Supervising the future of banking: navigating the digital transformation
Speech by Elizabeth McCaul, Member of the Supervisory Board of the ECB, at “The New Frontiers of Digital Finance” conference organised by CONSOB
Rome, 10 March 2023
When I was growing up, the term “new frontier” was commonplace in the United States, capturing a period of hope and opportunity as science and technology made rapid progress. I remember how thrilling it was when this progress ultimately sent the first person to the moon.
We are of course not talking about the space race today. But the speed of technological innovation makes the present day no less exciting. It has been said that we are living through a technological renaissance. I don’t know if it is a renaissance or a revolution, but it is plain to see that the digital transformation of our societies and economies is accelerating. The banking sector is no exception, and this has profound implications for the business of banking and for us as supervisors.
Today I will first focus on our supervision of banks’ digital transformation and on the results of the digitalisation survey we conducted last year, which provide something of a snapshot of the progress made so far. I will then reflect on the broader challenges we face in implementing appropriate supervisory and regulatory oversight regimes for the new frontiers of digital finance.
Supervising banks’ digital transformation
Advancements in technology have been shaping banking for centuries – from the first wire transfer between Boston, New York and Chicago in 1871 to the unveiling of the first ATM in Enfield, north London, in 1967, and the rise of online and mobile banking in recent years.
The uniqueness of the current situation stems from a combination of three trends in today’s market environment.
First, customers are increasingly calling for digital solutions to conduct their daily banking activities, facilitated by the widespread use of mobile phones globally, and the proliferation of apps for transactions and payments in particular.
Second, today’s accelerated pace of technological development makes it easier and more cost-effective for banks to digitalise their operations and processes and extract value from data to gain a competitive advantage.
Third, and related to this age-old challenge of gaining competitive advantage, new market entrants are intensifying the ever-present competitive pressures.
In the face of these three trends, digital transformation is now widely considered to be both a strategic imperative and a strategic risk for banks. So what is the role for us as supervisors in this digital transformation of the banking sector?
Tommaso Padoa-Schioppa once famously said that it’s not the supervisor’s task to prevent Darwinian selection in the financial system, nor to protect dinosaur banking from extinction. Indeed, as supervisors, it is not our task to defend banks’ market shares. It is certainly in our interest, however, to make sure our supervision encourages banks to develop and implement sound digital transformation plans, especially if these plans make the banks more cost-effective, as this increases their profitability and thus improves their overall business models.
Having said that, I think it is no longer fair to compare banks to dinosaurs, since digital transformation is certainly underway across the euro area. However, I fear that many banks may be underestimating the speed of technological innovation and the urgency of digital transformation. We only have to look at the developments in artificial intelligence (AI) in recent months, where a generative AI language model has demonstrated its potential to be a real game changer for many businesses. While banks are already making changes, it is the nature, speed and extent of their transformation that will determine how they manage their business models and strategic risks, as well as their operational resilience.
The status of banks’ digital transformation
Last year, we launched two major initiatives to deepen our understanding of the digital transformation of the European banking sector.
We engaged with stakeholders, including banks, technology companies and consultants, to gain insights into major market trends. We also surveyed 105 large banks to assess the status of their digital transformation. Of course, I should add the caveat that the results of this survey are based on these banks’ self-assessments, and we will verify these findings through our supervisory processes.
So what did we discover? It likely won’t surprise you to know that almost all of the banks we surveyed now have a digital transformation strategy in place. However, perhaps more surprisingly, these strategies are not always fully developed and are often supported by only limited investment. The core focus of banks’ strategies is, of course, to improve profitability, either by enhancing customer experience or improving operational efficiency. On average, banks were allocating 5.2% of their staff to digital transformation projects. Many banks have launched a variety of initiatives and projects, but given the multifaceted nature of digital transformation, banks generally struggle to isolate and quantify the cost and revenue impact of their digital transformation strategies. In addition, the average budget that these banks dedicate to the digital transformation is still limited, accounting for only 4% of their operational costs in 2021.
Most banks are also reporting that they have a coordination body in place to steer their digital strategy. Some executive or supervisory management bodies do include members with previous experience in digitalisation topics, although the extent or level of experience in IT projects varies, and the “war for IT talent” is seen as a key challenge by banks.
Banks also report that half of their customers already appear to have gone digital. On average, the surveyed banks were concluding 46% of their loans via digital channels, with 36% of their customers using mobile banking and 21% using online banking.
When it comes to how these banks are using technology, we see a mixed picture in the survey results. Almost all banks are using some form of cloud and application programming interface, while 60% of them are using AI, with more use cases in development. Less than 20% of them are using distributed ledger technologies, and when we checked for crypto activities specifically, we found that these were insignificant for the surveyed banks. However, considering bank customers’ heightened interest in investing in crypto-assets, the topic requires further attention. There is also the question of banks being linked to crypto activities via lending products and counterparty arrangements – it is crucial that we ensure these links are transparent.
