloud SaaS
2017 86% 5% 9%
2020 79% 11% 10%
Low 2030
60% 40%
scenario
High 2030
10% 90%
scenario
0% 20% 40% 60% 80% 100%
Source: McKinsey & Company, McKinsey Enterprise Cloud Infrastructure Survey v2.0, McKinsey ITaaS survey 2017, IDC, Gartner newsroom, expert interviews.
Based on retail banking financial markets cloud survey.
Illustrative low adoption scenario: Banks continue to replace applications at a rate of ~5%pa except for legacy core of ~20% of applications. New applications
are 66% SaaS, 33% public cloud.
Illustrative high adoption scenario: Banks migrate all legacy applications en masse to 50% public cloud, 50% SaaS, except for legacy core of ~10% of
applications.
Box 2: UK Finance best practice in cloud usage
• UK Finance’s suggestions for best practice • The cited risks are focused on the viability
consist of 44 controls. These are mapped to a and resilience of the provider and controlling
range of domains, which they consider should access to customer data. They also concern
be included in all risk frameworks, and oversight by risk and internal audit functions,
11 underlying risks. data governance, IT security of the provider
and vendor lock-in.
Assuring customer institution that the provider has

Audit assurance and compliance appropriate business continuity and operational resilience
measures
The processes, and their management, used to keep

Encryption key management
customer data secure and segregated from other tenants
The provider’s internal policies and governance and how

Governance
they may affect customer data
Assuring that the appropriate controls can or

Identity and access management
will be in place to ensure the security of customer data
The lifecycle of data and how it is deleted/removed from

Lifecycle management
the provider
Security controls on physical The physical security of the datacentres where client data
infrastructure and facilities and/or systems are hosted
The virtual security of the cloud infrastructure and its

Security of cloud networks and
connections with other systems, whether customers or
connections
third parties
Security provisions for cloud

The virtual security of the cloud applications
applications
Workforce security and access How the staff of the provider have been trained to ensure
management the security of customers’ data
Source: UK Finance, “Cloud Computing Controls Framework: A Procurement Framework for Public Cloud Computing Services”, 2019.
Box 3: The Australian Trusted Digital Identity Framework
The Australian Trusted Digital Identity Framework Govpass identity providers must be accredited
(TDIF) governs the platform Govpass.1 The to pull information from government sources.
government developed it in consultation with The system operates independently from other
industry. It allows people to choose their identity government or private sector systems to ensure
provider and access a range of public and private data privacy.
sector services.
A user registers by selecting a provider to
TDIF is a set of rules and standards that verify their identity. Their documents are then
accredited members of the digital identity processed through the government’s document
federation must follow. It concerns:2 verification service (DVS).3 It may verify the user’s
identity by matching the uploaded photo against
• handling personal information;
an image on one of their government records
• access and use of identity services; such as a passport photo. This is the Face
Verification Service (FVS).
• security and fraud protection; and
• system management and maintenance.
1 See www.dta.gov.au/blogs/creating-govpass-digital-identity.
2 See www.dta.gov.au/our-projects/digital-identity/join-identity-federation/accreditation-and-onboarding/trusted-digital-
identity-framework.
3 See www.dvs.gov.au/Pages/default.aspx.
Estonia has a near-universally adopted national digital ID scheme. About 98% of its population have an
ID card, containing an electronic chip that allows them to sign documents digitally, access medical
records and even vote.30 The system is based on two principles:
a. A national register which provides a single unique identifier for all citizens and residents.
b. Identity cards providing legally binding identity verification and electronic signing.
Establishing viable means of digital identification in the UK will be of vital importance going forward.
Building the right public infrastructure

The Bank should keep its hard and soft infrastructure under review, including areas where access to its
services, rules and regulations can support innovation and the creation of new products and services.
This may involve evaluating how broadening access to central bank infrastructure to a wider class of
financial firms may benefit innovation and enable competition, while still ensuring monetary and financial
stability.
Enabling safe use of the cloud
The cloud is becoming a strategic necessity. Firms’ senior executives repeatedly said it will be central to
their business models and the benefits are only achievable at scale. To benefit from cloud technology,
firms and regulators need to work together to manage the risks as reliance on third-party suppliers rises
as they may become critical to financial sector infrastructure.31 This could heighten the risk of disruption
to essential financial services in the event of operational outages or cyber-attacks. Firms will need to
uphold the highest standards of risk management and operational resilience. Authorities should work
with them to keep the system safe.
The Bank’s Financial Policy Committee (FPC) should continue to keep a close watch on the changing
use of cloud technology and what this means for financial stability. It has already reviewed cloud
infrastructure across the financial sector.32 And as adoption grows, the FPC will need to be ever more
vigilant to emerging vulnerabilities. Eventually, this may necessitate changing the boundaries of financial
regulation to include aspects of cloud service providers’ operations in the Bank’s direct oversight.33
As fintechs and incumbent financial institutions move services onto cloud platforms, major cloud
providers may become systemically important. This means they might be of concern to the financial
system as a whole. The small number of service providers could risk becoming a single point of failure.
Concentration risk raises the question of whether regulation of cloud providers should go beyond
reliance on guidance for firms’ risk management of outsourcing arrangements. Supervisory powers might
have to be extended if supervising “through” regulated firms is no longer deemed sufficient. Regulators
may have to engage with service providers directly to ensure they meet supervisory expectations.
Alternatively, cloud providers could become regulated public utilities, creating a “certified cloud”.
There may be analogies with central counterparties (CCPs). When mandatory central clearing of
standardised derivatives through CCPs was introduced, policymakers recognised that they were creating
concentrated nodes, which despite this risk would make the overall system safer.34 Similar trade-offs may
apply when considering the implications of cloud-hosted services for financial stability.
The Prudential Regulation Authority (PRA) will also need ongoing assurance that firms are managing risks
from the cloud as it becomes increasingly central to their business models.35 Cloud use has been an
area of particular focus, including assessing firm’s governance and management of risks from third-party
relationships. It also includes evaluating specific topics such as managing service level agreements and
fall-back arrangements.
As cloud use grows, the PRA must ensure its information sources, supervisory skills and approach keeps
pace. It should also consider whether it needs new powers such as giving supervisors sufficient access to
cloud service providers to monitor risks appropriately.
The FPC and PRA will need to weigh up the benefits of cloud technologies for operational and
cyber-resilience against the risks that might be posed. They should enable greater adoption of the
cloud through improved guidance and by communicating their expectations of risk management and
operational resilience more clearly. This will give additional clarity and confidence to firms when deciding
whether and how to use these technologies and will encourage good risk management practices.
The Bank may also wish to explore its stance on cloud computing for its own systems, some of which are
already cloud hosted.
Highlighting the potential of digital identification
There is consensus that an effective digital identification system is needed to help the UK benefit from a
digital economy and financial system. But a variety of complexities and challenges need to be resolved for
a successful system to emerge.
The experts consulted deemed voluntary schemes based on private sector solutions the most
likely to succeed. But this requires access to public information. It also points to the need for
public–private collaboration. Complex and sensitive questions of privacy, consent, and data security
through appropriate levels of encryption will have to be resolved. As will questions about liability in the
event of breaches of privacy or fair use.
Digital identification could boost the effectiveness of finance and may enhance access to finance for
households and businesses, reduce transaction costs, improve operational efficiency for financial
institutions and reduce financial crime. All of these features would support the Bank’s mission to promote
the good of the people of the UK through monetary and financial stability.
It is not for the Bank to deliver a system of digital identification. But given the fit with the Bank’s objectives,
it should make the case for the benefits. The Bank could share its view on advantages and blocks,
drawing on its unique vantage point at the centre of the UK financial system.
Promoting operational resilience through enhanced regulatory co-ordination
The Bank’s objective is to maintain and promote stability by ensuring the resilience of the firms, markets
and infrastructure that make up the financial system. This is to secure the continuity of essential financial
services.
In an increasingly digital financial system, operational resilience is becoming as important as financial
resilience.36 Disruption to critical financial services may come from operational and technology events
rather than from the financial distress of an institution. That means the resilience and effective
management of operational and, in particular, technology infrastructure is paramount.
The Bank and the financial system have much to gain from better co-ordination of regulatory initiatives.
Co-ordinating deadlines will reduce the risk of crowding out longer-term investment and ease
pinch points that could exacerbate the peril of systems and technology migrations.
RECOMMENDATIONS

• Opening up wider access to central bank infrastructure could enable private
sector innovation and competition. The Bank was the first G20 central bank to
open up access to its payment system to non-bank payment service providers.
• As financial data becomes ever richer, the Bank may wish to consider whether
2.1 Build an APIs and other data tools can allow members of the payment system to
innovative securely access and analyse the payments data they generate.
payment
infrastructure What can the Bank (and others) do?
to enable The Bank should:
alternative • Consider how alternative providers might access the Bank’s infrastructure
payment including balance sheet and payment systems, and the appropriate package
methods of obligations which come with these rights. This will need to dovetail with
new payments regulation to ensure any new members are appropriately
capitalised and supervised. Careful thought would also need to be given to the
implications for monetary and financial stability of any further extension.
• Create an API to allow improved information retrieval and sharing from
payment systems.

• Stakeholders repeatedly said verifying customer identity is excessively costly
and cumbersome for the financial sector. UK Finance have highlighted that this
causes delays and adds to the costs of finance for SMEs and consumers. It also
impacts financial inclusion and creates a further barrier to competition.
• Most stakeholders don’t believe a fully-fledged (biometric or other) digital
ID scheme would gain support in the UK, which has been scarred by the failed
attempt of a national ID card.
• There are opportunities to create protocols for selected public and private
entities to share identification data safely with each other. These could include
the Passport Office, Driver and Vehicle Licensing Agency, the Land Registry
and private firms such as banks, telcos and utilities (see Chapter 3 on data
2.2 Champion standards).
trusted digital
identification What can the Bank (and others) do?
The Bank should:
• Engage with the financial sector to establish its requirements for a digital ID,
including discerning the features that would:
- help reduce fraud in financial transactions;
- reduce costs of on-boarding new customers and anti-money laundering
and Know Your Customer processes; and
- expand access to those excluded from the financial system.
• Champion these requirements in broader engagement with public and private
sector participants. The government should consider the merits of secure and
efficient information gateways to trusted official sources, so the private sector
can improve the effectiveness of identification verification.
• Cloud computing has emerged as a critical enabler for firms’ efforts to meet
rapidly evolving customer expectations, reduce risks, improve cyber-security
and efficiency. Cloud service providers are able to offer outsourced storage
and processing at a fraction of the cost of in-house data centres due to their
large scale.
• Cloud service providers spend much more on cyber-security than traditional
financial services firms. Their scale and capabilities mean they are likely to be
able to maintain leading cyber-security standards. Failing to empower the use
of the cloud may create its own operational resilience risks.
• The Bank needs to clearly articulate its assessment of cloud use in the financial
sector, and the financial stability and safety and soundness considerations
it presents. It should reach a judgement on whether the cyber-resilience
benefits of cloud providers outweigh the potential risks associated with critical
operational dependencies.
2.3 Embrace • This will give the market the certainty it needs to use cloud computing, and
safe cloud other hosted services, in a safe and resilient way. It will allow firms to create
usage the infrastructure to make the most of big data and advanced analytics. This is
likely to include updated guidelines and standards for cloud usage. Business
continuity and interoperability solutions merit even greater consideration to
mitigate risk from a single point of failure.
What can the Bank (and others) do?

The Bank should:
• Work with the private sector to help firms realise the benefits of public cloud
usage without compromising resilience by:
- understanding and mapping concentration risks and interoperability, as
well as building expertise within the Bank;
- testing operational resilience, including to cyber-risk;
- setting standards and guidelines for cloud usage; and
- collaborating with international regulators on a longer-term approach to
cloud oversight.
• Banks and insurers highlight that regulatory fragmentation imposes increased
cost to the industry, and so customers, and creates risks to operational
resilience.
• In addition to already squeezed investment budgets, the multitude of at times
duplicative regulatory data requests may have held back firms from adopting
innovative solutions.
2.4 Support
an “air traffic What can the Bank (and others) do?
control” of The Bank should:
major projects • Argue for a new forum with all major regulatory bodies to map and identify
critical junctures for ongoing and new regulatory projects. These include:
The Payment Systems Regulator, the Financial Conduct Authority, the Open
Banking Implementation Entity and the Competition and Markets Authority.
While respecting each institution’s statutory duties, sharing information on
the timing and impact of major projects would reduce risk to operational
resilience. It would also limit the risk of crowding out innovation through the
bunching of regulatory initiatives. Indirectly, it may build a richer roadmap of
tech transformation for financial infrastructure.
ENDNOTES
1 McKinsey & Company research.
2 Financial regulation — 20 years after the Global Financial Crisis, speech given by Ravi Menon, Managing Director of the Monetary
Authority of Singapore, Symposium on Asian Banking and Finance, June 2018.
4 See www.srgresearch.com/articles/fourth-quarter-growth-cloud-services-tops-banner-year-cloud-providers.
5 See www.ibm.com/blogs/cloud-computing/2017/05/17/cloud-drives-enterprise-innovation/.
6 See www.salesforce.com/uk/blog/2015/11/why-move-to-the-cloud-10-benefits-of-cloud-computing.html.
7 Finastra, FTI Consulting Survey, 2019.
8 Cloud Computing in Banking. What banks need to know when considering a move to the cloud, Capgemini, (2017).
9 FinTech and market structure in financial services: Market developments and potential financial stability implications, Financial
Stability Board (FSB), 2019.
10 See https://aws.amazon.com/solutions/case-studies/monzo/.
11 Cloud Computing in the Financial Sector, Part 3: Cloud Service Providers (CSPs), Institute of International Finance (IIF), 2019.
12 See www.srgresearch.com/articles/fourth-quarter-growth-cloud-services-tops-banner-year-cloud-providers.
13 See http://ide.mit.edu/news-blog/blog/digital-identity-key-privacy-and-security-digital-world.
14 Staying ahead of cyber crime, UK Finance, KPMG, (2018).
15 How digital identities which meet government standards could be used as part of UK banks’ customer on-boarding and KYC
requirements, Open Identity Exchange White Paper, (2017).
16 Digital Identity: On the Threshold of a Digital Identity Revolution, World Economic Forum (WEF) White Paper, (2018).
17 A Blueprint for Digital Identity: The Role of Financial Institutions in Building Digital Identity, World Economic Forum (WEF), (2016).
18 Digital Identification: A Key to Inclusive Growth, McKinsey Global Institute, (2019).
19 See www.gleif.org/en/about-lei/introducing-the-legal-entity-identifier-lei.
20 See https://bbvaopen4u.com/en/actualidad/new-digital-identity-thanks-apis.
21 See www.bankofengland.co.uk/payment-and-settlement/payment-and-settlement-statistics.
22 A platform for innovation, speech given by Mark Carney, Innovate Finance Global Summit, April 2019.
23 See www.bankofengland.co.uk/payment-and-settlement/rtgs-renewal-programme.
24 See www.bankofengland.co.uk/payment-and-settlement/rtgs-renewal-programme/rtgs-renewal-programme-news-events-and-mile-
stones.
25 See https://searchcloudcomputing.techtarget.com/definition/Software-as-a-Service.
26 Cloud Computing in the Financial Sector, Part 2: Barriers to Adoption, Insitute of International Finance (IIF), (2018).
27 Finastra, FTI Consulting Survey, 2019.
28 Cloud Computing Controls Framework: A Procurement Framework for Public Cloud Computing Services, UK Finance, (2019).
29 See www.dta.gov.au/our-projects/digital-identity.
30 See https://e-estonia.com/solutions/e-identity/id-card/.
31 Managing third party risk in financial services organizations: A resilience-based approach, Haller et al., Carnegie Mellon University,
(2016).
32 Record of the Financial Policy Committee Meetings on 20 and 27 November 2018, Bank of England, (2018).
33 Building the UK financial sector’s operational resilience, Prudential Regulation (PRA) DP01/18, Financial Conduct Authority (FCA)
DP18/04, (2018).
34 Central counterparties: what are they, why do they matter and how does the Bank supervise them?, Bank of England, (2013).
35 Regulating and supervising the clouds: emerging prudential approaches for insurance companies, FSI Insights on policy
implementation No 13, Bank for International Settlements (BIS), (2018).
36 Operational resilience — a progress report, speech given by Nick Strange, 21st Annual Operational Risk Europe Conference,
May 2019.
3 SUPPORT THE DATA ECONOMY
THROUGH STANDARDS AND PROTOCOLS
THE OUTCOME WE SEEK
Data standards and protocols which enable households and businesses to access better, more
customised financial services and to enable competition. Wider sharing and use of data are accompanied
by improvements in security, and a clearer sense of data privacy, legitimate use and liability.
• D
ata standards and protocols are the bedrock of a robust and dynamic financial
system. They can enable innovation and competition and reduce the cost of finance.
But privacy, security, liability and trust will be of ever greater prominence.
• Automated decision-making based on machine learning is one of the most important

trends in technology today and will become widespread in financial services.
Ensuring artificial intelligence (AI) is used responsibly will be an important task.
• Financial services’ use of data is already highly regulated, but businesses, policymakers and
regulation have to keep pace with new techniques and alternative data sets. The responsible,
explainable and ethical use of machine learning/AI will be important to achieve.
KEY DEVELOPMENTS
The power of data and analytics

Advanced analytics and the emergence of artificial intelligence could transform how customers
experience finance and the agility, efficiency and resilience of financial firms. But risks must be managed.
Data and analytics could broaden access and increase customisation. They could also improve pricing
of financial products for customers. But reaping these benefits will require the trust and consent of
customers.
The volume of data has increased exponentially in the digital economy and will accelerate over the
next decade (Figure 1). Over four billion people use the internet and more than 40 billion devices are
connected globally.1 Each creates a trail of data with every action, adding 2.5 quintillion bytes every day.2
It is estimated that more data would have been created in 2017 than in the past 5,000 years combined.3
Figure 1: The growth of data around the world
Zettabytes
Rest of world
150M
US
Asia/Pacific
excl. China
100M
EMEA
50M
China
0M
2010 2015 2020 2025
Source: IDC White Paper, sponsored by Seagate, Data Age 2025: The Digitization of the World from Edge to Core, November 2018.
When harnessed properly, data has an enormous value.4 One estimate suggests that big data and the
internet of things are already contributing more than £73bn to the UK economy yearly, or just over 4%
of GDP.5 Other research suggests that firms which adopt data-driven decision-making are 5%–6% more
productive.6 And these benefits can accrue to virtually every sector in the economy.
Data has always been the cornerstone of finance — from primitive ledgers to today’s hyper-connected
fast markets. McKinsey & Company outline the relatively high benefits from big data in finance compared
to other sectors in Figure 2. The Centre for Economics and Business Research (CEBR) estimates that big
data creates a £7bn benefit to retail and investment banking and insurance industries each year.7 And
the future lies in smart use of data to improve consumer outcomes and generate enterprise value for
financial services companies.
Data standards could bring several benefits to many different areas:
• Innovations in retail payments built on data standards and protocols can enhance the understanding
of customer shopping habits and transform the checkout experience.
• Access to novel data sets could allow more tailored and accurate decisions about lending, opening
new borrowing opportunities for customers and small businesses.
• Big data can help provide an in-depth understanding of business models for credit assessment.
• Transferring data through APIs could give households and businesses better information about and
access to financial products.
• Data standards, such as the Legal Entity Identifier (LEI) and the ISO20022 payment message, can
support innovation in, and greater connectivity across, wholesale payment systems, thereby cutting
the costs of doing business across borders.
Figure 2: Big data and advanced analytics will shape every part of the economy — but financial
services stands out
Big data ease of capture

High
Utilities
Health Care Providers
3
Manufacturing
Financial services and insurance
Professional Services
2
Construction Wholesale trade
Other Services Retail trade

1
Government
Arts and Entertainment
0 Low High
0 2 4 6
Big data value potential index
Source: Beyond the buzz: Harnessing machine learning in payments, McKinsey & Company, (2016).
Determined by industry average of transaction intensity, amount of data per firm, variability in performance, customer and supplier intensity, and turbulence.
Artificial intelligence and machine learning

Artificial intelligence (AI) and machine learning (ML) have existed since the 1960s.8 However, the recent
growth in processing power and explosion of data available to “learn from” mean innovative analytical
tools become vastly more important.
Machine learning can facilitate faster, more efficient and more personalised financial services at a lower
cost. Financial firms can gain insights from customer data on everyday transactions, spending habits
and preferences like never before, especially when supplemented by data from social media platforms,
wearables and location devices. AI could improve the safety and soundness of firms, too, by making risk
management more effective and reducing fraud. AI is already being used to understand and predict
developments in financial markets, analyse risk scenarios, identify fraud and to monitor transactions.
The potential efficiency gains from AI are high. McKinsey & Company estimate AI and machine learning
could provide a substantive uplift in financial performance for banks.9 A case study on China’s financial
sector by Boston Consulting Group (BCG) estimates that it will generate a 38% productivity increase
within 10 years equivalent to a 27% reduction in hours worked (BCG, Figure 3). This said, it could come
at the cost of jobs, as the Bank of England’s (“the Bank”) chief economist Andy Haldane and others have
argued.10
The US and China are world leaders in the development and adoption of AI.11 The UK should consider
how it can stay at the forefront.12
Figure 3: Increases in efficiency in China’s financial sector due to AI
AI could significantly raise efficiency in the financial sector

Reduction in
Reduction Equivalent working hours
in working to efficiency in 10 years
hoursa of... increaseb of... time due to AI
Reduction
in working
Banking 29% hours of
2.4 hours
42% 27%
Reduction
per day in working
hours
2.1 fewer hours

needed to
Reduction complete the
in working same functional
Insurance 23% hours of
1.8 hours 29% activities per day
Equivalent to
per day
a substatial
increase in
activity
Reduction
38%
Capital in working increase in
markets 36% hours of
2.9 hours
56% per capita
efficiency
per day
Sources: Boston Consulting Group Model for the impact of AI on the Employment Market in the Financial Sector by 2027; WIND; National Bureau of Statistics;
China Banking Regulatory Commission; Insurance Association of China; China Securities Industry Association.
a Reduced working hours refers to activities that could be carried out using existing AI technologies in positions that have not been replaced by AI by 2027
(where less than two thirds of working hours have been replaced by AI); the estimate of reduced working hours is based on the status of AI in 2017, and is
calculated based on the compound growth rate of employment from 2003–14 in the banking, insurance and capital markets, and the reduction in the total
number of working hours of the total number of employees in 2027.
b The increase in efficiency refers to the increased efficiency from the reduction in working hours after applying AI.
The value of data standards
Standards can democratise data.13 Fragmented data in different formats from disparate sources is
difficult and expensive to use, limiting its potential.14 When it is organised and described according to
widely recognised standards, it’s easier to access, share and use. People, other than the creators can also
use the data, which means it can benefit a larger share of society and the economy.
In finance, data standards enable more transparency in markets, boost efficiency by slashing costs and
give faster and more certain settlement. This cuts transaction costs and frees liquidity and capital for
more productive uses. An example is the international data standard ISO20022 for payments which the
Bank is adopting in its new RTGS system.15 It can help speed up cross-border payments by reducing
frictions in payment messaging.
The UK has pioneered standards creating the first ever national standards body in 1901.16 Standards can
encourage innovation and improve outcomes for customers. A widely adopted data standard gives an
incentive to innovate.17 When the value of data can be utilised by a wider array of businesses, the gains
for customers begin to multiply. Firms that are able to build a clearer picture of their customers can
better anticipate their needs and offer keener pricing.18 Standards also enable data to be shared rather
than being captive to one provider. Data portability enabled by standards could empower customers to
take control of their data, use it for their benefit, and shop around for the proposition that best meets
their needs.
Standards can improve risk monitoring.19 It is widely recognised that the lack of a common standards
during the financial crisis made it difficult for firms to aggregate and understand their exposures in
derivative markets.20 The creation and promotion of the LEI as a unique identifier for firms has been a
key part of the post-crisis regulatory framework and opens up a number of possibilities for the financial
system and real economy. The LEI is also mandated for certain transactions in the Bank’s new RTGS
payment system.21
Finally, standards could drive greater resilience through better transparency, comparability, surveillance
and oversight. This includes the transfer of critical functions in the event of distress or failure of a firm.
And they can support interoperable infrastructure, enabling the development of platforms and other
competitive market places.
Ethical standards for the sharing and data and use of AI/ML
Standards will also have to be developed for the ethical use of data and analytics in order to promote
trust.22 Consumers are not always aware when they consent to their data being shared and used.23 And
they are likely to have imperfect awareness of what they have agreed to. For example, research has
shown that it would take the average online user 76 days to review all the terms and conditions they
consent to in a year.24
Additionally, privacy concerns could create a confidence backlash that would stifle the possibilities of data
and analytics. Customer data is often shared between providers and across platforms. The median app
on mobile phones transfers data to 10 third parties (Figure 4).25 This raises concerns about the potential
for data misuse. Cambridge Analytica’s use of data from 87 million Facebook profiles in 2018 provoked a
public backlash.26 It put big technology firms’ use of personal data under closer scrutiny.
Customers are increasingly concerned by and aware of the use of AI to make decisions that will affect
them. Surveys show that banks enjoy relatively more trust today than firms in other sectors to manage
personal data (Figure 5). And yet even in a trusted sector, AI techniques are unlikely to be entirely
transparent or understood. This could lead to unexpected outcomes and an erosion of trust.27 As
such, firms need to be accountable for the decisions made by AI and able to explain their outcomes to
customers.
Furthermore, while more precise and efficient risk assessment and pricing through AI will benefit users of
finance, a minority may find themselves excluded. This could for example happen if new data or analytical
techniques in health insurance revealed risk characteristics previously not fully appreciated, leading to
cover being withdrawn from customers.
Figure 4: Data sharing with third parties
Share of apps sending data to...
Alphabet
Facebook
Twitter
Verizon
Microsoft
Amazon
0% 20% 40% 60% 80% 100%

Source: Reuben Binns, Ulrik Lyngs, Max Van Kleek, Jun Zhao, Timothy Libert, Nigel Shadbolt. 2018. Third Party Tracking in the Mobile Ecosystem.
The sample represents almost 1 million android apps.
Figure 5: Data and trust
Which type of company do you trust most to securely manage your data? (% of respondents)
Bank
Payment provider
MNO
Online retailer
Consumer tech
Internet provider
Social media
0% 20% 40% 60% 80% 100%

Source: Boston Consulting Group, Capgemini survey.
Establishing expectations for the acceptable use of data and AI

UK laws provide a baseline of what is permissible and prohibited for access and use of data.28 For
example, GDPR covers rights and responsibilities around the safeguarding, sharing and use of data, and
specific provisions on automated processing such as AI.29
Guidance and codes can support legislation and regulation. They can also make practitioners confident in
using new technologies, where, new use cases emerge every day and conventions may not yet be clear.
Companies should behave responsibly, ethically and within the law. But codes and guidance can foster a
dialogue about emerging practices, highlight issues and ensure best practice is shared. This helps clarify
grey areas, sets expectations and builds confidence in using new technologies (see Figure 6).
Figure 6: Three levers to ensure good AI governance
Frequency of
Description Examples
updating
Enshrine high-level FSMA, UK Companies

