Implementation of faster payments: Key considerations and the way forward

Considering the growing need for interoperability and the ability to handle rich data generated from transactions, payments system operators are looking for a message standard which can deliver these functionalities. International Organization for Standardization (ISO) has the capability to provide standardisation across regions and is futureready. ISO 20022 is the most common standard adopted globally for faster payments. It is costly and time-consuming for implementation as it requires a detailed impact analysis and updated legacy systems to work with new data requirements. Proprietary messages can provide the flexibility on customisation and are cost-effective but lack the ability to drive interoperability for cross-border transactions.

Multiple use cases for real-time payments work on a credit push or a debit pull transaction. While technically a system can be designed to run on either /both of the transaction types, payment rails have to decide on the type they would choose to be cognisant of the existing regulations in the underlying country. For example, South Africa has separate collection-related regulations which need to be adhered to in case a debit pull transaction is initiated.

Choosing to implement either a credit push or a debit pull for the entire payment rail might be a cost-effective decision and easier to implement but building both as a part of the design can enable multiple use cases and enhance customer experience.

Clearing methodology varies from country to country and depends on the regulatory design for interbank payments in the country. European countries and Australia leverage the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network for all domestic interbank as well as cross-border payments, while in countries like India and South Africa, clearing is routed and managed by central agencies appointed by regulators, or by the regulators themselves. However, the settlement for all interbank communication is maintained and managed by the central operator maintaining accounts of participants. For the new faster payments rail, it needs to be decided whether the existing batch settlement system (with required changes) is to be used or a new immediate settlement system, like the Fast Settlement Service (FSS) in Australia for NPP settlements where exchange settlement accounts held by participating banks are used for settlement, is to be build.

Using beneficiary account numbers and bank reference numbers has been the legacy method for any type of financial transaction. However, faster payments have been leveraged by various countries to provide enhanced customer experience by deploying features which may range from basic credit transfer using proxy setup, QR code payments, RTP or set up a mandate to debit account at scheduled frequency. The features to be built in the payment rail needs to be decided as per its purpose.

Communication layer security, encryption of sensitive data and authentication of transactions are three key areas that demand attention from the central operator and regulators for defining the security protocols for a real-time payments rail.

The use of secure sockets layer (SSL), virtual private network (VPN) and other private networks must be leveraged as required. Tokenisation of sensitive data, asymmetric key encryption, hashing and using a hardware security module are just some of the means which need discussion from the right participants to arrive at a ‘fit for purpose’ security protocol for the payment rail.

User authentication security guidelines vary from region to region. While the two-factor authentication for added security (made mandatory by regulators) has become a global preference, the step up/down of authentication factors is still the call of the bank/account holder based on proprietary risk based approach and customer behaviour.

Allowing access to non-banking participants in the faster payment ecosystem has resulted in multiple innovative use cases being offered to customers, but it brings in added security concerns. The key decision here to be taken by the regulators is whether they are providing either a direct or indirect access to non-bank players, which will force regulators to issue stringent security guidelines accordingly to secure finances as well as customer data with robust liability clauses.

There are various methods which can be adopted for implementation of faster payments:

• Leverage existing systems: Existing payments systems deployed by bank participants with either proprietary or ISO message format can be leveraged by building an orchestration layer above that for message conversion from existing to target message format. While this may be a quick fix solution, all potential benefits of the migration will not be realised with a message convertor.
• Conversion by central system: The central system takes the ownership to convert incoming messages to the format accepted by the central core system (PromptPay in Thailand) instead of transferring the load of message conversion to each participating bank in some countries. This method can significantly increase the responsibility with the central operator and due to inefficiencies related to message conversion, can devoid the system of all potential benefits. The participants still need to make the required changes in their systems to be compatible with the convertor at the operator’s end.
• Build a new system: A completely new parallel system can be built by banks as per the defined technology specification of the faster payments system being implemented. While this may be more costly and time-consuming as compared to other adoption models, it will prepare all participating banks for a future-ready infrastructure and derive all potential benefits of modernisation. Multiple countries like the UK and the US have adopted a phased approach over multiple years to build a feasible implementation plan for participants in their faster payments system.