Payments as a service (PaaS) – an approach to outsourcing the payments technology and support functions

Introduction

The payment industry has witnessed increased disruption from nonbanking players such as technology companies, retailers, start-ups, and telecommunication providers who specialise in niche value-added services in the payment processing chain. Outsourcing has become an extremely popular business strategy in this highly competitive world. It has been looked at as an effective mechanism to increase efficiency for service recipients by reducing costs and enabling a greater focus on core banking activities.

Traditionally, banks have been outsourcing their non-core functions like data centre management, software and hardware, disaster management, call support services, help desk centres and brown/white label ATM operations to third-party service providers. Brown label ATMs are a classic example of outsourcing services to service providers, where the ATM hardware is owned by the service provider, but cash management and network connectivity are provided by the sponsor bank. Several leading banks have also used the outsourcing model to expand their ATM networks using the brown label ATM model.

The payment industry is now witnessing an increased level of disruption from non-banking players who specialise in value-added services in the payment ecosystem. This new generation of players are allowing financial institutions (FIs) and other non-bank players to expand and meet customers’ expectations by offering payment products and services without incurring high upfront investments. This has helped organisations outsource their payment products. FIs are now outsourcing not just their non-core functions but also core functions such as transaction management, payment processing, risk management, and information technology and information security management. Outsourcing of these elements in the payments value chain is referred to as payments as a service (PaaS). PaaS can be seen as a combination of software as a service (SaaS) and infrastructure as a service (IaaS) for the payments domain.

In the last couple of years, PaaS providers have also started offering specialised services such as payment engine hosting, reconciliation and settlement, cross-border payments, and monetary disbursements to FIs/corporates on a cloud platform. These providers are also helping banks address the ever-growing security and fraud concerns and changing regulatory requirements.

For example, the Reserve Bank of India (RBI) has prohibited storage of customer card details by merchants and payment aggregators. As a solution to this, card scheme operators have started offering card-on-file (CoF) tokenisation services in India. This has enabled banking partners to offer end customers the token services on e-commerce platforms. This service is being extended to payment aggregators and merchants as well. Service recipients may use such offerings provided by service providers or may want to build their own infrastructure.

Need for PaaS

The payment ecosystem is evolving massively. Tightening of regulations and emerging technologies pose challenges for traditional payment businesses. As a result, banks may evaluate two options: (1) own customer and transaction management and outsource payment functions to third-party service providers; (2) tie up with FinTechs, allowing them to own distribution or customer management while the banks retain ownership over product offerings (neobank model). Updating the core system to be a front runner in the market and adhering to regulatory norms require time and upfront capital which impacts the margins of companies.

FIs as well as non-bank entities can improve their payments capabilities by using the PaaS model, which allows them to manage higher transactions volumes more quickly and at lower costs as compared to legacy models. This also helps the organisations to increase their revenues and market share while being compliant and secure.

Key considerations

While PaaS has been gaining popularity and has a number of advantages, there are some aspects that need to be considered when an organisation decide to outsource payment services to PaaS providers. Entities should evaluate the need for outsourcing their critical processes and activities and select a PaaS provider based on comprehensive risk assessment. Some of the key considerations are highlighted below:

3. Regulatory compliance

Various countries across the globe have issued specific payment guidelines on open banking, data access and protection, and payment standards. Even for cross-border payment transactions, there is an increased level of complexity due to domestic and international rules. Financial and nonbank entities in the payment sector have to be cautious while engaging in transactions in order to avoid regulatory penalties and fines. When these entities outsource payment services under PaaS, they have to verify that PaaS providers comply with regulations. In addition, there may be regulatory restrictions on activities that are outsourced to PaaS providers.

The RBI, in its “Framework for Outsourcing of Payment and Settlementrelated Activities by Payment System Operators”, prohibits outsourcing of core management functions (including risk management and internal audit), compliance and decision-making functions such as determining compliance with KYC norms to third-party service providers for non bank entities. With this framework in place, entities need to make sure that the outsourcing arrangement is properly managed with clearly written rolesand responsibilities.

With inputs from Aarushi Jain, Dhaval Jariwala, Neha Dharurkar, Shubham Jain and Shashank Gupta.