Legal basis Updated infrequently
principles Act
Specify meaning of
Regulatory rules and legislation in light of Updated as the need SM&CR, EBA guidelines
expectations technological and arises (eg on outsourcing)
other developments
FEMR, FMSB,
Add more clarity on
Technology specific
Industry standards what it means in Regularly updated
(eg ISO/IEC 19941
practice
Cloud)
Source: Bank of England.
Three areas in particular can support the resilient and fair use of AI: data governance, model validation
frameworks and accountability regimes:30
• Quality control for data inputs into AI models.
Controlling the quality of model inputs is key to ensuring good outcomes. Data used to train
models can replicate existing biases. So the data inputs should be well understood in model
development.
• Best-in-class model validation frameworks.31
Existing frameworks must be adjusted to account for AI. Several promising methods have
emerged to aid testing and “explainability” of AI models. Spreading best practice will promote
quality control and reduce errors. This could be done through bodies akin to the Fixed Income,
Currencies and Commodities (FICC) Markets Standards Board (FMSB).
• Clear expectations around governance and accountability for the use of AI.
In the financial sector, AI should be subject to the same standards of accountability, oversight,
governance and risk management as other activities. But additional specific guidance and
expectation-setting may be helpful.
Platform finance for small and medium-sized enterprises (SMEs) and individuals
The experience of China shows how data and technology can be used by platforms to provide access to
finance. Ant Financial uses an array of data to offer credit to those that have been previously underserved
by finance.32 For example, its “sesame” credit score includes individuals’ social media interactions and
businesses’ sales and ratings on the Alibaba marketplace (see Chapter 1).33
Examples from around the world show the potential of platform finance. Based on sales and ratings data,
Amazon is now able to extend trade credit to businesses selling on its marketplace.34 PayPal is extending
credit to online customers at the point of sale, using their transaction history.35 And the accounting
software provider Xero’s agreement with RBS enables them to on-board customers using their account
data.36
Open Banking and greater use of APIs to share data across the financial system offer a glimpse of what
might be possible with the right platforms, protocols and standards. For example, SMEs could benefit
from being able to compile their data from different vendors to build a comprehensive, digital business
profile.37 They could then use their data to seek the most appropriate forms of finance at the best
possible prices.
Quicker identification would speed up onboarding processes and allow SMEs to switch providers more
easily. A deeper financial history, especially for young companies, could unlock working capital, invoice
and trade finance.
Better access to government information would make this truly transformative. SMEs could demonstrate
their credentials and verify their directors’ identity by sharing accounts filed at Companies House, linked
to data from the Passport Office and the Driver and Vehicle Licensing Agency (DVLA). Sharing tax data
held at HMRC could provide a further step in offering a rich description of their business model.
A shared data platform could also benefit gig economy workers.38 Utilities statements, DVLA and passport
data could quickly prove their address and identity. Transaction and savings data could help build up
their credit score. This would widen access at potentially more competitive prices for anything from
consumer loans to mortgages.
Meeting the needs of small businesses and workers in the gig economy
The nature of work is changing with a larger proportion of the population in self-employment, flexible
working or multiple jobs. In the UK, three million people worked in the gig economy over the past year,
and nearly a third of British workers are self-employed.39 In the US, 90% of new jobs created in the past
decade were in the gig economy according to PayPal.40
Work through platforms such as Uber, Deliveroo or TaskRabbit can produce irregular incomes, which
does not fit well with traditional lending models. Gig workers who are generating regular incomes may be
doing so without permanent contracts.
Lenders should lend responsibly and prudently, but conventional measures of creditworthiness may
not give a full picture of the financial prospects of the self-employed and those in flexible employment.
Innovators are trying to respond. Their use of novel data sets can also help SME finance.
The nearly six million SMEs in the UK are an important driver of growth. They account for 60% of all
private sector employment41 and 70% of all new jobs since 2010.42
These small firms report barriers to accessing finance that can stifle investment in their business.43
More than two thirds of SMEs would rather grow slowly than borrow to grow faster.44 And 6 in 10
would-be-borrowers end up using personal funds instead of borrowing.
More than half of SMEs only apply to one provider when seeking a loan.45 A quarter of their applications
are rejected.46 And a similar figure don’t approach other providers because of the “hassle” or time
associated with applying for finance, particularly at short notice.
The costs of verifying the identity of these companies and understanding their businesses are a
significant barrier. This includes confirming the identity of the company, its directors and officers, and its
business model and risk profile.
New data and analytical techniques can reduce these barriers. This might help explain the success of
alternative lenders in recent years. Fintechs around the world are finding ways to streamline onbording
and verification of SMEs through new forms of data.47 And others are using it to enrich credit scoring
and open up lending to previously underserved businesses.48 Over half of SME owners are now aware of
alternatives to bank lending, in part due to HM Treasury’s credit referral scheme.49
Machine learning and AI are likely to become widely applied over the coming decade. There are many
reasons to be optimistic about better fraud protection, more personalised finance and cheaper and
more efficient services thanks to data and AI. But there are also many legal, ethical, economic and social
challenges. Some topics which firms and financial regulators will need to consider include:
• Artificial stupidity: how to guard against mistakes such as learning from incomplete data sets
(otherwise known as sample bias)?
• Racist robots: how to eliminate AI bias?
• What if platforms that aren’t covered by financial regulation misuse or lose data? Who is liable?
How can they recover?
• Security: how to keep AI systems safe from data manipulation?
• Singularity: how to stay in control of a complex and intelligent system?
• What is the legal status of algorithms?
Many of these issues will go well beyond finance. But the ethical use of data should be an important topic
for firms and regulators. Some have started working with industry on this. The Monetary Authority of
Singapore for example has published a set of principles around the use of AI, which address some key
risks.50 Stakeholders confirmed that industry welcomed this interesting initiative. This could be a useful
model which could be adapted and developed for the UK.
Box 1: Singapore’s FEAT principles
In November 2018, the Monetary Authority of So AI should only use attributes to discriminate
Singapore (MAS) co-created a set of principles between people if this “can be justified” and that
with industry on the ethical use of AI in financial data and models should be regularly reviewed for
services.1 They decided upon four principles: bias.
fair, ethical, accountable and transparent. They
Another concern is around transparency and
aim to promote public trust in the use of AI and
accountability. AI decisions could “significantly
data analytics by providing general guidance for
affect data subjects” and so need to be “approved
programmers on design choices and for senior
by the appropriate internal authority”. Firms
executives on oversight.
should be prepared to explain decisions to
One concern the principles seek to address people who are affected. Finally, any decisions
is discrimination. MAS highlights that AI could made by AI should be aligned with the firm’s
lead to differential treatment of groups in new general ethics principles.
ways and “at greater scale and faster speed”.
1 www.mas.gov.sg/News-and-Publications/Media-Releases/2018/MAS-introduces-new-FEAT-Principles-to-promote-responsible-
use-of-AI-and-data-analytics.aspx.
Data standards can benefit the effectiveness and resilience of finance. So the Bank should keep
identifying areas where it can encourage the adoption and embedding of robust data standards.
It should have a keen eye on potential market failures where policy interventions to mandate or
encourage data standards may be needed. This is reflected in its work on regulatory data taxonomies in
the European Banking Authority, the European Occupation and Pensions Authority, the Financial Stability
Board and the Basel Committee on Banking Supervision. And its participation in the Committee on
Payments and Market Infrastructure, as well as the engagement with private sector organisations.
Significant efforts towards ensuring greater data protection have already been made, most notably
through the EU’s General Data Protection Regulation (GDPR). But with constantly changing business
models and innovation, authorities are only starting to set boundaries for data use and sharing.
The UK Government has set up a Centre for Data Ethics and Innovation which seeks to establish general
principles and a code of conduct for data use.51 The Bank should take a keen interest in how this is
embedded in the financial sector and should share its perspectives.
It should also evaluate its domestic rules around the governance of AI, including through the Senior
Managers Regime (SMR).
Looking to the future, the Bank should help make sure that data and ethical standards are applied
across the financial sector to enhance competition and avoid concentration. Only then can it make sure
the financial system is resilient and ready for a future where it continues to provide the best financial
outcomes for UK households and businesses. And it will need to work closely with other regulators,
especially the Information Commissioner’s Office, as the use of data and advanced analytics grows.
RECOMMENDATIONS

• Ethical implications of the data economy are evolving rapidly. And the UK
financial services industry is employing AI and data analytics on an increasing
scale. It will be important to encourage transparent, responsible and
accountable use of these technologies to maintain trust in the financial system.
• Customers need to understand how they have been assessed and rated for
risk evaluation and pricing by AI. This is so they can be assured they have had
a fair outcome, but also to avoid moral hazards in areas such as credit scoring
and underwriting. This may also create positive incentives for consumers to
manage their risk profiles.
• Policymakers will want assurance that models are explainable and fair. And as
models evolve, they may want greater clarity on issues such as how personal
data is used and how consent to use data is given and withdrawn. Where
decisions are made by AI or machine learning, a “right of appeal” process is
needed.
• It would make sense to establish industry standards or regulatory guidance for
the use of AI in financial services. Other jurisdictions, especially the Monetary
Authority of Singapore, have co-created a set of guiding principles with the
3.1 Promote
industry. The UK Government has also recently established a Centre for Data
the responsible
Ethics and Innovation.
use of machine
learning and AI
The Bank should:
• Establish a public-private financial sector working group with the Financial
Conduct Authority to:
- monitor developments in the use of machine learning to understand
possible micro and macroprudential implications of widespread
adoption;
- develop principles, and share best practice, for the responsible,
explainable and accountable use of machine learning in finance;
- explore the intersection with current rules (including Senior Managers
Regime) and where old rules need updating; and
- feed into the Centre for Data Ethics and Innovation’s work on
maximising the benefits of artificial intelligence and managing the risks
in finance.
• A wholesale working group (or subgroup) should also involve or could be
championed by the Fixed Income, Currencies and Commodities Markets
Standards Board.
• As working patterns become more flexible, parts of the real economy are at
risk of exclusion by traditional credit risk assessment.
• Alternative data sources could help build richer credit scores. This might
include current account transaction data, regular savings behaviour, or even
social media to enhance the accuracy of existing scores and achieve better risk
separation. It could make many of today’s credit invisibles visible. Historically,
these data sources have not been accessible — and some would require the
public sector to adopt their model of providing access to data.
• UK SMEs’ access to a variety of affordable finance could improve. Identification
and sharing business and financial information are key pinch points. This is in
3.2 Support part because of KYC/anti-money laundering requirements.
better credit
files for SMEs • HM Treasury ran a successful Rent Recognition Challenge to enable private
and social renters to share a record of their rent payments to build their credit
scores and improve access to credit. This may provide lessons for the future.

The Bank should:
• Use its knowledge of LEIs in finance to support wider adoption.
• Contribute analysis on the value of better credit files for small and
medium-sized enterprises and individuals. This could include considering
permissioned access to high-level company tax data. The Treasury may wish to
establish a competition for private innovators to help build better credit files
for the gig and sharing economy.
ENDNOTES
1 See www.statista.com/statistics/617136/digital-population-worldwide/.
2 See www.socialmediatoday.com/news/how-much-data-is-generated-every-minute-infographic-1/525692/.
3 See https://appdevelopermagazine.com/more-data-will-be-created-in-2017-than-the-previous-5,000-years-of-humanity-/.
4 The economic value of data: discussion paper, HM Treasury (2018).
5 See www.dataiq.co.uk/articles/articles/uks-data-economy-worth-ps73-billion-potential-greater.
6 BCG research.
7 The Value of Big Data and the Internet of Things to the UK Economy, Centre for Economic and Business Research (CEBR), SAS,
(2016).
8 The new physics of financial services: understanding how artificial intelligence is transforming the financial ecosystem, World
Economic Forum (WEF), Deloite, (2018).
10 Artificial intelligence and machine learning in financial services: market developments and financial stability implications, Financial
Stability Board (FSB), (2017).
11 See www.mckinsey.com/featured-insights/artificial-intelligence/kai-fu-lees-perspectives-on-two-global-leaders-in-artificial-
intelligence-china-and-the-united-states.
12 AI sector deal, Policy paper, Department for Digital, Culture, Media & Sport (DCMS), (2019).
13 The democratization of data science, Harvard Business Review, (2018).
14 See www.cio.co.uk/it-strategy/data-fragmentation-challenges-restrict-business-flexibility-3431866/.
15 See www.bankofengland.co.uk/payment-and-settlement/rtgs-renewal-programme/consultation-on-a-new-messaging-standard-for-
uk-payments-iso20022.
16 Regulation, ethics and standards in wholesale financial markets, Mark Yallop, ICMA ERCC Conference, 27 September 2016.
17 The economic value of data: discussion paper, HM Treasury (2018).
18 Made-to-order: the rise of mass personalisation, The Deloitte Consumer Review, Deloitte, (2015).
19 Office of Financial Research Annual Report 2012.
20 See www.treasury.gov/initiatives/wsr/ofr/Documents/Promoting-Data-Standards.pdf.
21 Implementation and effects of the G20 financial regulatory reforms, 3rd Annual Report, Financial Stability Board (FSB), (2017).
22 Building digital trust: the role of data ethics in the digital age, Accenture, (2016).
23 See https://iapp.org/news/a/what-misconceptions-do-consumers-have-about-privacy/.
24 See www.bbc.co.uk/news/technology-22772321.
25 Third party tracking in the mobile ecosystem, Binns et al., University of Oxford, (2018).
26 See www.bbc.co.uk/news/topics/c81zyn0888lt/facebook-cambridge-analytica-scandal.
27 See www.forbes.com/sites/bernardmarr/2018/11/19/is-artificial-intelligence-dangerous-6-ai-risks-everyone-should-know-about/
#122bf53e2404.
28 See www.forbes.com/sites/bernardmarr/2018/11/19/is-artificial-intelligence-dangerous-6-ai-risks-everyone-should-know-about/
#122bf53e2404.
29 Guide to the General Data Protection Regulation (GDPR), UK Government, (2018).
30 Notes from the AI Frontier, Modeling the impact of AI on the world economy, Discussion Paper, McKinsey & Company, (2018).
31 See www.forbes.com/sites/insights-intelai/2019/03/27/wrestling-with-ai-governance-around-the-world/#47c1f54a1766.
32 See www.economist.com/finance-and-economics/2017/02/25/in-fintech-china-shows-the-way.
33 See www.ft.com/content/ba163b00-fd4d-11e8-ac00-57a2a826423e.
34 See www.cnbc.com/2017/06/08/amazon-loaned-1-billion-to-merchants-to-boost-sales-on-its-marketplace.html.
35 See www.paypal.com/uk/smarthelp/article/what-is-paypal-credit-faq2887.
36 See www.xero.com/blog/2014/08/rbs-natwest-direct-feeds-update/.
37 See www.ukfinance.org.uk/news-and-insight/blogs/benefits-open-banking-smes.
38 See www.ipse.co.uk/ipse-news/news-listing/how-data-can-help-workers-in-the-gig-economy.html.
39 Labour market economic commentary: May 2019, Office for National Statistics (ONS), (2019).
40 See www.paypal.com/stories/us/evolving-financial-services-to-meet-needs-of-the-global-workforce.
41 See www.fsb.org.uk/media-centre/small-business-statistics.
42 See https://smallbusiness.co.uk/smes-driving-employment-levels-2539643/.
43 Enhancing the contributions of SMEs in a global and digitalised economy, OECD, (2017).
44 SME Finance Monitor, Q4 2018, BVA BDRC, (2019).
45 Retail banking market investigation, CMA (2016).
46 SME Finance Monitor, Q4 2018, BVA BDRC, (2019).
47 See www.bankingtech.com/2018/09/the-future-of-client-onboarding/.
48 On the rise of the FinTechs — credit scoring using digital footprints, Berg et al., FDIC, (2018).
49 Bank referral scheme: official statistics, HM Treasury, (2018).
50 Principles to promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics
in Singapore’s Financial Sector, Monetary Authority of Singapore (MAS), (2018).
51 See www.gov.uk/government/groups/centre-for-data-ethics-and-innovation-cdei.
4 CHAMPION GLOBAL STANDARDS FOR
FINANCE
THE OUTCOME WE SEEK
An open, effective and integrated global financial system that supports trade, commerce and investment.
Global standards are embraced to maintain resilience and avoid fragmentation.
• Emerging markets will likely play an ever greater role in the international economy and global
financial system as they continue to grow (faster than advanced countries) and open up their
economies.
• As the largest international financial centre, the UK has an important role to play in helping
finance the needs of a green and global economy.
• The Bank oversees the stability and effectiveness of the UK financial systems.
• To achieve this, the Bank needs to work intensively with others to create, develop and
implement the global standards and deep supervisory co-operation that are crucial to
ensuring open and resilient international financial flows.
KEY DEVELOPMENTS
As a global financial centre, the UK has an opportunity to share in the growth of the global economy as
well as help mobilise international finance to support the transition to a green economy. But this means
ensuring that the conditions are in place for safe, resilient and open international financial flows. At a
minimum, this will require ongoing strong global financial standards and deep supervisory co-operation.
It will also require emerging markets to carefully sequence their opening up to foreign investors. They will
need structures and policy frameworks to mitigate risks to financial stability.
Political changes around the world are likely to impact the global economy and financial system in
the decade ahead. This includes the UK’s exit from the EU which will be critical context against which
policymakers in the UK, including the Bank, will need to make decisions going forward. Irrespective of
the outcome of “Brexit”, there are numerous areas where the Bank can collaborate internationally to
contribute to an effective and safe global financial system.
This is critical, as over the next decade, emerging market economies (emerging markets) will likely play a
more central role in the global financial system as they continue to grow and open. By 2030, China could
be the world’s biggest economy and India the third largest, with their combined output accounting for
more than a quarter of global GDP (at market prices).1
London as an international financial centre and its importance to the UK economy
The UK financial sector is a driver of national prosperity. It employs over 1 million people2 and contributes
£60bn in exports.3
The UK financial sector is both a national asset and a global public good. London accounts for over 40%
of global FX and interest rate derivative volumes, and more international banking business is booked here
than anywhere else.4 UK banks’ foreign lending is the third highest in the world, of which three quarters is
lending to non-EU countries.5
The UK financial sector is also the second largest asset management and fourth largest global insurance
centre.6 And UK financial institutions, especially non-banks, play an important role in international
capital markets. As of end-2017, UK-resident investors held US$3.4 trillion foreign portfolio investments,
equivalent to 140% of UK GDP.7 Two thirds were invested in debt and equity instruments issued by
non-EU countries.
Growth in emerging market economies
Over the past 25 years, emerging markets’ share of global economic activity has risen from 16.5% to
40%.8 In purchasing power parity (PPP) terms emerging markets’ share of world GDP has risen from 40%
to 60%.9 Their share of global trade has also increased from one fifth to one third.10 But developments
in the global financial system have lagged behind those in the real economy. Financial assets and savings
pools are still mainly concentrated in advanced economies.11
A number of large emerging markets, such as China and India, remain relatively closed to foreign
investment.12 The composition of their external financing is focused on foreign direct investment rather
than debt or portfolio equity flows. As they develop and deepen their financial sectors and open to
foreign investors, they will need to ensure they focus on the effectiveness and integrity of their markets.
London as a global financial centre is open and connected to the global economy. This has significantly
contributed to the UK’s prosperity, but the interconnectedness also brings risks. UK financial institutions
remain relatively focused on advanced economy clients. Other than China, currently most foreign
financing of UK banks is provided to other advanced countries. Figure 1 shows UK banks’ claims on
individual major countries as a share of all foreign banks’ claims on these markets.
Figure 1: Global network of UK-HQ banks’ claims
Korea Mexico Brazil

India
26 10
24 4
Switzerland
Turkey 8 14
Singapore
Indonesia 14 24
Russia Canada
4 21
Saudi Arabia 30 Australia

12
UK
South Africa 24
Italy
Argentina 14 4
Hong Kong
53 SAR
15
China
25
United States
13 19
21
Germany Japan
France
Source: BIS.
Note: 2017. Width of the arrows reflects UK banks’ relative claims. Size of the boxes reflects that market’s share of the total global claims of all foreign banks.
The numbers in the boxes are UK banks’ share of each market, end-2017. The colour coding of the boxes are green for advanced countries and pink for EMEs.
In the future, emerging markets will likely play a significantly bigger role in the global economy and
finance. If the composition of finance extended by UK banks were to change and tilt more towards EMEs,
this would have important implications for financial stability. Relative to the overall economy, the UK has
the biggest financial centre of any large country (Figure 2), standing at over 10 times GDP. So it will be
crucial to enhance existing approaches to maintaining financial stability to meet new challenges as the
range of counterparties and opportunities expands.
The high degree of openness leaves the UK susceptible to financial stability threats from abroad. For
example, more than one half of UK banks’ total exposures are overseas rather than from the domestic
economy.
Figure 2: Size of G20 financial systems as a percentage of GDP
Banks Public financial institutions Other financial intermediaries Central banks

Pension funds Insurance corporations
UK
Japan
Canada
France
USA
Australia
Germany
China
South Korea
Italy
South Africa
Brazil
Russia
Saudi Arabia
India
Turkey
Mexico
Indonesia
Argentina
0% 200% 400% 600% 800% 1,000%
Source: Global Monitoring Report on Non-Bank Financial Intermediation 2018, Financial Stability Board, 2019.
Note: Year-end 2017.
Emerging market debt

Emerging market government and corporate debt (owed to both domestic residents and foreigners) has
gone up nearly 10 times in the past two decades — from US$6 trillion at end of 1995 to US$55 trillion
as at end of 2018.13 The share of locally denominated debt for the top 21 emerging markets by size has
grown from 76% in 2005 to 87% in 2018, as domestic debt markets have deepened.14
Local currency government bonds can contribute to a variety of policy objectives. Countries have to repay
their debts in the same currency they borrow in. This exposes them to foreign exchange risk and the risk
of changes in foreign countries’ interest rates. Locally denominated bonds can help to meet emerging
economies’ financing needs while reducing currency mismatch and contributing to financial deepening.
Even though local currency bond markets have deepened over the past two decades, including since
the global financial crisis, the growth in debt held by non-residents (“external debt”) has been mainly
denominated in US dollars.15 This leaves emerging markets vulnerable to appreciation in the US dollar.
Were local currency bonds to be issued more widely then the currency mismatch would migrate
elsewhere in the financial system to the holders of these bonds. This would place ever greater
importance on understanding the behaviour of the investors, and how their actions may affect the
riskiness of capital flowing to emerging markets.
Growth in green finance
Green finance has seen significant growth in recent years.16 There is increasing focus on Environmental,
Social and Governance (ESG) investing and sustainable finance among investors’ client bases. Green
finance is as an important element of financing the transition to a low-carbon economy (Chapter 5).
While still a relatively small part of global bond issuance, the market for green bonds is growing at an
accelerating pace with about US$168 billion of issuance in 2018, quadrupling from 2015 (Box 1).
As a result of strong demand, green bonds have been more oversubscribed and, in some specific cases,
have provided lower borrowing costs than their non-green equivalents.17 Therefore some argue evidence
of a “Greenium” in debt pricing is emerging.
Box 1: Green bonds
Finance that is climate-friendly does not always Energy sector corporates, then banks and most
have a label, but there is an increasingly defined recently sovereigns have picked up on green
market for green finance. The market for bond issuance, which was originally driven by
financing environmentally aligned projects and supranational development banks.4 Energy
companies has blossomed in recent years. The production and efficiency remain the main
bond market is the most visible area of green areas for use of proceeds from green bonds.
finance.1 Green bonds from banks are typically used to
finance mortgages on more energy efficient
The Green Bond Principles were established by
properties. The share of proceeds for transport
the International Capital Markets Association
and water projects has increased in recent years,
(ICMA).2 They provide a framework for issuing
largely driven by sovereign and supranational
bonds whose proceeds are designated to
issuers.
support environmentally friendly objectives,
while typically maintaining full recourse to the Overall, the market has seen rapid growth
issuing company. The European Commission’s with issuance of US$168 billion in 2018, taking
Sustainable Finance Action Plan is developing a total cumulative issuance to approximately
classification system for sustainable economic US$500 billion (Figure 3). But it remains small
activities, a harmonised green bond standard and compared to the financing needs that will arise
methodologies for low-carbon indices.3 for infrastructure investments globally.
Figure 3: Green bond issuance in recent years
$150B
$100B
Loan
Local gov
Sovereign
$50B Developm bank
Gov-backed entity
ABS
Non-fin corporate
Fin corporate
$0B
2012 2013 2014 2015 2016 2017 2018 2019 - to date
Source: Climate Bonds Initiative.
1 www.sustainalytics.com/sustainable-finance/2019/03/06/trends-in-sustainable-finance-for-2019/.
2 www.icmagroup.org/green-social-and-sustainability-bonds/green-bond-principles-gbp/.
3 https://ec.europa.eu/info/business-economy-euro/banking-and-finance/sustainable-finance_en.
4 The Green Bond Market in Europe, Climate Bonds Initiative, 2018.
Emerging markets are expected to continue to grow and open

Emerging markets’ share of the world economy could increase to around three quarters on a
PPP basis by 2030 if trends continue.18 And further liberalisation of their capital accounts could lead
to a marked increase in financial flows. Emerging markets’ external financing as a proportion of GDP
could roughly double over the next two decades.19 As suggested by recent trends, this would likely be
accompanied by a diversification of EME financial inflows, moving towards markets rather than borrowing
from overseas banks.
This would support EME growth by making it easier to finance domestic investment needs, which are
likely to be substantial. Although wider adoption of protectionist or fragmenting measures may act as a
countervailing force to greater integration.
The UK has an important role to play in financing the global economy
The prospect of a more broad-based global economy where economic and financial power is distributed
more widely could benefit the UK. With a strong history of innovating to meet the needs of international
clients, the UK also has an important role to mobilise finance for the low-carbon economy.
UK banks provide significant finance to advanced and emerging economies. Figure 4 shows how
much finance foreign banks provide to selected countries as a percentage of GDP and the UK’s market
share. The same applies to foreign portfolio investments in these countries. Figure 5 presents selected
countries’ total foreign investment and the UK’s share. The UK’s exposures are high compared to its share
of only 2.3% of the world economy.20 If UK banks maintain their current foreign market share in many
emerging markets, it could lead to strong business growth.
Figure 4: Total borrowing from foreign banks and UK market share, 2030
UK HQ banks' claims (% of total) S

Size: Country's GDP in 2030
Emerging Advanced
30%
Gradual Fast
India
Korea
20% China Canada
South Africa Germany
Japan France
Argentina
10% Indonesia Australia Switzerland

Mexico
Turkey
Russia
Brazil Italy
0%
0% 10% 20% 30% 40% 50% 60%

Foreign banks' claims in country (% of GDP)
Sources: BIS Consolidated Banking Statistics, IMF WEO 2018 and Bank calculations.
Note: The size of the bubbles reflects the forecast of a country’s GDP in 2030. Advanced countries in green, EMEs in purple. Gradual external liberalisation is
to current South Korean levels, fast liberalisation is to current US levels.
Figure 5: Total portfolio investment liabilities to foreign investors and UK market share, 2030
UK portfolio investment (% of total investment in country) Size:

S Country's GDP in 2030
Emerging Advanced
10% Gradual Fast Hong Kong
United States
8% Switzerland
Russia
Korea Japan Australia Singapore

6% Brazil India
Germany France
Mexico
4% China
Argentina Canada
Italy
2%
0%
0% 20% 40% 60% 80% 100% 120% 140%
Total foreign investment in country (% of GDP)
Sources: BIS Consolidated Banking Statistics, IMF WEO 2018 and Bank calculations.
Note: The size of the bubbles reflects the forecast of a country’s GDP in 2030. Advanced countries in green, EMEs in purple. Gradual external liberalisation is
to current South Korean levels, fast liberalisation is to current US levels.
Different scenarios, where emerging markets see varying levels of liberalisation, can inform the
implication of these trends. For example, EMEs could open up capital accounts to the levels currently
experienced by South Korea. In this scenario, UK banks’ claims on emerging markets could rise from
20% of UK GDP to around 60% in 2030. And UK residents’ holdings of G20 emerging markets’ portfolio
debt and equity could rise from around 10% to 30% of UK GDP. Figure 6 projects UK banks’ claims on
different countries under this scenario to 2030.
In a scenario of faster liberalisation, UK banks’ claims could rise to almost 90% of UK GDP and portfolio
investments to 55%. Figure 7 shows that claims on emerging markets could overtake those of advanced
economies in this scenario. UK portfolio investment in these — while also significantly increasing —
would not yet reach the level of advanced economies.
An accelerated rate of liberalisation could considerably increase financial flows intermediated by UK
institutions and the connectedness of the financial system to overseas economies. However, such
liberalisation, would also leave emerging markets more exposed to external shocks which might
“spill-back” to the UK with negative consequences for financial stability. In particular, capital flows are on
average twice as volatile to emerging markets as they are to advanced economies.21
Green finance is on the rise
Green finance will likely become an increasingly important segment of global financial markets. In order
to deliver the Paris Agreement commitment to limit global warming to well below 2⁰C compared to
pre-industrial levels, carbon emissions would have to decline by 45% from 2010 to 2030 and reach net
zero by 2050 (see Chapter 5).22 In practice, this would require 95% of electricity generation to be low
carbon (eg from wind, solar, hydropower), 70% of cars electric and the entire building stock retrofitted
with energy saving features.
This will require a significant investment in infrastructure, requiring private and public finance. The
Organisation for Economic Co-operation and Development (OECD) estimates it could take more than
US$90 trillion in investment, or US$6.9 trillion annually between 2016 and 2030 on average.23
The UK’s deep financial and derivatives markets such as renminbi clearing facilities and “Panda” (renminbi)
and “Masala” (rupee) bonds could provide a platform for increased green debt issuance. London has
been the centre of a series of landmark global green bond issuances, including China’s first international
issuance of a green bond, the Green Covered Bond.24
Figure 6: Global network of UK-HQ banks’ claims, end-2030
Mexico Brazil Switzerland