As part of their digital transformation strategies, banks tend to rely on outsourcing and external partnerships. However, as they open up their IT infrastructure to these types of arrangements, there are increasing risks around third-party dependency, money laundering, fraud and cybersecurity. The need to address gaps in internal technical skills and the resulting “war for talent” also contributes to increased dependency on third parties. While banks acknowledge these kinds of risks in the context of the digital transformation, their risk appetite frameworks and stress scenario analyses do not always reflect them.
Digital transformation requires a holistic approach. To successfully implement a digitalisation strategy, a bank’s individual operations, products and processes are not the only areas that need to be transformed – its entire business model and corporate culture also need to undergo transformation. And I’m sure many of you will agree that achieving the cultural change of going digital is often harder than merely implementing a new technology.
Additionally, this cultural change should not only include banks’ digital business, investment and resources; it also has to cover their governance and risk management frameworks. Supervisors need to be able to assess the sustainability of a bank’s business model and whether it has established appropriate risk management and governance arrangements. And these arrangements need to enable the bank to identify, manage and mitigate risks related to the use of innovative technologies.
As part of our supervisory priorities for 2023 to 2025 we plan to continue our work on digital transformation, with targeted reviews and on-site inspections due to be carried out this year.
In the targeted reviews, we will look at governance, technological and operational aspects, banks’ overall strategies and the impact they have on business models and profitability, and we will focus on answering a number of questions, including: how does a bank’s internal governance framework support the development and implementation of digital transformation strategies? Are the banks’ risk management frameworks equipped to deal with the potential rise in IT, cyber and operational risks? How do banks manage their third-party risk? Do banks ensure adequate data quality and data aggregation for proper risk governance and sound risk-based decision-making, also for their digital transformation strategies?
We plan to publish our findings, with a particular focus on best practices, in addition to any deficiencies we may discover. These findings will ultimately be integrated into our supervisory methodology and will become part of our supervisory guidance and expectations for banks in the coming years.
Supervising the new frontiers of digital finance
I will now briefly turn to the broader challenges of supervising the new frontiers of digital finance as transformation across the financial services sector profoundly changes the landscape.
As banking supervisors or overseers of securities markets, we have become quite accustomed to debating the attributes of what belongs where over the last two decades, using definitions of products and categorisations of delivery mechanisms and business models to help determine how we assign oversight activities to appropriate regimes. But today, our challenge is even more pronounced as the digital transformation has blurred the lines, including for those borders that are more distinct in the physical world.
The collapse of FTX last November has left us with questions about gaps in the framework. How can we achieve consolidated oversight of firms that claim to have no headquarters at all? What does that mean in terms of having a home country banking supervisor or an equivalency regime in the securities oversight arena? The lack of a traditional central entry point poses challenges for our current regulatory and supervisory approaches.
Looking at the crypto market in particular, I would like to see more regulatory convergence and supervisory cooperation at the international level. Individual regulatory regimes based solely on individual jurisdictions may no longer be sufficient. The new developments in digital finance are shining a spotlight on the need to have a more integrated global framework in place. Without it, regulatory arbitrage will increase the risk of customer losses, and may even threaten financial stability.
Europe is leading in developing regulation, having already developed a regulatory framework around which consensus is forming – the Markets in Crypto-Assets Regulation, or MiCA. This is great progress and highly welcome. But on its own it will not be sufficient to close all the potential gaps, not least because the same level of oversight does not exist in other major jurisdictions. For as long as this is the case, I fear that firms will continue to arbitrage the different frameworks, leading to gaps in oversight. At least within the EU, I very much hope that MiCA will put an end to this and ensure effective cross-border cooperation and information exchange between all involved authorities.
Technological innovation has been a constant presence in the history of banking.
Whether we’re witnessing a technological renaissance or a revolution, the confluence of increased consumer demand, competitive pressures and rapid technological innovation makes digital transformation a strategic imperative for banks. But the digital transformation of banks’ business models is only one side of the coin – banks must also adapt their governance, risk management and overall steering capabilities accordingly.
At the same time, we need more regulatory convergence and cooperation at the international level to close any potential gaps in oversight, particularly with regard to crypto activities. After all, it isn’t the frontiers of outer space we are looking to conquer. We simply need to manage the risks that are present here on Earth.
Thank you very much for your attention.
ECB Banking Supervision (2023), “Banks’ digital transformation: where do we stand?”, Supervision Newsletter, 15 February; ECB Banking Supervision (2023), “Take-aways from the horizontal assessment of the survey on digital transformation and the use of fintech”, 15 February.
Padoa-Schioppa, T. (2000), “Licensing Banks: Still Necessary?”, The William Taylor Memorial Lectures, No 5, Group of Thirty.