Korea
10 4
26 14
Singapore
Indonesia 14 24
Australia
Russia 4 12
Turkey Canada
8 21
Saudi Arabia 30 Italy

4
UK
South Africa 24
Japan
Argentina 14 19
Hong Kong
53 SAR
15
India
24
United States
25 21
13
China France
Germany
Source: BIS.
Note: See Figure 1. Relative size of each market assumes that for EMEs total liabilities to foreign banks (per cent of own GDP) rise by 2030 to the current levels
in South Korea but remain unchanged in advanced countries. GDP growth forecasts through to 2023 from IMF WEO October 2018. Growth 2024–30 assumed
at same rate as the last period of the IMF forecast (2023).
Figure 7: UK holdings on the G20 advanced countries and EMEs under different scenarios
(% of UK GDP)
Gradual No Fast
% of UK GDP liberalisation liberalisation liberalisation
2030 2030 2030
80%
60% 2018
2018
40%
20%
2018
0% 2018
G20 AEs G20 EMEs G20 AEs G20 EMEs
Banks' claims Portfolio
Sources: IMF CPIS, BIS Consolidated Banking Statistics, WEO Forecast and Bank calculations.
Note: Gradual and fast liberalisation means foreign liabilities (per cent of GDP) rise by 2030 to the current levels in South Korea and the United States
respectively. GDP growth forecasts through to 2023 from IMF WEO October 2018. Growth 2024–30 assumed at same rate as the last period of the
IMF forecast (2023). UK is assumed to maintain its current foreign share of these markets.
Open international finance needs global standards and co-operation

The Bank is responsible for maintaining monetary and financial stability and promoting the safety and
soundness of financial institutions. As such, it has a keen interest in the integrity and effectiveness of
financial markets. In line with its mandate the Bank makes policy judgements and targeted interventions.
It has a range of tools to protect financial stability at its disposal, including its annual stress-testing
framework, setting an appropriate countercyclical capital buffer and the resolution regime for failing
financial institutions.25
The Bank closely monitors the shifts in the international economy and global financial system towards
new and emerging market players. The openness of the UK economy means macroeconomic
developments abroad can have “spillover” effects as emerging markets continue to open their economies
and financial systems. Changes in the global financial system must be accompanied by a shift in how
authorities deal with broader financial opening. Identifying new drivers of possible financial instability will
be key to ensuring continued oversight and stability of the system.
This oversight is provided by a number of international financial institutions including the International
Monetary Fund (IMF), the Bank for International Settlements (BIS), the Financial Stability Board (FSB) and a
number of standard setting bodies. All are reviewing how their financial stability surveillance frameworks
operate in light of the changing nature of risks.26 There are also regular meetings of senior central
bank and finance ministry officials from the major economies (G20, G7) to discuss issues affecting the
international monetary and financial system.27
The Bank engages in these international meetings by contributing to setting international regulatory and
prudential standards, discussing macroeconomic and financial issues and, where required, co-ordinating
policies. These institutions and meetings help to maintain an open and stable global financial system.
Global financial standards
Financial openness is good for sustainable global growth. But this openness needs to be safeguarded
by a set of solid foundations. This means having strong global financial standards. The global financial
crisis revealed a system that needed fundamental repair. The UK has been at the centre of G20 reforms
to create a global financial system that is safer, simpler and fairer in the aftermath of the global financial
crisis of 2008 (see Chapter 9).28 This included repair of the banking sector and a fundamental shift from
a system of largely intransparent bilateral trades to central clearing of standardised derivatives through a
strong, centralised infrastructure.
But, finance, the economies, and threats to stability also constantly evolve. It is not sufficient to simply
focus on the problems of the past to ensure they do not reoccur. Global standards, the institutions in
which they are designed, and the authorities of which they are comprised must be forward looking,
dynamic and ever vigilant to new threats. The UK, as host to a major international financial centre should
be at the forefront of efforts to spot new risks, develop standards and promote close supervisory and
regulatory co-operation.
Standards are also only as good as their implementation in practice. Therefore the FSB and the IMF
regularly assess and transparently report on implementation. This helps to maintain trust in each other’s
policies. It also provides opportunities for authorities to defer to each other to harmonise regulation and
avoid global financial fragmentation.
An additional requirement for markets to be effective is the development of an institutionalised
framework of standards that go beyond the traditional reach of legal and regulatory frameworks to tackle
the behavioural, social and other causes of misbehaviour in markets. These can be developed through
initiatives by the public (as, for example, the FX Global Code)29 or the private sector (as is being attempted
through the Fixed Income, Currencies and Commodities Markets Standards Board)30 or a collaboration
between the public bodies and the industry.
Going forward, International co-ordination will be ever more important to avoid national approaches
generating new sources of fragmentation and arbitrage as new issues merit policy action. This includes
convening industry stakeholders to harmonise data standards and improving the quality of financial
information.
The financial crisis exposed the failure of firms and public authorities to accurately identify exposures to
troubled institutions, which significantly impacted the ability to react to events as they unfolded. Since
then, international efforts to improve the availability of information on markets and firms include: the
FSB’s Common Data Templates reporting standards, reference data such as the Legal Entity Identifier
(LEI) and defined data elements for OTC derivatives trades.31 These include the CPMI and IOSCO’s Critical
Data Elements (CDE).
Authorities will have to collaborate closely to manage the increasing data flows across borders. Current
requirements for data localisation support national policy objectives, such as law enforcement, national
security and personal data protection.32 But they may also be used as a tool for economic protectionism.
Data sharing should occur wherever possible to ensure international finance can serve the global digital
economy.
Careful capital account liberalisation
Further EME opening, especially to market-based finance, needs to be managed well to minimise risks
and maximise the opportunities. Over the past 20 years, portfolio flows to emerging markets have been
nearly four times as volatile as foreign direct investment (FDI) flows.33 Emerging markets will need certain
structures and safeguards to reduce their vulnerability to potentially damaging capital flow volatility:
(i) sound macroeconomic and prudential policies (ii) deeper domestic financial markets and (iii) better
monitoring of capital flows.
When countries are confronted by volatile capital flows, the first line of defence should be sound
domestic macro and macro prudential policies. In certain cases, they could consider using temporary
policies that directly affect capital flows (“capital flow management measures”) although such policies
should not be used to maintain undervalued exchange rates.
A deepening and broadening of domestic financial markets can also help countries better absorb capital
inflows and enable an efficient allocation of funds to productive uses in the real economy. This includes
local currency debt. A more diversified domestic investor and instrument base including institutional
investors and simple and transparent securitisation markets further reduce risks.
The traditional advice to emerging markets on capital flow volatility has been to “keep your own house
in order” by reforming domestic institutional frameworks and so stabilising capital flow “pull” factors.34
Emerging markets have made good progress here. This has protected against external forces outside of
their control — capital flow push factors. But push shocks have been amplified by underlying changes in
the global financial system, including the structural shift from bank to market-based finance.35
Much of the increase in emerging markets’ external debt since the global financial crisis has come from
portfolio debt, which is volatile.36 In addition, market-based cross-border capital often comes from
non-bank financial companies. These usually fall outside the regulatory scope. There is a need for an
increased understanding and ability to manage such flows.
A final backstop, to avoid currency crises, is provided by the Global Financial Safety Net (GFSN) —
consisting of IMF loans, regional financial arrangements and bilateral swap lines.37 There is a risk that
financing of the IMF — the only truly multilateral lender of last resort to the global financial system —
could decline over the next decade while demands on it increase.38 Given the likely growth of emerging
markets, global gross external liabilities could double in dollar terms by 2030.39
Deep supervisory co-operation
Deep supervisory co-operation will be an important element of strong international co-operation. The
Bank has a long history of building and maintaining relationships with overseas supervisory authorities.
Supervisory colleges such as crisis management forums and established resolution mechanisms play a
valuable role in the supervision of internationally active financial institutions.40 And they will continue to
be a key element in fostering international co-ordination.
Going forward, they will have to engender even greater collaboration to increase information sharing to
manage cross-border challenges to financial stability. The UK is home to four and hosts more than
26 globally systemically important banks. So the Bank already participates in major supervisory colleges
which are key to achieving this goal.
Green standards
The Bank may also wish to take a more active role in promoting greater international co-operation on
implementing standards for green finance. At present, standards for what constitutes “green finance” are
high-level, fragmented and voluntary. There has been a proliferation of private sector entities providing
green labels, each with their own taxonomies, frameworks and methodologies.
Loosely constructed, unenforceable standards and definitions can lead to “greenwashing”, especially
when coupled with economic incentives. This would mislead investors, undermine confidence in the
market and hinder the growth of green finance.
A number of developments could be helpful to support the growth of this market including: clear,
granular standards of what is classified as green and brown; robust and harmonised certification and
verification methods; transparency on the use of proceeds and independent audit mechanisms and;
consistent rating methodologies on the “green-ness” of bonds.
RECOMMENDATIONS

• Over the next decade emerging market economies will play a more central
role in the global economy and global financial system. They are also
likely to continue to open up their capital accounts. This brings significant
opportunities but also new risks to financial stability, both in the UK and
globally.

The Bank should:
4.1 Champion
global standards • Promote strong public sector standards and deep supervisory co-operation,
including through maintaining and optimising influence in forums such as the
Financial Stability Board, the Basel Committee on Banking Supervision and the
International Monetary Fund.
• Convene and catalyse private sector standards through discussions on road
blocks to more effective finance, particularly in post-trade and deepening
supervisory co-operation. A good place to start would be the swap and
collateral markets along the lines of the International Swaps and Derivatives
Association common domain protocols. The Fixed Income, Currencies and
Commodities Markets Standards Board can play a useful role on this.

• As emerging market economies continue to grow the UK as a global financial
centre has an opportunity to share in the growth of emerging markets. It may
also help meet the investment needs that will be required for a transition
to a low-carbon economy given its strong history of innovating to serve
4.2 Engage on the international clients.
evolving needs
of emerging
markets What can the Bank (and others) do?
The Bank should:
• Continue to engage internationally to explore ways in which the UK, as a
global financial centre can use its expertise to meet the needs of international
markets. This includes through providing green finance, greater insurance for
cyber-risk and offshore local currency bonds.
• The confluence of a number of factors may lead the current or any future
government to wish to explore the competitiveness and shape of the
UK financial sector in the decade ahead — similar to the Darling-Bischoff
report from 2009.41
• Brexit poses numerous challenges to businesses and the financial system. It
has driven many firms to re-evaluate the UK as their choice for future jobs and
investment.
4.3 Engage • Fintech is a significant opportunity for the UK economy and the jobs of
with future of tomorrow. In addition, after a decade of regulatory reform nears its end, it
financial services is important to re-assess whether rules work as intended, are as efficient
initiatives as possible and don’t create unintended consequences. The recent reviews
in the US of financial regulation also contain many useful ideas for modest
recalibrations to make the system more efficient.

The Bank should:
• Contribute within the scope of its mandate, if the Treasury wants to explore
pro-growth changes to financial services regulation and other policies to be a
competitive vibrant centre of financial services and be a leader in fintech, not
least as Brexit choices become clearer.
ENDNOTES
1 International Monetary Fund, World Economic Outlook Database, October 2018.

2 www.statista.com/statistics/298370/uk-financial-sector-total-financial-services-employment/.
3 www.ons.gov.uk/economy/nationalaccounts/balanceofpayments/datasets/3tradeinservicesthepinkbook2016.
4 Staying Connected, speech given by Mark Carney, Markets Forum, May 2018.
5 www.bis.org/statistics/b1.pdf.
6 New Economy, New Finance, New Bank, speech given by Mark Carney, The Mansion House, June 2018.
7 http://data.imf.org/?sk=B981B4E3-4E58-467E-9B90-9DE0C3367363&sId=1424963554286.
9 Pull, Push, Pipes: Sustainable Capital Flows for a New World Order, speech given by Mark Carney, Institute of International Finance
Spring Membership Meeting, June 2019.
11 https://datacatalog.worldbank.org/dataset/world-development-indicators.
12 http://web.pdx.edu/~ito/Chinn-Ito_website.htm.
13 IIF Global Debt Monitor Database.
14 IIF Global Debt Monitor Database.
15 www.ecb.europa.eu/pub/economic-bulletin/focus/2018/html/ecb.ebbox201808_01.en.html.
16 Sustainable Finance Progress Report, UNEP, (2019).
17 Climate Bonds Initiative, Green Bond Pricing in the Primary Market January-June 2019.
18 Based on IMF projections 2019–23 of GDP at market prices from the World Economic Outlook, October 2018 and assuming growth
rates 2024–30 remain at 2023 levels.
20 www.statista.com/statistics/270452/united-kingdoms-share-of-global-gross-domestic-product-gdp/.
21 IMF IFS and Bank calculations.
22 Global Warming of 1.5°C, IPCC, (2018).
23 Green Finance and Investment: Mobilising resources for sustainable development and climate action in developing countries,
OECD, (2017).
24 www.lseg.com/resources/media-centre/press-releases/icbc-london-lists-1-58bn-equivalent-green-bond-london-stock-exchange-
green-bond-segment.
25 www.bankofengland.co.uk/financial-stability.
26 See for example: www.imf.org/en/About/Factsheets/IMF-Surveillance.
27 https://g20.org/en/.
28 Prudential bank regulation: present and future, speech given by Vicky Saporta, Westminster Business Forum, 4 July 2018.
29 www.globalfxc.org/fx_global_code.htm.
30 https://fmsb.com/.
31 Data Standardization: A Call To Action, Regulatory Policy Insights, JP Morgan Chase, (2018).
32 Data Flows Across Borders: Overcoming Data Localization Restrictions, Institute of International Finance (IIF), (2019).
33 IMF IFS and Bank calculations.
35 Transforming Shadow Banking into Resilient Market-based Finance, FSB, 2015.
37 Stitching together the global financial safety net, Bank of England Financial Stability Paper No. 36, Denbee et al (2016).
39 IMF IIF for gross external liabilities, IMF WEO for GDP growth, World Bank for population projections and Bank calculation.
40 www.bankofengland.co.uk/prudential-regulation/policy.
41 UK international financial services — the future: A report from UK based financial services leaders to the Government, (2009).
5 PROMOTE THE SMOOTH TRANSITION
TO A LOW-CARBON ECONOMY
THE OUTCOME WE SEEK
A smooth transition to a low-carbon economy through mainstreaming climate-related disclosures,

launching climate stress tests and promoting climate risk management.
•
Climate change poses risks to financial stability and threats and opportunities for firms.
An earlier and smoother adjustment to a low-carbon economy can help mitigate this.
•
Achieving the Paris Agreement’s 2°C target requires huge investment in infrastructure
that can only be made possible by mobilising public and private finance.
• Better disclosure of climate-related risks is necessary to steer investment towards initiatives

that reduce the world’s dependency on fossil fuels and promote investment in energy
efficiency.
KEY DEVELOPMENTS
Industrialisation has brought an exponential increase in global growth and prosperity since 1850.1 Yet the
benefits have come at a significant cost to the environment.
Energy usage has gone up 20 times. We’re seeing the highest rate of atmospheric CO2 for hundreds
of thousands of years. Surface temperatures have increased by 1°C and sea levels are 20cm higher.
Unchecked, this trend will present grave threats to the environment, the economy and financial stability
(Figure 1).
Figure 1: Industrialisation has had a negative effect on the environment
The change in climate since 1850
100x increase in global GDP
20x increase in 1% increase in 20cm increase in

global energy use global temperatures sea levels
A response to climate change
Paris Agreement: long-term goal to limit global warming to 2°C
45% reduction in carbon emissions by 2030

US$6.9tn annual investment until 2030
Source: Annex to the Ladybird Expert Guide on Climate Change, HRH The Prince of Wales et al., British Antarctic Survey, Data compiled from a wide range of
sources, Bank (2018).
To mitigate this impending climate tragedy, decisive action is needed. In 2015, 197 governments met in
Paris and formed the Paris Agreement.2 They committed to keep warming to well below 2°C and to strive
to limiting it to no more than 1.5°C (Box 1).3
Achieving the 2°C goal of the Paris Agreement will require significant public policy interventions, changes
in individual lifestyles, and companies adapting their business models and investment choices. This
presents an unprecedented collective action problem with many risks and opportunities that will shape
the new economy. Finance, both public and private, will be needed to fund the transition.
Box 1: The 2015 Paris Agreement
The Paris Agreement was built on various • Climate finance, technology and capacity
principles including: building: Developed countries have committed
to mobilise US$100bn of public finance each
• Emissions peaking: The need for greenhouse
year by 2025.3 This is to support developing
gas emissions to peak as soon as possible and
countries create a Green Climate Fund
to then undertake “rapid reductions”.1 This
and facilitate the transfer of “climate-safe
includes recognising emerging economies
technologies”.
will need longer to adjust and that developed
economies are expected to make greater and • Transparency and global stocktake: Robust
faster reductions. transparency measures, an international
emissions accounting framework and a global
• Mitigation: Each country has prepared a
stocktake on progress every five years.
binding national climate action plan on
emissions reduction.2 While the sum of these The Paris Agreement came into force in
national plans would not be sufficient to limit November 2016, and 185 of the 197 parties
warming to below 2°C, they provide clarity and have ratified it in their national legislation.4
a path going forward.
In 2018, the Intergovernmental Panel on Climate
• Adaptation: Increasing the resilience of Change (IPCC) concluded that countries needed to
economies and infrastructure to climate take unprecedented action to limit temperatures
change. Governments have committed to to 1.5°C above pre-industrial levels within the next
“adaptation planning”, including communicating decade.5
and co-ordinating their priorities.
1 See www.ec.europa.eu/clima/policies/international/negotiations/paris_en.
2 See www.unfccc.int/process-and-meetings/the-paris-agreement/what-is-the-paris-agreement.
3 See www.unfccc.int/news/finale-cop21.
4 See www.unfccc.int/process/the-paris-agreement/status-of-ratification.
5 Summary for Policymakers of IPCC Special Report on Global Warming of 1.5°C approved by governments, IPCC, (2018).
A low-carbon economy is an economic and environmental imperative.

The case for action is compelling (Figure 2). For the economy, failure to act could be catastrophic with
the potential for more extreme weather events, widespread resource degradation and shortages. It
could cause damage to land, property and physical capital. And it may lead to volatile migration flows and
disruption to supply chains.
Figure 2: CO2 emissions curves could vary widely
Source: Global Carbon Project. Data: SSP Database (IIASA)/GCP.
The economic impact of more frequent and extreme weather events is devastating for advanced
and emerging economies alike. Extreme weather events totalled US$160bn of losses globally in 2018
according to one estimate.4 Where these losses are not insured, as often is the case in emerging
economies, they directly damage the financial wellbeing of citizens and businesses.
Risks to financial stability
It is increasingly recognised that climate change can pose risks to financial stability and the safety and
soundness of financial firms, particularly through two channels:
1. Physical risks are caused by damage to assets including property, land and infrastructure from
climate and weather-related events.5 These can for example be heatwaves, droughts, floods
and rises in sea level. The events can cause financial losses, increased insurance claims and
impairment to asset values and borrower creditworthiness. Insured weather-related losses have
risen from US$10bn a year in the 1980s to US$45bn in this decade.6
2. Transition risk can occur from the adjustment to a lower-carbon economy. Changes in climate
policy, technology or market sentiment could prompt a reassessment of the price of many assets
as changing costs and opportunities become apparent.7 The timing and speed of this repricing is
uncertain. It could impact financial stability, particularly if such risks are not reflected in current
valuations.
Given the historic reliance on fossil fuels much focus has been on the issue of so-called unburnable
carbon (Figure 3). This is the embedded valuation of fossil fuel reserves that under new emissions
targets may never be allowed to be used.8 But in practice this issue goes well beyond fossil fuels,
given the scale of the realignment required to support the transition to a low-carbon economy. It is
relevant to every sector of the economy. One estimate puts the potential value of the global stock of
manageable assets that are at risk between US$4.2tn and US$43tn until the end of the century.9
Figure 3: The carbon embedded in global fossil fuel reserves is more than double the 2°C
carbon budget
Gigatonnes of CO2
3,000
Oil
2,000 Gas
Coal
1,000
Remaining
Used
0
Carbon embedded in global fossil fuel reserves Carbon budget after 2015
2013
Source: Heede and Oreskes, 2016. Rogali et al., 2016.
Note: Carbon budget estimates are uncertain and depend on a number of factors, including the probability with which warming is kept below 2°C; the
contribution to warming from non-CO2 emissions; and uncertainties in climate processes and feedback.
There is growing consensus that an earlier and smoother adjustment to a low-carbon economy will allow
risks to financial stability and threats to financial firms to be better managed. However, this requires
effective transparency and information from companies and governments on their strategy and progress.
Financing the transition
The transition to a low-carbon economy requires support from the financial sector. It must mobilise
private finance for projects and infrastructure that reduce carbon emissions.
To achieve the Paris Agreement, carbon emissions must decline by 45% until 2030 from 2010 levels and
reach net zero by 2050.10 To meet this goal, 95% of electricity generation will need to be low-carbon
according to the International Energy Agency. Seventy per cent of cars will need to be electric. And the
entire building stock in the UK must be fitted with energy saving features to reduce CO2 emissions from
housing by 80%.11
This assumes tremendous investment in infrastructure that requires private and public finance. The
Organisation for Economic Co-operation and Development (OECD) estimates it could take more than
US$90tn in investment in total between 2016 and 2030.12 This is almost five times the annual GDP of
the USA.
Capital will especially need to be redirected from carbon-intensive projects to initiatives that reduce the
world’s dependency on fossil fuels (Figure 4). And emerging economies will need to spend the most.
While this demands a striking financial mobilisation and capital reallocation, it also presents opportunities
for the financial sector to develop new products and services.
Figure 4: The need for low-carbon energy will increase significantly
Wind and solar PV Electric car fleet Energy CCUS deployment Share of
generation Million cars productivity Gigatonnes of non-fossil fuels
TWh $GDP/Mtoe captured CO2
40%
15K 20 3Gt
800
Sustainable
Development 30%
Scenario
10K 600 2Gt
New 20%
Policies 10
400
Scenario
5K 1Gt
10%
200
0K 0 0 0Gt 0%
2017 2040 2017 2040 2017 2040 2017 2040 2017 2040
Source: World Energy Outlook 2018, International Energy Agency.
The pathway forward — barriers and frictions to be addressed

Policy responses are needed to resolve barriers and ease frictions for an earlier and smoother
adjustment to a low-carbon economy and to mobilise investment. Some of the most significant barriers
include:
Lack of understanding and awareness
The market’s perception of the relative rates of return on carbon-intensive assets and those funding
emission reductions in part reflects a lack of understanding of the financial risks from climate change.13
Firms still need to recognise that climate change-related risks should be seen as part of financial
risk management. Instead they are often regarded through a narrow lens such as corporate social
responsibility. The timespan for corporate lending of three to five years may be too short to warrant
greater consideration of climate factors.
Information shortages
The lack of understanding comes with an information shortage. Financial markets are not sufficiently
aware of the risks of ignoring climate change. This is partly because recipients of finance do not disclose
enough information for an appraisal of the risks. It is compounded by the absence of standardised
measures of carbon intensity for specific assets.
Tragedy of the horizon
In a 2015 speech, the Governor of the Bank of England, Mark Carney, coined the term “the tragedy of
the horizon”.14 It describes how financial markets can be too focused on short-run profit maximisation
to consider the long-term impact. This can be driven by many factors including: risk appetite, investment
horizons, and the need to match investment and funding profiles. Overall, this can result in the negative
effects of climate change being seen as relevant only well beyond normal business planning horizons.
Disclosure — breaking down barriers to better informed investment
Asset allocators and institutional investors are seeking to integrate environmental factors into their
investment processes. Demand is growing. In 2018, US$760bn of investment flowed into sustainable
funds across the US and Europe, up from US$453bn in 2013.15 In the US alone, more than 100 new
sustainable mutual funds were launched between 2015 and 2017.
But markets need more and better information to work properly. In particular, investors need companies
to produce more consistent and comparable information mainstreamed in company reporting.
Better disclosure is especially important with institutional investors looking to alternative investments
and longer-term infrastructure projects for returns because of low interest rates. The economies of scale
that passive investing offers are also leading to “barbell” asset allocations, meaning core index portfolios
accompanied by high conviction satellite asset allocations.
Climate-related disclosures can be particularly challenging. Measuring and assessing long-term trends,
and the interactions between climate science, public policy, economics and financial markets is complex.
Making sense of the potential impact of climate change and the strategic response is also difficult due
to interconnected global supply chains and a multitude of intersecting legal, regulatory and operating
environments.
One feature of climate disclosures has been the number of fragmented schemes, well-intentioned but
lacking comparability and consistency. 7 in 10 asset managers say the lack of high-quality information
is the biggest challenge in adopting sustainable principles.16 And the growth in, potentially piecemeal,
disclosure schemes may slow adoption.
The International Trade Centre reports at least 230 corporate sustainability standards initiatives in over
80 sectors.17 There are nearly 400 initiatives with varying status, scope, methodologies and ambition.18
Over 90% of FTSE 100 companies and more than 80% of Fortune 500 companies are members of one of
these schemes.
In response, the G20 finance ministers and central bank governors asked the Financial Stability Board to
consider this issue. The FSB established the Task Force on Climate-related Financial Disclosures (TCFD) in
2015 (Box 2). Its G20 member states account for over 85% of global emissions.
Box 2: FSB Task Force on Climate-related Financial Disclosures
In 2015, G20 finance ministers and central bank across sectors and geographies.
governors asked the Financial Stability Board
The recommendations were based on several
(FSB) to convene public and private sector
key features including: (i) they should be
participants1 to review how the financial sector
adoptable by all organisations, (ii) provide useful,
can take account of climate-related issues.
forward-looking information on financial impacts,
The review identified the need for better (iii) bring the “future nature of issues into the
information to support informed investment, present through scenario analysis”, (iv) present a
lending, and insurance underwriting decisions strong focus on both the risks and opportunities
and to improve understanding and analysis of of the transition to a low-carbon economy.3
climate-related risks and opportunities. The
The TCFD is supported by over 700 global
FSB established the industry-led Task Force on
companies with a market capitalisation of
Climate-related Financial Disclosures (TCFD)
more than US$9tn and is endorsed by financial
to identify which information was needed. It
institutions managing over US$110tn in assets.4
published voluntary, consistent, climate-related
This includes three quarters of the globally
financial disclosures that would be useful to
systemic banks, eight of the top 10 global
investors, lenders, and insurance underwriters in
asset managers, and leading insurers and
understanding material risks in 2017.2
pensions managers from across the globe.5
The TCFD‘s recommendations span governance, Twenty-three per cent of UK companies
strategy, risk management and metrics and are expected to report in line with TCFD
targets. They were designed to be applicable recommendations in 2019.6
to both financial and non-financial institutions
TCFD recommendations
Governance Strategy Risk management Metrics and targets
Disclose the Disclose the actual Disclose how Disclose the metrics
organisation’s and potential impacts the organisation and targets used to
governance around of climate-related risks identifies, assesses assess and manage
climate-related risks and opportunities and manages climate- relevant climate-
and opportunities on the organisation’s related risks related risks and
businesses, strategy opportunities where
and financial such information is
planning where such material
information is material
1 See www.fsb.org/work-of-the-fsb/policy-development/additional-policy-areas/climate-related-financial-disclosures/.
2 Recommendations of the Task Force on Climate-related Financial Disclosures, FSB, (2017).
3 Task Force on Climate-related Financial Disclosures: Overview of Recommendations, FSB, (2017).
4 TCFD: 2019 Status Report, FSB, (2019).
5 A New Horizon, speech by Mark Carney, European Commission Confere: A global approach to sustainable finance, (2019).
6 See www.carbontrust.com/news/2019/01/two-thirds-of-major-uk-companies-to-incorporate-climate-change-risks-and-
opportunities-in-this-year-s-annual-reporting/.
Broad adoption of the TCFD recommendations is based on supply and demand, which is helping to
create a virtuous circle of disclosure. “Suppliers” of disclosures have emerged covering every geography
and sector, from consumer goods to oil and gas majors, from auto manufacturers to technology
companies. Alongside, investors are increasingly asking for, and using, TCFD information. The TCFD’s
status reports on implementation published in 2018 and 2019 generate encouraging evidence on uptake
increasing from the first to the second round of reviewed company reports.
But the overall adoption is still low and disclosure can improve. Firms publish climate-related information
in a variety of different reports, which often lack appropriate information about the financial implications
of the cited climate risks. Additionally, disclosures vary across industries and regions which does not
always ensure they are aligned with the TCFD recommendations.
More also needs to be done to enhance awareness. The TCFD has established a range of materials and
support networks to help companies implement the recommendations, share experience and securing
progressive improvements in their disclosures.
There may be a good case for making disclosures mandatory in the UK company reporting framework,
as adoption broadens, quality improves and experience increases. This would ensure consistent and
comparable practice and equip markets with the necessary information. As Box 3 indicates, some
countries have already made aspects of climate reporting mandatory.
Box 3: French energy transition law
In August 2015, France passed the Energy While most other jurisdictions have taken a
Transition for Green Growth Law.1 Under voluntary disclosure approach, Article 173
Article 173, asset owners and managers have creates a mandatory approach while giving firms
to report on how physical and transition risks leeway in how they disclose.2 This can help the
impact their activities and assets. The law helps to breadth of disclosure and make sure climate
create a co-ordinated framework for policy action change is on the management team agenda.
by linking disclosure to the broader efforts to
decarbonise the energy sector.
1 Article 173-VI: Understanding the French regulation on investor climate reporting, Forum pour l’investissment responsible,
(2016).
2 French Energy Transition Law: Global Investor Briefing, UNEPFI Principles for Responsible Investment, (2016).
Other incentives
It is worth adding that incentives are an important driver in addition to increased information.
Many banks highlight that they are primarily regulated through risk-weighted assets, which are based
on historical information and expert analysis. They do not always take account of longer-horizon
forward-looking information such as climate change. And while adjusting the risk weights for exposure
to “brown” assets might merit discussion, it would not be easy to operationalise, given the globally
agreed approach to setting capital requirements. But some banks like ING are starting to measure and
incorporate data on green commercial real estate in the Netherlands, which at the margin can help.19
This is a topic the Bank may wish to explore and advocate internationally.
The Bank does not have a statutory objective to set or implement environmental, energy or broader
economic policy, which is rightfully for the Government. As such, it does not have the mission or mandate
to set the course to a low-carbon economy. At all times, the Bank’s supervisory and operational decisions
should be based on the economics and financial risk substance of the issues, governed by its mandate.
And it should not use the policy tools at its disposal to incentivise specific “green” behaviours from market
participants.
Consistent with its duties, the Bank must take steps to ensure systemic risks from climate change are
addressed and the safety and soundness of regulated financial institutions upheld. This means making
sure risks are properly managed. It requires a strategic approach to account for the distinctive features of
climate risks. These features arise from the breadth of industries and geographies, the magnitude of the
impact climate-related events can have on the economy and their foreseeable nature. Most importantly,
short-term actions today are determining the size of future impacts.20 So the uncertain time horizon of
climate risks needs to be brought into traditional business planning cycles. Box 4 outlines the work the
Bank has already done to meet the need for strategic action.
Box 4: The Bank’s response to the financial risks from climate change
The Bank has enhanced its understanding of To advance the financial sector’s approach to
physical and transition risks from climate change climate risks, the PRA and the Financial Conduct
through detailed reviews of the impact on Authority (FCA) created the Climate Financial
insurers and banks.1 It considers that an early Risk Forum.4 Combining the expertise from a
adjustment to a low-carbon economy will be group of regulated firms, it aims to develop best
lower risk. The costs and potential for threats practice approaches to identifying, mitigating, and
to financial stability from transition risks can managing these risks. The forum will also seek
be reduced by pulling this process forward. to support innovation for financial products and
Consistent, comparable and timely information, services in green finance.
which allows a broad range of stakeholders to
The PRA’s work informs the Financial Policy
assess the risks and opportunities from the
Committee’s (FPC) efforts to identify, monitor
transition will catalyse this adjustment.
and remove or reduce systemic risks to protect
The Bank’s mission as to micro-prudential and increase the resilience of the UK’s financial
regulation is to promote the safety and system. The FPC is exploring whether
soundness, and the protection of benefits for climate-related factors should be included in the
insurance policyholders, of firms regulated by biennial exploratory scenario (BES) stress test.
the Prudential Regulation Authority (PRA). A
The Bank also recognises that climate change
PRA survey established that financial risks from
is a global issue that requires global solutions.5
climate change tend to be beyond firms’ usual
It has worked with other regulators and central
planning horizon of roughly four years.2 Even
banks across the world to ensure consistent
where these may crystallise in full over longer
approaches to managing these risks. It is an
time, their effects are becoming apparent now.
active member of the Sustainable Insurance
Almost three quarters of banks surveyed are
Forum and a founding member of the Network
starting to treat them as financial risks. The PRA
for Greening the Financial System.6 As part of
has published supervisory expectations that
these, it has convened conferences with over
firms manage the far-reaching and foreseeable
100 attendees from different central banks,
risks from climate change as part of a strategic
financial firms, academics, and NGOs to further
approach.3 These span governance, risk
the thinking on important issues such as the
management, disclosure and the use of scenario
use of scenario analysis. It also supports global
analysis as a tool.
initiatives such as the G20’s Sustainable Finance
Study Group and the TCFD.
1 The impact of climate change on the UK insurance sector: A Climate Change Adaptation Report by the Prudential Regulation
Authority, (2015).
2 See www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/report/transition-in-thinking-the-impact-of-climate-
change-on-the-uk-banking-sector.pdf.
3 See www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/supervisory-statement/2019/ss319.
pdf?la=en&hash=7BA9824BAC5FB313F42C00889D4E3A6104881C44.
4 See www.bankofengland.co.uk/news/2019/march/first-meeting-of-the-pra-and-fca-joint-climate-financial-risk-forum.
5 Open letter on climate-related financial risks, Governor of Bank of England Mark Carney, Governor of Banque de France
François Villeroy de Galhau and Chair of the Network for Greening the Financial Services Frank Elderson, (2019).
6 See www.bankofengland.co.uk/climate-change.
RECOMMENDATIONS

• Better data can improve the analysis of the risks and opportunities of climate
change. Disclosure plays an important role in allowing the market to assess
exposures and determine a strategic response. The TCFD has outlined a
voluntary disclosure framework to help investors and others understand how
reporting organisations assess climate risks and opportunities. The Bank has
been vocal supporters of the TCFD, recognising its role in enabling the private
sector to assess these.
5.1 Advance
the adoption of What can the Bank (and others) do?
climate change The Bank should:
disclosure
• Encourage widespread adoption of the Task Force on Climate-related Financial
Disclosures’ (TCFD) recommendations.
• Monitor climate-related disclosures among supervised firms.
• Work with the Department for Business, Energy and Industrial Strategy and
relevant authorities to explore the merits of making climate-related financial
disclosures mandatory in mainstream financial disclosures, ideally within
five years.
• Consider climate disclosure for its own operations.

• If firms are to assess and manage the risks from climate change adequately,
they need a forward-looking, strategic approach. It must account for the
long-term nature of climate risks and recognise the impact of today’s
decisions. Firms should incorporate the risk assessment of climate change
into their risk management frameworks and governance structures.
• Firms should also hold financial resources against these risks where they are
material in line with the prudential capital regime. This will require them to look
beyond their capital planning horizon towards the longer term where losses
5.2 Embed are likely to occur.
climate risk
management What can the Bank (and others) do?
The Bank should:
• Ensure that the firms the Bank supervises are embedding scenario analysis in
their risk management.
• Engage internationally to develop templates for scenario analysis.
• Facilitate the sharing of best practices in the management of climate-related
financial risks.
• Include a new climate-risk scenario for the Biennial Exploratory Scenario (BES).
ENDNOTES
1 Annex to the Ladybird Expert Guide on Climate Change, HRH The Prince of Wales et al., British Antarctic Survey, Data compiled from
a wide range of sources, (2018).
2 The Paris Agreement, UNFCC, (2015).
3 See www.unfccc.int/files/meetings/paris_nov_2015/application/pdf/paris_agreement_english_.pdf.
4 The natural disasters of 2018 in fugures, Munich Re, (2019).
5 Enhancing banks’ and insurers’ approaches to managing the financial risks from climate change, PRA Supervisory Statement
SS13/19, (2019).
6 The Bank of England’s response to climate change, Bank of England Quarterly Bulletin 2017 Q2, (2017).
7 Transition in thinking: The impact of climate change on the UK banking sector, PRA, (2018).
8 The Carbon Bubble: Climate Policy in a Fire-Sale Model of Deleveraging, Comerford et al., (2016).
9 The cost of inaction: Recognising the value at risk from climate change, The Economist Intelligence Unit, (2015).
10 Global Warming of 1.5°C, IPCC, (2018).
11 UK housing: Fit for the future, Committee on Climate Change, (2019).
12 Green Finance and Investment: Mobilising resources for sustainable development and climate action in developing countries, OECD,
(2017).
13 See www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/report/transition-in-thinking-the-impact-of-climate-change-
on-the-uk-banking-sector.pdf?la=en&hash=A0C99529978C94AC8E1C6B4CE1EECD8C05CBF40D.
14 Breaking the Tragedy of the Horizon - climate change and financial stabiliy, speech given by Mark Carney, Lloyd’s of London, 29
September 2015.
15 Sustainability: The future of investing, Blackrock Global Insights, (2019).
16 Sustainable Signals: Growth and Opportunity in Asset Management, Morgan Stanley Institute for Sustainable Investing, (2019).
17 See www.intracen.org/itc/market-info-tools/voluntary-standards/standardsmap/.
18 Climate change: The investment perspective, EY, (2016).
19 See www.ing.com/Newsroom/All-news/ING-will-only-finance-green-office-buildings-in-the-Netherlands-after-2017.htm.
20 A call for action: Climate change as a source of financial risk, Network for Greening the Financial Services (NGFS), (2019).
6 ADAPT TO THE NEEDS OF A
CHANGING DEMOGRAPHIC
THE OUTCOME WE SEEK
Individuals are empowered to save in an efficient and convenient way across a wide range of investments.
This provides a secure income stream in retirement and supports the flow of long-term finance for the
economy.
• Individuals are living longer and increasingly have to provide for old age, as traditional state
and corporate pension schemes have been transformed.
• As our population ages, it is becoming clear that policy changes will be needed to facilitate
greater security in retirement.
• Finance will also need to support major changes in demographics and working patterns as well
as the evolving needs of savers and borrowers.
KEY DEVELOPMENTS
Ageing society
People are living longer in the UK. By 2030, more than a fifth of the population may be above 65.1 This
could rise to over a quarter in 2050, depending on levels of immigration and advances in healthcare.2
As a result, ill health and disability are rising.3 People are also having fewer children, while the working
age population is in decline, putting pressure on funding provisions for old age (Figure 1). This said,
individuals may also be working for longer in the future, offsetting some of the pressure. Advances in
technology and productivity could help further.
Figure 1: We are getting older

Age dependency ratio
Age dependency
80%
UK
60%
World
40%
1960 1980 2000 2020 2040
Source: World Bank.
Note: Age dependency ratio is the ratio of dependents — people younger than 15 or older than 64 — to the working-age population — those ages 15–64.
Data are shown as the proportion of dependents per 100 working-age population.
People have to save more to reflect longer retirement periods and costs of long-term care, which are
likely to rise. They need access to savings products to accumulate wealth — and products to help ensure
a steady income in retirement, “decumulation”.
Greater longevity and tax changes mean many firms have switched from defined benefit (DB) to
defined contribution (DC) pension schemes in recent years.4 But DC schemes provide less certainty
over retirement income. Contribution rates to occupational DC schemes are typically lower than for
DB schemes. Oliver Wyman suggest that the share of pensions in DC schemes will significantly increase in
the next five years (Figure 2).
Low expected returns as interest rates remain low make certain mainstream retirement products less
viable and appealing. Long-term income is largely backed by lower-risk fixed income assets, including
government and corporate bonds. A decade of low yields has had a profound effect on retirement
security, including greater liabilities for pension managers.
Many are not saving enough for their retirement. More than seven in 10 adults have no investments.
Of those that do, only 35% have in excess of £10,000.5 A third of UK adults make no private pension
provision. Yet, nearly half of people think they will have the same living standard or higher in retirement.
Recent increases in flexible employment are likely to further increase the savings gap. Three million
people worked in the “gig” economy in 2017. While flexible/gig economy employment offers a number of
benefits to the individual, it does not include employer pension contributions.
Figure 2: UK assets in DC schemes will significantly rise in the next five years
Percentage of assets in UK DB and DC pension plans
Percentage of assets in UK DB and DC pension plans

100%
Assets in defined benefit pension plans

80%
60%
40%
20%
Assets in defined contribution
pension plans
0%
2017 2018 F 2019F 2020 F 2021F 2022 F 2023 F 2024F 2025 F 2026 F
Source: Oliver Wyman.
Figure 3: Demand for equity release mortgages has increased to £4bn

Total equity release lending activity 2000–17
Total equity release lending activity and change on previous year

£4B
£3B
£2B
£1B
£0B
2000 2002 2004 2006 2008 2010 2012 2014 2016 2018
Source: Spring Report 2018, Equity Release Council.
Much of wealth in the UK is in housing — almost the equivalent to private pensions, according to the
ONS.6 In recent years, equity release mortgages (ERMs) that offer an upfront lump-sum payment for a
contingent claim on a property have become more common (Figure 3).7 They provide an income stream
from property. An alternative is for individuals to sell their house and downsize. This may be the better
option for many people.
LOOKING INTO THE FUTURE
Retirement security is one of the most important financial priorities. It is important that the UK retirement
savings market can best accommodate the prospective changes in the need for savings, investment and
retirement income. Industry, policymakers and consumer groups all have a role in ensuring that long-
term savings products provide the combination of security, affordability, risk-sharing and flexibility that is
appropriate to the long-term interests of individuals.
Figure 4: The UK fails to make it into the top 10 on the Natixis Global Retirement Index
Natixis Global Retirement Index (GRI)
Rank Country Health Finances in Quality of Material Global

Index Retirement life Index wellbeing retirement
Index Index Index
#
1 Switzerland 87% 78% 92% 80% 84%
2 Iceland 85% 71% 88% 93% 84%
3 Norway 90% 60% 92% 87% 81%
4 Sweden 89% 67% 90% 71% 78%
5 New Zealand 85% 79% 90% 63% 78%
6 Australia 85% 78% 83% 66% 78%
7 Ireland 82% 71% 83% 73% 77%
8 Denmark 85% 59% 94% 74% 77%
9 Canada 87% 74% 83% 65% 77%
10 Netherlands 90% 58% 83% 80% 76%
11 Luxembourg 92% 62% 80% 73% 76%
12 Finland 81% 63% 93% 69% 75%
13 Germany 86% 57% 83% 79% 75%
14 Austria 86% 54% 87% 76% 74%
15 Czech Republic 72% 69% 75% 82% 74%
16 United States 86% 72% 77% 61% 73%
17 United Kingdom 83% 57% 83% 71% 73%
18 Belgium 83% 59% 80% 71% 73%
19 Israel 76% 71% 78% 63% 72%
20 Malta 77% 67% 69% 73% 71%
Source: Natixis Global Retirement Index 2018.
Demographic and economic trends signal that more needs to be done. The Natixis Global Retirement
Index which ranks countries by their level of retirement security puts the UK 17th (Figure 4).8
Policymakers will have to:
1. Stimulate contributions to retirement savings.
2. Create efficiencies including through larger savings schemes to reduce the costs of investing and
widen choice.
3. Ensure products provide a suitable income stream in retirement.
4. Encourage the industry to invest in infrastructure.
The government is already taking steps to encourage more saving. In 2012, it introduced automatic
enrolment into employer pension schemes.9 This has contributed to a large increase in employees
saving through workplace pensions from 47% in 2012 to 73% in 2017.10 This was accompanied by the
introduction of pension freedoms dropping the requirement for individuals to purchase an annuity at
retirement.11 But frequent changes in tax treatment have also reduced incentives to save.
Technology can enable better access to and control over savings. A number of fintechs are using
well-timed “nudges” to encourage saving among younger adults, including by illustrating their purchasing
power in retirement. This gives them greater control over their financial outcomes. In addition, the
government is working with the industry to develop an online dashboard for consumers to see an
overview of their pensions in one place.12
Several government initiatives to consolidate pension schemes are also under way to create greater
economies of scale in savings. With current interest rates, it is imperative to reduce costs and maximise
returns. The Department for Work and Pensions (DWP) is proposing to create collective DC schemes,
enabling savers to pool money into a fund and share risks.13 These could take inspiration from models in
Sweden, Australia and elsewhere.
The Australian Superannuation system is seen as a leading national retirement income system (Box 1).14
It provides incentives to save, efficiency in investment and viable decumulation products. It is formed of
two pillars:
• Compulsory superannuation: This ensures a reasonable level of income is saved for retirement. It is set
at 9.5%15 of salary (expected to rise to 12% by 2026) and taxed at a lower rate of 15%.16 Employers
contribute to the scheme.
• Voluntary contributions: The scheme provides a tax-assisted means for self-contribution for retirement.
Figure 5: Passive investment is on the rise

Active and passive as proportion of total UK assets under management (2008–17)
Proportion of active and passive UK assets under management
80%
60%
40%
20%
0%
2008 2009 2010 2011 2012 2013 2014 2015 2016 2017
Source: Asset Management in the UK 2017–2018, The Investment Association.
Box 1: The Australian Financial Systems Inquiry (the “Murray Review”)
The Australian Financial System Inquiry (the which improves simplicity and transparency and
so‑called “Murray Review”) was published allows comparison.4
in 2014.1 The inquiry evaluated changing
demographics and customer preferences MySuper has rules for fund governance and
and the role and impact of new technologies transparency and restricts how advice is given
and market innovations. It also assessed changes and paid for. It provides a default investment
in the way Australia sources and distributes option with a minimum level of insurance cover
capital through banks’ intermediation of savings, and a short list of allowable fee types.
non-bank financial institutions, insurance
companies, superannuation funds and capital The superannuation system plays an important
markets. role in providing long-term funding for economic
activity in Australia. It has grown rapidly in the
The review presented 44 policy past 20 years, with assets standing at
recommendations to future-proof the Australian AUS$2.7 trillion by 2018.5 Superannuation assets
financial system. A focus was on how to foster are generally expected to outgrow those of the
more effective risk-sharing between individuals banking system over the next few decades.6
to provide sustainable retirement incomes to
the aging population. It also considered how This attests to the effectiveness of the scheme in:
investment choices would best promote the
efficient allocation of capital in the economy and • incentivising higher savings;
cost-effective services for individuals.
• creating efficiencies in investment;
The Australian “super” system provides a holistic
• providing a suitable income stream in
approach to encouraging greater savings.2
retirement; and
It is funded through employer, personal and
government contributions. Money deposited into • funding long-term investment for the
the super fund is invested by the fund’s trustee. economy.
Upon retirement, it is usually converted into a
pension.3 Funds can also offer a simple, low-cost Changes to the UK pensions system might do
default superannuation product called MySuper, well to target similar areas for reform.
1 Financial System Inquiry: Final Report, Australian Government, (2014).

2 See http://strongersuper.treasury.gov.au/content/publications/information_pack/downloads/information_pack.pdf.
3 See www.ato.gov.au/super/self-managed-super-funds/paying-benefits/lump-sum-and-income-stream-(pension)/.
4 See http://strongersuper.treasury.gov.au/content/publications/information_pack/downloads/information_pack.pdf.
5 “Superannuation Statistics”, The Association of Superannuation Funds of Australia, (2017).
6 Financial System Inquiry: Final Report, Australian Government, (2014).
Box 1 continued: The Australian Financial Systems Inquiry (the “Murray Review”)
Figure 6: Illustrative view of Australia’s Superannuation System

Australian Retirement Income System
Universal means-tested age pension
Australian superannuation system
Compulsory Voluntary
superannuation contributions
Salary sacrifice
Downsizing contributions
Personal contributions
Employer contributions
9.5% of ordinary time
earnings
Add employer
contributions
Non-concessional
contributions
Self-employed
contributions
Contributions not taxed,

15% income tax; 10% capital gains tax but earnings taxed at
same rate
Access to superannuation: generally have to reach preservation age and meet

“condition of release”
Lump-sum payment Superannuation pension
Sources: ASIC, Australian Government Productivity Commission and Oliver Wyman.
Shifting models
Insurers and asset managers are responding to client needs by using technology to improve efficiency,
and returns, and to offer greater control and choice. Almost a quarter of UK-managed assets are
passively managed, up 17% from a decade ago (Figure 5, excluding insurers). Index-tracking exchange
traded funds have risen in recent years, providing lower-cost investment opportunities (Box 2).
There has furthermore been a shift to more sustainable finance and the integration of sustainable
factors into decision-making. More than 6 in 10 institutional investors have changed their approach to
voting or incorporated environmental, social and governance criteria in the past 12 months, according to
Edelman.17 And sustainable investment assets globally have increased to more than US$30 trillion from
US$13 trillion in 2012 (Figure 7).
Figure 7: Global ESG investment is on the rise

Sustainable investment assets globally (in $trn)
Sustainable investment assets globally

AUS & NZ
$30T Canada
Asia
$20T US
$10T
Europe
$T
2012 2014 2016 2018
Source: The Global Sustainable Investment Alliance, Oliver Wyman. The Global Sustainable Investment Alliance defines sustainable investing in terms of
portfolio selection and management reflecting ESG factors, plus investments that are otherwise identified as being socially responsible.
Infrastructure and private assets

Demographic, economic and environmental factors all reinforce the need for infrastructure investment.
This would benefit economic growth directly in the near term by boosting activity and indirectly
over longer periods by supporting productivity. For example, the OECD estimates that the required
infrastructure investment to deliver the Paris Agreement commitment to limit global warming to well
below 2% compared to pre-industrial levels may be more than US$90 trillion in investment, or
US$6.9 trillion annually between 2016 and 2030 on average (see Chapter 5).
Insurers and pension funds play a key role in intermediating savings and investing them in a variety of
assets. With their long-term liabilities, pensions and long-term savings products are crucial for supplying
long-term finance to the economy. UK insurers held assets totalling around £2 trillion (end-Q1, 2019), of
which firms classified £115 billion, or 6%, as infrastructure investments.18
There is a trend in the insurance industry towards increasing investment in infrastructure. The
Solvency II Matching Adjustment encourages long-term investment to back long-term annuities.
Insurers have diversified their portfolio away from government and corporate bonds into other direct
investments.19
For pension funds, there has been a movement to de-risk assets so employers have less volatility and
uncertainty in their future funding obligations.20 This has happened through off-loading liabilities to
insurers and increased hedging against adverse movements in interest rates and inflation. There has
also been a shift from higher-risk, higher-return equity to fixed income securities and other investments.
In addition, DC pension schemes generally invest through traded funds. These are likely to be more
liquid than DB schemes and so favour less investment in illiquid assets, such as infrastructure. More may
be done to ensure retail investors can invest in industries of the future and longer-term assets which
generate returns.
Box 2: Exchange-traded funds (ETFs)
ETFs have grown rapidly in recent years as In Europe, ETF assets totalled US$761bn in 2018
technology has democratised access to stock and with somewhat slower growth than in the US.5
bond markets. Retail investors accounted for roughly 15%.6
Global ETF assets totalled US$4.8tn in 2018.1 The emergence of ETFs partly reflects a broader
Since 2003, they have grown at an annual rate shift towards cheaper, passive investment styles
of 23.4%. The majority of growth in assets that often seek to track a benchmark market
under management can be attributed to net index. Without the costs of investment
inflows rather than capital appreciation.2 This is decision-making, the management cost to the
driven by a number of factors such as the low investors can be much lower. The Investment
cost compared to other investment vehicles, Company Institute estimates that index ETFs have
transparency about target tracking indices and an asset-weighted expense ratio of 0.21%,7 as
pricing, and the promise of intra-day liquidity. compared to active funds which charge 0.76%.
Inflows into ETFs and mutual funds were heavily They provide a lower-cost investment vehicle that
concentrated in those with lower expense ratios can provide individuals with greater returns in a
in 2017.3 In some countries, ETFs can also be tax low-rate environment.
efficient.4
Figure 8: Investment through ETFs has increased in Europe
ETC and ETF
€600bn
€400bn
€200bn
€0bn
Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4
14 14 14 14 15 15 15 15 16 16 16 16 17 17 17 17 18 18 18 18
Source: ETF Global Annual Review, Deutsche Bank Research, 2019. ETC: exchange-traded commodities.
1 ETF Global Annual Review, Deutsche Bank Research, (2019).

2 In Turbulent Times, European Institutions Turn to ETFs, Q1 2019, Greenwich Associates, (2019).
3 The implications of passive investing for securities markets, Sushko et al, Bank for International Settlements (BIS) Quarterly
Review, (2018).
4 See www.morningstar.com/articles/914893/etfs-are-tax-efficient-but-is-that-sound-policy.html.
5 ETF Global Annual Review, Deutsche Bank Research, (2019).
6 See www.euroclear.com/newsandinsights/en/Format/Articles/RetailETFs.html.
7 Trends in the Expenses and Fees of Funds, 2018, Investment Company Institute Research Perspective, March 2019, Vol. 25,
No. 1, (2018).
Demographic challenges beyond old age
It is worth noting that an ageing population is far from the only transition in society. Each generation faces
particular financial challenges. The younger generations today are saddled with far more student debt
than their parents and higher economic uncertainty, including through the rise in the gig and sharing
economy among younger adults.21 The issue of intergenerational fairness has grown in importance,22
as older generations have enjoyed more secure pensions and a boom in house prices. A series of policy
decisions may have further widened the gap between young and old.
The Financial Conduct Authority (FCA) have recently launched their work on intergenerational finance.23
This is important in light of ever more pressing challenges for the financial services industry to better
meet changing consumer needs. It will be key for the Bank to monitor the outcomes of this work and
contribute to its objectives where it can provide expertise.
Setting or implementing pension policy is not part of the Bank’s objective. It should not use its policy
tools to encourage specific investment or savings choices from the market. But as part of its mandate of
financial and monetary stability, it should continue to monitor developments in the savings rate.
In macroeconomic terms, an ageing population is likely to save more out of current income, which could
depress consumer spending over the medium term, while the increase in savings may put downward
pressure on long-term yields. These will be important considerations for the Bank’s monetary policy and
financial stability objectives.
Through the prudential supervision of insurance firms, the Bank ensures that firms hold adequate
levels of financial resources to meet their liabilities. In accordance with the EU legislation relating to the
prudential regulation of insurance and reinsurance undertakings, Solvency II, the Prudential Regulation
Authority (the PRA):
• Requires a buffer of assets above the value of policyholder liabilities to absorb unexpected losses,
including through market moves;
• Allows firms to apply a matching adjustment when valuing certain policyholder liabilities (subject to
certain conditions), which can incentivise UK insurers to invest in assets with long-term fixed cash flows
to match their annuity liabilities.24
The Bank has shown keen interest in developments around pensions and insurance and monitors
and contributes to government initiatives relating to its mandate. The DWP has recently consulted on
the consolidation of legacy DB schemes.25 The Bank has responded to the DWP’s consultation.26 It
highlighted that DB consolidators face similar risks to those managed by insurance companies providing
annuities, suggesting they may merit a similar regulatory approach.
The main objective of Solvency II is the protection of policyholders, but the regime also recognises
that financial stability and fair and stable markets are other objectives of insurance and reinsurance
regulation, which should be taken into account. The Solvency II regime does not aim to eliminate all risk.
Similarly, the PRA’s two primary objectives are to (i) promote the safety and soundness of all of the firms
it regulates and (ii) (specific to its regulation of insurers) contribute to the protection of policyholders,
balancing policyholder protection with broader economic considerations.
Insurers need to match their assets and liabilities to ensure that they are able to meet their liabilities
as they fall due. This is particularly important in the case of annuity business and other policies with
long-term guarantees, which can span many years. The Solvency II Matching Adjustment recognises
that insurers with illiquid long-term liabilities (like annuities) may have matching illiquid bonds or other
assets with similar cash flow characteristics; and by holding them in maturity they avoid exposure to the
risk of changing spreads on those assets. In order to avoid changes of asset spreads from impacting on
the amount of own funds of those undertakings, they are allowed to adjust the value of those liabilities
to take into account an illiquidity premium. This may incentivise investment in long-term assets, yielding
better returns.
The design of the risk margin under Solvency II merits ongoing review. For long-dated insurance risks
such as longevity, the margin calculation is sensitive to interest rates. As a result, it is particularly high
when rates are low, and particularly low when rates are high. Insurers have responded to current rates by
reinsuring longevity risk, for example through offshore vehicles that may not offer the same security. This
is undesirable because UK insurers may be over-exposed to offshore reinsurers.
Policymakers should continue to think about how to enable individuals to deal with increased longevity
risks. The government’s proposed collective DC schemes are a first step to pooling risk. The Bank should
also review lifetime income products such as annuities. These mitigate longevity risk and alleviate
challenges from managing withdrawals throughout retirement by providing a basic level of income
security.
RECOMMENDATIONS

• Policy changes need to facilitate a secure income in retirement as people live
longer. As average life spans extend to 83, this means a third may reach the
age of 93 and 5% will reach the age of 100. Budgeting for this is incredibly
difficult.
• Lifetime income products, such as annuities, can help mitigate longevity risk
and alleviate challenges from managing withdrawals throughout retirement.
Insurers may need to offer decumulation products combined with options to
6.1 Consider
buy annuities if people live to a certain age.
forces
determining • Other markets provide greater ways mitigating and sharing longevity risk. For
security in instance, in the Netherlands individuals bear systematic longevity risk under a
retirement collective arrangement but pool idiosyncratic longevity risk.27

The Bank should:
• Consider what opportunities finance presents to share longevity risk.
• Explore any regulatory impediments to security in retirement, starting with the
treatment of risk-sharing products and products that help protect savers from
outliving their savings if they live longer.

• Pension funds can hold on to very illiquid investments and should be a
significant source of “patient capital”.28
• Meanwhile, a growing number of innovative companies are staying in private
capital markets for longer, when more risk-seeking investors in DC schemes
may want to benefit from the new opportunities these provide.
6.2 Support wider What can the Bank (and others) do?
investment The Bank should:
choices
• Provide its expertise to help challenge firms and authorities to consider what
financial products or protections gig and sharing economy employees may
need and the implications for firms’ risk management.
• Assess how firms are responding to the changing investment desires of
younger demographics and whether they are strategically resilient to changing
preferences.
• Share expertise from climate-disclosure work to help investors develop
principles for broader sustainability metrics.

ENDNOTES
1 National population projection: 2016-based, Office for National Statistics (ONS), (2017).
2 Overview of the UK population, November 2018, Office for National Statistics (ONS), (2017).
3 Living longer: caring in later working life, Office for National Statistics (ONS), (2019).
4 Occupational Pensions Schemes Survey, UK: 2017, Office for National Statistics (ONS), (2018).
5 The financial lives of consumers across the UK: Key findings from the FCA’s Financial Lives Survey 2017, FCA, (2018).
6 Wealth in Great Britain Wave 5: 2014 to 2016, Office for National Statistics (ONS), (2018).
7 See www.ft.com/content/2e33921c-5546-11e9-a3db-1fe89bedc16e.
8 2018 Global Retirement Index, Natixis, (2018).
9 See https://www.workplacepensions.gov.uk/employee/.
10 Employee workplace pensions in the UK: 2018 provisional and 2017 revised results, Office for National Statistics (ONS), (2019).
11 See www.gov.uk/government/news/over-92-billion-released-by-pension-freedoms.
12 See https://pensionsdashboardproject.uk/.
13 Collective defined contribution pension scheme inquiry, House of Commons, (2018).
14 See www.ft.com/content/79be1a82-c3dd-11e7-b2bb-322b2cb39656.
15 See www.ato.gov.au/Business/Super-for-employers/How-much-to-pay/.
16 See www.moneysmart.gov.au/superannuation-and-retirement/how-super-works/tax-and-super.
17 See www.ft.com/content/c742edfa-30be-328e-8bd2-a7f8870171e4.
18 Solvency 2 data, Bank calculations.
19 An annuity is a very serious business: Part Two, speech given by David Rule, Westminster and City Bulk Annuities Conference, (2019).
20 www.ppf.co.uk/sites/default/files/file-2018-12/the_purple_book_web_dec_18_2.pdf.
21 See https://researchbriefings.parliament.uk/ResearchBriefing/Summary/SN01079.
22 Select Committee on Intergenerational Fairness and Provision Tackling intergenerational unfairness, Report of Session 2017-2019,
UK Parliament, (2019).
23 Intergenerational differences, Discussion Paper 19/2, FCA, (2019).
24 www.bankofengland.co.uk/-/media/boe/files/speech/2019/an-annuity-is-a-very-serious-business-part-two.pdf?la=en&hash=6BF-
86C21B2C85232A0A22D7D4D36344DF34B4610.
25 Defined benefit pension scheme consolidation, Department for Work and Pensions (DWP) consultation, (2018).
26 PRA response to DWP consultation paper: Defined benefit pension scheme consolidation, PRA, (2018).
27 The economics of sharing macro-longevity risk, Working Paper No. 618, De Nederlansche Bank, (2018).
28 Patient Capital Review, HM Treasury, (2017).

7 SAFEGUARD THE FINANCIAL SYSTEM
FROM EVOLVING RISKS
THE OUTCOME WE SEEK
A financial system that innovates to serve its customers better. It should be safeguarded by effective, and
dynamic oversight and regulation that support innovation, prosperity and sustainable growth.
• Financial stability supports innovation, prosperity and sustainable growth. And as the financial
system evolves and innovates; the Bank’s approach to financial stability will need to keep pace.
• New entrants and “unbundling” of the financial services business model may change market
structures. Open Banking gives consumers more control over their data. But authorities need
to address concerns around liability and operational resilience.
• Market‑based finance has bought welcome diversity and choice in funding options. But
possible vulnerabilities around liquidity mismatches and investor behaviour need to be
understood and managed, particularly following a decade of ultra‑low interest rates.
KEY DEVELOPMENTS
Financial stability supports innovation, prosperity and sustainable growth

Financial stability is the reliable and resilient provision of critical financial services for households and
the economy.1 These financial services allow consumers and businesses to make and receive payments,
borrow money to invest and grow, save for the future and manage and insure against risks. They support
businesses in promoting economic activity, creating employment, and investing in their efficiency and
productivity.
Financial crises are extremely costly and have long lasting effects. Research suggests they can cost
as much as 75% of annual GDP, equivalent to about £21,000 per person in the UK.2 The 2008 “Great
Financial Crisis” lead to the deepest recession in the UK since the Second World War, with one million
more people unemployed, a 5% fall in wages below 2007 levels, and a complete halt in bank lending.
Financial stability supports fertile conditions for innovation.3 This is because stability gives consumers and
entrepreneurs confidence to invest and experiment. When coupled with regulation aimed at protecting
consumers, it can give businesses confidence to innovate and helps customers feel more secure in using
new types of financial services.
Not all innovations are desirable or sustainable. For example, the “financial engineering” that preceded
the crisis, was innovation that should have been constrained. It allowed risks to be parceled in highly
leveraged, opaque and fragile structures with misaligned incentives that had catastrophic effects for
financial stability.4 This serves to underline that innovation is essential but can bring new risks and also
old risks in new forms.
Finance has continually evolved to meet changing needs of customers throughout its history. These
changes have often helped finance become more accessible, effective and efficient. But they have also
bought episodes of risk and instability. The Bank needs to keep pace to ensure that changes benefit
users of finance, while not threatening stability.5
The rise of market‑based finance
One of the defining changes over the past ten years, which will shape the future of finance and markets
for now and in the coming years, is the reform of the financial system following the crisis and the rise of
market‑based finance.6

Common equity requirements and capital buffers for banks are now ten times higher than pre‑crisis.7
“Too big to fail” banks are subject to resolution plans which means “bail‑in” (of investors) rather than
“bail out” (by taxpayers) is becoming a reality.8 Central counterparties (CCPs) have been created to
untangle the complex and risky web of opaque over‑the‑counter derivatives transactions.9 And formerly
toxic, and under‑regulated, shadow banking has been transformed into resilient market‑based finance
through new regulations and rules.10
The Financial Stability Board (FSB) estimates that around 50% of the US$382tn total global financial
intermediation11 now takes place outside the banking system. The global asset management industry has
grown from around US$50tn a decade ago12 to US$80tn in 2017.13 In the UK, over two thirds of the net
finance raised publically by private non‑financial corporations (PNFCs) since the crisis has been through
capital markets, mostly through corporate bond issuance.14 Markets have also accounted for almost all of
the increase in overseas lending to emerging markets since the crisis.
The diversity that market‑based finance brings is welcome. It promotes choice and reduces the reliance
on bank funding. And it can promote resilience where investors may be better able to absorb risks and
changes in asset prices than banks.15 This is because, unlike banks, they do not generally use leverage or
undertake maturity transformation. Capital markets may therefore be better able to fund certain types of
activities like long‑term infrastructure investment.
While market‑based finance is an important risk sharing mechanism that can mobilise productive and
resilient finance for the economy, it can also display vulnerabilities. This includes the potential for sudden
changes in investor behavior in response to market developments, the possibility for surges of requests
for redemption of money from funds which offer daily liquidity but are invested in less liquid assets, and
“fire sales” which can transmit to markets more widely.16 This could result in a “sudden stop” in the flow
of finance to the economy. Therefore, understanding structural vulnerabilities in market finance, and
the evolving dynamics of investor behavior, and putting in place mechanisms to promote stability should
remain a priority for authorities. This is particularly the case following a decade of ultra‑low rates with a
different structure of capital markets.
New Business models and “unbundling” value chains
Advances in technology, e‑commerce and the growth of peer‑to‑peer networks are enabling new
business models and greater diversity of players (Figure 1). For example, insurance telematics, wearable
technology and home sensors provide real‑time data about customer behavior and risk.17 This is positive
by promoting choice, inclusion, and competition for customers. But it can also bring risks.
Figure 1: Diversity of new entrants in finance (selected providers)
Neo banks Fin Techs Tech Giants
N26 mint Amazon pay

orange bank Bankin’ Paypal
Atom Linxo Apple Pay
Fidor Bank Lending Club Android Pay
Monzo Prosper AliPay
WeBank Funding Circle WeChatPay
MyBank iDeal
Simple adyen
Klarna
vpps
Venmo
Source: Boston Consulting Group.

The increased competition from new entrants can have implications for the business models of
“incumbent” financial services companies, who may experience reduced revenues or margins, and
pressure to adapt their strategy and operations in response. For example, PWC estimate that “fintechs”
are contesting nearly a quarter of banking revenues, and similar trends are expected in insurance and
wealth management.18 The Bank of England’s 2017 “Biennial Exploratory Scenario” (BES) stress test
explored the possible impacts of increased competition through new entrants on bank profitability and
resilience.19
Big techs have also entered finance in recent years and many expect them to offer significant
competition. They could use their global customer base and brand to attract customers and launch
new propositions. Amazon, for example, provides payments, cash, lending, credit and prepaid cards.20
In China, Ant Financial has the largest money market fund in the world.21 When considering these new
competitors, authorities will be interested in understanding the implications for the structure of markets
and viability of business models to ensure that financial firms remain safe and sound and financial
stability is maintained.
New entrants are unbundling financial services and dividing them into their core activities.22 These
include payments, settlement, safeguarding assets, savings, lending, insurance and investments.
Unbundling can involve activities transferring to new players, including those who may be outside the
“perimeter” of PRA regulation. It can also lead to narrower, more specialised business models that can
bring efficiency and customer focus, but may be more vulnerable in downturns due to their focus on a
relatively narrow set of clients and activities.
So far, unbundling has been most prominent in payments, consumer finance, wealth and asset
management and lending to small and medium‑sized enterprises (SMEs), where new entrants have been
able to take significant market share (Figure 2). But in the future, it could also include products such as
mortgages. The extent to which more profitable activities migrate, or how far competition compresses
margins, will have implications for the viability of some business models.
Figure 2: Provision of financial services by fintechs in the UK
Start-ups and innovations as a percentage of total institutions (product and customer segments)
Account management Lending and financing
Retail Retail
SME SME
Large corp Large corp
0% 5% 10% 15% 0% 5% 10% 15%
Payments Wealth management and capital markets
Retail Retail
SME SME
Large corp Large corp
0% 5% 10% 15% 0% 5% 10% 15%

Sources: McKinsey & Company, Pitchbook, Crunchbase, Fintech Global, McKinsey Panorama Fintech Database.
Number of start-ups and innovations as a percentage of database total.
Open Banking and new market structures

Open Banking, introduced in the UK in 2018, has required banks to give third parties access to current
account information through direct application programming interfaces (APIs).23 Third parties can initiate
payments on their customers’ behalf (Box 1).

Box 1: Open Banking in the UK
The UK’s Open Banking reforms were The CMA has set up the Open Banking
developed in response to a report issued by Implementation Entity (OBIE) which determines
the Competition and Markets Authority (CMA) the specifications for APIs, creates security and
in 2016.1 The report highlighted a lack of messaging standards and manages the Open
competition among established, larger banks Banking Directory. It also produces guidelines
for customers’ business as well as difficulties and manages disputes and complaints.
for smaller and newer banks to compete.
Eligible third parties which can access data
Open Banking requires the nine largest banks2 shared by banks have to be authorised and
to develop a common API and provide — at the regulated by the FCA and enrolled in the Open
request of customers — access to customer Banking Directory3. They include account
data. They also have to initiate payments information and payment service initiation
in a standard format. It was adopted in providers (AISPs/PISPs) as well as banks and
January 2018. other third‑party providers. 86 AISPs and
37 PISPs have been authorised by the FCA.
Open Banking could change the relationship
between banks and customers (Figure 3).
Figure 3: How Open Banking changes customers’ relationships with banks
Current model — Post reform —

Direct interaction with banks access accounts through third parties
Banks
Consumer interacts directly obliged to
with their account providers AISP/PISP provide
to check account information Regulated by access to
and/or make a payment the FCA Common API AISPs/PISPs
Source: FCA.
1 Retail banking market investigation: Final report, Competition & Markets Authority (CMA), (2016).
2 RBS, Lloyds, Barclays, HSBC, Santander, Nationwide, Danske Bank, Bank of Ireland and Allied Irish Bank. These were selected by
the CMA based on their market share of retail current accounts in Great Britain and, separately, Northern Ireland.
3 See www.openbanking.org.uk/customers/regulated-providers/.
Open Banking can revolutionise how customers manage their finances and enable more choice and
greater convenience.24 But it also poses risks around fraud, security an unlevel playing field, costs and
liability. As the UK is one of the first countries in the world to have launched it, the onus is on authorities
to get it right or adapt fast. Teething issues will be inevitable.
Reflection on what can be learned from the experience with Open Banking so far is called for.
For example, UK Finance estimates it has cost the nine major banks up to £1.5bn to create
Open Banking.25 Boston Consulting Group also argue that the design of Open Banking does not fulfil
the most attractive use cases. Only 28% of adults were aware of the initiative half a year in according to
a YouGov survey in August 2018.26 Nervousness around data sharing may also be a barrier to adoption.
Almost four out of five of those surveyed stated a concern around sharing their financial data with
companies other than their bank.
Nearly 60% of retail banking transactions worldwide are now estimated to go through mobile and online
channels.27 So customers could benefit from the framework. Important considerations for policymakers
will include:28

• Understanding the implications for funding and liquidity in the banking system if deposits are moved
more frequently;
• monitoring the system’s ability to withstand outages as the volume of information requests and
transactions executed through APIs and third‑party providers increases;
• ensuring adequate mechanisms for collecting customer consent and addressing complaints in the
event of data breaches; and
• reviewing how liability between banks and third parties is split (under current rules banks compensate
customers for unauthorised transactions by third parties, which they can subsequently reclaim from
providers).29
When considering these, the experience of other jurisdictions in opening up financial data through similar
initiatives might inform future policy choices (Box 2).
Box 2: Opening up account information around the world
Jurisdictions around the world are opening up infrastructure affect operational resilience. So
customer data (Figure 4). In Europe, the revised called “screen scraping”, may expose customer
Payment Services Directive (PSD2) requires data to greater vulnerabilities than data
banks to share both payments data and the accessed through APIs, given it involves sharing
ability to transact (read and write privileges) identity credentials.4
with third parties.1 In contrast, Australia has
Other countries that are exploring the
limited the scope of its framework to read
establishment of an Open Banking framework
access.2 In addition, it requires more industries
include Japan and Canada.5 The US does not
such as telecom companies and utility
currently have a legislative framework for Open
providers to share their customer data. This
Banking. The US Treasury Department’s recent
is part of the Consumer Data Right strategy,
report on fintech acknowledges the need to
which has a much broader competition
remove legal and regulatory uncertainties
objective.3
preventing financial services firms and data
What data and processes to open, to whom and aggregators from establishing data-sharing
under what rules has significant implications agreements, but does not specify an Open
for the impact of Open Banking type initiatives. Banking model.6 It highlights the benefits of
Greater scope, increases opportunities, but a private solution to developing APIs. Such a
also create complexity. Futhermore, the private initiatives are also being explored in
level of security standards and data sharing Singapore.7
1 EU Payment services (PSD 2) — Directive (EU) 2015/2366.

2 See https://bankingblog.accenture.com/open-banking-framework-comes-to-australia?lang=en_US.
3 See http://static.treasury.gov.au/uploads/sites/1/2018/02/180208-CDR-Fact-Sheet-1.pdf.
4 See www.finextra.com/blogposting/16494/open-banking-vs-screen-scraping-looking-ahead-in-2019.
5 See www.lexology.com/library/detail.aspx?g=65efbc60-73b9-4f9a-beb5-ce7cee58b05f.
6 A Financial System That Creates Economic Opportunities: Nonbank Financials, Fintech, and Innovation, US Department of the
Treasury, (2018).
7 See www.dbs.com/newsroom/Reimagining_banking_DBS_launches_worlds_largest_banking_API_developer_platform.

Box 2 continued: Opening up account information around the world
Figure 4: How Open Banking changes customers’ relationships with banks
UK EUa Australiab Hong Kongc
Revised Payment
Services Directive HKMA’s Open API
CMA’s National CDR
Initiative PSD2 (implemented Framework as part
Open Banking initiative
individually by each of “Smart Banking”
member state)
Phased Phased
Implementation
January 2018 January 2018 implementation implementation
date
from June 2019 from January 2019
Product
All payment
and service
accounts (not just Current accounts,
information (for
current accounts), credit cards,
Personal and small comparison
including flexible personal and
Scope of data businesses current sites), account
savings, corporate business loans,
accounts information in the
(large and small) mortgages
future (timetable
and credit card (to be phased in)
to be determined
accounts
with industry)
Read access
(limited to product
information at
first) and write
access in the
Scope of Read and write Read and write
Read access future (timetable
application access access
to be determined
with industry),
banks can choose
third parties to
grant access to)
Banks, energy Largest banks,

Nine largest current Banks and online
Scope of actors companies and others able to join in
banks payment providers
telcos the future
Technology-
Method of
API neutral (API, screen API API
data sharing
scraping)
Office of the
OBIE determines
Australian
the specifications
Information
for APIs used, EBA issues
Commissioner
creates security guidelines and
Governing advises on and This is yet to be
and messaging recommendations
rules enforces privacy determined
standards, produces to authorities and
protections.
guidelines, manages financial institutions
Standards are
disputes and
based on the UK’s
complaints
OB standards
a EU Payment services (PSD 2) — Directive (EU) 2015/2366.

b See http://static.treasury.gov.au/uploads/sites/1/2018/02/180208-CDR-Fact-Sheet-1.pdf,
www.capgemini.com/2018/06/open-banking-and-australias-emerging-financial-services-ecosystem/.
c See www.hkma.gov.hk/media/eng/doc/key-information/press-release/2018/20180718e5a2.pdf.

Hurdles to investment in resilience
While market structures and participants have changed in recent years, banks have faced a period of
low profitability. Figure 5 shows that the average return on equity (RoE) for UK banks has been lower in
recent years than their European and US counterparts’.
Figure 5: Europe and North America Banks Return on Equity Dispersion
Average RoE within a country 2014-2018

RoE for banks
Europe
Ireland
UK
Italy
Germany
Switzerland
Spain
USA
Benelux
France
Nordics
Canada
-10% -5% 0% 5% 10% 15% 20%
Source: “Bank X” report, Citigroup.
One implication of low profitability is that there are fewer resources for investment in systems and
technologies, which could lead to the patching‑up and maintenance of aging legacy systems.30 Such
temporary solutions can increase operational vulnerabilities and increase cyber‑risks.
Legacy IT infrastructure and physical distribution models are costly to maintain and update. This presents
a strategic challenge as one response to low profitability is structural investment in new technology
to reduce cost and make systems fit for the future (see Chapter 2).31 The costs of a transformational
IT change are even higher. In a low margin world, scale becomes more important, putting particular
pressure on challenger banks.
Evidence collected for this review suggests UK banks overall have lower innovation budgets than the
global average. The weight of new rules and regulations, high compliance costs, lower returns and
management decisions all seem to factor in, but no good data exists to explore this rigorously. For
example, UK banks spent about half of their change‑the‑bank (CTB) budgets on mandatory initiatives
such as those required by regulation in 2017 according to Oliver Wyman.32 This compares to 35% for
the overall group and is significantly higher than for US banks. Supporting UK banks as they seek to
make investments in technology will help boost the resilience and competitiveness of a key sector of the
economy. Given the focus on the UK’s lagging productivity, zooming in one of the UK’s leading industries
could help.
Finally, some banks highlighted as a regulatory barrier to investment in technology an uneven playing
field between US, Swiss banks and EU banks. This is because investment in software is deducted from
banks’ capital base in the EU; but not in other countries, such as the US.33 This can act as a disincentive in
strategic investment in technology in the EU banking sector. It merits further consideration.
The financial system needs to be able to innovate to meet customer demands and serve the economy
reliably in good times and bad. The ability to do so rests on a fair, resilient and dynamic financial system
which is able to serve households and businesses throughout the economic and business cycle, shaped
by forward‑looking and agile regulation. It also rests on firms being able to invest in their infrastructure.

How the system might evolve in the future will depend on different factors. To explore this, it is helpful to
consider two key dimensions; first, the level of interest rates as a proxy for economic growth and second,
the degree of competition and disruption to the mainstream banking business model from unbundling
and challengers.
Evidently, reality is much more complex. And the range of business models of big or small banks cannot
be captured by simple scenarios. But they may provide a useful thought experiment. The Bank may wish
to develop indicators to identify the path along them.
Several scenarios may unfold as the pace of disruption and unbundling accelerates and entrants further
unpick the traditional banking model. Below are highlighted just two.
Scenario 1 — Low rates/economic growth and low disruption
It is possible that competition and the entry of new actors in finance proceeds at a gradual pace.
Opportunities to contest markets which are easier to enter, such as payments and SME lending may have
largely been exploited. Other activities, such as custody and settlement could prove sticky with fewer
chances to disrupt. It is possible some fintechs could adopt a partnership model, offering their services
primarily through incumbent banks.
The degree of value chain unbundling and market disruption in such a scenario might be moderate with
continued vertical integration of non‑disrupted activities.
Return on equity could exceed the industry’s cost of capital. In this scenario, banks might use technology
to enhance their products, services and operations, allowing them to retain their customer relationships
and core services. Risks to financial stability might be more modest in this situation as the pace of change
would be lower, yet the benefits of competition and innovation may also reduce.
Scenario 2 — Low rates/economic growth and “high degree of disruption”:
New firms might consolidate their market position and aggressively contest markets, with value chains
unbundling faster as a result. Greater access to data and growth in peer‑to‑peer systems allow fintechs to
form new types of connections and dependencies. The core banking model may be increasingly focused
on a narrower set of activities in which the funding advantages of banks are powerful, or where there are
very high barriers to entry. In the most extreme form, the deposit‑taking and credit provision services
traditionally bundled in banks would be increasingly separated. Funding and lending might be undertaken
in new market places.
Continued low rates mean the system may struggle to make their cost of capital. The majority of
incumbents might become low‑margin back‑end utilities with nimble new entrants focused on customer
acquisition. Smaller banks may be forced to merge to find scale. The industry could become more
modularised with services provided primarily through market place platforms and outsourced activities.
In this scenario, the Bank would need to consider its perimeter or regulation to account for new market
structures and the distribution of critical economic functions.
New risks, new practices, new policy choices

In line with its financial stability objective it is key for the Bank to keep up with risks to the financial system
and the changes it undergoes.34 And often, prevention is better than a cure.35
Therefore, the Bank’s Financial Policy Committee (FPC), works to oversee the financial system, scan the
horizon for emerging problems, and act when risks become threats.36 This ensures that essential financial
services are available in both good times and bad, and that the banks, insurers, and financial market
infrastructures in the system are safe and sound.37
The FPC seeks to identify the overall level of risk in the financial system and is vigilant for signs of
vulnerability, such as over indebtedness or asset price over‑valuation that could be subject to sharp
and disruptive adjustment. It makes policy judgements to help the system absorb any adjustments and
losses, and potentially mitigate their impact.38 To do this the FPC seeks to build resilience and strength
when conditions are calm, and to allow relaxation of those requirements when times are more turbulent.
This philosophy of “fixing the roof whilst the sun shines” supports sustainable growth, where the financial

system grows at a manageable rate that delivers long term prosperity, rather than going through cycles of
“bubble and bust”.39
The tools at the Bank’s disposal include oversight and horizon scanning, regulations and policies which
put in place safeguards and shock absorbers informed by stress testing that build resilience and protect
the system from unexpected events.40
Regulatory perimeter
Familiar financial activities may increasingly be undertaken by new actors operating outside of the
traditional regulatory perimeter. The UK regulatory authorities have an established, robust approach for
monitoring and addressing shifts in how finance operates, but this will need to keep pace with change.41
The Bank’s Financial Policy Committee (FPC) conducts an annual assessment of risk and regulation
beyond the core banking sector.42 It can recommend to HM Treasury changes to the “perimeter” of
regulation, or additional powers if needed to address a systemic threat.
The framework is designed to identify emerging risks, assess the potential hazards they present and
intervene if necessary. This is based on the significance of transmission channels of risk to the real
economy and the severity of the threats involved.
A good example of this approach is the crypto‑asset market (see Chapter 1). Valuations grew rapidly over
2017, with prices rising faster than any previous bubble in history.43
The FPC acted decisively to assess the significance of the emerging issue, size the threat and consider
whether action was needed. In this case, it did not seek to regulate crypto‑assets, but did make clear that
the limited scale and connectedness of crypto‑assets meant they were not deemed to be systemically
important at the point in time.44 The UK Government’s 2018 Crypto Asset Taskforce report also
highlighted risks to consumers and market integrity as well as potential illicit activity using crypto‑assets.45
The FPC will need to keep the implications of new business models and “unbundling” under close review
and be ready to act if necessary to keep the system safe and stable.
Risks from market‑based finance
Structural changes since the financial crisis have changed the dynamics in certain financial markets and
altered market structures. The FPC has previously highlighted the increased risk of amplification created
by tight market liquidity, especially where financial products promise a different liquidity from that of the
underlying asset.46 Open‑ended funds promising daily liquidity but investing in illiquid underlying assets
such as property is one such example.
If the potential of market‑based finance is to be harnessed; the Bank will need to make sure it has
effective mechanisms for oversight of developments and risks, techniques for diagnosing emerging
vulnerabilities, and structures which promote resilience of these intermediaries, including under stressed
conditions. Progress has been made on this through the Financial Stability Board and International
Organization of Securities Commissions (IOSCO) internationally,47 and through FPC and the FCA
domestically. But as market‑based finance continues to evolve and grow, this will be an ongoing area of
priority.
Building on the FPC and FSB’s ongoing initiatives on system‑wide stress simulation, the Bank with other
regulators will also want to consider how an exit from a decade of ultra‑low rates might play through new
structures in capital market.48 This will have to have regard to the different forms of intermediaries and
investors and different behaviours, structures and liquidity dynamics.
Dynamic adjustments
Over time regulation has to make “dynamic adjustments” if it is to remain effective and to support
innovation and resilience.49 The scope of reforms following the financial crisis was remarkable. The Basel
Committee on Banking Supervision (BCBS) published twice as many standards between 2009 and 2017
as it did in the 20 years before.50 Internationally, this is embedded in the work of the Financial Stability
Board and the BCBS which are both focusing on timely and consistent implementation of reforms,
evaluation and, where needed, dynamic adjustment of policy to maintain its effectiveness.51

Open Banking
Together with other authorities, the Bank should maintain a keen interest in the evolution of
Open Banking.52 As a framework to open up and share data, it can reduce costs and broaden access
to products and services offered in the digital economy.53 But for customers to benefit, it has to ensure
consumer protection and continued operational resilience.
In considering the implications of how the framework evolves, UK authorities should have an eye
to similar initiatives launched across the world. Design choices will result in different outcomes for
effectiveness and resilience.
Central bank infrastructure
The Bank has reflected the dynamism of the fintech industry by being open to and enabling change,
including through expanding access to settlement accounts in RTGS to non‑bank payment providers.54
The Prudential Regulation Authority (PRA) has authorised 43 new banks through its New Bank Start‑up
Unit since 2013. It has also launched a similar initiative for insurers.
As payments providers proliferate, they may take on new responsibilities previously reserved for major
banks. This promotes greater diversity but also poses new risks that require oversight.
The Bank has been and should continue to keep under review the infrastructure it provides to different
market participants (Chapter 2). It will have to focus on how its relationships with these actors changes.
It will also monitor the effect on its market operations of providing access to central bank services and
potential implications for its balance sheet such as the operation of reserve or settlement accounts.
A review of access to its services and balance sheet will have to evaluate potential risks of further opening
and the obligations firms would have to fulfil, including appropriate oversight by the Bank.

RECOMMENDATIONS

• Technology and policy have opened up the financial system to many new
entrants in recent years. With rapid innovation and the rise of new banking
models alongside increased data portability, there is now a more diverse
set of players in the financial system, benefiting customers through more
competition and innovative services.
• This diversity is a positive development, but it means important financial
activities may increasingly be performed by new actors outside the traditional
“banking” value chains and so the perimeter of regulation.
• The UK regulatory authorities have an established and robust approach
7.1 Ensure for monitoring and responding to change. The FPC conducts an annual
regulation and assessment of risk and regulation beyond the core banking sector and can
infrastructure request that the Treasury amend or grant the Bank new powers if necessary.
keep pace with • While the UK starts from a good place, it is essential that the framework for
innovative overseeing risks to financial stability from new actors and activities keeps pace
business with innovation, changing business models and evolving market structures.
models

The Bank should:
• Remain vigilant to developments in the financial system and be ready to act to
protect resilience when needed. To do so, approaches and macroprudential
tools may need to evolve. This report can provide suggestions on and risks to
watch closely.
• Evaluate the appropriate level of access to central bank infrastructure,
including its balance sheet, for non‑banks in order to support greater
innovation while safeguarding monetary and financial stability.

• Roundtables with experts conducted for this review highlighted a desire by
firms, especially smaller ones, to have a channel to discuss problems with
regulations outside normal supervisory processes. This is both where old
rules pinch or have had unintended consequences, and where others need to
evolve to new business practices.
• The goal is to assess whether specific regulatory reforms are operating as
intended and to make policy adjustments if needed without compromising on
the original objectives or resilience. This should, of course, be an integral part
7.2 Foster a of any effective policy process.
dynamic and
responsive • This coincides with the Financial Stability Board’s thought leadership on
regulatory regualtory evaluation and dynamic adjustment. With the finalisation of Basel III,
regime the new global regulatory framework is now largely in place. As such, it argues
for a shift in focus which includes a rigorous evaluation of implemented
reforms, to ensure the reform programme is efficient, coherent and effective.

The Bank should:
• Establish a dedicated “regulatory evaluation and response” unit to assess the
effectiveness and impact of major polices across their life cycles. This includes
anomalies, unintended consequences and continued relevance.

• The CMA’s Open Banking initiative is developed to promote competition and
empower consumers. These are worthwhile objectives, but stakeholders have
highlighted several considerations.
• Open Banking is a powerful idea to give customers more control over their
finances in the next decade. But it also poses issues around security, costs,
resilience, data sharing and legal liability.
• The UK is one of the first countries in the world to undertake this experiment,
so the onus is on authorities to get it right, or adapt fast. UK Finance
estimates it has already cost the nine largest banks up to £1.5bn to kick‑start.
Boston Consulting Group argue data available through Open Banking does not
enable the most attractive use cases and few customers are using it. Law firms
have raised concerns around that legal liability questions remain unresolved
and payment firms’ problems could rebound onto banks.
7.3 Contribute • The treatment of liability in the event of a data breach or an unauthorised
to an open transaction is one example. Non‑regulated financial institutions are generally
banking policy not required to hold operational risk capital. Today’s rules suggest a bank, not
framework the payment company, might have to compensate the client for any errors or
cyber‑breaches and then counter‑sue the payment firm. This does not seem to
be an optimal design if the system was scaled. Additionally, the involvement of
different parties in the flow of data and the initiation of transactions raises the
issue of how to resolve potential disputes.
• A number of meetings suggested that the OBIE should transition to becoming
a standards body going forward with implementation resting with the private
sector.

The Bank should:
• Work with the Financial Conduct Authority to suggest a Treasury‑led review of
lessons learned from the first 18 months of Open Banking. The Bank should
consider how to mitigate risks and galvanise opportunities, including the
implications of unclear liability for data loss and failed payments.

ENDNOTES
1 See www.bankofengland.co.uk/financial-stability.
2 See www.bankofengland.co.uk/knowledgebank/will-there-be-another-financial-crisis.
3 Embracing the promise of fintech, Mnohoghitnei et al, Bank of England Quarterly Bulletin, (2019).
4 G20 Leaders’ Declaration, Washington DC, 15 November, 2008.
5 How to: MACROPRU. 5 principles for macroprudential policy, speech given by Alex Brazier, London School of Economics, (2017).
6 Transforming Shadow Banking into Resilient Market-based Finance, FSB, (2015).
7 Prudential bank regulation: present and future, speech by Vicky Saporta, (2018).
8 See www.bankofengland.co.uk/financial-stability/resolution.
9 Central counterparties: what are they, why do they matter and how does the Bank supervise them?, Nixon et al, Bank of England
Quarterly Bulletin, (2013).
10 Transforming Shadow Banking into Resilient Market-based Finance, FSB, (2015).
11 Global Monitoring Report on Non-Bank Financial Intermediation, Financial Stability Board (FSB), (2019).
12 Conquering the Crisis, Global Asset Management Report 2009, Boston Consulting Group (BCG), (2009).
13 Global Asset Management 2018: The Digital Metamorphosis, Boston Consulting Group (BCG), (2018).
14 Financial Stability Report, November 2018, Bank of England, (2018).
15 Market-based finance: a macroprudential view, speech given by Sir Jon Cunliffe, Asset Management Derivatives Forum, February
2017.
16 Market-based finance: a macroprudential view, speech given by Sir Jon Cunliffe, Asset Management Derivatives Forum, February
2017.
17 See www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjgooelj-7iAhXZRhUIHaZ3B8cQFjAAegQI
BBAC&url=https%3A%2F%2Fwww.actuaries.org.uk%2Fdocuments%2Ffinal-draft-sessional-paper-wearables-and-iot-working-
party&usg=AOvVaw2O59Hf3SNKEO-VwaBA_QEK.
18 Redrawing the lines: FinTech’s growing influence on Financial Services, Global FinTech Report 2017, PWC, (2017).
19 See www.bankofengland.co.uk/news/2017/march/2017-stress-test-scenarios-explained.
20 See www.cbinsights.com/research/report/amazon-across-financial-services-fintech/.
21 See www.wsj.com/articles/worlds-largest-money-market-fund-is-shrinking-as-it-battles-rival-on-yields-11548934202.
22 Embracing fintech, speech given by Dave Ramsden, Innovate Finance Global Summit, April 2019.
23 See www.openbanking.org.uk.
24 See www.mckinsey.com/industries/financial-services/our-insights/data-sharing-and-open-banking.
25 See UK Finance research.
26 www.moneywise.co.uk/news/2018-08-02/brits-still-the-dark-open-banking.
27 BCG research.
28 See www.ashurst.com/en/news-and-insights/legal-updates/open-banking-open-liability-accountability-issues-for-open-banking-apis/.
29 An effective dispute resolution mechanism has not yet been trialled and issues may arise when disputes are cross-border or
payment providers are too thinly capitalised to refund the bank.
30 SSM thematic review on profitability and business models: Report on the outcome of the assessment, European Central Bank (ECB),
(2018).
31 See www.bankofengland.co.uk/news/2017/march/2017-stress-test-scenarios-explained.
32 Oliver Wyman research.
33 CRD 5/CRR2: Capital treatment of Software, Association for Financial Markets in Europe (AFME), (2018).
34 Five years of macro-prudential: Regulating the Square Mile for all 94,000 square miles, speech given by Alex Brazier, Imperial College
Business School, April 2018.
35 How to: MACROPRU. 5 principles for macroprudential policy, speech given by Alex Brazier, London School of Economics, (2017).
37 Five years of macro-prudential: Regulating the Square Mile for all 94,000 square miles, speech given by Alex Brazier, Imperial College
Business School, April 2018.
38 When expectations meet the future, speech given by Sir Jon Cunliffe, London School of Economics, March 2019.
39 Three priorities for the global economy, speech by Christine Lagarde, Hong Kong, April 2018.
41 Embracing fintech, speech given by Dave Ramsden, Innovate Finance Global Summit, April 2019.
43 See https://publications.parliament.uk/pa/cm201719/cmselect/cmtreasy/910/910.pdf.
45 Crypto-assets: Twenty-Second Report of Session 2017-2019, House of Commons Treasury Committee, (2018).
47 Market-based finance: macroprudential view, speech given by Sir Jon Cunliffe, Asset Management Derivatives Forum, February 2017.
50 Prudential bank regulation: present and future, speech given by Vicky Saporta, Westminster Business Forum, (2018).
51 See www.fsb.org/work-of-the-fsb/implementation-monitoring/effects-of-reforms/.
53 See www.mckinsey.com/industries/financial-services/our-insights/data-sharing-and-open-banking.
54 See www.bankofengland.co.uk/payment-and-settlement/rtgs-renewal-programme.

8 ENHANCE PROTECTION AGAINST
CYBER‑RISKS
THE OUTCOME WE SEEK
A UK financial system that helps prevent cyber‑crime and is resilient to cyber‑risk. Law enforcement
agencies, financial regulators and institutions that collaborate on critical security threats.
• The financial system is a constant target for cyber‑criminals. Regulators and the private sector
need to maximise their efforts to keep up with this dynamic threat.
• Cyber‑penetration and simulation exercises to explore vulnerabilities and encourage firms to

build greater resilience will be essential.
• The key part missing in the UK cyber‑defences today is an industry response to a data wipe
at an institution. Building a strong model for data recovery should be a priority for industry.
US Sheltered Harbor is a useful concept to explore.
• Finance can help businesses manage cyber‑risks, build resilience and recover from
incidents through wider access to cyber‑insurance products. But to become widely adopted,
cyber‑insurance needs richer datasets.
KEY DEVELOPMENTS
Cyber‑crime is big business

The volume of remotely accessible sensitive data has expanded rapidly, as our lives become more
digitised. The risk of cyber‑incidents grows with our reliance on third parties that process and store our
information. Figure 1 maps out the scale of cyber‑security breaches around the world since 2012.
Cyber‑crime has become big business. The global impact exceeds US$450bn a year as crime, extortion,
blackmail and fraud move online.1 Estimates suggest the vast majority of cyber‑incidents on banks seek
to steal funds. But a meaningful percentage are to steal intellectual property or disrupt activity. So firms
will need to be alert to the different motivations and styles of attack.
Industries across the board are under threat from cyber‑attacks. Over four in ten UK businesses had
experienced a cyber‑security breach in the past 12 months in 2018.2 And cyber‑incidents cost the
average business £25,700 annually.3
Financial services are an attractive target. Online fraud and account hacking have nearly completely
replaced traditional theft of banknotes and gold. Nearly all attacks in financial services, 91%, are aimed
at banks.4 They primarily affect retail banking 39% and credit cards 25%. Financial services firms already
spend three times the amount that non‑financial organisations do on cyber‑security according to
UK Finance.5 This investment will need to keep up with an ever growing threat.
Cyber‑security is at the top of the financial sector’s agenda. In the latest Bank of England Systemic Risk
Survey, cyber‑risk was the second‑most cited source of risk by firms at 66%.6 Only “Brexit/political risk”
was more common at 97% (see Figure 2).
The UK ranked 12th in the Global Cyber Security index in 2017.7 Arguably, it should be on par with
countries that are leading cyber‑security efforts, but strategic investment will be needed to achieve this.

Figure 1: Cybersecurity breaches since 2012
2017 Pentagon
Verizon GOP
200,000,000
Equifax 14,000,000 Yahoo Deep Root
1,800,000,000
143,000,000 Uber 3,000,000,000 Analytics
57,000,000 198,000,000
Philippines
Telegram Anthem mail.ru
electoral
55,000,000 MySpace 15,000,000 80,000,000 25,000,000
Adult Friend Finder 164,000,000 Weebly
2016
400,000,000 43,000,000
Yahoo VK
500,000,000 100,544,934 Interpark
10,000,000
US OPM
21,500,000
Securus Ashley
Kromtech Technologies Madison.com
15,000,000 Voter Database 70,000,000 37,000,000
2015
191,000,000
Experian/T-mobile Premera
15,000,000 11,000,000
JP Morgan Chase Home Depot

76,000,000 Korea Credit 56,000,000
Ebay
bureau
145,000,000 20,000,000
2014
Target
70,000,000
Sony Pictures Living Social
10,000,000 50,000,000
Evernote
UbiSoft 50,000,000 Tumblr
65,000,000
2013
(-)
Yahoo Japan Adobe
22,000,000 36,000,000
Zappos
24,000,000 KT Corp
Dropbox 8,700,000
68,700,000
Massive American
Greek Government Business Hack LinkedIn Gamigo
2012
Court Venture
9,000,000 160,000,000 117,000,000 200,000,000 8,000,000
Note: Size of the bubbles denote the records reported stolen in a selection of publicly acknowledged breaches.
Sources: Boston Consulting Group (BCG), BCG analysis, DataLossDB.org and informationisbeautiful.net.
Figure 2: Sources of risk to the UK financial system
100% UK political risk
80%
Cyber-incident
60%
Geo-political risk
40%
UK downturn
Global downturn
20%
0%
2013 2014 2015 2016 2017 2018 2019

Source: Bank of England Systemic Risk Survey 2018.

The base case for the coming decade assumes ever‑more sophisticated attacks. So the system will need
greater protection and the ability to bounce back from successful attacks swiftly.
Firms are responsible for building resilience and recovering from attacks. Senior management own
and should oversee firms’ cyber‑strategies. And the financial community must collaborate with law
enforcement and governments, given the nature of the threat. This means creating new models for
co‑operation that are agile, responsive and focus on protecting customers against exploitation, as well as
the integrity of the system. The public sector can also help underpin services which the private sector on
their own will struggle to internalise.
Financial institutions are highly regulated entities that focus on controls, structures, and technology.
Their security responses must be managed through carefully controlled and audited environments,
delivered at the pace that this process allows. In contrast, criminals are agile and opportunistic.
UK Finance recently said the industry needs to see cyber‑security as competition with a digital rival rather
than simply a governance, risk and control issue.8
Questions for the future
Meetings and workshops held as part of this review resulted in eight questions for the coming years that
can help inform the approach to cyber‑risk:
1. How will a more complex value chain interact with cyber‑risks?
2. How can law enforcement, regulators and financial institutions co‑ordinate better over threats
and share information quickly and across borders?
3. How does a payments system with different levels of risk interact with cyber and the core
banking system?
4. What would firms do if part of or a whole bank was to fall over or get wiped?
5. How will the desire for open finance trade off with cyber‑risks?
6. What is the optimal way to operate cyber‑penetration tests?
7. Can a cyber‑insurance market be cultivated to mitigate the risks to firms?
8. And could the UK do more to promote itself as a cyber‑security centre?
An approach to cyber‑security
Authorities and firms have been collaborating to build cyber‑resilience and recovery capabilities.
Established frameworks have emerged that are useful for thinking about the features of effective
cyber‑defence. But if cyber‑incidents are becoming more frequent and severe, the response and
framework must keep up.
In 2016, the G7 published its “Fundamental Elements for Effective Assessment of Cybersecurity in the
Financial Sector”.9 It can be characterised by four aspects:
• Preparation: building cyber-strategies and preparedness.
• Assessment and Adjustment: assessing the effectiveness of those strategies and preparedness
through realistic and thorough penetration testing. And dynamically evolving and adjusting defences
based on the lessons learned.
• Recovery: building frameworks for effective, rapid and comprehensive recovery when defences are
penetrated.
• Lessons learnt: promoting learning and co‑ordinated responses through secure information-sharing
and incident‑reporting.
This approach is consistent with, and underpinned by, existing regulation guidance for firms and their
senior management to build resilience and manage their cyber‑risks.10 It promotes the integrity and
stability of the system, enhances safety and soundness of firms and protects consumers.

In its evolving risk assessments, the Bank must consider complex supply chains, cloud providers and
fintechs, who have expanded the surface area for cyber‑attacks. Spreading best practice from top
institutions to smaller, less well‑resourced ones through collective defence should be a priority.11
How can firms prepare for cyber‑incidents?
Firms will and should assume operational disruptions will occur. Effectively sharing early warning
information is also essential. The public and private sectors must collaborate to identify potential threats,
establish responses and ensure that emerging threats are known, shared and acted upon.
Firms’ investments in cyber‑defences, systems and infrastructure should test the implications of an
incident and its response to invest in the most effective way. This is crucial as financial institutions need
to prioritise and maximise the impact of their operational investment spend. For example, according to
research by BCG major banks’ spending on cyber‑security averaged 0.5% of revenue and 0.64% of opex
with an estimated US$3bn spent by banks on cyber overall in 2017.
Risk assessment
Penetration testing is a tool used to identify vulnerabilities and potential responses. Authorised
hackers attempt to gain access to a firm’s systems and data using the latest cyber‑threat intelligence
to identify weak spots in firms’ cyber‑defences. Firms then use this knowledge to inform the design
and configuration of their defences, target their investment spending and to adjust their response and
communication plans.
While penetration testing is mainly a tool for firms, testing is also undertaken in collaboration with
authorities, using the latest threat information from authorities and benefiting from the system‑wide view
of regulators.
The Bank of England was an early adopter of such testing.12 It is working with authorities at home and
abroad to periodically test firms’ cyber‑resilience and develop rapid response mechanisms. These tests
can be categorised broadly as:13
• Threat‑led penetration testing for individual institutions (domestic): the Bank’s CBEST framework
targets firms’ systems based on threat intelligence that is relevant to their individual business models
and operations;
• Sector‑wide exercises (domestic): the SIMEX initiative tests the impact of industry-wide scenarios. It
simulated an outage of the UK’s RTGS system in 2016 and an operationally paralysed G‑SIB in 2018;14
• Joint testing exercises with other jurisdictions (international): these include the Resilient Shield Exercise
between the UK and the US in 2015 and G7 Cyber Exercise in 2019.15
Penetration testing is likely to become ever‑more important. And the Bank should continue to draw on
the approaches that have been adopted by international peers to champion best practice and maintain
its leadership position.
Joint exercises, which simulate real cyber‑incidents, can help encourage greater information‑sharing
across borders. One frequently mentioned issue is the ability to share information on attacks across
borders, such as from one stock exchange to another.
Recovery
Firms and authorities have mechanisms in place to respond to incidents. The aim of these is to minimise
disruption, data loss and to speed up recovery by practicing the response to an incident. Response
frameworks are vital to sustain critical financial services and to recover promptly. This is an area where
the UK could improve in the years ahead.
In the US, the government ran a set of cyber‑exercises called the “Hamilton Series” (see Box 1).16
This triggered an industry initiative, Sheltered Harbor, which allows the recovery of customer account
information in the event of a cyber‑incident.17 A UK version of Sheltered Harbor could become a powerful
tool for firms and authorities.

Box 1: The “Hamilton Series” and Sheltered Harbor
In 2014–16, the US Treasury Department Participating institutions make a daily copy of

convened 13 cyber‑exercises called the their customer accounts data.4 The data is stored
“Hamilton Series”. This was done in collaboration in a standardised and encrypted format and
with the Financial Services Sector Co‑ordinating protected from change. Data storage follows a
Council (FSSCC) and other US government distributed model with no central repository of
agencies. It aimed to prepare the financial sector information.
for a large cyber‑incident.
Secure data storage
The exercises simulated a variety of incidents. Sheltered Harbor members can store data
They ranged from regional attacks on small and directly themselves or outsource it. If a
medium‑sized companies to exercises involving cyber‑incident occurs, the data is validated,
large, systemically important financial institutions. formatted, encrypted and transmitted through
The scenarios examined the impact of threats on industry‑established, standardised file formats.5
different segments of the financial system, such The underlying information is restored and
as equities markets, exchanges, payment systems accessible to customers within a week.6
and large, regional, and medium‑sized deposit
takers. Benefits and design choices
The benefits of Sheltered Harbor and specific
The US financial services sector launched the design choices are important when considering
non‑profit initiative Sheltered Harbor, which the implications for the UK financial system.
followed the Hamilton Series in 2017.1 The Sheltered Harbor is particularly targeted at
Financial Services Information Sharing and mid‑sized financial institutions with relatively
Analysis Centre (FS‑ISAC) operates it. Current limited accounts, with the largest institution
membership covers roughly 60% of US‑domiciled relying on additional internal mechanisms.7 The
retail bank and brokerage accounts as well as “Hamilton Series” revealed that even a mid‑sized
technology firms.2 institution’s failure can undermine trust in the
Interoperability broader financial system. The initiative is limited
Sheltered Harbor allows financial institutions to to domestic retail assets for which the data
securely store and rapidly reconstitute account is less complex to capture than wholesale or
information. If an institution can’t recover quickly international exposures.8 It has not yet been used
from a cyber‑incident, customers can access in response to an actual cyber‑incident.
their information through a service provider or
another financial firm.3
1 See https://bankingjournal.aba.com/2017/02/sheltered-harbor-website-launches/.
2 See https://bankingjournal.aba.com/2017/03/how-sheltered-harbor-provides-safety-from-the-cyber-storm/.
3 See https://independentbanker.org/2018/01/cam-fine-sheltered-harbor-participants-have-each-others-backs-2/.
4 See www.aba.com/Tools/Function/Cyber/Pages/sheltered-harbor.aspx.
5 See www.icba.org/solutions/tools/cyber-security-guide/cybersecurity-mitigation.
6 FIS Data Restore, A Sheltered Harbor Solution, FIS, (2018).
7 See www.cio.com/article/3298538/sheltered-harbor-ensures-cyber-resilience-for-financial-services-firms.html.
8 See www.defenseone.com/ideas/2018/07/what-alexander-hamilton-can-teach-us-about-cyber-policy/149921/.
Delivering many of its public services online, the government of Estonia has developed an innovative
mechanism for information recovery in the event of cyber-incidents through the world’s first data
embassy (Box 2).18 While it’s uncertain whether this would suit the UK, there are lessons to learn.
Information sharing
Much can be gained if authorities co‑ordinate their responses and firms share information. This will help
to flag threats and promote learning from attacks and near‑misses.
In the UK, the Authorities Response Framework (ARF) establish information‑sharing protocols between
HM Treasury, the Bank and the Financial Conduct Authority (FCA).19

Box 2: Estonia’s data embassy
Estonia has built a digital system that allows in 2017.5 The backup allows the Estonian
citizens to access a wide range of government government to access critical data in the event
services electronically, underpinned by a of an incident. Luxembourg has guaranteed to
digital ID.1 Its paperless public services mean protect the data with the same legal guarantees
the country is highly reliant on protecting as in Estonia.6
its information systems and data through
The embassy is a sovereign unit in a foreign
cyber‑security mechanisms.2
data centre. It is a novelty under the legal
In 2007, hackers denied users access to arrangements governing international diplomatic
almost 60 Estonian websites belonging to the relations. An immunity clause ensures the
government, several newspapers and banks.3 confidentiality and security of the critical data
In response to this and many smaller incidents, despite being in the jurisdiction of another state.7
Estonia developed the first data embassy in The Estonian government is also exploring new
partnership with Luxembourg in 2017.4 technologies such as blockchain to keep the
two data centres synchronised and ensure the
Luxembourg hosts Estonian data servers with
integrity of the data.8
copies of the country’s key databases in its data
centre. Both governments signed an agreement
1 See www.techrepublic.com/article/how-estonia-became-an-e-government-powerhouse/.
2 See https://qz.com/1052269/every-country-should-have-a-cyber-war-what-estonia-learned-from-russian-hacking/.
3 Denial-of-Service: The Estonian Cyberwar and Its Implications for U.S. National Security, International Affairs Review, (2019).
4 See https://e-estonia.com/estonia-to-open-the-worlds-first-data-embassy-in-luxembourg/.
5 See www.opengovasia.com/estonian-government-approves-agreement-with-luxembourg-enabling-establishment-of-worlds-first-
data-embassy/.
6 Establishing the first Data Embassy in the world, Observatory of Public Sector Innovation, (2017).
7 See https://blogs.microsoft.com/eupolicy/2017/12/14/diplomatic-immunity-data-estonia-creates-virtual-embassy/.
8 Blockchains for Governmental Services: Design Principles,Applications, and Case Studies, Working Paper Series No. 7, Kello et al.,
University of Oxford, (2017).
In 2018, 145 cyber‑breaches were reported to the FCA.20 This may still understate the actual incidence,
and the UK authorities may wish to learn from international approaches.21
Some jurisdictions have specific requirements for the reporting of cyber‑incidents, subject to
thresholds.22 In the EU, this is done under the Single Supervisory Mechanism’s (SSM) cyber‑incident
reporting framework.23 The General Data Protection Regulation (GDPR), which also covers UK firms,
further specifies firms have to report personal data breaches to the right supervisory authority within
72 hours.24 Failure to comply can lead to fines of up to €20mn or 4% of global annual turnover.25
In other jurisdictions, cyber‑incidents are captured in existing reporting requirements.26 For example,
the US Treasury Department’s office of Financial Crimes Enforcement Network (FINCEN) requires firms to
report detailed information about cyber‑incidents when filing their mandatory suspicious activity reports
(SARs). This includes describing how their systems were breached, IP addresses of hackers’ computers
and device identifiers.27
Firms may also want to share threat intelligence with each other. The authorities facilitate this in some
jurisdictions by developing incident and risk taxonomies. The US Financial Services Information Sharing
Analysis Center (FS-ISAC) shares information among members automatically using the TAXII CybOX STIX
taxonomy.28 And Hong Kong explicitly requires firms to participate in an infrastructure for sharing threat
intelligence between banks, called the Cybersecurity Fortification Initiative (CFI).29
Can cyber‑insurance help businesses manage risks more effectively?
Finance can play an important role in helping businesses manage cyber‑risks, build resilience and recover
from incidents through better access to cyber-insurance products.30
Insurance can help businesses recover from the potentially devastating costs of a cyber‑incident to
support and sustain activity and employment in the real economy. Insurance cover can also provide
support from specialist insurance risk managers and create incentives to manage risk. But it is still

relatively new.31 For the market to deepen it needs richer data to assess risks and the nature and size of
the exposure.
The economic and commercial case for cyber-insurance is clear. Globally, cyber‑crime could have cost
up to US$600bn in 2017 according to an estimate by BCG (see Figure 3).32 Businesses had to pay about
US$900mn only for the NotPetya ransomware attack alone.33 Despite the rising costs and disruption,
the majority of losses remain uninsured. Lloyds of London have put this figure at 90%.34 The Boston
Consulting Group also estimate that the cyber‑insurance premiums of US$3.7bn cover less than 1% of
losses.
Figure 3: Global cyber and insurance premiums
Global costs of
$600bn
cybercrime
Global
cyber-insurance $3.7bn
premiums incl UK
$0bn $200bn $400bn $600bn

Source: BCG.
Cyber‑insurance is growing35 and the market for global cyber‑premiums is projected to reach US$8.2bn
in 2020 (Figure 4). Demand is expected to grow as businesses and authorities become more aware of
cyber‑risks.36 Legislative initiatives such as GDPR and the Network and Information Systems Directive
(NIS) may also increase demand as they require the reporting of breaches. Cyber‑insurance could benefit
the real economy and present an opportunity for the financial sector.
Figure 4: Estimated global cyber‑premiums (US$bn)
£10bn
London
market
£8bn composites
Lloyd's
£6bn
Assumed CAGR +30%
£4bn
US
premiums
£2bn
£0bn
2015 2016 2017 2018 2019E 2020E
Source: BCG.

About 90% of stand‑alone cyber‑insurance was for US risks in 2016.37 Some states require
cyber‑insurance coverage for certain businesses.38 London has a significant share of the global market
and could benefit from more growth. Its expertise in pricing complex, often international, risks in the
wholesale insurance market puts it in a good position to do so (see Figure 4).
The private sector should seize the opportunities of the cyber‑insurance market. Authorities and public
policy can support it. Regulators will need to ensure that effective prudential and risk management
practices are observed by insurers, so they have the financial resources to absorb losses and pay claims.
About 70% of insurers say that pricing cyber‑risks is still a black box, so making sure firms are effectively
assessing and pricing risk will be important.39
The European insurance standard setter, EIOPA, has published a diagnosis of key considerations for
developing a cyber‑insurance market (Figure 5).40 They highlight the need for a deeper understanding of
cyber‑risk and the importance of available information.
Figure 5: Framework of the key considerations around cyber‑insurance
Broadness of coverage,
Lack of historical data terms and conditions
Difficulties in properly
quantifying risks
Systemic nature of
potential events
Need for a deeper

understanding of Risk of underpricing
cyber risk
Insufficient
information on risks
Lack of appropriate
reinsurance coverage
Lack of specialised
underwriters Improper addressment of
silent risks
Source: Understanding Cyber Insurance — A Structured Dialogue with Insurance Companies, EIOPA (2018).
The Department for Digital Culture, Media & Sports (DCMS) led a government‑industry group to develop
cyber‑data sharing further after a consultation in 2015. It included the Information Commissioner’s
Office, The British Insurance Brokers’ Association, The Association of British Insurers, the National Crime
Agency, NCSC and the Bank. A renewed focus on this topic could be helpful. Consultation on gateways
and protocols for sharing cyber-incident information for insurance underwriting would be of value.
The consultation could review the themes set out below and may require mandatory sharing of loss
experience and data breach events:

• Review incident breach notifications and whether existing mechanisms such as reporting under GDPR
or Network and Information Systems Regulations can be used to gather data for risk assessment.
• Identify protocols for the dissemination of information.
Firms must have contingency plans in place regardless of what causes operational disruptions, including
for cyber‑incidents.41 The Bank’s Financial Policy Committee (FPC) sets thresholds for risk tolerance
and supervisors oversee firms’ cyber‑plans to maintain financial stability and confidence in the system.
Considerations extend beyond business continuity and disaster recovery and include physical and
cyber‑incidents, IT system outages, third‑party supplier failure and natural hazards.
There is not consensus on the link between cyber‑risk and systemic risk.42 There are also no examples of
cyber‑risk becoming systemic and impacting the real economy as yet. Also, it is clear that users do expect
systems to fall over occasionally and a modest outage is accepted by individuals and companies, as long
as services resume quickly following an incident.
The Bank’s focus on operational and cyber‑risks will likely become as important as its supervision of
capital and liquidity. It will have to continue to work with the financial sector to enhance cyber‑resilience
and keep up with the threat.
The Bank has the following objectives for a major operational disruption:43
• To keep retail and wholesale markets, including payment and settlement systems, open and
functioning;
• To provide effective channels of communication and a co‑ordinated response in case market
functioning is paused to ensure an orderly and early return;
• To involve relevant infrastructure providers/market participants and facilitate market initiatives where
possible, when responding in ways that affect markets.
The dynamic and sophisticated nature of cyber-risks means the Bank must collaborate with the private
sector to achieve these goals and to drive collective action. Co‑operating with international partners,
including through the G7, is also vital because of the financial interconnectedness and global nature of
many threats.

Box 3: What is the Bank already doing?
The Bank has been a thought leader on of longer disruptions to payment services for
cyber‑resilience. It has several existing and financial stability.3
upcoming initiatives to address cyber‑risks:1
• The Bank is working closely with the National
• The FPC encourages firms to enhance their Cyber Security Centre (NCSC), HMT and the
resilience to cyber‑incidents, including through FCA to share information about cyber‑threats
state‑of‑the art penetration testing using the in the financial sector.4
CBEST framework.
• The Bank is working with its G7 counterparts
• The FPC is launching a pilot cyber‑stress test to establish best practice information‑sharing
in Summer 2019. It will explore a scenario and cyber exercises.5
that assumes the systems supporting firms’
• UK Finance, the Government Communications
payments services are unavailable.2
Headquarters (GCHQ), BoE and NCSC are
• The FPC will also explore what affects firms’ working together to address cyber‑risks
ability to restore activity quickly, whether doing in a faster and more co‑ordinated way.6
so might have unintended consequences This includes the Financial Sector Cyber
and what would happen if contingency Collaboration Centre which will be launched
measures were unsuccessful. This will allow this year.7
the Committee to consider the implications
1 See www.bankofengland.co.uk/financial-stability/financial-sector-continuity.
2 At a glance: FPC plans for operational resilience stress testing, PWC, (2018).
3 Financial Stability Report —
June 2018, Bank of England, (2018).
4 See https://publications.parliament.uk/pa/jt201719/jtselect/jtnatsec/1708/170807.htm.
5 G7 Fundamental Elements for Effective Assessment of Cybersecurity for the Financial Sector, (2016).
6 Cyber and the City: Making the UK financial and professional services sector more resilient to cyber attack, TheCityUK, Marsh,
(2016).
7 See www.bankingtech.com/2018/10/uk-financial-sector-unites-for-financial-sector-cyber-collaboration-centre/.

RECOMMENDATIONS

• The data wipe of even a mid‑sized institution could undermine trust in the
system — as shown by the US “Hamilton Series” cyber‑exercise convened by
the US Treasury.
• US firms have created an industry‑led initiative that allows firms to securely
store a protected, unalterable backup that can be used to serve customers
in case of a major disruption, called Sheltered Harbor. This is an additional
layer of resilience to business continuity and disaster recovery. About 60% of
US retail bank accounts are now covered by this voluntary scheme. It offers the
potential that a second bank could take over the operations of the first, in the
8.1 Enhance
event of a debilitating attack.
data recovery
• This additional layer of protection is currently a missing piece in the
UK landscape.

The Bank should:
• Map the mechanisms for data recovery and the potential for firms “stepping in”
in the event of a major cyber-incident.
• Consider the merits of the US private sector “Sheltered Harbor” initiatives.

• Cyber‑risk is one of the top priorities for financial services firms.
Cyber‑exercises are useful to understand vulnerabilities and reaction
functions.
• The Bank’s CBEST penetration test is one of the supervisory tools available to
test firms’ resilience to cyber‑incidents. CBEST mimics skilled attackers who are
able to steal, corrupt or destroy their target. It runs every three years for banks
and five years for infrastructure and systemic payment firms.
• The US “Hamilton Series” simulated a variety of plausible cyber‑security
incidents to better prepare the financial and public sector in responding to
8.2 Conduct cyber‑attacks. These cyber‑exercises are developed in collaboration with the
cyber‑exercises FSCCC, the US Treasury Department and other US government agencies.
Since 2015, US financial institutions have partnered on 19 “Hamilton Series”
cyber‑security exercises through the voluntary body Financial Services
Information Sharing and Analysis Center. This has improved public and private
sector policies, procedures and response capabilities.

The Bank should:
• Enhance the frequency of domestic and international cyber‑penetration tests.
Growing focus should be on payments from traditional and new entrants and
the full value chain of providers.

• Cyber‑risk is complex with insufficient insurance coverage in scale and scope.
A material cyber-incident could disrupt public and private sectors in the
UK and worldwide.
• The pace of developments and scale of opportunity suggest developing a
deeper insurance market for businesses at home and abroad might be worth
8.3 Encourage exploring.
better • Increased collation and availability of anonymised data on cyber-incidents
information would be a tangible step in this direction.
sharing

The Bank should:
• Encourage better disclosure on cyber‑threats domestically and internationally
to help develop the data required for developing a more effective
cyber‑insurance market.

ENDNOTES
2 Cyber Security Breaches Survey 2018, Department for Digital, Culture, Media & Sport (DCMS), (2018).
3 See www.hiscoxgroup.com/news/press-releases/2018/18-10-18.
4 Cyber Risk for the Financial Sector: A Framework for Quantitative Assment, International Monetary Fund (IMF), (2018).
6 Systemic Risk Survey Results, 2018 H2, Bank of England, (2018).
7 Global Cybersecurity Index (GCI) 2017.
9 G7 Fundamental Elements for Effective Assessment of Cybersecurity for the Financial Sector, (2016).
10 Building the UK financial sector’s operational resilience, Discussion Paper 01/18, PRA, FCA, (2018).
12 See www.bankofengland.co.uk/-/media/boe/files/news/2014/june/boe-launches-new-framework-to-test-for-cyber-vulnerabilities.
13 CBEST Intelligence-Led Testing: CBEST Implementation Guide, Version 2.0, Bank of England, (2016).
14 Self-assessment of the Bank of England’s Real-Time Gross Settlement Service against the Principles for Financail Market
Infrastructures, Bank of England, (2016).
15 Summary of the 2016 Sector Security and Resilience Plans, Cabinet Office, (2016).
16 Financial Services Sector Cybersecurity Recommendations, Financial Services Sector Coordinating Council, (2017).
17 See https://shelteredharbor.org.
18 The world’s first data embassy — Estonia case study, OECD, (2018).
19 See https://publications.parliament.uk/pa/jt201719/jtselect/jtnatsec/1708/170807.htm.
20 See www.information-age.com/data-breaches-financial-services-firms-123479537/.
21 See www.ft.com/content/6a2d9d76-3692-11e9-bd3a-8b2a211d90d5.
22 Cyber Security in Securities Markets — An International Perspective: Report on IOSCO’s cyber risk coordiantion efforts, OICV-
IOSCO, (2016).
23 ECB Banking Supervision: SSM Supervisory Priorities 2019, ECB, (2019).
24 See https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-
data-breaches/.
25 See www.itgovernance.co.uk/dpa-and-gdpr-penalties.
26 FSI Insights on policy implementation No 2: Regulatory approaches to enhance banks’ cyber-security frameworks, Bank for
International Settlements (BIS), (2017).
27 Advisory to Financial Institutions on Cyber-Events and Cyber-Enabled Crime, Financial Crimes Enforcement Network (FinCEN), (2016).
28 Cyber Threat Intelligence — Issue and Challenges, Abu et al., Indonesian Journal of Electrical Engineering and Computer Science,
Vol. 10, No. 1, (2018).
29 See www2.deloitte.com/cn/en/pages/risk/articles/cyber-resilience.html.
30 Enhancing the Role of Insurance in Cyber Risk Management, OECD, (2017).
31 Global Cyber Market Overview: Uncovering the Hidden Opportunities, Aon Inpoint, (2017).
32 See www.financialdirector.co.uk/2018/07/16/financial-risk-analysis-methods-and-techniques/.
33 See www.securityweek.com/steps-improve-critical-infrastructure-and-ics-network-security.
34 Counting the cost: Cyber exposure decoded, Emerging Risks Report 2017, Lloyd’s, (2017).
35 Black swans and fat tails: The market for cyber-insurance is growing, The Economist, (2019).
36 Understanding Cyber Insurance — A Structured Dialogue with Insurance Companies, European Insurance and Occupational
Pensions Authority (EIOPA), (2018).
37 See https://home.kpmg/xx/en/home/insights/2018/10/lead-in-cyber-insurance-fs.html.
38 See www.ncsl.org/research/telecommunications-and-information-technology/cybersecurity-legislation-2018.aspx.
39 Gaining Ground on the Cyber Attacker: 2018 State of Cyber Resilience, Accenture, (2018).
40 Understanding Cyber Insurance — A Structured Dialogue with Insurance Companies, European Insurance and Occupational
Pensions Authority (EIOPA), (2018).
42 Could a cyber attack cause a systemic impact in the financial sector?, Quarterly Bulletin 2018 Q4, Bank of England, (2018).
43 See www.bankofengland.co.uk/financial-stability/financial-sector-continuity.

9 EMBRACE DIGITAL REGULATION
THE OUTCOME WE SEEK
A world-leading, technology-enabled and cost-effective regulator that uses modern technology to gather
data, monitor risk and maintain a safe and effective financial system.
• Markets have been made far more transparent in response to the financial crisis. Technology
and new techniques are now essential to monitor them most effectively.
• There is huge scope for the Bank to use of advanced analytics for analysis of macroeconomic
trends, financial surveillance and supervision.
• Routine tasks should increasingly be automated. A shift will free up resources to focus on value
added analysis.
• The PRA needs a long-term strategy for data and regulatory technology. This requires
investment and collaboration from firms. Costs may rise temporarily but then transform in the
longer term.
KEY DEVELOPMENTS
Using new technologies to keep the financial system safe from threats
There is huge scope for the Bank to use advanced analytics for analysis of macroeconomic trends,
financial surveillance and supervision. The explosion in data in finance demands new techniques. The
UK’s financial system is creating more data, and perhaps moving faster, than ever before. Technology can
enable better surveillance and analysis.1 It can also help regulators to spot irregularities and problems
earlier,2 to fight financial crime and get a better picture of the overall system’s health and risks.3
The PRA’s philosophy is based on forward-looking judgment-based supervision.4 Technology can
automate routine tasks, offer new analytical and oversight techniques and provide information and
diagnostics. All of this will support and enhance rather than replace high value-added human judgement.5
Technology may also help with threats to operational resilience. Since the crisis there has been a
large shift to market based finance (Chapter 7). This diversity is welcome, but markets can have many
participants with complex interconnections and behaviours, and transaction flows are at high volumes
and rapid frequency.6 Technology can help track these better.
More sophisticated regulation and growing volumes of supervisory data
The volume of data in the economy has surged in recent years (Chapter 3). This is also true of the
quantity of data available to regulators.7 Aggregate data collections have increased more than fivefold
since the crisis (Figure 1). In addition, mandatory reporting of granular trade repository data offers the
potential to monitor trading behaviour in near real-time.8 But it means the Bank now receives more than
one billion rows of data every month.9 Supervisors must take advantage of the ongoing developments in
data science and processing power.10 This includes artificial intelligence (AI) and machine learning that
automate data collection and processing.11 Given regulation is global, the increase in data is a common
theme across the world. Therefore the Bank can learn from international peers.
New tools will be essential to digest the extraordinary growth in data. For example, the Bank could decide
to reach out for data rather than requesting submissions of regulatory returns.12 Some other regulators
around the world are embracing technology to improve their effectiveness in this and other ways.13 A
central bank that uses innovative technologies and data science for market surveillance and to monitor
financial activities will make the system safer and improve regulation.
Over the coming years, the system would benefit from a shift in mindset from the cost to the regulator
of compliance, to efficiency of the system, including the costs to the private sector. McKinsey & Company
estimates that regulatory reporting for UK banks costs the industry £2bn–£4.5bn per year in run costs
and risk change costs alone.14

Box 1: Reforming and repairing the financial system — a decade of regulatory investment
The global financial crisis revealed a system that These were global reforms, endorsed by G20
needed fundamental reform and repair. G20 governments.7 The European Union has legislated
Leaders acted in 2008 to halt the crisis and, a year to apply them consistently across all EU Member
later, established the Financial Stability Board to States. In the UK, the authorities complemented
address underlying issues in the financial system.1 international regulation8 with structural reform
to increase the resilience of UK retail banking
A decade on, bank regulation is significantly operations,9 stricter governance requirements
stricter.2 Capital requirements are ten times for those running UK financial institutions10 and
higher for the largest banks and supplemented measures to address misconduct in wholesale
by resolution plans and other standards that markets.11
mean that banks can fail safely in the future.3
Other parts of the financial system, including Inevitably, given the depth of the financial crisis
central counterparties4 and shadow banking,5 and the scale of reform, this “re-regulation”
have also been reformed in order to strengthen has been the priority of the last decade.12 With
their resilience and limit the damaging effects of the repair of the financial system now largely
contagion across the system. And regulators now complete,13 the Bank and firms alike can now
gather more data with which to monitor financial focus on strategic and long-term investment in
stability.6 capabilities, technology and infrastructure.
1 Improving Financial Regulation: Report of the Financial Stability Board to G20 Leaders, FSB, (2009).
2 Basel III Monitoring Report, Bank for International Settlements (BIS), (2018).
3 The Bank of England’s approach to resolution, Bank of England, (2017).
4 Central counterparties: what are they, why do they matter and how does the Bank supervise them?, Bank of England, (2013).
5 Transforming Shadow Banking into Resilient Market-based Finance, FSB, 2015.
6 Artificial intelligence and machine learning in financial services: Market developments and financial stability implications, FSB,
(2017).
7 Leaders’ Statement, The Pittsburgh Summit, September 24–25, 2009.
8 Changing banking for good, Report of the Parliamentary Commission on Banking Standards, (2013).
9 Ring-fencing: what is it and how will it affect banks and their customers?, Bank of England, (2016).
10 See www.bankofengland.co.uk/prudential-regulation/authorisations/senior-managers-regime-approvals.
11 Fair and Effective Markets Review — Final Report, Fair and Effective Markets Review (FEMR), (2015).
12 Prudential bank regulation: present and future, speech given by Vicky Saporta, Westminster Business Forum, 4 July 2018.
13 Basel III Monitoring Report, Bank for International Settlements (BIS), (2018).
Figure 1: Data collected by the Bank has grown rapidly since the crisisa
200M
150M
100M
50M
0M
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
a Selected regulatory and statistical aggregate data collections.
Regulation and the rulebook for firms have become more sophisticated, but also more complex. As a
result of the “re-regulation” following the crisis (Box 1), the current rulebook at 638,000 words, is longer
than War and Peace.15 Technology, through the use of machine-readable rules and AI could help firms
and supervisors navigate and use the rulebook more effectively and efficiently.16 This can improve
compliance and risk management outcomes, reduce costs and ease the process of implementing and
adjusting regulation.

Co-ordinated and led by the Financial Stability Board, with membership from across all G20 countries,
financial sector reform was global.17 Detailed international standards have been developed by global
standard setters such as the Basel Committee on Banking Supervision. This provides a baseline of
international consistency across jurisdictions. In Europe, reforms are implemented through “maximum
harmonised” regulation and harmonised pan-EU reporting taxonomies and templates. Taken together
this means that the trends observed are global, and that UK authorities may not have much latitude to
change regulation or reporting requirements.18
Embracing digital regulation
Technology can help improve the use of the information and reduce costs for firms and supervisors alike.
An ecosystem for regulatory technology, or regtech, has emerged in recent years (Figure 2). Regtech
companies are cutting costs of collating and submitting regulatory data by streamlining and automating
some of the manual processes at financial services firms.19
Figure 2: The regtech industry has attracted considerable investment
Total amount invested

$2,000m
$1,000m
$0m
2014 2015 2016 2017
Source: McKinsey & Company American Banker, press releases; International RegTech Association (IRTA); Thomson Reuters; CBI Insights; and Fintech Global.
Technology is also improving the quality of oversight within firms. As well as using algorithms for
hyper‑fast trading, firms are using AI to monitor trading activity and spot anomalies.20 They are also using
anomaly detection to combat fraud in consumer credit and to improve money laundering controls.21
Given the volume of information created, transmitted and received, embracing leading technology is
no longer a choice. The explosion in the volume of regulatory data means supervisors receive more
information than they can absorb and analyse using traditional methods.22 This may cause distraction
and creates the risk of missing the wood for the trees in safeguarding the financial system. Technology
could help make the best use of this data.
As firms become more digitised, regulators globally are keen to keep up and explore ways to use the
latest techniques. Some are deploying machine learning to analyse granular datasets, while others are
trialling the use of natural language processing to evaluate firm reports. And a number are completely
re-thinking the way they gather data from firms.
The Bank has conducted proofs of concept on using AI for data analysis and is exploring making its
rule book machine-readable.23 And it has an advanced analytics hub, which is using some of the most
progressive techniques in analysing policy data. But there is considerable scope for further development.
Reducing time spent cleansing and manipulating data
Supervisors spend most time on preparation in the data lifecycle. Compiling supervisory information can
require considerable manual manipulation and reconciliation for even the most basic analysis. Estimates
suggest that supervisors spend around two thirds of their time on manipulating rather than analysing
data. This makes it difficult to focus on high-value analysis.

Data on the scale and granularity received by regulators is hard to manipulate and analyse using
traditional methods.24 And combining disparate datasets to conduct network analysis, for example,
requires sophisticated techniques. But even with the latest techniques, cleansing and cataloguing
incomplete and erroneous data is arduous and time-consuming. Today’s approach is a long way from
real-time monitoring.
Better regulatory data can reduce the need for ad-hoc requests
The Bank collects two main types of data for supervisory purposes. It has large structured datasets that
are mandatory, consistent across firms and regularly collected.25 These have some downsides. They
are untimely, often quarterly with a six-week lag. They can be unwieldy, comprising a large number of
aggregate data points with complicated definitions, about 15,000 for a small firm and 300,000 for a
large firm. They are expensive to replace or update. And firms collect them based on the appropriate
regulatory balance sheet, which is often hard to relate to their business lines.
To supplement the structured information, supervisors ask firms for management information (MI).26
This is generally produced by business line, on the basis of an accounting balance sheet and on a much
timelier basis. As a result, MI is regularly used to supervise larger firms with regulatory returns only being
a periodic secondary “sense check”. In contrast, regulatory data is often the primary information source
for smaller firms that produce far less firm MI.
This means supervisors receive an enormous body of unstructured data.27 As supervisors get barraged
with data, they have to be smarter about how they spend their time. And they must use ever more
sophisticated techniques to gather, organise and interrogate the data.
Effective storage and access is needed to make the most of data
Most regulatory data is stored in legacy Bank or Financial Conduct Authority (FCA) systems that may be
slow and clunky to use, making it difficult to blend and in some case construct time series or cross-firm
analysis.
Supervisors collect firm MI — unstructured data — directly and store it locally. This can make managing
and manipulating it harder. The general process for comparing and contrasting data from different
sources is often manual. And increasing amounts of public data are now behind paywalls. Given
budgetary constraints, supervisors cannot access all of this information.
Improving efficiency of regulation for an industry facing cost pressure
McKinsey & Company estimates that the cost to the industry of regulatory reporting amounts to
£2bn–£4.5bn a year for UK banks in run costs and risk change costs alone (Figure 3).
Simultaneously, UK banks’ return on equity is under pressure from all angles (Chapter 7).28 Net interest
margins have been compressed as the low interest-environment has pushed down the rate earned on
lending. And the rate banks pay on deposits has hit an effective lower bound. After many years spent
rebuilding balance sheets, regulatory initiatives such as the recent Directive (2014/65/EU) and Regulation
(600/2014/EU) on markets in financial instruments directive (MIFID II) and Open Banking have placed
considerable costs on the banking industry. And regulatory fines and redress, such as £35billion in
PPI pay‑outs to compensate customers for systemic mis-selling, have absorbed resources.29
Alongside this, competition in the banking industry has increased. Several challenger banks have
emerged in the past decade. More recently non-bank fintechs are also competing for some of the most
profitable parts of the banking value chain. Although take-up has so far been slow, its proponents argue
that Open Banking could create further competition.30 PWC predicts that 40% of banking revenues could
be at risk from fintech.31
Banks increasingly recognise the threat and opportunity from technology. The Bank’s 2017 Biennial
Exploratory Scenario (BES) asked the major UK banks to estimate the impact of these trends on their
profits over the next three years.32

Figure 3: UK banks spend between £2bn–£4.5bn yearly on regulatory data, according to one estimate
Cost of standard regulatory and ad-hoc reporting in the UK banking

system order of magnitude directional estimates for purposes
of illustrationa
• Digital supervision
Second line risk can directly address
run cost of the £500mn-£1bn
regulatory risk run cost and
reporting at least this value
£500mn–£1bn again in the wider
business
• Change costs are

unlikely to decrease
Finance, business, and
with digital supervision
first line risk run cost
since significant
of regulatory reporting
investment is required
£500mn–£3bn
Second line risk change

cost of regulatory reporting
£500mn–£1bn
Business change cost

of regulatory reporting
Not estimated but is by far
the largest cost
Digital supervision likely to directly reduce costs
Unclear if digital supervision can reduce costs
Sources: McKinsey & Company, Capital IQ, industry interviews, expert estimates and team analysis.
a Estimating cost of regulatory reporting is extremely challenging due to the breadth of institutions, diverse range of processes, and fragmentation of
activities across business/first line/second line, and across run/change. These numbers have been calculated using a best endeavours approach based on
banks’ self reported figures combined with expert interviews. Therefore the numbers should be seen as an order of magnitude guiding indication rather
than a precise calculation.
Learning from overseas

International experience emphasises the need for a step change in investment, prioritisation and
collaboration if long-term data strategies are to succeed. This chapter presents four case studies from
Australia, Singapore, the Philippines and Austria. Each country has taken a distinctive approach. But the
uniting factor is that each initiative was a strategic, management and investment priority. If the Bank
launches a long-term data strategy, it should ensure these conditions are in place.
Taking a strategic view on data is a fundamental starting point for a digital transformation. This means
understanding the role and purpose of data in the organisation, its value and how the organisation wants
to use it. Once this strategic vision is in place, design, investment and operational choices can be made
with greater certainty. The example of the Australian ASIC three-year data strategy could have helpful
lessons for the Bank (Box 2).

Box 2: What the Bank can learn from the ASIC three-year data strategy
In 2017, the Australian Securities and • A set of clear and specific initiatives:
Investments Commission (ASIC) introduced a
Creating a Chief Data Office.
consultation and framework on a three-year data
strategy.1 It included some valuable elements, Establishing the Data and Information
which are worth considering for the UK. Governance Framework.
Opening a data science lab.
• A clear objective and purpose to – in their
own words: Setting up governance forums that are public/
private bodies, including the Digital Governance
“Transition ASIC into a more data-driven and
Board, Data Governance Council, Data Analyst
intelligence-led organisation, more capable
Network and Data Champions Forum.
of “connecting the dots” to achieve better
regulatory outcomes.” Forming data exchange frameworks with other
agencies.
“Describe our vision for data, our objectives
and our approach to improving how we Educating staff on the value and potential uses of
capture, share and use data. Understanding data.
the regulatory environment, how the Implementing the One ASIC Regulatory
regulated community behaves, and the Transformation Program. This includes:
outcomes for consumers and markets is key
to performing our role.” - Creating a repository of the regulatory data
captured, and a new search tool for staff,
• Collaboration with industry with regular providing a consolidated view of the regulated
review and a strategic plan: entities;
“Our data strategy is part of One ASIC which is - Replacing legacy workflow systems with a
about “connecting the dots” to achieve better single integrated customer relationship
regulatory outcomes. It is about working together management system;
and sharing data seamlessly using common - Using a common language that supports
language, systems and processes. Where possible, consistent recording, reporting and
we will streamline our processes to make clear analysis across the regulatory business;
to our regulated population what data we need
and why, and to ensure that we collect it in a - Developing a new online portal to support
proportionate and fair way. We will review our improved stakeholder interaction and better
progress and publish an update annually.” collection of digital data.
Such a strategic view of data can be enhanced by
thinking about the wider regulatory ecosystem.
This gives a 360 degree view on data and
analytics, and how industry collaborations and
consultation can leverage best practice. The
Singapore Fintech Ecosystem strategy (Box 2)
could provide some lessons for the Bank in this
regard.
1 ASIC’s Data Strategy 2017-20, Australian Securities & Investments Commission (ASIC), (2017).
Source: Australian Securities and Investments Commission data strategy.

Box 3: What the Bank can learn from Singapore’s active stance on modernising regulation
MAS fintech ecosystem strategy 3 Using enhanced analytics

The Monetary Authority of Singapore (MAS) To enhance the use of data analytics, MAS
launched a new strategy in 2017 with clear has designated a suptech office within its data
objectives and a coherent series of plans.1 As analytics group (DAG) with dedicated SupTech
part of Singapore’s Smart Nation agenda, MAS and regtech teams conducting data analysis
is helping to create an “open API economy”, on supervisory and financial sector data.6 This
enabling service providers to use information includes machine learning techniques, such as
directly from multiple sources.2 It wants to: natural language processing (NLP) to analyse
“create an ecosystem for innovation, where structured and unstructured data that helps
established financial institutions and fintech regulators review suspicious transaction reports.
start‑ups compete as well as collaborate”.3 It has It also includes studying trading behaviour
four key elements: through machine learning.
1 Regulation 4 International and industry collaboration

A regulatory strategy that is conducive to fintech As part of its wider strategy, MAS is operating
innovation and harnesses technology for greater a regulatory sandbox and runs regular
effectiveness. It relies on people, identification, hackathons for smaller fintechs to develop
payments, data governance, applied research solutions to industry problems.7 It cooperates
and platforms for innovation. domestically and internationally with research
and government institutions and industry
2 Collecting and sharing data bodies.8 This includes research and development
MAS is transforming its approach to data collaboration with MIT, which explores
collection from financial institutions by using pilots using distributed ledger technology,
machine-readable templates to automate it.4 The cryptography, quantum computing and AI.9 It
goal is to eliminate any duplicated data requests. also has several fintech cooperation agreements
It has also encouraged firms to develop and with institutions such as The French Prudential
openly share application programming interfaces Supervision and Resolution Authority (ACPR), the
(APIs).5 French markets watchdog AMF and the Swiss
Financial Market Supervisory Authority (FINMA).
MAS has created a referral mechanism to

support Singapore fintech start-ups in overseas
markets and to facilitate foreign start-ups to set
up gateways in Singapore.
1 See www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre.aspx.
2 See www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/Financial-Industry-API-Register.aspx.
3 Singapore FinTech journey 2.0, speech by Ravi Menon, Singapore FinTech Festival, 14 November 2017.
4 MAS Moves Towards Zero Duplication of Data Requests to Financial Institutions, Monetary Authority of Singapore (MAS), (2018).
5 Singapore’s FinTech Journey — Where We Are, What Is Next, speech by Ravi Menon, at Singapore FinTech Festival,
16 November 2016, and The Future of Banking — Evolution, Revolution or a Big Bang?, speech by Ong Chong Tee,
German-Singaporean Financial Forum, 16 April 2018.
6 MAS Sets up Data Analytics Group, MAS, (2017).
7 See www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/FinTech-Regulatory-Sandbox/Understanding-and-ap-
plying-to-the-sandbox.aspx.
8 See www.mas.gov.sg/Singapore-Financial-Centre/Smart-Financial-Centre/FinTech-Cooperations.aspx.
9 Singapore FinTech — innovation, inclusion, inspiration, speech by Ravi Menon at Singapore Fintech Festival 2018,
12 November 2018.
Source: Monetary Authority of Singapore.

A global leader in financial regulation needs to use the latest technology. This is to analyse the increasing
amounts of data that will continue to become available without disproportionate costs to the industry. It
should aspire to:
• Only require firms to submit data once;
• Develop a taxonomy and data standard that are clear, widely recognised and machine-readable;
• Leverage cloud technology to benefit from increased scale, agility and cyber- and operational
resilience;
• Minimise the risk of human error by reducing the need for manual data cleaning;
• Use dashboards to monitor and compare risks across firms in real-time;
• Be able to request further data instantly to interrogate it as the need arises;
• Have the analytical tools to make tangible inferences from large datasets and present them in a
meaningful way to policymakers.
In terms of data, it should also be ambitious:
• Collection: Requests for structured data should be machine-executable. Regular requests would be
coded so firms can automatically read the requirements and pull the data from their systems. This
requires defining the suite of data that matters most, including more comparable forward looking
information on firms’ business models.
• Storage: Rather than collecting data every week, the Bank could access it from firms’ cloud
infrastructure when needed through a shared data lake.
• Analysis: The Bank could use pioneering NPL, machine learning and big data analytics to chart data
points in real time for supervisors. This provides an instant view of how firms’ business models are
performing against forecast and actual updates of key ratios. It also allows supervisors to apply real-
time shocks and stresses to better predict breaches of regulatory requirements.
This would allow supervisors to focus on what matters most. By creating a set of definitions with the
industry that are machine-readable and executable, supervisors will be able to go straight to processing.
This will maximise time spent on high-value activities and improve the quality of the analysis.
To respond to the rapidly changing environment, the Bank could consider four options with varying
degrees of ambition. All involve greater use of the technology and require learning and development
of the supervisory workforce. The Bank can develop them as modular improvements that build
incrementally towards a new technology stack. How far it chooses to go is a decision for its executive. The
costs and benefits are set out below.
Optimising the existing framework for gathering, storing and analysing data
• Option 1 — optimise unstructured data:

Recognising that much information received by supervisors is unstructured, the Bank could seek to
achieve “quick wins” by improving the receipt, storage and analytics of unstructured information.
• Option 2 — optimise within current structure:
Supervisors can continue to use firm reports but these would be improved by a common reporting
taxonomy and the use of better data management and analytics. The Bank could make efficiency
savings by improving its ability to analyse big data sets. And through improved analytics, raise the
quality of micro- and macro-prudential analysis and action.

Transforming the regulatory approach
• Option 3 — supervise within firms’ systems using APIs:

Work with industry to access data through APIs directly from firms’ systems using a common format.
Select three high value use cases and sequence them into a roadmap that delivers tangible benefits in
the first two years. Build in-house analytical capabilities in tandem with specific use cases. This could
reduce submission time from 30 minutes to just 10 seconds. It requires transparency and firms to be
comfortable with supervisors accessing their data.
• Option 4 — create a shared data repository:
Work with the industry to build a data utility that firms and supervisors can access. All statistical and
regulatory reports are run from the central repository. Near real-time analysis is possible with granular
data. This allows transparency over impromptu data requests and low marginal costs on firms. It takes
a long time to build and runs a higher risk of obsolescence (Figure 4).
The Bank can learn much about different models for data receipt, storage and manipulation from
overseas. It is not clear than any single model stands out. But increasingly distinct strategies and models
are emerging. Those include the models adopted in the Philippines (Box 4) and Austria (Box 5).
Box 4: What the Bank can learn from the Philippines’ use of an API for regulatory data
The Bangko Sentral ng Pilipinas (the Philippines BSP launched a competition with Regtech for
Central Bank, or BSP) is developing an API and Regulators Accelerator (R2A) with a maximum
prototype application for back-office reporting grant value of US$100,000 in October 2017.
and visualisation, which will:1 A panel of judges selected Compliant Risk
Technology (CRT) as the winner to develop the
• “Allow financial institutions to submit API and visualisation prototype.
high‑quality, granular data digitally, and
automatically to the financial authority with The project aims to address late, lacking and
higher frequency.” inconsistent reporting by improving the quality
and access to data, and developing new tools
for visualisation and analysis. It should help BSP:
• “Enable BSP staff to make data validation faster
”implement a risk-based supervisory approach that
and analysis sharper by generating customised
reduces compliance costs and promotes financial
reports for supervisory and policy development
inclusion while ensuring financial stability and
purposes in different formats.”
integrity.”3
Currently, BSP’s Supervisory Data Center (SDC)
receives incomplete, late, and inconsistent
reports. Data cleaning and validation is manual
and consumes significant resources.2
1 See www.r2accelerator.org/bsp.
2 See www.r2accelerator.org/api-visualization-prototype.
3 See www.r2accelerator.org/bsp.
Source: Bangko Sentral ng Pilipinas and Regulators Accelerator.

Box 5: What the Bank can learn from Austria’s central data platform
In 2014, seven of the largest Austrian banks came The basic cube achieves:
together to found a central platform (AuRep) for • A harmonised database model at a very
statistical and regulatory reporting.1 Its objective granular level;
was to improve data quality while generating
• Consistency, absence of redundancy and ease
medium-term cost savings for the whole market.
of expandability;
Banks created a standing committee (SCom) with
the Austrian central bank (OeNB) to develop the • Joint platform development between banks
integrated reporting model. and regulators;
• A future basis for almost all reporting
Banks make sure their raw data meets basic obligations;
reporting requirements (Basic Cube). AuRep then • More clarity regarding definitions and higher
transforms it into multi-dimensional reporting submission quality through the Cube;
forms using smart cubes. But banks remain
• The re-use of data for different needs through
responsible for data accuracy.
multi-dimensional cubes;
• Consistency of input-and output data (internal,
external reporting);
• Transparent communication;
• Stepwise approach and a well-planned
transition period with a parallel testing phase.
1 OeNB’s innovative reporting data model as RegTech/SupTech solution?, Oesterreichische Nationalbank (OeNB), (2018).
Source: Austrian Reporting Services and Bearing Point.

Figure 4: Options for a future approach to gathering data
Optimise within current framework Transform the regulatory approach
A: Short term: B: Optimise within C: Supervise and D: Create a shared

optimise current structure test within firms’ data repository
unstructured data systems
BoE invests
BoE continues
in document
to see reports
management BoE access
but these are BoE accesses data
and AI tooling granular data in
enhanced via in common format
to optimise common format
Description supervisor ability
common reporting on-demand via
in shared data
taxonomy and APIs directly from
to locate and drive repository (e.g.,
deploy document firm systems.
insights from data lake)
management/AI
unstructured data,
for supervisors
especially firm MI
Who generates
Firms in reports Regulator with direct analysis
insights
Where is data
Firms’ systems Shared data lake
held
When can
Defined regulatory reporting
supervision On demand
schedule and ad-hoc requests
occur
How can BoE Past data and in

Past data Past data Past data
supervise real time
Reduction in time All benefits from

taken to process option A
(Potential for much greater granularity,
MI and compile High data
timeliness and access
initial reports consistency across
Granular data drawn directly minimising
Increase in capacity firms, minimising
burden on firms and request duplication,
of supervisors to burden on
ultimately reducing the run costs
Benefits focus on deriving firms to define
Near real-time data extraction, analysis,
insights for entities data taxonomy,
and intervention possible
and sectors at removing
Could enable multiple regulators to
risk e.g., dynamic ambiguity
access shared data if common reporting
and allowing
visualisation taxonomy adopted across jurisdictions
comparisons
across firms
High: Requires
Moderate: investment from
Requires firms to achieve
Low: Requires High: As per option
investment from common reporting
some BoE C and also requires
Investment firms to achieve taxonomy and
investment (e.g., investment in
needed in moder-nising IT,
common reporting enable APIs;
common data lake
taxonomy; requires requires BoE
cloud and AI) infrastructure
investment from investment to
BoE as in option A develop and
manage APIs
Sources: Industry and expert interviews and McKinsey & Company.

The Bank has a statutory objective to maintain financial stability by ensuring the safety and soundness of
regulated firms and reducing risks to the system. But it also needs to use resources in the most efficient
and economic way. With the memory of the financial crisis still strong, it is committed to harnessing data
and technology to monitor risks and mitigate them early (Box 6).
Box 6: How the Bank uses data and technology
The Bank is modernising and improving the Practices like resource pooling and improved
resilience of its services through the Data Centre online digital collaboration are making the Bank
Migration Programme (DCMP). more agile. It is considering how supervisors
need to adapt to a more digital world as part of
It has begun investing in internal digitalisation the PRA Target Operating Model 2025.
— for example through initiatives such as Data
Analytics, Cyber2020 and how it manages firms The Bank has done proofs of concepts with
through its Risk and Work Manager. The One fintech to automate analysis of unstructured
Bank Service Transformation (OBST), a three- to data. And it is exploring whether parts of its
five-year programme, also addresses internal rulebook can be made machine-readable with
processes. Staff are encouraged to improve their small-scale pilots.
digital literacy, for example through the Digital
Ninja Network.
The Bank has taken steps to minimise the fees on regulated firms in recent years. But it must commit to
an ambitious and transformational long-term plan, if it wants to move the dial on how it uses data.
Firms and regulators are trialling different approaches globally. All require a multi-year programme. The
Bank and the PRA, the wider system and firms will need to make significant investments over a long
horizon to reap the benefits of technology.
The mindset must shift from minimising costs to investing in the future. The case for transformation
should focus on benefits to the system as a whole through more agility, flexibility, space for innovation
and reduced compliance costs. Delivery will require funding, and short-run costs may rise. But the
long‑term payoffs will be considerable.
A data strategy will need to be a strategic and management priority. Understandably, the past decade has
been characterised by an intense focus on repair and reform of the system, and in the UK, more recently,
Brexit. This has inevitably resulted in tough prioritisation decisions for the Bank and the PRA and less
than ideal investment in systems and capabilities.
Collaboration must bring together thought leaders from technology, finance and regulation to shape
the programme. The Bank will need to harness advice from technology experts, consult widely and
work closely with the industry. This is to ensure the strategy is effective, efficient, targeted on delivering
long‑term benefit and executed ruthlessly to maximise impact.

RECOMMENDATIONS

• Adapting to the new data environment requires a significant change in
the Bank’s approach and capabilities, which will take time.
• Firms have limited funds to deploy for change programmes. Working
with the industry to set a clear direction will enable firms to align their
investment plans with the Bank’s vision of the future.
• To be effective, the Bank will need to develop a wide-reaching and
ambitious regtech strategy to transform how it collects data from firms.
• Looking to the growth in data volumes, current practices are unlikely
to scale and there are significant efficiencies from defining a suptech
strategy on how the Bank should analyse and use data in supervision.
9.1 Consult on a
new digital data
What can the Bank do?
strategy
The Bank should:
• Develop and consult on a medium-term regulatory data strategy, ideally
for three to five years, with specific initiatives to embrace data-driven
and intelligence-led risk monitoring.
• Foster data science capabilities and deliver a medium-term roadmap
for its digital transformation. This includes a recruitment and training
strategy that meets the need of a central bank of the future.
• Consider making its rulebook machine-readable so it can be interpreted
more efficiently and accurately.
• Consider not just the cost of its own regulatory functions but the total
cost of regulation for the UK financial system.

• Financial services firms are facing shortages of staff with skills in machine
learning and advanced analytics.33 As the quantity of information
increases, the Bank will need more data scientists to enable smarter
regulation and better analysis. Future supervisors will need different
skills.
• There are not enough data scientists coming out of universities.34 And
many of the best will go to big tech firms. The Bank will need to develop
more of its own. Life-long learning will be key for the Bank to adapt to
the fourth industrial revolution.
• The Bank has many highly able mathematicians, including amongst
its economists. Experience from Bloomberg, Aviva and others suggest
9.1 Enhance individuals with strong Bayesian maths can be trained to be data
risk monitoring scientists in three to 12 months. Bloomberg developed a training course
through with academics at NYU and have since made it freely available to their
digitalisation of clients.35 UK academia has considerable AI expertise, so the Bank could
supervision partner with universities to create a joint learning programme (and
possibly a formal UK hub to attract new skills).
What can the Bank do?

The Bank should:
• Consider which new regulatory and supervisory technologies could
make the data capture and analysis of information from firms less
resource-intensive.
• Increasingly automate routine tasks and so free up resources to focus
more on value-added processes.
• Over the longer term, make a choice about reaching out for data rather
than ask for it to be submitted.

ENDNOTES
1 Regtech in financial services: technology solutions for compliance and reporting, Institute of International Finance, (2016).
2 Cyborg supervision — the application of advanced analytics in prudential supervision, speech given by James Proudman,
Workshop on research of bank supervision, 19 November 2018.
3 FSI Insights on policy implementation No 9: Innovative technology in financial supervision (suptech) - the experience of early users,
Bank for International Settlements (BIS), (2018).
4 The Prudential Regulation Authority’s approach to banking supervision, Bank of England, (2018).
5 Cyborg supervision — the application of advanced analytics in prudential supervision, speech given by James Proudman, Workshop
on research of bank supervision, 19 November 2018.
6 Global Shadow Banking Monitoring Report, FSB, (2017).
8 The use of derivatives trade repository data: possibilities and challenges, Iman van Lelyveld, Netherlands Bank, (2017).
9 Bank of England.
12 Embracing the promise of fintech, Bank of England, (2019).
15 Bank of England.
18 Regtech in financial services: technology solutions for compliance and reporting, Institute of International Finance, (2016).
19 The regulator’s new toolkit: Technologies and tactics for tomorrow’s regulator, Deloitte, (2018).
20 The Future of Trader Surveillance: The ABCD of Successful Surveillance, EY, (2017).
21 Machine Learning in Anti-Money Laundering, Institute of International Finance (IIF), (2018).
22 Innovative technology in financial supervision (suptech) - the experience of early users, BIS, (2018).
23 www.bankofengland.co.uk/research/fintech/proof-of-concept.
24 Will Big Data Keep Its Promise?, speech given by Andrew Haldane, Data Analytics for Finance and Macro Research Centre at King’s
Business School, 19 April 2018.
25 See www.bankofengland.co.uk/prudential-regulation/regulatory-reporting/regulatory-reporting-banking-sector.
26 Supervisory Statement 5/16: Corporate governance: Board responsibilities, Bank of England, (2018).
28 Stress testing the UK banking system: 2018 results, Bank of England, (2018).
29 See www.fca.org.uk/data/monthly-ppi-refunds-and-compensation.
30 See www.openbanking.org.uk/wp-content/uploads/One-Year-of-Open-Banking.pdf.
31 UK financial services firms fear up to 40% of revenue at risk from FinTech, PwC, (2017).
32 Stress testing the UK banking system: 2017 results, Bank of England, (2017).
33 The future of talent in banking: workforce evolution in the digital era, EY, (2018).
34 See www.forbes.com/sites/louiscolumbus/2017/05/13/ibm-predicts-demand-for-data-scientists-will-soar-28-by-
2020/#72c1fddf7e3b.
35 See www.techatbloomberg.com/blog/foundations-machine-learning/.

GLOSSARY
ACH – Automated Clearing House. FPC – Financial Policy Committee.

AI – artificial intelligence. FSB – Financial Stability Board.
AMF – Autorité des Marchés Financiers. FSMA – Financial Services and Markets Act (2000).
AML – anti-money laundering. FTSE – Financial Times Stock Exchange.
API – application programming interface. FVS – Face Verification Service.
ASIC – Australian Securities and Investments FX – foreign exchange.
Commission. G7 – Canada, France, Germany, Italy, Japan, the
ASP – account information service provider. United Kingdom and the United States.
ATM – automated teller machine. G20 – The Group of Twenty Finance Ministers and
AuRep – Austrian Reporting Services GmbH. Central Bank Governors.
BCBS – Basel Committee on Banking Supervision. GDP – gross domestic product.
BES – Biennial Exploratory Scenario. GDPR – General Data Protection Regulation.
BIS – Bank for International Settlements. GFSN – Global Financial Safety Net.
BSP – Bangko Sentral ng Pilipinas. G‑SIB – global systemically important bank.
CAGR – compound annual growth rate. HMT – Her Majesty’s Treasury.
CBDC – central bank digital currencies. ICMA – International Capital Market Association.
CBI – Confederation of British Industry. IMF – International Monetary Fund.
CCP – central counterparty. IOSCO – International Organization of Securities
CDE – Critical Data Elements. Commissions.
CEBR – Centre for Economics and Business IPCC – Intergovernmental Panel on Climate
Research. Change.
CMA – Competition and Markets Authority. IRTA – International RegTech Association.
CPIS – IMF Co-ordinated Portfolio Investment KYC – know your customer.
Survey. LEI – Legal Entity Identifier.
CPMI – Committee on Payments and Market NBPSP – non-bank payment service provider.
Infrastructures. NGO – non-governmental organisation.
DB – defined benefit. NLP – natural language processing.
DC – defined contribution. NYU – New York University.
DCMP – Data Centre Migration Programme. OBIE – Open Banking Implementation Entity.
DDoS – distributed denial-of-service. OBST – One Bank Service Transformation.
DLT – distributed ledger technology. OECD – Organisation for Economic Co-operation
DNB – Dutch Central Bank. and Development.
DVLA – Driver and Vehicle Licensing Agency. ONS – Office for National Statistics.
DVS – document verification service. OTC – over the counter.
DWP – Department for Work and Pensions. PBoC – People’s Bank of China.
ECB – European Central Bank. PISP – payment initiation service provider.
EIOPA – European Insurance and Occupational PPP – purchasing power parity.
Pensions Authority. PRA – Prudential Regulation Authority.
EME – emerging market economy. PSD2 – Payment Services Directive II.
ERM – equity release mortgage. RoE – return on equity.
ESG – Environmental, Social and Governance. RTGS– Real-Time Gross Settlement system.
ETC – exchange-traded commodity. SME – small and medium-sized enterprise.
ETF – exchange-traded fund. TCFD – Task Force on Climate-related Financial
FCA – Financial Conduct Authority. Disclosures.
FDI – foreign direct investment. TDIF – Trusted Digital Identity Framework.
FINMA – Swiss Financial Market Supervisory UID – unique biometric ID.
Authority. UNEPFI – United Nations Environment Programme
FMSB – Fixed Income, Currencies and Finance Initiative.
Commodities Markets Standards Board. WEO – IMF World Economic Outlook.

ACKNOWLEDGEMENTS
I am extremely grateful to the very wide range of individuals and companies who engaged with me
throughout the Review and provided valuable contributions. These include:
8 EIGHT ROADS British Business Bank

A16Z Bruegel
ABACO Burning Glass
Aberdeen Standard Investments BYNMellon
ACBM CalSTRS
Access for Cash Review Capital
ADYEN Caranegie Mellon
AFME Cardinal Analytics
Age Scotland Carmignac
Algebris Catalyst Inc
Allianz Global Investors Cerberus
Allstate CISCO
Amazon Citigroup
American Express ClearBank
Amundi Clifford Chance
AntFinancial Cobalt
APG Codebase
Arabesque Cognizant
Artemis Partners Copper Street
Association for Financial Markets Corsair Capital
Association of Corporate Treasurers CPP Investment Board
Atom Bank CQS
Autonomous Research Credit Suisse
Aviva Credit Union
Axa CRYSTAL AMBER
Bain & Company CSIT
Bain Capital CYBG
Balderton Capital Datactics
Balyasny Deka
Bank North Deloitte AG
Bank of America Merrill Lynch Deutsche Bank
Bank of Canada Devoff
Bank of China Digital Identity
Bank Pekao Digital Mortgage Broker
Banque de France Donata Denny
Barclays Dow Jones
BBVA E.L. Rothschild
Blackrock Eastspring Investments
Bloomberg EBF
Bluebay Edelman
Bluecrest Egertoncap
BlueVoyant Emerging Payments Association
Boston Consulting Group ENA
Brent Hoberman ERLAM

Ernst & Young LLP Lloyds Banking Group
Euroclear London Stock Exchange
Fannie Mae Lone Pine
FCA Lord Hill of Oareford
FCLTGlobal Lynn Forester De Rothschild
Fidelity Investments M&G Prudential
FIDEURAM INVESTIMENTI Macro Advisory Partners
Finastra Mambu
Finsbury Man Group
Fintech Envoy for Northern Ireland Manchester Square Partners LLP
FinTrU Marshall Wace
Firstminute Capital Mastercard
Founders Factory McKinsey & Company
Funding Circle Metlife
Funding Xchange Michael Milken
Gadhia Group Microsoft
GDP Equity Experts Milken Institute
General Atlantic Monese
GIC Moneybox
Google Monzo
Goldman Sachs Moore Capital
Greensill Morgan Stanley
Gulf International Bank MSCI
Harvard Business School Natalie Ceeney MBE
Hellman & Friedman NBC
Hermes Growth Partners NEST
HM Treasury New Day
HSBC New Financial
Hub Culture Nordea
HVMD Nucleus
ICMA NYU
IHS Markit Ltd Oaknorth
IMF OBIE
Index Ventures OECD
Innovate Finance Oliver Wyman
Institute of International Finance PayPal
InvestNI Per Ardua Associates Ltd
Irish League of Credit Unions PIMCO
ISDA Pricewaterhouse Coopers
Iwoca Professor Jason Furman
iZettle Professor Charles Goodhart
Janus Henderson Investors Raiffeisen Bank International
JC Flowers & Co Ratesetter
JP Morgan RBS
Jupiter Fund Management Refinitiv
Kempen Renosys
King & Wood Mallesons Richard Berner
KKR Richard Sharp
KPMG Ridgeway Partners
L&G Ripple
Lansdowne Royal Banking Group
Leeds Building Society Royal London
Leeds University Russell Reynolds
Legal & General S&P
Legal & Regulatory Said Business School
Linklaters LLP Samos

Santander UK TV Squared
SASB UBS
Scottish Financial Enterprise UK Finance
Scottish Fiscal Commission UniCredit
SETL University of Edinburgh
Shell UK University of Glasgow
Simon Gleeson Upstream Working Capital Ltd
Societe Generale USS
Standard Chartered Virgin Money
Starling Bank Visa Inc.
Stepchange Wall Street Journal
Stripe Wapping Consulting Group
Style Research Warburg Pincus
Suade Wellcome Trust
Summit Wellington Management
Tenax Capital White Cap Consulting
Teneo Blue Rubicon World Economic Forum
TG Americas Worldline
TheCityUK Y analytics
Thomson Reuters Yorkshire Building Society
Thought Machine Zopa
Tortoisemedia Zurich
Tosca And a wide range of policymakers and some who
Transfer Wise preferred to be anonymous
I would like to thank all staff across the Bank who shared advice, analysis and helped compile this report.
In particular, the Review’s Advisory Group.
Advisory Group:
Sandy Boss (Chair) Mark Yallop
Alex Brazier Sarah Breeden
Andy Haldane Sonya Branch
David Bailey Victoria Cleland
James Proudman Vicky Saporta
David Rule Rob Elsey
Andrew Hauser
And:
Tom Mutton Andrew Lodge
Varun Paul Lewis Webber
Julia Kowalski Stefan Claus
Justin Jacobs Mark Cornelius
Ronnie Driver Himali Hettihewa
Andy Murfin Eir Nolsoe
Clair Mills Oliver Burrows
I would also like to thank the following for their pro bono research and support on scenario analysis:
McKinsey & Company on payments and digital Christian Edelman, Lisa Quest, Magnus Burkl,
regulation. James Davis, Davide Taliente and colleagues
at Oliver Wyman on corporate and wholesale
Ian Walsh, Dean Frankle, Sukand Ramachandran, markets, and asset management.
Paul Clark, Brandon Miller and colleagues at The
Boston Consulting Group on retail/SME banking
and insurance.

Future of Finance Report

Uploaded by

Copyright:

Available Formats

Future of Finance Report

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Future of Finance Report

Uploaded by

Copyright:

Available Formats

FUTURE

Chaired by Huw van Steenis

Recommendations for the Bank

1 Shape tomorrow’s payment system 25

2 Enable innovation through modern financial infrastructure 41

3 Support the data economy through standards and protocols 56

4 Champion global standards for finance 67

5 Promote the smooth transition to a low-carbon economy 80

6 Adapt to the needs of a changing demographic 90

7 Safeguard the financial system from evolving risks 102

8 Enhance protection against cyber-risks 116

9 Embrace digital regulation 129

Huw van Steenis

Forces shaping What it means What it means

Platform-based 1 Shape tomorrow’s payments system

Gig and sharing Serve the 2 Enable innovation through

3 Support the data economy through

Integrating 4 Champion global standards for finance

Forces shaping What it means What it means

WHAT DOES THIS MEAN FOR FINANCE?

1 Shape tomorrow’s payment system

2 Enable innovation through modern financial infrastructure

Innovative payments infrastructure to enable alternative payments

4 Champion global standards for finance

6 Adapt to the needs of a changing demographic

The financial system is under almost constant cyber-attack.

9 Embrace digital regulation

The broad-based growth and further opening of emerging market economies

To help finance serve the digital economy, the Bank should:

1 Shape tomorrow’s payment system

1 SHAPE TOMORROW’S PAYMENT SYSTEM

The Bank should:

The Bank should:

The Bank should:

2 ENABLE INNOVATION THROUGH MODERN FINANCIAL INFRASTRUCTURE

The Bank should:

The Bank should:

The Bank should:

2.3 EMBRACE - understanding and mapping concentration risks and interoperability, as

The Bank should:

3 SUPPORT THE DATA ECONOMY THROUGH STANDARDS AND PROTOCOLS

The Bank should:

The Bank should:

4 Champion global standards for finance

4 CHAMPION GLOBAL STANDARDS FOR FINANCE

The Bank should:

4.2 ENGAGE ON The Bank should:

4.3 ENGAGE The Bank should:

The Bank should:

The Bank should:

6 ADAPT TO THE NEEDS OF A CHANGING DEMOGRAPHIC

The Bank should:

The Bank should:

7 Safeguard the financial system from evolving risks

7 SAFEGUARD THE FINANCIAL SYSTEM FROM EVOLVING RISKS

The Bank should:

7.2 FOSTER A The Bank should:

7.3 CONTRIBUTE The Bank should:

The Bank should: