Input:
	Background

Fintech—originally short for financial technology—refers to the use of  technology and innovation to provide financial products and services. For  purposes of this report, fintech firms are nontraditional technology- enabled providers, such as start-ups or more established technology  firms, such as Apple or Google, that are offering traditional financial  products or services to consumers. Fintech products or services are  typically provided—sometimes exclusively—through the Internet or via  mobile devices, such as smartphones, rather than being provided through  face-to-face visits to financial institution branches.
The products and services that fintech firms offer include: payments between individuals, and between individuals and  loans to consumers and businesses; advice on wealth management or general financial activities; and distributed ledger technology used to make payments, record and  track asset ownership, and other purposes.

		Fintech Payments

Various fintech firms offer ways for individuals to make payments and  transfer value, including for purchasing goods or services or for  transferring money to individuals domestically or internationally. The  payments offered by these providers are often conducted using  applications (apps) on smartphones or other mobile devices. Often these  fintech payments involve the use of accounts linked to existing debit or  credit cards and are processed through the existing networks and  channels for these types of payments. In some cases, fintech providers  may also route their payments through the Automated Clearing House  networks, which have traditionally been used to facilitate automatic bill  paying to utilities or other merchants or funds transfers between banks.  Fintech payments can also be made by charging a consumer’s phone bill.  For example, consumers can send charity contributions via text or charge  in-app purchases to their mobile phone bill.
One common fintech payment method involves mobile wallets, or  electronic versions of consumers’ wallets, which offer consumers the  convenience of conducting transactions without having to enter credit or  debit card information for each transaction. Using a mobile wallet,  consumers can store payment card information and other information on  their mobile devices that is often needed to complete a purchase.  Generally, mobile wallets replace sensitive information with random  values—a process called tokenization—to provide greater security when  making a payment, and transmit this information using existing credit and  debit card networks. A variety of fintech firms provide mobile wallets,  including Apple, Google, and Samsung.
Consumers may use mobile wallets to make payments to other  consumers or to businesses; in mobile applications; through mobile  browsers; or in-person at a store’s point-of-sale terminal. Some providers,  such as Paypal and Venmo, allow individuals to create accounts on  mobile devices to make payments funded by debit or credit cards, as well  receive and store funds sent to the account owner that can be used to  make payments to others or buy goods from merchants. Figure 1  illustrates how a mobile wallet enables the payment information to be  transferred by allowing compatible devices to exchange data when placed  in very close proximity to each other using various technologies, such as  wireless communication.
Regarding the total volume of payments by fintech providers, the  association representing state banking supervisors estimated that fintech  payment firms were likely used to facilitate payments or currency  exchanges of up to $189 billion in the first 2 quarters of 2017. In a 2016  report on consumers’ use of mobile financial services, the Federal  Reserve’s survey of more than 2,220 respondents found that over 30  percent of consumers aged 18-44 had made payments using mobile  phones sometime during 2015. According to a report by the Smart  Payment Association, 200,000 locations accepted Apple Pay when it was  launched in September 2014, but by February 2016, this number had  reached 2 million. According to Paypal, it had 218 million active  customer accounts at the end of the third quarter of 2017 and processed  over 6 billion payments valued at more than $354 billion in 2016.

		Fintech Lending

Fintech lenders—often referred to as marketplace lenders and which  operate almost exclusively online —offer a variety of loan types and may  use different sources of funds than traditional lenders. The types of loans  offered by fintech providers include consumer and small business loans.  While these lenders may use traditional means of assessing borrowers’  creditworthiness, such as credit scores, they also may analyze large  amounts of additional or alternative sources of data on other aspects of  borrower characteristics, such as information from bank accounts, to  determine creditworthiness.
Fintech lenders can follow various models. For example, some conduct  person-to-person lending in which loans are financed by individual  investors. In other cases, the funds for these loans can come from  institutional investors such as hedge funds, financial institutions, or from  notes sold to individual investors. In some cases, funding for loans is  obtained by securitizing previously-made loans and selling securities  backed by the cashflows from the underlying loans. The fintech lenders  that use external capital are referred to as direct lenders and include such  firms as SoFi and Earnest. Figure 2 below shows the flow of funds for  typical direct lenders.
Other fintech lenders include lenders that partner with depository  institutions—including banks or credit unions—to originate loans that are  then purchased by the lender or by another investor. Examples of lenders  partnered with depository institutions include LendingClub Corporation,  Prosper, and Upstart. Figure 3 shows the flow of funds for such lenders.  Some lenders, such as OnDeck, have now developed hybrid models,  selling some whole loans to institutional investors while retaining servicing  responsibilities.
One firm that tracks fintech activities reported that the volume of lending  by 13 of the most significant lenders had reached about $61 billion as of  the end of September 2016, and other market monitors estimate that  fintech lending volumes could grow to as much as $90 billion to $122  billion by 2020.

		Fintech Wealth Management and Financial Advice

Fintech firms are also offering wealth management or other financial  advice, some with minimal or no human interaction. For example, new  firms called robo-advisers are offering investors advice using algorithms  based on these investors’ data and risk preferences to provide advice on  recommended asset holdings and allocations. Fintech firms offering these  advice services include Betterment, Personal Capital, and Wealthfront.  Figure 4 illustrates a typical case of a consumer using a fintech wealth  management adviser.
One research firm estimated in July 2017 that robo-adviser firms would  have as much as $1 trillion in assets under management by 2020 and as  much as $4 trillion by 2022.
In addition, some fintech firms—referred to as financial account  aggregators—allow consumers to aggregate the information from their  various financial accounts, including their assets in bank accounts and  brokerage accounts, to enable them to better see their financial health  and receive advice on alternative ways to save money or manage their  finances. Consumers can access this combined information either online  or on mobile devices. Account aggregator firms offering this type of  advice on savings and other activities include Mint and HelloWallet.

		Distributed Ledger Technologies

Distributed ledger technology (DLT) is a secured way of conducting  transfers of digital assets in a near real-time basis potentially without the  need for a central authority. DLT involves a distributed database  maintained over a network of connected computers that allows network  participants to share and retain identical cryptographically secured  records. Such networks can consist of individuals, financial entities, or  other businesses.
Blockchain is one type of DLT. A blockchain is a shared digital ledger that  records transactions in a public or private network. Distributed to all  members in the network, the ledger permanently records, in a sequential  chain of cryptographically secured blocks, the history of transactions that  take place among the participants in the network. DLT products can have  different types of access control. For example, some may be  “unpermissioned” (public) ledgers that are open to everyone to contribute  data to the ledger and have no central control, while others may be  “permissioned” (private) ledgers that allow only certain participants to add  records and verify the contents of the ledger.
The financial services industry has identified various potential uses for  DLT. These include tracking international money transfers or tracking  the changes of ownership of various financial assets, such as or  securities like bonds or stocks or derivatives like swaps contracts. In  addition, DLT is being used to track ownership of bitcoin, a virtual  currency, specifically using a blockchain.
Some companies are using DLT to raise funds. According to a recent  bulletin by U.S. securities regulators, these virtual coins or tokens are  being created and then disseminated using DLT as part of offerings  known as token sales or initial coin offerings. As part of these token  sales, purchasers may use fiat currency (e.g., U.S. dollars) or virtual  currencies to buy these virtual coins or tokens. Currently, the capital  raised from the sales may be used to fund development of a digital  platform, software, or other project; or, the virtual tokens or coins may be  used to access the platform, use the software, or otherwise participate in  the project. After they are issued, in some cases the virtual coins or  tokens may be resold to others in a secondary market on virtual currency  exchanges or other platforms.

		Various Regulators May Oversee Fintech Activities

A variety of federal and state regulatory bodies may oversee fintech firms  or their activities to the extent these firms provide a regulated payment;  lending; wealth management; or distributed ledger technology service or  activity. Table 1 explains the basic functions of the relevant federal  regulators.
In addition to the federal regulators above, various state entities also  conduct regulatory activities over fintech firms operating within their  jurisdictions. According to the association representing state regulators,  state financial services regulators license and supervise activities, such  as money transmission, consumer lending, and debt collection,  irrespective of technology deployed. Nonbank financial service providers  that offer services directly to consumers are likely subject to state  oversight. In addition to state financial services regulators, state securities  regulators, state entities that oversee corporate activities, and state  attorneys general have jurisdiction over certain fintech firms. In general,  these entities may have authority to license or register firms, conduct  exams, and take enforcement actions for violations of state laws or  regulatory requirements.

	Fintech Activities Can Provide Benefits and Pose Risks to Consumers and the Broader Financial System

Fintech products in payments; lending; wealth management; and  distributed ledger technology can provide consumers and the broader  financial system with various benefits but may also pose risks similar to  those of traditional products. While existing laws apply to fintech products  and services in most cases, some products pose additional risks that may  not be sufficiently covered by existing laws.

		Fintech Products Can Provide Various Consumer Benefits

According to our prior work, literature we reviewed, and stakeholders we  interviewed, consumer benefits of fintech products include greater  convenience; lower cost; increased financial inclusion; faster services;  and improved security.
Greater convenience: Consumers can use fintech products and  services on their mobile device to make payments; transfer money;  easily obtain payment for shared expenses; obtain loans; or to receive  investment advice without the time and expense of visiting a financial  service provider’s physical location. They can also access these  services outside of standard business hours. In addition, the ability to  see information from all of their financial accounts together in a single  dashboard provided by an account aggregator is more convenient  than reviewing information from each account on separate  statements.
Lower cost: Innovations in payments, including the use of DLT, could  reduce the cost of payments for consumers. For example, one fintech  firm uses DLT to reduce the operational and liquidity costs traditionally  incurred with some international payments. Some fintech providers  do not charge fees for payments, so consumers save by avoiding  paying for checks or incurring automated teller machine fees. In  addition, because fintech providers often do not have overhead costs  associated with physical locations and use automation instead of  relying on large staffs to provide services, they may be able to pass  these cost savings on to consumers. For example, according to a  Treasury report, automated loan processing, underwriting, and  servicing may allow fintech lenders to offer lower rates or fees on their  loans because they have to hire fewer loan officers. Similarly,  automation in robo-advising could allow consumers to obtain  investment advice at a lower cost than if they obtained services from a  firm that relied more heavily upon human advisers.
Increased financial inclusion: Using alternative data may allow  fintech lenders to offer loans to consumers whose traditional credit  history may have been insufficient for banks to extend them credit.  CFPB officials stated that using alternative data—including bill  payment history as a proxy for debt repayment—could expand  responsible access to credit, particularly to some consumers who are  among the estimated 45 million people who lack traditional credit  scores. Similarly, a study by FDIC staff noted that fintech accounts  may also enable consumers whose traditional accounts are closed  due to lack of profitability for the provider or other reasons to continue  to have access to financial services. Also, robo-advising services  can make investment advice more accessible to consumers who  cannot meet account minimums at traditional advisers by offering  lower account minimums.
Faster services: Automation may reduce transaction times for  services like loan approval or investment advice. Stored payment data  in fintech providers’ mobile wallets may reduce transaction time for  online purchases because consumers do not need to reenter billing  information. Further, such data may reduce transaction time for in- store purchases because transactions using contactless payments  are faster than transactions using card readers and cash. Peer-to- peer payments made via mobile wallets may transfer money faster  than checks. Also, using DLT may greatly reduce settlement times for  currency, derivatives, and securities transactions by improving  processes or reducing the number of entities involved in a transaction.  For example, one firm is using DLT to reduce settlement for securities  from 2 days to the same day.
Improved security: While credit and debit transactions have  traditionally transmitted sensitive information that can be hacked and  used to make fraudulent transfers, fintech providers’ mobile wallets  generally replace this sensitive information with randomly generated  numbers that mitigate the risk that transaction information can be  used fraudulently (tokenization), according to the Federal Reserve’s  Mobile Payments Industry Workgroup. Similarly, while lost or stolen  credit and debit cards can be used to make fraudulent payments, a  lost or stolen mobile device can have security features that protect a  mobile wallet from unauthorized use. For example, according to FTC,  mobile device features such as device passwords, fingerprint readers,  and face recognition software can help protect consumer accounts  from unauthorized access. Additionally, FCC notes in a consumer  guide that consumers’ ability to disable their mobile devices remotely  can help prevent fraudulent use of a consumer’s fintech provider  accounts if their mobile devices have been lost or stolen. Further,  mobile device Global Positioning System (GPS) data can help identify  suspicious activity in consumer accounts or to ensure that a mobile  phone being used at a particular merchant is actually at that location,  according to the Federal Reserve’s Mobile Payments Industry  Workgroup and others.

		Fintech Products Generally Pose Consumer Risks Similar to Those of Traditional Products

The literature we reviewed and stakeholders we interviewed also  identified potential risks fintech products pose to consumers, including  fraud, discrimination, and unsuitable advice. In general, these risks are  similar to those posed by traditional financial products. While laws that  apply to traditional products also apply to fintech products in most cases,  some fintech products pose additional risks that may not be sufficiently  addressed by existing laws. While the legal framework for consumer  protection applies to many of the risks associated with fintech products,  the extent to which consumers benefit from these protections is a function  of the existing regulatory framework and its coverage of fintech activity.  We discuss the regulatory framework for fintech products in greater detail  later in this report.

			Fintech Payments

Consumers face the risk of unauthorized transactions regardless of  whether they use a traditional or fintech firm to make payments. CFPB  officials we interviewed told us that some fintech products, such as mobile  wallets, increase the number of firms involved in a transaction, which may  increase the risk of unauthorized transactions. However, when  consumers fund their mobile wallets by linking to traditional funding  sources—debit or credit cards or bank accounts—consumer protection  laws such as the Electronic Fund Transfer Act and the Truth in Lending  Act generally apply. These acts and their implementing regulations  provide that consumers can dispute charges to these accounts and  liability for losses may be limited to $0 if disputes are made within  specified time frames.
Consumer protection laws, such as the Electronic Fund Transfer Act,  which apply to traditional funding sources, do not yet cover payments  funded by mobile wallet balances or mobile carrier billing. To address this  gap in protections for mobile wallet funds, CFPB issued a final rule on  prepaid accounts that will extend protections for error resolution and  liability for unauthorized transfers to prepaid account and mobile wallet  balances. This rule had previously been scheduled to become effective in  April 2018, but in January 2018, CFPB delayed the effective date of the  rule to April 1, 2019. However, fintech firms we interviewed told us that  even when certain consumer protections are not required by statute or  regulation, they voluntarily provide similar protections and disclose these  protections in their terms of service.
Agencies have also issued tips for consumers to safeguard their mobile  devices and identify fraudulent payments. Similarly, wireless carriers  have taken steps to mitigate fraudulent billing in response to enforcement  actions, including offering services that prevent third parties from adding  charges to consumer bills without consumers’ knowledge or permission— a practice known as “cramming.” However, FCC has found that fraudulent  billing continues to be a problem. FCC’s July 2017 proposed cramming  rule seeks to codify the agency’s existing prohibition against fraudulent  billing through language explicitly prohibiting wireless carriers from  placing third-party charges on consumers’ bills without consumer  verification. In addition, FCC and FTC have issued tips for consumers  and firms publicizing practices that help avoid cramming.
Consumers also face the risk their funds could be lost due to the failure of  their payment provider. Although consumers with funds in a bank account  have protection from this risk through federal deposit insurance up to  $250,000, consumers with funds in a mobile wallet may not be similarly  protected. To address this risk, some fintech firms deposit consumers’  mobile wallet balances into an FDIC-insured bank or savings association,  resulting in the funds being insured by FDIC up to the applicable deposit  insurance limit in the event of the failure of the bank or savings  association. Other fintech firms voluntarily disclose to consumers in their  terms and conditions that any mobile wallet balances they hold are not FDIC insured. However, according to the Conference of State Bank  Supervisors (CSBS), 49 states have laws that require fintech firms  engaged in money transmission or stored value to self-insure through  bonding, holding investments against funds held or transmitted, and  meeting minimum net worth requirements.
Further, consumers face the risk that their mobile wallet balances will not  be accessible in a timely manner. Under the Expedited Funds Availability  Act, banks are required to make customers’ deposited funds available to  them within prescribed time frames. For example, banks are typically  required to make funds a customer receives through an electronic  transfer available by the next business day. However, as nonbanks,  fintech firms are not subject to this act’s requirements and therefore do  not have to make mobile wallet balances available under the same time  frames. For example, one fintech firm we interviewed told us that most  transfers from mobile wallets to bank accounts make funds available by  the next business day, but certain circumstances, such as suspicious  account activity, may cause the firm to delay transfers a few days.  Another fintech firm we interviewed told us that transfer amounts are  limited based on anti-money laundering requirements. However, fintech  firms we spoke with voluntarily disclose the availability of funds and any  limits on access in the terms and conditions provided to customers when  they create their accounts. However, FTC recently settled with a fintech  payment provider for delays in fund accessibility experienced by its  users.  In its complaint, FTC charged that the firm had failed to disclose  that these funds could be frozen or removed based on the results of the  firm’s review of the underlying transaction. As a result, consumers  complained that at times, the firm delayed the withdrawal of funds or  reversed the underlying transactions after initially notifying them that the  funds were available.

			Fintech Lending

Consumers face risks associated with unclear terms and conditions  regardless of whether they borrow from a traditional or fintech lender. For  example, consumers could have difficulty understanding their repayment  obligations or how those terms compare to terms offered by other  lenders. However, the Truth in Lending Act requires lenders to provide  consumers with standardized, easy-to-understand information about the  terms of the loan and enables consumers to make claims against lenders  for violating Truth in Lending Act requirements.
Consumers also face risk of discrimination and unfair credit practices  regardless of whether they borrow from a traditional or fintech lender.  However, these risks may not be fully understood with fintech lenders that  use alternative underwriting standards and consumer data—such as  information on rent payments and college attended. For example, fintech  firms assessing applicants’ creditworthiness with criteria highly correlated  with a protected class—such as race or marital status—may lead to a  disproportionate negative effect. As with traditional lenders, federal fair  lending laws, such as the Equal Credit Opportunity Act, apply to fintech  lenders. In addition, some fintech lenders have taken steps that aim to  address this risk. For example, one fintech lender said it monitors the  effect any changes to their underwriting models may have on fair lending  risk.
Consumers face risk of harm due to inaccurate credit assessments, but  these risks are also less understood with fintech lenders that use  alternative data to underwrite loans. For example, inaccurate data or  models used by a fintech lender could classify borrowers as higher credit  risks than they actually are. This could result in those borrowers paying  unnecessarily high interest rates and increasing their risk of default or  could result in creditworthy borrowers being denied credit. Whereas the  Fair Credit Reporting Act requires that borrowers have an opportunity to  check and correct inaccuracies in credit reports, borrowers could face  more challenges in checking and correcting alternative data that some  fintech lenders use to make underwriting decisions because alternative  data are not typically reflected in credit reports. However, the Equal  Credit Opportunity Act requires lenders, including fintech lenders, that  deny credit to applicants to disclose the specific reasons for denial.  Alternatively, if the fintech lender’s underwriting is too lax, loans could be  made to borrowers who lack the ability to repay them. Borrowers who  default under these circumstances then face limited access to and higher  prices for credit in the future.

			Fintech Wealth Management

Consumers face risks of receiving unsuitable investment advice  regardless of whether they obtain advice from a traditional or robo- adviser. While a human adviser may be able to mitigate this risk by  probing consumers for more information to assess needs, risk tolerance,  or other important factors, a robo-adviser’s ability to mitigate this risk may  be based on a discrete set of questions to develop a customer profile. In  addition, advisers could make inaccurate or inappropriate economic  assumptions, perhaps due to a failure to factor in changing economic  conditions, which could result in flawed investment recommendations.  While human advisers may be able to mitigate this risk to some degree  based on their ability to adjust to economic conditions, a robo-adviser’s  ability to mitigate this risk is based on whether its algorithm has been  updated to reflect the most recent economic conditions. Because, as we  discuss below, robo-advisers generally are required to comply with the  same requirements as traditional investment advisers, customers of robo- advisers and traditional advisers receive the same protection from these  risks.
Consumers who use fintech services that provide an aggregated view of  their accounts at other financial institutions could potentially be more  exposed to losses due to fraud. If a consumer authorizes an account  aggregator to access their financial accounts and grants the aggregator  authority to make transfers, the consumer may be liable for fraudulent  transfers made. CFPB is studying risks associated with entities that rely  on access to consumer financial accounts and account-related  information, and has issued a related request for information (we address  this issue later in this report).

			Distributed Ledger Technology

DLT can be used to issue and distribute digital assets known as tokens to  consumers and investors. Virtual currencies—tokens that are digital  representations of value that are not government-issued legal tender— could pose some unique risks to consumers. For example, the ability of  virtual currency users to recover funds lost due to fraud or errors may be  more limited than that of customers using traditional products like  payment cards or bank transfers to make payments. Whereas traditional  transactions can be reversed to correct fraud or errors, many virtual  currency transactions are designed to be irreversible. Also, unlike  storing dollars in a bank account, if a consumer stores their virtual  currency in a mobile wallet, their wallet provider may disclaim  responsibility for replacing virtual currency that is stolen. Further, CFPB’s  prepaid accounts rule, which will extend consumer protections to prepaid  cards and mobile wallets with stored value, explicitly does not extend  consumer protections to virtual currencies. However, firms that transmit,  exchange, hold, or otherwise control virtual currency may be subject to  state consumer protection law.
In addition to fraud and errors, consumers who use virtual currencies may  face other risks of loss. Federal deposit insurance does not apply to  virtual currency balances. As a result, according to FDIC staff, consumers  could face losses if they store their virtual currencies with a mobile wallet  firm that goes out of business unless the firm offers private insurance.  Further, if consumers store their virtual currency on their own and  misplace or forget their account access information, they may lose access  to their funds. Unlike bank accounts for which users can reset passwords  or usernames, some wallets do not offer a way to reset such information.  To help consumers address these risks, federal agencies and state  regulators have issued documents publicizing practices that may help  consumers use virtual currency more safely.
Tokens—which may also function similarly to a security—could pose  some unique risks to investors, and some investor protections may not be  available. Token sales, sometimes known as initial coin offerings or ICOs,  are being used by firms to raise capital from investors and may pose  investor risks, including fraud and theft. For example, one firm allegedly  promised investors it would invest its token sale earnings in real estate,  but instead allegedly defrauded investors of their investments. Fraud  and theft are risks of other securities offerings, and investors receive  protections from these risks under the Securities Act of 1933 and the  Securities Exchange Act of 1934 for token sales that meet SEC’s  definition of a security. However, these protections do not apply to  investors who participate in token sales that do not meet the definition of  a security. In December 2017, SEC issued a cease-and-desist order to  one firm for failure to register their token sale with SEC. In addition,  SEC has reported that an investor’s ability to recover funds may be  limited if key parties to token sales are located overseas or operating  unlawfully. To help investors address these risks, SEC and FINRA have  issued documents publicizing risks of token sale investment.
Tokens traded on a platform may also be considered commodities and  may pose investor risks including fraud and theft. Platforms that facilitate  leveraged, margined, or financed trading of tokens may be subject to a  requirement to register with the CFTC. To help investors understand  tokens, CFTC has issued a report publicizing potential risks of virtual  currencies and clarifying cases in which investors may be at risk because  CFTC does not have oversight authority. For example, virtual currency  and token exchanges that conduct certain spot or cash market  transactions but do not use leverage, margin, or financing are not  required to follow all of the rules that regulated exchanges are required to  follow.
DLT applications may pose other unknown risks compared to the  technologies and processes they replace, given that the technology is in  the early stages of development. For example, CFTC and the Federal  Reserve have identified cybersecurity and operational risks as potential  risks of DLT. FDIC officials said that finality of a transaction under a DLT  settlement may potentially raise legal challenges. Also, applications of  DLT that depend on consensus for validating transactions are vulnerable  to a “51 percent attack,” which could defraud consumers by revising their  transactions or sending fraudulent payments. However, according to  market observers, such an attack is unlikely and has not been carried out.

		Fintech Products Can Pose Other Risks to Consumers; Risks to the Broader Financial System Are Unclear

Consumers face the risk of financial loss due to data breaches regardless  of whether they use a traditional or fintech firm, and these breaches could  undermine the financial system by eroding consumer trust in financial  institutions. Similar to traditional products and services that collect  sensitive consumer information and are connected to the Internet, fintech  products and services may be vulnerable to cyberattack and can pose  data security risks. In addition, one market observer we interviewed told  us that hackers may target these new fintech firms before their security  systems are mature.
However, according to literature we reviewed and fintech firms and  market observers we interviewed, some fintech firms have adopted  technologies or practices designed to mitigate security risks. For  example, new fintech firms can use the latest information technology  systems to secure their products instead of having to update older  systems. Additionally, as discussed above, some fintech firms use new  techniques and leverage mobile device features to enhance data security,  and one fintech firm said that it also uses technology that contacts clients  if a data breach issue arises. Like traditional financial institutions, rules  and guidelines implementing the Gramm-Leach-Bliley Act (GLBA)  generally require fintech firms to secure customer information. In  addition, some regulators have issued guidance to consumers publicizing  practices that help avoid security problems when using fintech products.  Regulators have also issued guidance to businesses including fintech  firms that recommends that they adopt policies and procedures that  address the prevention and detection of, and response to, cybersecurity  threats. For example, the New York State Department of Financial  Services requires regulated entities to meet cybersecurity requirements  outlined in regulation.
Some fintech firms may also pose privacy concerns because they may  collect more consumer data than traditional firms. For example, fintech  lenders that use alternative data in underwriting may have sensitive  information about consumers’ educational background, mobile phone  payments, or other data. One fintech firm we spoke with requires  consumers to provide additional data, such as what a payment is for, in  order to make peer-to-peer payments. Some data aggregators may hold  consumer data without disclosing what rights consumers have to delete  the data or prevent the data from being shared with other parties. A leak  of these or other data held by fintech firms may expose characteristics  that people view as sensitive. GLBA generally requires fintech firms and  traditional financial institutions to safeguard nonpublic personal  information about customers. According to literature we reviewed and  fintech firms and market observers we interviewed, as with data security,  some fintech firms use new technologies or mobile device features to  mitigate data privacy risks. In addition, some regulators have issued  guidance to consumers publicizing practices that help maintain privacy  when using online products and services, including those provided by  fintech firms. Regulators have also issued GLBA guidance to  businesses including fintech firms recommending that they adopt policies  and procedures to prevent, detect, and address privacy threats.
Similar to traditional products and services, fintech products may be used  to facilitate illicit activities, including money laundering, terrorist financing,  and evading sanctions program requirements. For example, in 2015, the  Financial Action Task Force (FATF) reported that new payment methods  pose an emerging terrorist finance vulnerability because users can  access these methods from anywhere in the world and it is difficult for  enforcement agencies to identify the beneficiary. However, FATF found  that the extent to which terrorist groups actually exploit these  technologies is unclear and said that enforcement agencies should  monitor these risks for developments. Further, FATF has stated that  fintech innovations provide an opportunity to bring anti-money laundering  efforts into the 21st century by reducing dependency on cash and  informal systems and making it easier for authorities to detect and follow  illicit financial flows. Relevant laws that prohibit financial crimes apply to  fintech products. For example, the Bank Secrecy Act (which established  reporting, recordkeeping, and other anti-money laundering requirements)  and economic sanctions programs (which create economic penalties in  support of U.S. policy priorities) apply to all financial firms that transmit  money regardless of whether they use traditional or fintech products.
Finally, market observers have questioned whether fintech activities could  create risks to overall financial stability, but many have said such risks are  relatively minimal due to fintech firms’ small market presence. While  direct or indirect linkages between large financial institutions could lead  financial problems at one firm to create similar problems for other firms  that can undermine financial stability, studies by regulators in various  countries and international organizations found that fintech firms have not  generally reached a level of interconnectedness where their financial  distress would threaten the stability of other financial system  participants. For example, the Bank for International Settlements and  the Financial Stability Board reported that in 2015 fintech accounted for 2  percent of new credit in the United States. Additionally, after assessing  virtual currencies, the European Central Bank concluded in a November  2017 report that virtual currencies were not a threat to financial stability  due to their limited connection with the real economy, their low volume  traded, and the lack of wide user acceptance.
However, the Financial Stability Board and other market observers have  noted that fintech firms could potentially affect financial stability in both  positive and negative ways as the activities and firms evolve. For  example, fintech firms could help decentralize and diversify the financial  services market, and they could diversify exposure to risk by increasing  access to financial services for consumers and small businesses. On the  other hand, providers could potentially also increase risks to financial  stability. For example, robo-advisers could amplify swings in asset prices  if their risk models rely on similar algorithms, making the portfolio  allocation methods of robo-advisers more highly correlated than those of  traditional advisers, although according to the Financial Stability  Oversight Council, this risk could also arise if traditional advisers follow  similar allocation strategies. Similarly, according to the Financial Stability  Board, fintech lenders could potentially amplify swings in credit availability  if the investors that fund many marketplace lending products are more  willing to fund loans during market upturns or less willing to fund loans  during market downturns. To help balance these potential benefits and  risks, the Financial Stability Board recommended that international bodies  and national authorities continue to monitor the issues and consider the  effects of fintech in their risk assessments and regulatory frameworks.

	Fintech Firms’ Compliance with Applicable Laws Is Subject to Varied Federal Oversight

The extent to which fintech firms are subject to federal oversight of their  compliance with applicable consumer or other laws varied. Fintech firms  that offer investment advice typically register with and are subject to  examinations by federal securities regulators. Some fintech firms  providing payments or loans that have partnered with federally regulated  banks or credit unions may receive indirect oversight from federal  financial regulators as part of their efforts to ensure that their regulated  entities are adequately managing the risks of these arrangements.  Nonpartnered fintech firms would not typically be subject to routine  examinations by a federal financial regulator but would instead be subject  to state regulatory oversight and enforcement. While fintech firms and  financial institutions are subject to different degrees of routine federal  oversight, we found that indications of fintech firms causing widespread  harm were limited as they were subject to fewer complaints than large  financial institutions.

		Fintech Firms Providing Investment Advice Are Subject to the Same Oversight as Traditional Financial Institutions

Fintech robo-advisers offering wealth management advice would  generally be subject to the same federal and state oversight as traditional  investment advisers. Under the Investment Advisers Act of 1940 and  state securities laws, any entity or individual that offers investment advice  for compensation generally must register as an investment adviser—with  SEC or states—and adhere to various reporting and conduct  requirements. When providing advice, investment advisers—traditional  or fintech—are considered fiduciaries to their clients, which means they  owe a duty of care and loyalty to their clients, and they must disclose all  actual or potential conflicts of interest, and act in their clients’ best  interest. To review for compliance with this standard and other applicable  requirements, staff from SEC and state securities regulators conduct  examinations of registered investment advisers. Specifically, state  regulators are responsible for conducting examinations of investment  advisers that operate in fewer than 15 states and hold client assets under  management of less than $100 million. However, according to staff from  the North American Securities Administrators Association—a membership  organization for state, provincial, and territorial securities administrators in  the United States, Canada, and Mexico—no robo-adviser firms were  solely regulated by the states as of October 2017.

		Fintech Firms That Partner with Financial Institutions May Be Subject to Indirect Federal Financial Regulator Oversight

Some fintech firms may be subject to indirect federal oversight as part of  relationships they have entered into with regulated financial institutions. If  fintech firms partner with federally-regulated financial institutions, such as  a bank or credit union, federal financial regulators may conduct  examinations of the regulated financial intuition that could include some  review of the extent to which the fintech firm may affect the partner  financial institution’s adherence to relevant regulations through the  services provided to the financial institution. Regulators conduct these  examinations in order to assess the risk to the regulated institution  because the failure of the fintech firm to follow such laws could expose  the bank or credit union to financial or other risks.
As part of the indirect oversight of fintech firms, the financial institution  would be expected by its regulators, under various third-party guidance  issuances by these regulators, to ensure that any risks to the institution  resulting from the relationship with the fintech firm are assessed and  mitigated. Among other things, banks and credit unions should conduct  due diligence on potential third-party partners, including having a process  within the institution for managing the risks posed to their institution by the  third party. For example, OCC third-party guidance states that banks  should adopt risk management processes that are commensurate with  the level of risk and complexity of the third-party relationship. These  processes include establishing risk-mitigating controls, retaining  appropriate documentation of the bank’s efforts to obtain information on  third parties, and ensuring that contracts meet the bank’s compliance  needs.
Although fintech firms partnering with federally regulated institutions  would be expected to follow the practices in this guidance, the extent to  which they would be overseen by a federal financial regulator was limited.  For example, FDIC and OCC staff told us that they had examined a  fintech firm that provides financial account aggregation services to  regulated institutions. This review focused on the fintech firm’s data  security rather than its activities with consumers. FDIC staff also said they  conducted exploratory discussions with some fintech lenders, but these  firms were not part of their technology service provider examination  program. However, as of November 2017, FDIC and OCC staff noted that  they had not completed examinations of fintech firms within our scope.  NCUA staff noted that NCUA does not have authority to examine services  provided to credit unions by third-party service providers. In order to  examine any services provided to credit unions, NCUA must rely on credit  unions voluntarily providing information on the third-party service  provider. However, NCUA’s staff noted some of their examiners had  accompanied state regulators in an examination that involved a credit  union’s partnership with a fintech payments firm.

		Other Fintech Firms Are Not Routinely Overseen by Federal Financial Regulators, but Are Subject to State Oversight

Fintech firms not providing investment advice or partnered with federally- regulated financial institutions would be subject to routine oversight by a  federal regulator only under certain circumstances. For example, CFPB  could examine some fintech firms as a result of its examination  authorities. Specifically, it has supervisory authority over certain  nondepository institutions, including mortgage lenders and servicers,  payday and student loan providers, and “larger participants” in consumer  financial product and service markets, which could include fintech  providers. CFPB has conducted or plans to conduct examinations of  fintech firms that meet the agency’s definition of ‘“larger participants” in  sectors for which they have designated such participants. For example,  according to CFPB staff, it has conducted a stand-alone examination of a  fintech payments company that provides international remittances, and it  has scheduled an examination of a fintech lender that provides student  loans. As of October 2017, it had not defined other “larger participants”  specifically for other markets in which fintech firms may be active, but it is  considering a proposed rule to supervise larger participants in the  personal loan markets, which might include larger fintech lenders. CFPB  may also conduct examinations of individual companies that it determines  pose risks to consumers, as identified in public orders. Furthermore,  CFPB’s supervisory authority also extends to third-party service providers  of nondepository institutions overseen by the agency.
Fintech firms may also be subject to examinations related to their  compliance with anti-money laundering laws and related requirements.  FinCEN, which is responsible for administering federal anti-money  laundering laws, has authority to examine any fintech firms conducting  money transmission, according to Treasury officials. These firms would  be required to comply with the applicable anti-money laundering and  counter-terrorist financing requirements, including registering with  FinCEN, establishing anti-money laundering programs, and reporting  suspicious activities to FinCEN. However, FinCEN delegates routine anti- money laundering examinations of federally-chartered or registered  financial institutions to the federal financial institution regulators. In other  cases, firms subject to anti-money laundering requirements, including  fintech payments or lending firms, could be examined by state regulators  and the Internal Revenue Service.
Fintech firms not subject to routine federal supervisory oversight would  instead generally be subject to state oversight. As of October 2017, 49  states, as well as the District of Columbia, Guam, Puerto Rico, and the  U.S. Virgin Islands, required entities that provide money transfer  services—which may include some fintech payments firms—to obtain  licenses to conduct such activities in their jurisdictions according to  documents from state regulator associations and CSBS staff. In  addition, all states and the District of Columbia required lending licenses  for consumer lenders operating in their states, according to CSBS staff.
Furthermore, some states have created or provided guidance on licensing  statutes in order to include virtual currencies. For example, in 2015 New  York finalized a new license for virtual currency businesses under New  York’s financial services law.
State regulators in these jurisdictions conduct examinations of the firms  that hold licenses to assess their compliance with safety and soundness  and various other requirements. In addition, CSBS staff stated that as of  February 2018, approximately 37 states authorize state regulators to  examine banks’ third-party service providers—which could include fintech  companies.
According to state regulators we interviewed in Illinois, New York, and  California, their agencies use the same approach to regulate and  examine fintech firms and traditional financial institutions providing similar  services. Furthermore, according to state regulatory associations and  some state regulatory agencies, fintech firms such as money transmitters  undergo regular supervision through on-site examinations to monitor  compliance with federal and state capital, liquidity, and consumer  protection requirements. For example, Money Transmitters Regulators  Association staff said that state regulators examine MSBs at least every 3  years depending on risk assessment and previous examination record,  and that state examinations cover federal and state laws, including data  security and anti-money laundering requirements. Similarly, staff from one  state regulator noted that they conduct consumer protection examinations  of direct lenders and take enforcement action if they identify potential  violations. CSBS staff noted that state requirements do not differ for  fintech firms because the requirements and examinations are activity- based. For example, most states have anti-money laundering  requirements within their money transmitter license laws. Due to state  anti-money laundering examination cycles, CSBS staff stated that MSBs  licensed in 40 or more total states experience an examination at least  once every 14 months.

		Fintech Firms Can Be Subject to Enforcement Actions by Federal and State Regulators

Outside of examinations, fintech firms that violate federal and state  regulations can be subject to enforcement actions by federal and state  agencies with such authorities. The OCC, Federal Reserve, and FDIC  may have enforcement jurisdiction over fintech firms when the fintech firm  is an “institution affiliated party” under the Federal Deposit Insurance Act  or a service provider under the Bank Service Company Act. In addition,  CFPB can take enforcement action against institutions under its  jurisdiction for noncompliance with federal consumer protection laws. For  example, in 2016, CFPB used its unfair, deceptive, or abusive acts or  practices authorities to investigate and issue a consent order against a  fintech firm operating an online payment system, which CFPB determined  had made deceptive data security claims to customers. FTC can also  take enforcement actions against fintech firms not registered or chartered  as a bank for violations of any federal consumer laws FTC enforces,  including the FTC Act’s prohibition against unfair or deceptive acts or  practices. For example, in 2015, FTC took action against the providers of a smartphone application, alleging that they deceived consumers and  installed hidden malicious software code to generate virtual currencies for  the providers without consumer permission. It can also bring  enforcement action against non-bank service providers that maintain or  process customer information under its GLBA authority.
Other federal entities can pursue enforcement action against fintech  firms. The Department of the Treasury’s Office of Foreign Assets Control  can take action against fintech firms that violate U.S. sanctions  regulations. In addition, FinCEN can also pursue enforcement measures  against fintech firms that transmit funds—such as certain fintech payment  and lending firms—due to its authority to enforce compliance with the  Bank Secrecy Act’s anti-money laundering and prevention of terrorist  financing provisions. For example, FinCEN took enforcement action in  May 2015 against the fintech firm Ripple—a company that allows users to  make peer-to-peer transfers in any currency using a DLT-enabled  process—for violating anti-money laundering requirements through its  sale of virtual currency. In 2016, CFTC brought an enforcement action  against a Hong Kong-based fintech firm for offering illegal off-exchange  financed retail commodity transactions in bitcoin and other  cryptocurrencies, and for failing to register as a futures commission  merchant.
Finally, state regulators can also take enforcement action against  financial institutions and fintech firms that violate state data security or  consumer protection laws. In addition, state attorneys general may bring  actions against fintech companies through consumer protection and  deceptive trade practice acts, according to the National Association of  Attorneys General.

		In Some Cases, Fintech Firms May Not Be Subject to Financial Regulator Oversight

Some fintech companies may not be subject to any federal or state  financial oversight if they do not meet federal or state definitions of a  money service or other regulated business. For example, some fintech  payments firms—such as certain mobile wallet providers—might not be  subject to state or federal money service business requirements because  their role in the payment process does not specifically involve transmitting  money, according to state and federal regulators. One mobile wallet  provider claimed that it is not subject to federal financial regulatory  oversight because it does not transfer funds or authorize transactions, but  instead facilitates the transfer of customer data as part of the credit card  or debit card networks; it also does not retain any of its consumers’  personal data, including data on purchase content, location, or dollar  amount.

		Indications of Fintech Activities Creating Widespread Consumer Harm Appear Limited Compared to Traditional Providers

Available regulatory data show that the number of consumer complaints  against fintech activities appears modest compared to traditional  providers. For example, although our analysis of the CFPB’s consumer  complaint database has limitations in assessing risk, the number of  published complaints submitted against several prominent fintech firms  from April 2012 through September 2017 included in this database was  generally low, when compared to select large financial institutions. Our  analysis showed that for 13 large firms offering fintech payments, lending,  investment advice, financial account aggregation, or virtual currencies,  only 5 of the firms had complaints in the CFPB database, with 4 having  received fewer than 400 complaints. The largest number of published  complaints had been submitted against a large fintech payment provider  with over 3,500 published complaints. Further, the number of published  complaints submitted against the fintech payment provider was relatively  small compared to the number of published complaints submitted against  other, often larger financial institutions. For example, our analysis showed  that 10 large financial institutions each received between approximately  14,300 and 67,300 total complaints April 2012 through September  2017.
In addition, various federal regulators, including CFPB and FTC, can  address the risk of consumer harm by taking actions against fintech firms  for deceptive or unfair acts or practices when warranted. For example, in  2016, FTC reached a settlement with a firm that sold machinery designed  to create virtual currencies—a process known as mining—and allegedly  had been deceiving its customers about the availability and profitability of  the machinery. As noted earlier, FTC also settled with a fintech payment  provider in February 2018 over complaints by thousands of consumers  the company had received regarding confusion over its funds availability  practices. Additionally, in 2016 CFPB assessed a $100,000 civil penalty  against a fintech payments firm for deceiving consumers about its data  security practices and the safety of its online payment system.

	The U.S. Regulatory Environment Poses Various Challenges to Fintech Firms

Fintech firms can find that the complexity of the U.S. financial regulatory  system creates challenges in identifying the laws and regulations that  apply to their activities, and that complying with state licensing and  reporting requirements can be expensive and time-consuming for mobile  payment providers and fintech lenders. Also, federal agencies could  improve collaboration and clarify issues related to financial account  aggregation by making sure that interagency efforts dedicated to fintech  include all relevant participants and incorporate other leading practices. In  addition, because banks are liable for risks posed by third parties, fintech  firms may face delays in entering into partnerships with banks.

		Challenges with Complexity of Financial Regulatory Structure

The complex U.S. financial regulatory structure can complicate fintech  firms’ ability to identify the laws with which they must comply and clarify  the regulatory status of their activities. As noted in our past reports,  regulatory oversight is fragmented across multiple regulators at the  federal level, and also involves regulatory bodies in the 50 states and  other U.S. jurisdictions. Fintech firms and other stakeholders we  interviewed told us that it was difficult for fintech firms to navigate this  structure. In particular, understanding the laws and regulations that may  apply to fintech firms was not easy because existing regulations were  sometimes developed before the type of product or service they are now  offering existed. In addition, the cost of researching applicable laws and  regulations can be particularly significant for fintech firms that begin as  technology start-ups with small staffs and limited venture capital funding.  Fintech payments and DLT firms and other market participants told us  that navigating this regulatory complexity can result in some firms  delaying the launch of innovative products and services—or not launching  them in the United States—because the fintech firms are worried about  regulatory interpretation. For example, staff from one U.S. firm that  developed a DLT payments technology told us that they and their peers  only work with foreign customers due to the fragmented U.S. financial  regulatory structure and lack of unified positions across agencies on  related topics.
However, several U.S. regulators have issued rules and guidance to help  fintech firms understand where their products and services may fit within  the complex financial regulatory structure, as shown in the following  examples.
In December 2017, the Federal Reserve’s Consumer Compliance  Outlook newsletter included an article that offered financial institutions  and fintech firms general guideposts for evaluating unfair and  deceptive practices and fair lending risk related to fintech, with a focus  on alternative data. Also, in 2016, a special edition of Consumer  Compliance Outlook focused on fintech, including summarizing  relevant federal laws, regulations, and guidance that may apply to  mobile payments, fintech lending, and digital wealth management.  For example, the newsletter listed laws and regulations related to  credit, privacy, and data security; anti-money laundering  requirements; and consumer and investor protection.
In 2016, CFPB issued a final rule that will extend wide-ranging  protections to consumers holding prepaid accounts, including peer-to- peer payments and mobile wallets that can store funds. Also, in  2015, CFPB issued a set of nonbinding consumer protection  principles for new faster payment systems, which outline CFPB  expectations for payment services providers.
In February 2017, SEC issued updated guidance on robo-advisers  that addresses the substance and presentation of disclosures  provided to clients on the robo-adviser and the investment advisory  services it offers, the obligation to obtain information from clients to  ensure that recommended investments are suitable, and the need to  implement effective compliance programs reasonably designed to  address the unique nature of providing automated advice. Similarly,  in March 2016, FINRA issued a report on effective practices related to  digital investment advice and reminded FINRA-registered broker- dealers of their obligations under FINRA rules.
In 2013, FinCEN issued guidance that clarified the applicability of anti- money laundering and related regulations to participants in certain  virtual currency systems, and in 2014 FinCEN issued administrative  rulings that further clarified the types of market participants to which  the 2013 guidance applies.
In October 2017, CFTC issued a report on virtual currencies that  explains that it considers virtual currencies to be commodities,  outlines related examples of permissible and prohibited activities, and  cautions investors and users on the potential risks of virtual  currencies.
In July 2017, SEC issued a report on DLT token sales, which cautions  market participants that sales with certain characteristics may be  subject to the requirements of federal securities laws. In general,  the report uses one company’s token sale as an example to illustrate  how SEC could consider a token sale to be a securities offering, and  why companies offering such products would have to register the  offering with SEC or qualify for an exemption. In August 2017, FINRA  also issued an investor alert on DLT token sales, which includes  questions for investors to ask before participating in such sales.
In January 2017, FINRA issued a report on DLT uses more broadly,  which outlines key regulatory considerations for firms that want to use  DLT in equity, debt, and derivatives markets. For example, the  report outlines securities-related regulatory considerations for DLT  applications that could alter securities clearing arrangements, be used  for recordkeeping by broker-dealers, or change the equity or debt  trading process, among other things.

		Challenges Complying with Numerous State Regulatory Requirements

As mentioned previously, although federal oversight applies to some  fintech firms, fintech payments and lending firms not subject to routine  federal oversight must typically obtain state licenses based on their  activities. Banks can choose to be chartered at the state level or as a  national bank, which generally exempts them from state licensing  requirements and examination. In contrast, fintech payment providers  operating as MSBs—including those using DLT—and fintech firms  offering consumer loans must typically hold licenses in each state in  which they operate. Similarly, as mentioned above, small robo-advisers  would generally have to be licensed in states in which they wish to  operate.
State regulators and other market observers we interviewed told us that  they believe state regulation of fintech firms provides benefits. Several  market participants and observers said that states understand the needs  of their local economies, consumers, and market participants and can use  their authorities to craft tailored policy and regulation. For example, New  York regulators created a special license for virtual currency firms. New  York regulators told us that they did so because of New York’s status as a  financial and innovation hub, as well as activities and concerns of virtual  currency firms operating within their jurisdiction. In addition, state  regulators may complement the federal oversight structure by dedicating  additional resources to helping educate fintech firms on regulatory  requirements and making sure that firms follow these requirements. For  example, two state regulators told us that they work closely with many  fintech start-ups to help educate them on regulatory requirements before  they apply for licenses or begin operations, and a state regulatory  association told us that fintech firms and state regulators often meet to  discuss regulatory concerns. Representatives of a state regulatory  association told us that federal agencies also rely increasingly on state  examinations to ensure compliance with anti-money laundering  requirements.
Similarly, an industry association and state regulators told us that they  believe states are very responsive to consumer complaints. For example,  one state regulator told us that they investigate hundreds of consumer  complaints per month and believed they often resolved consumer  complaints more quickly than their federal consumer protection  counterparts, although CFPB staff told us that CFPB handles thousands  of complaints per month. California regulators also told us they have  initiated their own investigations into the extent to which fintech lenders  comply with state lending and securities laws, and risks that fintech  lenders may pose to consumers and to markets.
However, complying with fragmented state licensing and reporting  requirements can be expensive and time-consuming for mobile payment  providers and fintech lenders. For example, stakeholders we interviewed  said that obtaining all state licenses generally costs fintech payments  firms and lenders $1 million to $30 million, including legal fees, state  bonds, and direct regulatory costs. Also, market participants and  observers told us that fintech firms may spend a lot of time on state  examinations because state exam requirements vary and numerous  states may examine a fintech firm in 1 year. For example, staff from a  state regulatory association said that states may examine fintech firms  subject to coordinated multistate exams 2 or 3 times per year, and as  many as 30 different state regulators per year may examine firms that are  subject to state-by-state exams.
Although these challenges are not unique to fintech firms, they may be  more significant for fintech firms than for other MSBs and lenders. For  example, some MSBs and lenders operate in a limited geographic area  that can require them to be licensed by one state only. Other firms  operate in multiple states or nationwide, but may have started with a  license in one state and then obtained additional licenses and spread  these compliance costs as they grew over time. In contrast, fintech firms  are generally online-only businesses that likely seek to operate  nationwide from their inception, which immediately requires licenses in all  states and generates higher up-front compliance costs that may strain  limited venture capital funding. For example, one firm we interviewed that  funds fintech start-ups told us that one of their fintech firms spent half of  the venture capital funds it had raised obtaining state licenses. As a  result, some firms may choose not to operate in the United States. For  example, one DLT provider we interviewed told us that although they are  based in the United States, they operate abroad exclusively because  state licensing costs are prohibitively expensive.
Bank partnerships and specialized operating charters offered by federal  and state banking regulators may help fintech firms more easily operate  nationwide by generally preempting state licensing requirements. For  example, some fintech payments firms and fintech lenders have chosen  to partner with nationally chartered and state-chartered banks, which  allows them to operate nationwide without having to obtain individual  state licenses. Also, two fintech lenders have applied for an Industrial  Loan Corporation (ILC) charter, an FDIC-supervised state banking  charter, which commercial firms other than regulated financial institutions  can obtain in certain states to operate nationally. Such ILCs would also  be overseen by FDIC if they obtain FDIC deposit insurance.
In addition, in December 2016, OCC announced its intent to consider  applications for special-purpose national bank charters from fintech firms  such as lenders, which would allow such firms to operate nationally under  a single national bank charter if finalized. However, OCC officials we  interviewed told us that this special-purpose national bank charter is on  hold because they are still reviewing whether to go forward with the  proposal, and CSBS has filed a lawsuit against OCC challenging the  fintech charter. Some fintech lending firms and an industry association  representing payments firms have expressed interest in applying for this  special charter, but other stakeholders we interviewed told us that the  proposed fintech charter may not be a good option for small fintech firms  if the capital requirements are the same as those for banks.
In addition, state regulators are taking steps to make it easier for fintech  firms seeking to operate across multiple states. For example, CSBS staff  we interviewed told us that states leverage the Nationwide Multistate  Licensing System—which enables firms to submit one application with  information that fulfills most of the licensing requirements of each state  that participates in this system. Staff from CSBS, some fintech firms,  and an industry observer we interviewed said that although the multistate  licensing system has reduced administrative requirements somewhat,  firms still have to make additional filings to address certain requirements  unique to some states. In February 2018, seven state regulators also  agreed to standardize key elements of the MSB licensing process and  mutually accept licensing findings. Additionally, in 2013, state  regulators established the Multi-State MSB Examination Taskforce, which  coordinates and facilitates multistate supervision of MSBs.  CSBS staff  told us that multistate exams have made the state MSB exam process  more efficient for state regulators and MSBs.
In May 2017, the CSBS also announced they would be expanding efforts  to modernize state regulation of fintech firms. For example, under this  initiative, officials we interviewed told us they plan to redesign their multistate licensing system to provide a more  streamlined licensing process for new applicants and shift state  resources to higher-risk cases by 2018; plan to harmonize multistate supervision by establishing model  approaches to key aspects of nonbank supervision, making  examinations more uniform, identifying and reporting violations at the  national level, and creating a common technology platform for  examinations by 2019; and have formed a fintech industry advisory panel—with sub-groups on  payments, lending, and banking—to identify licensing and regulatory  challenges.

		Challenges with Interagency Collaboration

Although a few fintech market participants and observers we interviewed  told us that they thought regulatory collaboration on fintech was sufficient,  the majority of market participants and observers we interviewed who  commented on interagency collaboration said that it could generally be  improved. Some also cited additional areas in which better interagency  collaboration could facilitate innovation:
Use of alternative data and modeling in fintech lending. Fintech  lenders may face challenges because agencies with authorities  related to consumer protection and fair lending have not issued  guidance on the use of alternative data and modeling. For example,  one fintech lender we interviewed told us that they discussed using  alternative data to assess creditworthiness with FDIC and FTC, but  they do not understand what each agency might consider to be an  unfair, deceptive, or abusive practice because the agencies have not  coordinated positions. Staff we interviewed from two consulting firms  that advise on fintech told us that lack of clarity or coordination on fair  lending and use of alternative data and modeling creates uncertainty  for fintech lenders. This has led some fintech lenders to forgo use of  alternative data for underwriting purposes since they do not know if it  will produce outcomes that violate fair lending laws and regulations.  However, FDIC staff told us that FDIC applies the same standards as  FTC in determining whether an act or practice is unfair or deceptive  and that existing guidance on fair lending applies broadly to traditional  and nontraditional modeling techniques and data sources.
OCC special-purpose national bank charter. A few market  participants and observers we interviewed told us that fintech  payment providers and lenders may face challenges because OCC  has not sufficiently coordinated with the Federal Reserve and FDIC on  OCC’s special-purpose national bank charter. Despite OCC  discussion with the Federal Reserve, the charter proposal does not  specify whether recipients could access the Federal Reserve  payments system. Federal Reserve officials have said that the  Federal Reserve will likely not take any policy positions or make any  legal interpretations about the proposed charter until OCC finalizes  the charter’s terms and a firm applies for a charter. Officials have said  that this is their position because the potential policy and legal  interpretation issues that could arise related to membership and  access to Federal Reserve services will require a case-by-case, fact- specific inquiry unique to any firm that moves forward with an  application. One fintech lender we interviewed told us that obtaining  consistent and complete information from OCC and the Federal  Reserve on the specific rights this charter would grant a fintech lender  had been challenging, and that this lack of consistency and clarity  could discourage fintech firms from applying for the charter. However,  OCC staff we interviewed told us that the charter is not yet final and  that they facilitate communication between fintech firms that are  interested in the special charter and the Federal Reserve. Also, OCC  staff said that they briefed FDIC staff on the special charter, but will  coordinate further if appropriate.
Differing regulatory interpretation of consumer protection  requirements. As discussed above, fintech firms may be subject to  CFPB oversight and limited federal financial regulatory oversight if  they also partner with financial institutions. In addition, FTC and CFPB  can also take enforcement actions against fintech firms not registered  or chartered as a bank for violations of any federal consumer  protection laws they enforce. Fintech firms we spoke with said that  this can cause challenges because firms are concerned that  regulators may have different interpretations of what conduct might  merit consumer protection enforcement actions, and a research and  consulting firm we interviewed that works with fintech start-ups told us  that this is one of the industry’s biggest challenges. Similarly, the  potential for differing regulatory interpretation may limit the  effectiveness of agency efforts to innovate. For example, fintech firms  can apply for a CFPB No Action Letter, which is intended to reduce  regulatory uncertainty for financial products or services that promise  substantial consumer benefit but face uncertainty regarding consumer  protection requirements. However, some entities we spoke with said  that few firms have applied, in part because a letter provided by CFPB  may not preclude prudential regulators or FTC from taking  enforcement actions in cases where they have jurisdiction.
Although stakeholders indicated that agencies could improve interagency  collaboration on other fintech issues, federal agencies said that they  already collaborate through a variety of informal and formal channels at  the domestic and international levels. Domestically, in addition to informal  discussions and participation in fintech events hosted by other agencies,  some agencies have coordinated examinations of third-party service  providers and enforcement actions. For example, in 2014 and 2015,  CFPB, FCC, FTC, and state regulators coordinated on enforcement  actions related to unauthorized mobile carrier billing charges. Also, U.S.  agencies have had informal discussions regarding fintech with their  foreign counterparts. For example, Treasury staff have discussed  regulations designed to counter money laundering and terrorist financing  with officials from countries such as France and the United Kingdom. In  addition, federal agencies have begun to collaborate on fintech regulatory  issues through formal interagency working groups that are primarily  concerned with other financial regulatory issues. For example, at the  domestic level, U.S. prudential regulators have discussed issues related  to potential risks of fintech lending and DLT through the Financial Stability  Oversight Council. At the international level, the Federal Reserve  represents the United States at the Bank for International Settlements,  which has published papers on fintech topics including payments, fintech  lending, and DLT. For more information on these efforts and others, see  appendix II.
Further, federal agencies said that they have recently organized the  following interagency collaborative groups dedicated to fintech, as  detailed in appendix II:  In March 2017, the Federal Reserve convened the Interagency  Fintech Discussion Forum, an informal group which meets  approximately every 4 to 6 weeks and aims to facilitate information  sharing among consumer compliance staff from the federal banking  regulators on fintech consumer protection issues and supervisory  outcomes. Discussion topics have included account aggregation,  alternative data and modeling techniques, and third-party oversight.
In 2016, Treasury created the Interagency Working Group on  Marketplace Lending, which was active over the course of fiscal year  2016, meeting 3 times. This group shared information among  industry participants and public interest groups, and discussed issues  from a Treasury report on benefits and risks associated with online  marketplace lending.
In 2010, the Federal Reserve Banks of Atlanta and Boston created  the Mobile Payments Industry Workgroup to facilitate discussions  among industry stakeholders about how a successful mobile  payments system could evolve in the United States. This group also  functions as an interagency collaboration mechanism through biennial  meetings between industry stakeholders and relevant regulators that  update industry on regulatory concerns, identify potential regulatory  gaps, and educate regulators on mobile payment technologies.
However, we found that these groups do not include all relevant  participants. For example, NCUA was not included in the Interagency  Fintech Discussion Forum or the Interagency Working Group on  Marketplace Lending, and FCC has not participated in the biennial  regulator meetings of the Mobile Payments Industry Workgroup since  2012. Federal Reserve staff said that they did not include NCUA in the  Interagency Fintech Discussion Forum because NCUA is not a bank  regulator. Treasury staff noted that staff who could explain why NCUA  had not been invited to participate in the Interagency Working Group on  Marketplace Lending were no longer with the agency. Similarly, FCC staff  could not recall why they had not participated in recent biennial regulator  meetings of the Mobile Payments Industry Workgroup.
However, NCUA has experiences and perspectives that would make it a  relevant participant in the Interagency Fintech Discussion Forum, and  NCUA officials said that they would participate in these interagency  efforts if invited. NCUA would be a relevant participant because, although  it does not oversee banks, it oversees credit unions that have entered into  partnerships with fintech lenders and virtual currency exchanges, and  could enter into partnerships with other fintech firms. Similar to fintech  partnerships with banks, these partnerships could create risks related to  safety and soundness and consumer protection. Further, NCUA’s 2018– 2022 draft strategic plan includes fintech as a key risk to the credit union  system because fintech could provide a competitive challenge to credit  unions or take advantage of differences in how credit unions and fintech  firms are regulated, among other things.
Likewise, as Federal Reserve staff have acknowledged, FCC could be a  relevant participant in biennial regulators meetings of the Mobile  Payments Industry Workgroup because FCC could share valuable insight  on regulatory concerns related to mobile device security with other  regulators and industry participants. Specifically, FCC has facilitated and  encouraged industry efforts to improve security of mobile devices, on  which consumers make fintech payments, and has conducted related  consumer education efforts. FCC staff said they would consider  participating in future biennial regulator meetings of the Mobile Payments  Industry Workgroup if the topics discussed aligned with FCC’s work on  mobile device security.
Our past work has identified key practices relating to collaborative  mechanisms among agencies that increase their effectiveness, such as  including participants with the appropriate knowledge, skills, and  abilities. In addition, these key practices also state that an interagency  group should continue to reach out to potential participants who may have  a shared interest in order to ensure that opportunities for achieving  outcomes are not missed.
However, we found that interagency collaborative efforts dedicated to  fintech issues were not fully leveraging relevant agency expertise. Lack of  NCUA participation in the Interagency Fintech Discussion Forum may  preclude NCUA and the other participating agencies from sharing  information that could be useful in efforts to oversee the risks that fintech  poses to their regulated institutions. Similarly, lack of FCC participation in  the biennial regulators meetings of the Mobile Payments Industry  Workgroup could preclude industry participants from receiving updates on  FCC regulatory concerns related to mobile device security and could  preclude FCC from learning about new risks that fintech payments  products pose to mobile device security.
Furthermore, OCC and international bodies have identified fintech as an  area where collaboration among agencies can be helpful. For example,  OCC has stated that collaboration among supervisors can promote a  common understanding and consistent application of laws, regulations,  and guidance through steps such as establishing regular channels of  communication. At the international level, the Bank for International  Settlements has recommended that bank supervisors in jurisdictions  where responsibilities related to fintech are fragmented among a number  of regulators with overlapping authorities should collaborate with other  relevant agencies to develop standards and regulatory oversight for  fintech, as appropriate. Similarly, the Financial Stability Board has  suggested that responsible agencies further open lines of communication  to address cross-cutting fintech issues.

		Industry Disagreements on Aggregation of Consumer Financial Account Information Create the Need for Stronger Collaboration

Among other consumer protection issues related to financial account  aggregation, market participants do not agree about whether consumers  using account aggregators will be reimbursed if they experience  fraudulent losses in their financial accounts. While some account  aggregators negotiate contracts with the financial institutions that hold the  consumer accounts that are being aggregated, other account aggregators  have no relationship with the financial institutions holding the consumer  accounts that they access on behalf of those consumers. Officials from at  least one large bank have made public statements that they may not  reimburse losses from consumer accounts if the consumer provided his  or her account credentials to an account aggregator and fraudulent  activity subsequently occurs in the consumer’s account. In contrast, some  account aggregators and consumer protection groups have argued that  consumer protection law establishes that banks retain the obligation to  reimburse losses due to transactions not authorized by the consumers.
To date, CFPB and the Federal Reserve have taken varying public  positions on this disagreement among market participants, and some  regulators told us that they have held related discussions with market  participants and observers. In October 2017, CFPB issued principles for  consumer-authorized financial data sharing and aggregation that stated  that consumers should have reasonable and practical means to dispute  and resolve instances of unauthorized transactions. However, CFPB’s  principles are not binding and federal financial regulators have not issued  guidance or rules to clarify this issue. As previously mentioned, CFPB  also issued a request for information studying these topics to various  industry members, observers, and consumers in November 2016. A  member of the Board of Governors of the Federal Reserve System has  publicly stated that industry stakeholders will need to come to agreement  on which party bears responsibility for unauthorized transactions. Also,  Federal Reserve staff told us that some financial institutions and account  aggregators are negotiating contractual arrangements that could address  this issue on a case-by-case basis. In addition, staff from FDIC, the  Federal Reserve, and OCC said that they have discussed related issues  with market participants and observers.
The financial regulators have recently begun to hold collaborative  information sharing discussions on consumer compliance issues  surrounding financial account aggregation, but this collaboration has not  resulted in any coordinated public outcomes on the issues. In May 2017,  the federal financial regulators—CFPB, the Federal Reserve, FDIC,  NCUA, and OCC—and representatives of state financial regulators began  to share information on account aggregation and related consumer  compliance issues through the Federal Financial Institutions Examination  Council (FFIEC) Task Force on Supervision and the FFIEC Task Force  on Consumer Compliance. The regulators are collaborating through  FFIEC because they acknowledge that account aggregation issues cross  agency jurisdictions. According to participating agency officials, FFIEC  discussions have covered responsibilities for consumer reimbursement  due to fraudulent charges and access to consumer data, generated an  internal paper on consumer compliance issues, and previewed CFPB’s  principles for consumer-authorized financial data sharing and aggregation  prior to publication. However, as of November 2017, these efforts have  not generated public outcomes to guide market participants.
The federal financial regulators’ missions include ensuring that  consumers are protected. CFPB’s primary mission is to protect  consumers in the financial marketplace, including ensuring that markets  for consumer financial products and services operate transparently and  efficiently to facilitate access and innovation. Similarly, according to their  mission and vision statements, the banking and credit union regulators  help protect consumer rights by supervising financial institutions to help  ensure compliance with consumer protections.
However, some of the regulators told us that they have not taken more  steps to resolve the disagreements surrounding financial account  aggregation because they are concerned over acting too quickly. For  example, Federal Reserve staff we interviewed told us that premature  regulatory action could be detrimental to the negotiations between  individual financial institutions and financial account aggregators.  Similarly, OCC staff we interviewed told us that OCC staff does not  recommend publishing guidance or rules while the account aggregation  industry is evolving because regulation should not constantly change.  Nonetheless, the financial regulators could take additional steps to  address these issues without prematurely issuing rules or regulations.  Further, the FFIEC IT Examination Handbook on e-Banking’s appendix  on aggregation services, which the financial regulators use in their  examinations of banks, indicates that the financial regulators have been  aware since at least 2003 that regulatory requirements related to  consumer protection responsibilities of financial account aggregators are  not clear.
Incorporating leading practices on collaboration could strengthen the  efforts that regulators are making to address financial account  aggregation issues. As discussed previously, our prior work has  developed interagency collaboration principles that make efforts among  agencies more likely to be effective. These principles find that  collaborative efforts should define the short-term and long-term outcomes  that the collaboration is seeking to achieve and clarify the roles and  responsibilities of the participating agencies, among other things.  Although banking regulators and CFPB have discussed issues related to  account aggregation within FFIEC, these discussions have not yet  defined outcomes or produced any public outcomes to help guide fintech  firms and traditional financial institutions which could help lead to market- based solutions, or defined agency roles and responsibilities. In addition,  market participants, CSBS staff, and a member of the Board of Governors  of the Federal Reserve System have said that additional collaboration on  financial account aggregation issues—including reimbursement for  unauthorized transactions—would be beneficial. Similarly, in its 2017  annual report, the Financial Stability Oversight Council encouraged  financial regulators to monitor how fintech products affect consumers and  regulated entities and to coordinate regulatory approaches, as  appropriate.
Acting collaboratively to help address consumer compliance issues  related to financial account aggregation could help financial regulators  better meet their consumer protection missions. Improved collaboration  could help regulators and market participants resolve disagreements over  account aggregation and related consumer compliance issues more  quickly and in a manner that balances the competing interests involved.  Taking steps now, while the discussion on financial account aggregation  is in its relatively early stages, could help federal regulators better  address these needs over the long term. Until regulators coordinate and  assist the industry in clarifying and balancing the valid interests on both  sides, consumers could have to choose between facing potential losses  or not using what they may find to be an otherwise valuable financial  service, and fintech firms providing useful services to consumers will face  barriers to providing their offerings more broadly.

		Challenges Involving Fintech Partnerships with Banks

Partnerships between fintech firms and financial institutions are  increasingly common because such partnerships offer benefits to both  parties involved. According to literature we reviewed and market  participants and observers we interviewed, the benefits to banks can  include the ability to meet consumer demand by providing their customers  with access to innovative products that provide good user experiences  without having to dedicate extensive internal time or resources. Market  observers and Federal Reserve staff we interviewed told us that this  benefit may be particularly important for small banks and credit unions,  which have fewer staff and fewer financial resources for research and  development. Similarly, the benefits to fintech firms can include access to  banking services and networks, customer acquisition, and assistance with  regulatory compliance. Some fintech firms enter contractual agreements  to partner with banks through white-labeling, a type of partnership where  the bank markets the fintech firm’s product as its own when soliciting  customers. Other fintech firms enter contractual partnerships with banks  as stand-alone third-party relationships. For example, some fintech  lenders make loans to customers and partner with a bank that originates  or purchases loans sourced through the fintech lender.
However, because banks are liable for risks posed by third parties as  discussed above, fintech firms may face delays in entering into  partnerships with banks. Financial regulators have issued guidance on  risk management for financial institutions’ relationships with third  parties. Among other things, this guidance explains that financial  institutions are expected to conduct proper due diligence in selecting  partners and to monitor the activities conducted by third parties for  compliance with relevant laws, rules, and regulations, considering areas  such as consumer protection, anti-money laundering/counter-terrorist  financing, and security and privacy requirements. Banks, fintech firms,  and market observers we interviewed told us that banks may interpret this  guidance conservatively. Large banks may also spend significant time  conducting due diligence on the practices and controls in place at the  fintech firms seeking to partner with them in order to prevent unnecessary  compliance or operational risks, while a banking association told us that  small banks with fewer resources to dedicate to due diligence may be  unwilling to risk partnering with fintech firms. Banks, fintech firms, and  market observers we interviewed told us that bank due diligence can also  lead to lengthy delays in establishing partnerships, which can put fintech  firms at risk of going out of business if they do not have sufficient funding  and are not able to access new customers through a bank partner. For  example, officials we interviewed from one bank told us that it takes about  18 months to launch a partnership with a fintech firm, and acknowledged  that this is too slow to align with venture capital funding cycles that many  fintech providers rely upon.

	Consideration of Regulatory Approaches Abroad Could Benefit Fintech Regulation and Innovation

Regulators abroad have addressed the emergence of financial innovation  through various means, including establishing innovation offices;  establishing mechanisms for allowing fintech firms to conduct trial  operations; holding innovation competitions; providing funding for firms  through business accelerators; and using various methods to coordinate  with other regulators domestically and internationally. While certain U.S.  regulators have adopted similar efforts, further adoption of these  approaches by U.S. regulators could facilitate interactions between  regulators and fintech firms and improve regulators’ knowledge of fintech  products. However, some initiatives may not be appropriate for the U.S.  regulatory structure. For example, adopting certain initiatives could raise  concerns about U.S. agencies picking winners, in which firms that  participate in these programs may be better positioned to succeed than  other firms. Further, particular initiatives may not align with agencies’  legal authorities or missions.

		Regulators in the U.S. and Abroad Have Developed Approaches to Improve Interaction with Firms and Help Them Identify Applicable Regulatory Requirements

Citing the complexity of the U.S. financial regulatory system, fintech firms  and industry observers noted having difficulty identifying which  regulations they were subject to or which regulators would oversee their  activities. Further, one fintech firm noted that when they were able to  identify their regulators, they had difficulty finding a point of contact at the  regulators. Officials from three regulators that we interviewed also noted  that they had been contacted by fintech firms that were confused about  their regulatory status and did not fall under the agency’s regulatory  authority, but were subject to oversight by other regulators.
Regulators in the U.S. and abroad have taken steps to better facilitate  interactions with fintech firms, including by establishing innovation offices  with dedicated staff to serve as a front door for start-up firms or  innovators to find information on regulation and to contact the agency.  These innovation offices generally maintain a webpage hosted on the  agencies’ websites, a dedicated e-mail address, or dedicated staff.  Through these innovation offices, some agencies offer services including  office hours during which regulatory staff are available to meet and  provide informal guidance. For example, CFPB officials said that, as of  August 2017, they had met with approximately 115 companies in four  such events in New York and San Francisco, under the agency’s Project  Catalyst. Similarly, OCC officials noted that through their Office of  Innovation, they have been able to answer regulatory questions for  fintech firms and connect firms to relevant OCC offices. Since the launch  of LabCFTC, CFTC’s innovation office, in May 2017, CFTC officials have  met with more than 100 entities through office hour sessions in New York,  Chicago, and Washington, D.C.
In addition to office hours, several regulators have held fintech events  through their innovation offices. For example, FTC has held three fintech  forum events comprising panel discussions with industry experts,  covering topics such as marketplace lending and distributed ledger  technology. Several regulators have also issued publications on various  fintech topics, which are posted to the dedicated webpages for those  agencies with innovation offices.
Some regulators from other jurisdictions also facilitated regular interaction  with firms through their innovation offices. For example, through its  Innovation Hub, the United Kingdom’s (UK) Financial Conduct Authority  offers informal regulatory guidance to individual firms directly and through  posted publications; operates its regulatory sandbox, described below;  and engages with industry participants through various events. Similarly,  through a program called Looking Glass, the Monetary Authority of  Singapore offers fintech firms training and consultation on regulation and  provides a space for fintech firms to give product demonstrations to  regulators and banks. Regulators and fintech firms we interviewed abroad  said that these innovation offices have helped firms better understand  their regulatory obligations and help regulators identify and address risks  early. For example, representatives of a robo-adviser firm we interviewed  in Hong Kong said that their interactions with the Hong Kong Securities  and Futures Commission’s innovation office—known as the Fintech  Contact Point—made identifying and obtaining guidance from the  appropriate regulatory officials easier, which helped the firm more  efficiently develop a product compliant with applicable regulations.
Some fintech firms and industry observers stated that U.S. regulators’  innovation offices have helped fintech firms by offering a point of contact  for new entrants in the industry. Additionally, in a 2009 report, we created  a framework that identified characteristics of an effective financial  regulatory system. One of the characteristics was that regulators  should oversee new products as they come onto the market to take action  as needed to protect consumers and investors, without unnecessarily  hindering innovation. Figure 5 summarizes efforts that we reviewed by  regulators in the U.S. and abroad to implement initiatives to improve  interactions with fintech firms.
However, FDIC and NCUA have not established innovation offices for  various reasons. For example, FDIC staff said that, although the agency  has not formally evaluated establishing an innovation office, they have  met with fintech firms to discuss deposit insurance applications.  Associated with the deposit application process, the agency has  established central points of contact for all interested parties, not only  fintech firms. NCUA said that its lack of legal authority over third-party  service providers limited the usefulness of an innovation office, since  fintech providers are often third-party service providers. However, by not  dedicating specific staff, as occurs with the establishment of an innovation  office, these regulators could be less able to interact with fintech firms in  their sectors and fintech firms that partner with their regulated entities.  Other regulators who, similar to FDIC and NCUA, generally do not directly  oversee third-party providers, though they may have such authority, have  noted benefits from establishing innovation offices. For example, OCC,  which has a similar mission to these two regulators, has formed such an  office and OCC staff said that the agency has benefited by learning about  industry trends involving fintech and by improving interactions with fintech  firms and banks. Similarly, Federal Reserve officials we interviewed said  that efforts through its innovation office have helped staff better  understand fintech issues and have particularly helped its examiners  better understand banks that partner with fintech companies.  Consideration of establishing innovation offices, as many U.S. regulators  have recently done, could help FDIC and NCUA better enable new firms  to become familiar with regulatory requirements and could better facilitate  interaction between the agencies and fintech service providers.

		Regulators Abroad Use Various Approaches to Learn about and Enable Development of New Fintech Products, and U.S. Regulators Could Consider Taking Similar Steps

Internationally, some regulators have taken various approaches that help  educate their staff on emerging products and help innovators develop  products in limited-risk environments (see fig. 6). Based on interviews  with regulators and firms abroad and a literature review, initiatives that we  studied include regulatory sandboxes, proofs-of-concepts, innovation  competitions or awards, and agency-led accelerators. Regulatory  sandboxes that we studied were agency-led programs that allow firms to  test innovative products; services; business models; or delivery  mechanisms in a live environment, subject to agreed-upon testing  parameters. The proofs of concept that we reviewed were similar to  sandboxes, but for these programs regulators issued a request for  proposals to industry to develop a product that is conceptual; that is, an  idea for a product that is not yet on the market. In the fintech competitions  that we studied, regulators invited firms to develop solutions to problem  statements drafted by agencies or financial institutions. Accelerators that  we reviewed provided funding; access to regulators and mentors;  connections to outside funding sources; potential clients; and working  space to fintech firms and start-ups.
One approach regulators abroad were using to learn about fintech  activities was regulatory sandboxes. While a few U.S. regulators have  undertaken efforts that are similar to regulatory sandboxes, most have  not. Two regulators that we interviewed stated that tools already exist,  such as the comment process, to fulfill the role of a sandbox by helping  them better understand innovation and assist in the development of rules  and guidance. However, other U.S. regulators said that creating  regulatory sandboxes by using tools such as No Action Letters could  benefit regulators and firms. Based on our analysis of selected  jurisdictions’ efforts, regulatory sandbox programs generally may include  the following elements:  firms apply to participate;  firms and regulators agree on the parameters of how products or  services will be tested, such as the number of consumers or  transactions included in the test, the required product disclosures, or  the time frame of the test;  firms secure the appropriate licenses, if applicable; and  firms and regulators interact regularly.
In some cases, the sandbox may include limited regulatory relief. For  example, UK regulators we interviewed noted that they can waive or  modify a rule, issue a “no enforcement action” letter, or provide a  restricted license for a firm participating in the sandbox. However, these  tools are used on a case-by-case basis for the duration of the sandbox  test, are not used for every participating firm, and would not limit any  consumer protections. Further, UK regulators we interviewed said that  while waiving or modifying rules is possible, they are only used on an  exceptional basis. Similarly, Singapore regulators said that they can relax  specific legal and regulatory requirements, such as capital requirements,  on a case-by-case basis for firms while they are participating in the  sandbox. Also, Hong Kong regulators allow firms to operate without full  regulatory compliance for the limited product offerings within the sandbox.  Similar to UK and Singapore regulators, Hong Kong regulators we  interviewed said that they have put safeguards in place to protect  consumers from and manage the risk of the regulatory relief. For a more  detailed description of the Hong Kong, Singapore, and UK sandboxes,  see appendix III.
Regulators and market participants we interviewed abroad said that these  fintech sandboxes have helped regulators better understand products and  more effectively determine appropriate regulatory approaches while  limiting the risk that the failure of a fintech firm could pose to consumers.  Some participating firms we interviewed told us they benefited by being  able to test products with customers, make changes to their business  model, and understand how their products would be regulated. Moreover,  two participating firms and a regulator we interviewed said that firms are  able to introduce their products to the market more quickly because they  are able to test their products in the market while becoming compliant  with laws and regulations. One fintech firm that participated in the UK  sandbox pointed out that the UK regulators better understood their firm’s  technology and business model because of interactions in the sandbox.  For example, although the company and regulatory officials had  previously disagreed on whether the firm’s product needed to be  regulated, after gaining a better understanding of the company’s business  model through interactions in the sandbox, the regulatory officials agreed  that the product did not require regulatory oversight. Similarly, Singapore  regulators we interviewed noted that their sandbox provides them a  hands-on approach to learning about new technologies and how the  technologies align with regulatory requirements.
Some U.S. regulators have programs that share some characteristics with  sandboxes. As shown in figure 6, CFPB, SEC, and CFTC have issued No  Action Letters in which agency staff state that they do not intend to  recommend certain regulatory action against the firms if they offer the  products in the way described in a request letter to the regulator. The  issuance of such letters could assist fintech firms in cases in which the  applicability of existing regulations to their product is unclear. However,  similar to sandboxes abroad, CFPB officials stated that No Action Letters  do not provide safe harbor for companies taking actions that are clearly  not allowed under U.S. consumer regulations. As of March 6, 2018, CFPB  had issued one No Action Letter to Upstart Network, a company that uses  alternative data to assess creditworthiness and underwrite loans. As a  condition of the No Action Letter, Upstart will regularly report lending and  compliance information to CFPB to mitigate risk to consumers and inform  CFPB about the impact of alternative data on lending decisions.
In addition, CFPB officials we interviewed said that they can use a similar  tool known as trial disclosure waivers, which allow industry participants to  seek CFPB approval to test an innovative disclosure or way of delivering  a disclosure to consumers that includes a safe harbor provision during  which the industry participant may be exempted from statutory or  regulatory requirements. As of March 6, 2018, CFPB had not issued  any trial disclosure waivers.
Through its Project Catalyst, CFPB has also established a research pilot  program where it collaborates with firms that are testing innovative  products to understand consumer use and policy implications of  innovative products. CFPB officials said that research pilots have similar  elements to sandboxes, including participant application, agreement of  testing parameters, and regular meetings between CFPB and the participating firm. Four firms have concluded research pilots with CFPB  and three other firms are currently participating in pilots. Similarly, OCC  officials said that they are considering developing a pilot program, which  will allow banks or fintech firms partnering with banks to test innovative  products with the involvement and interaction of OCC staff. OCC officials  said that they have not set a date for determining whether to go forward  or implement the program.

			Proofs of Concept

Another approach regulators abroad were using to learn about fintech  activities was establishing proofs of concept. The proofs of concept that  we studied are similar to sandboxes in that the regulator has regular  interaction with the company to better understand the product or  technology, but the product is not introduced into the market during the  proof of concept period. For example, the Bank of England, through its  Accelerator program, uses proofs of concept to have firms develop  technology that can help the agency improve its operations, according to  agency officials. The Hong Kong Monetary Authority, which, among other  things, regulates banks in its jurisdiction, uses proofs of concept to allow  industry participants to develop products that are conceptual and not  ready for market implementation. A firm we interviewed that participated  in a proof of concept with Hong Kong Monetary Authority said that it  offered the regulator the opportunity to gain a working understanding of  the technology, while providing a test environment for the company to  tailor the technology to adhere to regulatory requirements.
CFTC officials noted that they are exploring the ability to conduct proofs  of concept through LabCFTC. CFTC officials noted that the agency would  be well positioned to conduct proofs of concept because they already  collect large amounts of market data that could potentially be leveraged  for such projects. However, CFTC officials expressed concerns that  receiving services as part of proofs of concept may violate gift or  procurement laws. The Federal Reserve Bank of Boston participates in  a collaborative effort called Hyperledger, which serves a similar purpose  as a proof of concept for the Federal Reserve Bank. Hyperledger is a  collaborative effort involving public and private entities created to advance the use of blockchain technologies across various sectors. As observers  in the Hyperledger, Federal Reserve Bank staff have gained hands-on  experience with blockchain technology by experimenting with uses of the  technology. None of the other regulators with whom we spoke said that  they planned to conduct proofs of concept.

			Innovation Competitions or Awards

Another approach used by regulators abroad for learning about fintech  activities was establishing fintech competitions or awards to encourage  financial innovation. Winning firms receive recognition, contracts, or cash  prizes. For example, the Monetary Authority of Singapore operated an  international competition called Hackcelerator to crowdsource innovative  solutions to problems that Singaporean financial institutions identified,  including insurance, customer identification, and data analytics, according  to officials. Singapore regulators have also established FinTech Awards,  which provide ex-post recognition to FinTech solutions that have been  implemented. CFTC officials said that they are seeking public input to  establish prize competitions and intend to launch such competitions in  2018. FTC officials said that in 2017, the agency challenged participants  to create a technical solution, or tools, that consumers could use to guard  against security vulnerabilities in software found on the Internet of Things  devices in their homes. FINRA staff noted that the agency holds  internal innovation competitions, called CREATEathons, in which FINRA  staff compete to develop solutions to various problems identified internally  by staff. While external parties do not participate in these competitions,  teams can consult with firms. Some U.S. regulators pointed out that while  some regulators abroad are mandated to promote competition, no such  mandate exists among most U.S. financial regulators.

			Agency-led Incubator or Accelerator

Two governments we studied abroad were also learning about fintech by  establishing incubators or accelerators to encourage the development of  a country’s fintech industry and talent pool. The accelerators provide  funding, access to regulators and mentors, connections to outside funding sources, potential clients, and working space to fintech firms and start- ups. For example, officials we interviewed from SG Innovate, Singapore’s  government led accelerator, said that the agency helps Singaporean  businesses expand overseas, bring companies to Singapore, and  connect start-ups to regulators and funding, among other things. None of  the U.S. regulators we interviewed said that they planned to establish  such accelerator programs. Regulators from the U.S. and abroad pointed  out that the U.S. fintech industry is more developed than those of other  jurisdictions with many fintech firms, large talent pools, and significant  amounts of private funding or privately run accelerators.
Regulators and market participants we interviewed abroad said that these  knowledge-building initiatives have helped regulators learn about new  products and business models and have allowed firms to test products.  Although CFTC and SEC can issue No Action Letters, those agencies  have not adopted other approaches similar to these knowledge-building  initiatives described above. Further, FDIC, the Federal Reserve, and  NCUA have not adopted any of these approaches. U.S. regulators said  that these initiatives could raise concerns about favoring certain  competitors over others and also noted that they may not have the  authority to initiate these programs. However, despite similar potential  constraints with regard to competition and authority limitations, CFPB and  OCC have formally evaluated undertaking relevant knowledge-building  initiatives, through conversations with regulators abroad, general  research, and documentation of their efforts; and they have begun  developing similar approaches, according to agency officials.
A characteristic of an effective financial regulatory system we identified in  our 2009 framework was that a regulatory system should be flexible and  forward looking, which would allow regulators to readily adapt to market  innovations and changes. Consideration by U.S. regulators of adopting  approaches taken by regulators abroad, where appropriate, could result  in the implementation of initiatives that help improve their overall ability to  oversee fintech and how it affects the entities they currently regulate.  While constraints may limit the ability or willingness of regulators to fully  adopt these practices, opportunities exist to assess ways to tailor them to  the U.S context.

		Regulators in the U.S. and Abroad Have Adopted Approaches to Facilitate Coordination on Financial Innovation

Regulatory coordination is less of an issue for regulators abroad because  most jurisdictions have fewer financial regulators. For example, the UK  has 3 agencies involved in financial regulation, Singapore has 1 financial  regulator, and Hong Kong has 4 financial regulators, compared to the 10  federal agencies involved in the regulation of fintech in some capacity in  the United States. However, regulators abroad have undertaken efforts to  bolster coordination among domestic regulators—as applicable—as well  as regulators abroad and industry representatives (see fig. 7). These  collaborative efforts include advisory councils and steering committees  dedicated to fintech issues; and fintech-specific cooperation agreements.
In the jurisdictions we examined, two agencies have established fintech  advisory councils or steering committees of industry participants and  government officials. Fintech advisory councils and steering committees  may provide a valuable connection to industry, through which U.S.  regulators could gain insight into industry developments. For example, the  Hong Kong securities regulator has established an advisory council  comprised of members with knowledge and experience of various parts of  Hong Kong’s fintech industry. Officials of this agency told us that the  advisory council provides valuable market data, a forum that offers firms a  preliminary check for interpretation of their rules and updates on  emerging issues. Advisory council members said that the council gives  this regulator a cross-functional perspective from industry experts and  enables the agency to learn about emerging issues and related regulatory  challenges early in their development.
Selected U.S. regulators have established formal advisory committees  dedicated to fintech issues, as shown in figure 7.
FINRA has established a Fintech Industry Committee through which  FINRA member and nonmember firms are provided a platform for  ongoing dialogue and analysis of fintech developments related to  FINRA’s purview. FINRA officials said that the agency has also  established the FinTech Advisory Group, a forum to identify and  prioritize FinTech topics and coordinate appropriate regulatory  approaches with key stakeholders.
CFTC staff noted that the agency restarted its Technology Advisory  Committee in late 2017 to explore a range of fintech topics and  augment the work of LabCFTC.
FDIC officials noted that the agency has a Fintech Steering  Committee, which aims to help FDIC understand fintech  developments by identifying, discussing, and monitoring fintech trends  through reports from the staff working groups that the steering  committee has established. The Fintech Steering Committee had not  made any formal recommendations as of March 13, 2018.
As previously mentioned, U.S regulators we interviewed said that they  have coordinated with other regulators and industry through various  mechanisms, as the following examples illustrate. (For additional  information on interagency collaborative efforts, see app. II).
The Federal Reserve has coordinated with relevant industry  participants and other regulators including CFPB, FDIC, FTC, NCUA,  OCC, Treasury, and CSBS through its Mobile Payments Industry  Working Group and its Faster Payments Task Force.
FTC solicits insight from industry participants, observers, and  regulators through its fintech forums.
Regulators have also coordinated with each other through domestic  and international interagency financial regulatory bodies, as well as a  recently organized interagency collaborative group dedicated to  fintech, the prudential regulators’ Interagency Fintech Discussion  Forum.

			Cooperation Agreements

Some regulators abroad have cooperation agreements with other  regulators abroad to share information and to help fintech firms begin  operations in other jurisdictions. For example, Singapore regulatory staff  told us that the regulator has 16 such agreements with entities from 15  regions that typically consist of (1) referrals to regulatory counterparts for  firms attempting to operate in a new country, (2) guidance to firms on  regulation in the firm’s new country of operation, and (3) information  exchange among regulators and between regulators and fintech firms. UK  regulators said that these agreements outline how the agencies in each  country pledge to assist each other’s fintech firms seeking to operate in  their country with business-to-business contacts, office space, and other  assistance. For example, regulators can discuss trends related to their  authorities and share information on fintech firms seeking to expand  operations in the other country. A fintech firm we interviewed said that  because much financial innovation is international in scope, sharing  information across borders with cooperation agreements is important for  regulators to understand the new technologies and to be responsive to  risks. On February 19, 2018, CFTC and UK Financial Conduct Authority  signed a cooperation agreement, which, according to CFTC officials, will  focus on information sharing and facilitate referrals of fintech companies  interested in entering the other regulator’s market. None of the other U.S.  regulators that we interviewed had fintech-specific cooperation  agreements with regulators abroad. Most of them said that existing  memoranda of understanding were sufficient to facilitate information  sharing. One regulator we interviewed abroad noted that establishing  fintech-specific cooperation agreements with U.S. regulators is difficult  because no direct regulatory counterpart exists since the U.S. financial  regulatory structure is significantly different from those of other  jurisdictions.

	Conclusions

The emergence of various fintech products has produced benefits to  consumers and others. Fintech products often pose risks to those of  traditional financial products, although in some cases fintech products  pose additional risks. While existing consumer protection and other laws  apply to some fintech products and services, in some cases fintech  transactions may not be covered by such protections. The extent to which  the activities of fintech providers are subject to routine federal oversight  varies, but fintech firms not overseen by a federal body generally are  subject to oversight by state regulators. While limited evidence of  widespread problems has surfaced to date, as the prevalence of fintech  products grows, risks posed by segments of the industry that regulators  do not routinely examine could correspondingly grow. Therefore, efforts  regulators by regulators to monitor developments and risks posed by  these firms and their financial innovations remains a sound approach.
With fintech products spanning across financial sectors and jurisdictions  of the numerous U.S. regulatory bodies, many parties have called for  improved regulatory coordination. While regulators have taken steps to  collaborate, opportunities remain to improve collaboration in line with  GAO’s leading practices. For example, the Interagency Fintech  Discussion Forum and the biennial meetings of the Federal Reserve  Mobile Payments Industry Workgroup do not include NCUA and FCC,  respectively, agencies that could add valuable perspectives. Without  these agencies, these efforts are not fully leveraging relevant agency  expertise, and NCUA and FCC may be precluded from learning about  risks that are relevant to their authorities.
Among other consumer protection issues related to financial account  aggregation, market participants do not agree about whether consumers  using account aggregators will be reimbursed if they experience  fraudulent losses in their financial accounts. Until regulators coordinate  and assist the industry in clarifying and balancing the valid interests of  consumers, financial account aggregators, and financial institutions,  consumers could have to choose between facing potential losses or not  using what they may find to be an otherwise valuable financial service.  Although regulators have been reluctant to act too quickly in light of  related industry efforts, they could increase collaboration to address key  issues such as consumer reimbursement for unauthorized transactions.  Aligning ongoing collaborative efforts with leading practices could help  regulators and market participants resolve disagreements over financial  account aggregation and related consumer compliance issues more  quickly and in a manner that balances the competing interests involved.
With our past work finding that an effective financial regulatory system  needs to be flexible and forward looking to allow regulators to more  readily adapt and oversee new products, U.S. regulators could potentially  improve their oversight of innovative fintech activities by considering  adoption of some of the efforts already being successfully used by  regulators abroad. While constraints may limit the ability or willingness of  regulators to fully adopt these practices, opportunities exist to assess  ways to tailor them to the U.S. context. Some U.S. regulators have  established innovation offices that can help fintech providers more easily  obtain needed information from relevant regulators; however, FDIC and  NCUA have not established such offices, which could help facilitate these  regulators’ interactions with fintech firms and with the entities they  regulate. Also, initiatives such as regulatory sandboxes or proofs-of- concept that provide fintech firms the opportunity to operate and share  information with appropriate regulators have helped regulators abroad  educate their staff and thereby improve their oversight capacities.  However, the Federal Reserve, CFTC, FDIC, NCUA, and SEC have not  initiated such programs due to concerns about favoring certain  competitors over others or that they may not have the authority to initiate  these programs. While constraints may limit the ability or willingness of  regulators to fully adopt these practices, additional consideration by these  regulators of some of the approaches taken by regulators abroad could  assist U.S. regulators in learning more about new financial technologies  that could provide useful knowledge for their own regulatory activities.

	Recommendations for Executive Action

We are making a total of sixteen recommendations.
The Chair of the Board of Governors of the Federal Reserve System  should invite NCUA to participate in the Interagency Fintech Discussion  Forum. (Recommendation 1)
The Chairman of the Federal Communications Commission (FCC) should  discuss with the Presidents of the Federal Reserve Banks of Atlanta and  Boston whether the topics of the 2018-2019 biennial regulators meeting  of the Federal Reserve’s Mobile Payments Industry Working Group would  make FCC participation beneficial to the FCC or the group, and take  steps accordingly. (Recommendation 2)
The President of the Federal Reserve Bank of Atlanta should discuss with  the Chairman of the FCC and the President of the Federal Reserve  Banks of Boston whether the topics of the 2018-2019 biennial regulators  meeting of the Federal Reserve’s Mobile Payments Industry Working  Group would make FCC participation beneficial to the FCC or the group,  and take steps accordingly. (Recommendation 3)
The President of the Federal Reserve Bank of Boston should discuss with  the Chairman of the FCC and the President of the Federal Reserve  Banks of Atlanta whether the topics of the 2018-2019 biennial regulators  meeting of the Federal Reserve’s Mobile Payments Industry Working  Group would make FCC participation beneficial to the FCC or the group,  and take steps accordingly. (Recommendation 4)
The Director of the Consumer Financial Protection Bureau should engage  in collaborative discussions with other relevant financial regulators in a  group that includes all relevant stakeholders and has defined agency  roles and outcomes to address issues related to consumers’ use of  account aggregation services. (Recommendation 5)
The Chair of the Board of Governors of the Federal Reserve System  should engage in collaborative discussions with other relevant financial  regulators in a group that includes all relevant stakeholders and has  defined agency roles and outcomes to address issues related to  consumers’ use of account aggregation services. (Recommendation 6)
The Chairman of the Federal Deposit Insurance Corporation should  engage in collaborative discussions with other relevant financial  regulators in a group that includes all relevant stakeholders and has  defined agency roles and outcomes to address issues related to  consumers’ use of account aggregation services. (Recommendation 7)
The Chairman of the National Credit Union Administration should engage  in collaborative discussions with other relevant financial regulators in a  group that includes all relevant stakeholders and has defined agency  roles and outcomes to address issues related to consumers’ use of  account aggregation services. (Recommendation 8)
The Comptroller of the Currency should engage in collaborative  discussions with other relevant financial regulators in a group that  includes all relevant stakeholders and has defined agency roles and  outcomes to address issues related to consumers’ use of account  aggregation services. (Recommendation 9)
The Chairman of the Federal Deposit Insurance Corporation should  formally evaluate the feasibility and benefit of establishing an office of  innovation or clear contact point, including at least a website with a  dedicated email address. (Recommendation 10)
The Chairman of the National Credit Union Administration should formally  evaluate the feasibility and benefit of establishing an office of innovation  or clear contact point, including at least a website with a dedicated email  address. (Recommendation 11)
The Chair of the Board of Governors of the Federal Reserve System  should formally evaluate the feasibility and benefits to their regulatory  capacities of adopting certain knowledge-building initiatives related to  financial innovation. (Recommendation 12)
The Chairman of the Commodity Futures Trading Commission should  formally evaluate the feasibility and benefits to their regulatory capacities  of adopting certain knowledge-building initiatives related to financial  innovation. (Recommendation 13)
The Chairman of the Federal Deposit Insurance Corporation should  formally evaluate the feasibility and benefits to their regulatory capacities  of adopting certain knowledge-building initiatives related to financial  innovation. (Recommendation 14)
The Chairman of the National Credit Union Administration should formally  evaluate the feasibility and benefits to their regulatory capacities of  adopting certain knowledge-building initiatives related to financial  innovation. (Recommendation 15)
The Chairman of the Securities and Exchange Commission should  formally evaluate the feasibility and benefits to their regulatory capacities  of adopting certain knowledge-building initiatives related to financial  innovation. (Recommendation 16)

	Agency Comments and Our Response

We provided a draft of this report to CFPB; CFTC; FCC; FDIC; the  Federal Reserve; FTC; NCUA; OCC; SEC; and Treasury, as well as  CSBS and FINRA. We received written comments from all of these  agencies except for Treasury and FINRA; the comments are reprinted in  appendixes IV through XII, respectively. Agencies to which we directed  recommendations agreed with our recommendations, as detailed below.  All of these agencies except FCC and NCUA also provided technical  comments, which we incorporated as appropriate.
In response to our recommendation that CFPB engage in collaborative  discussions that incorporate leading practices with other financial  regulators on financial account aggregation issues, CFPB stated in its  letter that it concurred. CFPB stated that it has taken steps to address  related issues independently. CFPB also noted that it has participated in  related ongoing collaborative discussions and that it would continue to do  so.
CFTC concurred with our recommendation that it formally evaluate  adopting knowledge-building initiatives related to financial innovation.  CFTC also noted that it is either using or exploring the use of some of the  knowledge-building initiatives identified in the report. However, the  agency also raised concerns that, without targeted legislative changes,  some of those initiatives may violate federal procurement laws and gift  prohibitions.
In its letter, FCC agreed with our recommendation that it should discuss  with the Presidents of the Federal Reserve Banks of Atlanta and Boston  whether the topics of the 2018–2019 biennial regulator meeting of the  Federal Reserve’s Mobile Payments Industry Working Group would make  FCC participation beneficial to FCC or the group, and take steps  accordingly. FCC noted that it will reach out to the Federal Reserve  Banks of Atlanta and Boston to determine whether FCC participation  would be beneficial.
Regarding our recommendation that FDIC engage in collaborative  discussions that incorporate leading practices with other financial  regulators on financial account aggregation issues, FDIC stated in its  letter that it recognizes the benefits of engaging in collaborative  discussions with other relevant regulators. It noted that it has been  involved in ongoing collaborative discussions about such issues and that  it would continue to do so, particularly regarding liability for unauthorized  transactions and consumer reimbursement. Regarding our  recommendation that FDIC formally evaluate the feasibility and benefit of  establishing an Office of Innovation or clear contact point, FDIC stated  that it would conduct such an evaluation, and acknowledged that it has a  long history of engaging in open dialogue with any party interested in  discussing matters related to FDIC’s mission and responsibilities.  Regarding our recommendation that it formally evaluate adopting  knowledge building initiatives related to financial innovation, FDIC stated  that it recognizes the importance of knowledge building and has  developed a framework and implemented initiatives to facilitate this. It  also noted that it will continue ongoing efforts to build knowledge related  to financial innovation and will consider other relevant knowledge building  initiatives, as appropriate.
In response to our recommendations that the Federal Reserve include  NCUA and FCC in relevant working groups, the Federal Reserve stated  in its letter that its Board staff would seek NCUA’s participation and that  staff from the Reserve Banks in Atlanta and Boston would discuss FCC’s  participation in relevant working groups. Regarding our recommendation  that the Federal Reserve engage in collaborative discussions that  incorporate leading practices with other financial regulators regarding  financial account aggregation issues, the Federal Reserve acknowledged  the importance of working together to ensure that consumers were  protected, and noted a variety of ways it already coordinates on such  issues, and noted that it will continue to engage in such discussions to  address the important issues surrounding reimbursement for consumers  using these services. Regarding our recommendation that it formally  evaluate adopting knowledge-building initiatives related to financial  innovation, the Federal Reserve noted that it recognizes the importance  of such efforts and has recently organized a team of experts to ensure  that fintech-related information is shared across its organization.
NCUA stated in its letter that it concurred with our recommendations to  engage in collaborative discussions that incorporate leading practices  with other financial regulators on financial account aggregation issues,  formally evaluate the feasibility and benefit of establishing an office of  innovation or clear contact point, and formally evaluate the feasibility and  benefits to their regulatory capacities of adopting certain knowledge- building initiatives related to financial innovation. NCUA noted that  evaluations of fintech activities are challenging for NCUA because it does  not have vendor authority like the other federal banking regulators. We  have previously raised NCUA’s lack of vendor authority as a matter for  congressional consideration. NCUA stated it will continue to monitor risks  posed by fintech firms to the credit union industry by working with the  banking regulators.
Regarding our recommendation that OCC engage in collaborative  discussions that incorporate leading practices with other financial  regulators on financial account aggregation issues, OCC stated in its  letter that it recognizes the importance of this recommendation. It noted  that it has been involved in ongoing collaborative discussions about such  issues and that it would continue to do so.
SEC stated in its letter that it concurred with our recommendation to  formally evaluate the feasibility and benefits to their regulatory capacities  of adopting certain knowledge-building initiatives related to financial  innovation. SEC also stated that it will coordinate with other agencies as  appropriate during its assessment.
In its letter, CSBS drew connections between steps that state regulators  have taken and those that we are recommending to federal agencies.  CSBS also provided additional information regarding state licensing  requirements, which we incorporated into our report. Additionally, CSBS  expressed support for our recommendations on federal interagency  collaboration and stated that it would support related efforts that  respected the role of state regulators. In addition, CSBS said that these  efforts could benefit from the participation of state regulators and that it  would be willing to participate if invited. Similarly, CSBS expressed  support for our recommendations that certain federal agencies formally  evaluate the feasibility and benefit of establishing an office of innovation  or clear contact point and formally evaluate the feasibility and benefit of  adopting knowledge-building initiatives related to financial innovation.  However, CSBS also cautioned that knowledge-building initiatives should  not preempt state consumer protection and licensing laws for fintech  payment providers or fintech lenders.
As agreed with your offices, we are sending this report to the appropriate  members of Congress; CFPB; CFTC; FCC; FDIC; the Board of  Governors of the Federal Reserve; FTC; NCUA; OCC; SEC; and  Treasury, as well as CSBS and FINRA. In addition, the report will be  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or evansl@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

This report examines (1) fintech benefits, risks, and extent of legal or  regulatory protections for users; (2) efforts by U.S. regulators to oversee  fintech activities; (3) challenges that the regulatory environment poses to  fintech firms; and (4) the steps taken by domestic and other countries’  regulators to encourage financial innovation within their countries.
While fintech does not have a standard definition, for the purposes of this  report we focused on products and services leveraging technological  advances offered by financial institutions; nonbank financial companies;  and technology companies within the payment, lending, and wealth  management sectors, as well as products or services operating under  distributed ledger technology (DLT). Within these four identified sectors,  we examined particular products and services. In the payments  technologies sector we limited our scope to mobile wallets, peer-to-peer  payments, and peer-to-business payments products and services. To  identify these four sectors, we conducted background research and  reviewed prior GAO reports on fintech, person-to-person lending, and  virtual currencies. In the fintech lending sector, we focused on consumer  lending—including credit card and home improvement loans—and small  business lending services from direct and platform lending models;  however, we did not include mortgage lending in our scope, due to the  significant amount of regulation within the subsector. In the digital wealth  management sector, we examined firms that exclusively offer advice  using algorithms based on consumers’ data and risk preferences to assist  or provide investment recommendations and financial advice directly to  consumers. We also examined issues relating to fintech account  aggregation companies that consolidate and display data from  consumers’ accounts across financial institutions to help consumers more  easily see their overall financial health. For DLT, we focused on providers  that used DLT in payments and securities processing and token sales.  We also included information on the use of DLT in virtual currencies, such  as bitcoin and Ethereum. We also reviewed available data on transaction  volumes for the payments, lending, and robo advising sectors.
To identify the benefits provided and risks posed to consumers by fintech  services, we conducted a literature review of agency, industry participant,  and industry observer documents that analyzed developments within  fintech. Using ProQuest, Scopus, SSRN, and Nexis.com databases in the  literature review, we identified over 500 relevant articles out of over 1,100  search results by using search terms associated with the four fintech  subsectors mentioned above. Our search included articles from 2011 to  October 2017. To determine the usefulness of the studies for inclusion,  we conducted a review of search results involving multiple content  reviews by GAO analysts to determine which relevant articles could (1)  provide credible sources of information to help address our researchable  questions, or (2) help identify knowledgeable persons or groups to  interview. We excluded documents based on the following criteria that  eliminated articles that were (1) duplicated; (2) related to countries  outside our review; (3) about virtual currencies; (4) categorized as  “marginally relevant” by analysts based on the article’s title, publication  date, and source; (5) less recent documents from each author or source;  (6) from news outlets or nonauthoritative sources; or (7) deemed  irrelevant or not useful.
To obtain the financial services and fintech stakeholder perspectives on  fintech benefits and risk, we reviewed academic papers, reports, and  studies by other organizations on fintech activities we identified through a  literature search. We also conducted over 120 interviews with financial  regulators; banks; fintech providers; consumer groups; trade  associations; academics; think tanks; and consulting and law firms. We  identified potential interviewees by conducting Internet research;  reviewing literature search results; reviewing recommended interviewees  from our initial interviews; and selecting interviewees based on their  relevance to the scope of our review. We selected fintech firms and  financial intuitions, industry observers, and federal agencies based on the  product or service conducted by the firm, expertise of the industry  observers, and oversight authority of the federal agencies. We identified  fintech benefits and risk by speaking with relevant regulators and other  knowledgeable parties including: the Board of Governors of the Federal  Reserve System (Federal Reserve); the Federal Deposit Insurance  Corporation (FDIC); the National Credit Union Administration (NCUA); the  Office of the Comptroller of the Currency (OCC); the Commodity Futures  Trading Commission (CFTC); the Bureau of Consumer Financial  Protection, known as the Consumer Financial Protection Bureau (CFPB);  the Department of the Treasury (Treasury); the Federal Communications  Commission; Federal Trade Commission (FTC); the Financial Industry  Regulatory Authority (FINRA), the Securities and Exchange Commission  (SEC); and the Small Business Administration.
To obtain state-level perspectives we interviewed representatives of the  Conference of State Bank Supervisors (CSBS), National Association of  Attorneys General, Money Transmitter Regulators Association, National  Association of State Credit Union Supervisors, and the North American  Securities Administrators Association. We also interviewed staff from  three state financial regulatory agencies in states with active fintech firms  and regulatory activities: California, Illinois, and New York.
To assess the regulatory environment and various challenges faced by  fintech firms, we identified relevant laws and regulations pertaining to  fintech companies within our scope by reviewing prior GAO reports on  financial regulation and fintech, interviewed agency staff and industry  participants, and analyzed relevant agency documents, including relevant  laws and regulations. We also reviewed guidance; final rulemakings;  initiatives; and enforcement actions from agencies. To obtain federal  regulatory perspectives, we interviewed staff from the Federal Reserve,  FDIC, NCUA, OCC, CFTC, CFPB, Treasury, FTC, FINRA, SEC, and  SBA.
To determine the steps taken by domestic and other countries’ regulators  to encourage financial innovation in their countries, we conducted  fieldwork—including interviews with regulatory agencies, fintech firms,  and industry observers, as well as, observations of fintech programs—in  the United Kingdom, Singapore, and Hong Kong. We also conducted  interviews with a regulatory organization and fintech firms operating in  Canada. We identified and selected countries for our fieldwork through  criteria that focused on the extent to which these locations had significant  (1) financial services activities, (2) fintech activities, and (3) fintech  regulatory approaches. We conducted Internet research, literature  searches, and interviews to identify relevant foreign regulators within the  selected fieldwork sites. To obtain other countries’ regulator perspectives,  we interviewed and analyzed agency documents on regulatory efforts and  views on fintech innovations within their financial markets from regulators  in Hong Kong, Singapore, and the United Kingdom. To obtain the  perspective of fintech firms operating in the selected fieldwork sites, we  conducted Internet research, literature searches, and interviews to  determine relevant fintech firms and foreign trade associations, including  recommendations from domestic industry participants and observers.
We conducted this performance audit from initiation August 2016 to  March 2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Interagency Collaborative Efforts That Have Addressed Fintech Issues

In this appendix, we present interagency working groups (including task  forces and other interagency collaborative bodies) that have discussed  fintech issues, and in some cases, taken specific actions. This list  includes interagency groups that are dedicated exclusively to fintech as  well as those that may discuss fintech as part of their broader financial  regulatory focus. Also, it includes interagency groups that operate at both  the domestic and international levels (see tables 2 and 3). This list is  based on information we obtained from the federal financial regulatory  agencies we met with and is not intended to be an exhaustive list.

Appendix III: Regulatory Sandbox Examples

	UK Financial Conduct Authority’s Regulatory Sandbox

According to officials, the purpose of the Financial Conduct Authority’s  (FCA) sandbox is to allow firms to test innovative products, services, or  business models in a live market environment, while ensuring that  appropriate protections are in place. FCA has stated that its sandbox has  (1) reduced the time and cost of getting innovative ideas to market; (2)  facilitated access to finance for innovators; (3) enabled products to be  tested and introduced to the market; and (4) helped the agency build  appropriate consumer protection safeguards into new products and  services. The characteristics of the FCA sandbox, according to the  agency, are listed below.
Eligible Participants: Currently regulated firms as well as  unregulated firms.
Eligibility Criteria: Firms submit an application outlining how they  meet the eligibility criteria for testing, which are (1) carrying out or  supporting financial services business in the UK; (2) genuinely  innovative; (3) identifiable consumer benefit; (4) need for sandbox  testing; and (5) ready to test.
Testing Parameters: If a firm is unauthorized it must obtain  authorization or restricted authorization prior to participation in the  sandbox. Prior to participating in the sandbox a firm must design, and  obtain agreement on, the parameters of the sandbox test, including  the duration; customer selection; customer safeguards; disclosures;  data; and testing plans.
FCA has four ways that it can help firms operate more easily in its  sandbox. First, it can provide restricted authorizations that are a tailored  authorization process for firms accepted into the sandbox. Any  authorization or registration is restricted to allow firms to test only their  ideas as agreed upon with agency staff, which is intended to make the  process easier for firms to meet requirements and reduce the cost and  time to initiate the test, according to the agency. Second, FCA provides  individual guidance to firms in the sandbox that are unclear on how the  agency’s rules apply, whereby FCA will interpret the regulatory  requirements in the context of the firm’s specific test. Third, in some  cases, FCA may be able to waive or modify an unduly burdensome rule  for the purposes of the sandbox test, but it cannot waive national or  international laws. Finally, FCA can issue no enforcement action letters in  cases where they cannot issue individual guidance or waivers but they  believe regulatory relief is justified for the circumstances of the sandbox.  According to the agency, no enforcement action letters are offered only  during the duration of the sandbox test to firms that keep to the agreed- upon testing parameters and that treat customers fairly. Also, no  enforcement action letters only apply to FCA disciplinary action and do  not limit any liabilities to consumers. Officials we interviewed noted that  rule waivers and no enforcement action letters are rarely used tools. As of  January 2018, FCA had received more than 200 sandbox applications.  Eighteen firms had successfully graduated from the first cohort, 24 firms  were preparing to test in the second cohort, and 18 other firms were  accepted to test in the third cohort.

	Monetary Authority of Singapore’s Regulatory Sandbox

Recognizing that when lack of clarity over whether a new financial service  complies with legal and regulatory requirements could cause some  financial institutions or start-ups to choose not to implement an  innovation, the Monetary Authority of Singapore’s (MAS) purpose in  establishing its sandbox was to encourage such experimentation so that  promising innovations could be tested in the market and have a chance  for wider adoption, according to the agency. In addition, the agency  stated that sandbox tests include safeguards to contain the  consequences of failure and maintain the overall safety and soundness of  the financial system. The characteristics of the MAS sandbox, according  to MAS, are listed below.
Eligible Participants: Firms that are looking to apply technology in  an innovative way to provide financial services that are regulated by  MAS, including financial institutions, fintech firms, and professional  services firms partnering with such firms.
Eligibility Criteria: Firms submit an application outlining how they  meet the eligibility criteria for testing, which are that (1) the product  uses new technology or existing technology in an innovative way, (2)  the product benefits consumers or industry, and (3) the firm intends to  deploy the product in Singapore on a broader scale after exiting the  sandbox.
Testing Parameters: Firms must define the following testing  parameters prior to participating in the sandbox: (1) clearly defined  test scenarios and expected outcomes must be established; (2)  boundary conditions that facilitate meaningful experiments while  sufficiently protecting the interests of consumers and maintaining the  safety and soundness of the industry must be in place; (3) the firm  assesses and mitigates significant associated risks; and (4) an  acceptable exit and transition strategy must be defined.
MAS stated that it will consider relaxing various regulatory requirements  for the duration of the sandbox test. However, they emphasized that their  sandbox is not intended and cannot be used as a means to circumvent  legal and regulatory requirements. MAS staff determines the specific legal  and regulatory requirements that they may be willing to relax on a case- by-case basis. According to MAS, some of the regulatory requirements  that could be relaxed included maintenance of certain levels of financial  soundness, solvency, capital adequacy, and credit ratings as well as  licensing fees, board composition requirements, and management  experience requirements, among others. However, MAS has also laid out  some requirements that it will not consider relaxing, including those  regarding consumer information confidentiality, anti-money laundering,  and countering terrorist financing. MAS officials said that all firms in the  sandbox will receive some form of regulatory relaxation. As of November  2017, MAS had received more than 30 sandbox applications. One firm  had successfully graduated, and a few other firms were testing or were in  the process of initiating a sandbox test.

	Hong Kong Monetary Authority’s Fintech Supervisory Sandbox

According to the Hong Kong Monetary Authority (HKMA), the purpose of  the HKMA sandbox is to enable banks and technology firms to gather  data and user feedback so that they can make changes to their  innovations, thereby expediting the launch of new products and reducing  development costs. HKMA officials stated that the sandbox allows banks  and their partnering technology firms to conduct pilot trials of their fintech  initiatives involving a limited number of participating customers without  the need to achieve full compliance with HKMA’s supervisory  requirements. The characteristics of the HKMA sandbox, according to the  agency, are listed below.
Eligible Participants: Regulated banks and their partnering  technology firms.
Eligibility Criteria: Fintech initiatives that are intended to be  launched by banks in Hong Kong are eligible for the sandbox.
Testing Parameters: Participating firms must (1) define the scope,  phases, timing, and termination of the sandbox test; (2) establish  customer protection measures, including disclosures, complaint  handling, and compensation for consumer loss; (3) establishing risk  management controls; and (4) establish a monitoring program for the  sandbox test.
Similar to MAS, HKMA stated that its sandbox should not be used as a  means to bypass applicable supervisory requirements; however, HKMA  will relax regulatory requirements on a case-by-case basis. As of  November 2017, nine banks had participated in 26 HKMA sandbox tests.  Twelve of these tests had been completed and banks collaborated with  fintech firms in 15 of the tests.

Appendix IV: Comments from the Consumer Financial Protection Bureau

Appendix V: Comments from the Commodity Futures Trading Commission

Appendix VI: Comments from the Conference of State Bank Supervisors

Appendix VII: Comments from the Federal Communications Commission

Appendix VIII: Comments from the Federal Deposit Insurance Corporation

Appendix IX: Comments from the Board of Governors of the Federal Reserve System

Appendix X: Comments from the National Credit Union Administration

Appendix XI: Comments from the Office of the Comptroller of the Currency

Appendix XII: Comments from the Securities and Exchange Commission

Appendix XIII: GAO Contact and Staff Acknowledgments

	GAO Contact

Lawrance L. Evans, Jr., (202) 512-8678 or evansl@gao.gov.

	Staff Acknowledgements

In addition to the contact named above, Cody Goebel (Assistant Director);  Chloe Brown (Analyst-in-Charge); Chris Ross; Davis Judson; Ian P.  Moloney; and Bethany Benitez made key contributions to this report. Also  contributing to this report were Joanna Berry; Timothy Bober; Richard  Hung; Pamela Davidson; Tovah Rom; Cynthia Saunders; and Jena  Sinkfield.

Output:
Why GAO Did This Study

Advances in technology and the widespread use of the Internet and mobile communication devices have helped fuel the rise of traditional financial services provided by non-traditional technology-enabled providers, often referred to as fintech.
GAO was asked to provide information on various aspects of fintech activities. This report addresses fintech payment, lending, wealth management, and other products. GAO assesses 1) fintech benefits, risks, and protections for users; 2) regulatory oversight of fintech firms; 3) regulatory challenges for fintech firms; and 4) the steps taken by domestic and other countries' regulators to encourage financial innovation within their countries. GAO reviewed available data, literature, and agency documents; analyzed relevant laws and regulations; and conducted interviews with over 120 federal and state regulators, market participants, and observers, and regulators in 4 countries with active fintech sectors and varying regulatory approaches.

What GAO Found

Fintech products—including payments, lending, wealth management, and others—generally provide benefits to consumers, such as convenience and lower costs. For example, fintech robo-advisers offer low cost investment advice provided solely by algorithms instead of humans. Fintech products pose similar risks as traditional products, but their risks may not always be sufficiently addressed by existing laws and regulations. Also, regulators and others noted that fintech activities create data security and privacy concerns and could potentially impact overall financial stability as fintech grows. The extent to which fintech firms are subject to federal oversight of their compliance with applicable laws varies. Securities regulators can oversee fintech investment advisers in the same ways as traditional investment advisers. Federal regulators may review some activities of fintech lenders or payment firms as part of overseeing risks arising from these firms' partnerships with banks or credit unions. In other cases, state regulators primarily oversee fintech firms, but federal regulators could take enforcement actions. Regulators have published consumer complaints against fintech firms, but indications of widespread consumer harm appear limited. The U.S. regulatory structure poses challenges to fintech firms. With numerous regulators, fintech firms noted that identifying the applicable laws and how their activities will be regulated can be difficult. Although regulators have issued some guidance, fintech payment and lending firms say complying with fragmented state requirements is costly and time-consuming. Regulators are collaborating in various ways, including engaging in discussions on financial protections for customers that may experience harm when their accounts are aggregated by a fintech firm and unauthorized transactions occur. Market participants disagree over reimbursement for such consumers, and key regulators are reluctant to act prematurely. Given their mandated consumer protection missions, regulators could act collaboratively to better ensure that consumers avoid financial harm and continue to benefit from these services. GAO has identified leading practices for interagency collaboration, including defining agency roles and responsibilities and defining outcomes. Implementing these practices could increase the effectiveness of regulators' efforts to help resolve this conflict.
Regulators abroad have taken various approaches to encourage fintech innovation. These include establishing innovation offices to help fintech firms understand applicable regulations and foster regulatory interactions. Some use “regulatory sandboxes” that allow fintech firms to offer products on a limited scale and provide valuable knowledge about products and risks to both firms and regulators. Regulators abroad also established various mechanisms to coordinate with other agencies on financial innovation. While some U.S. regulators have taken similar steps, others have not due to concerns of favoring certain competitors or perceived lack of authority. While these constraints may limit regulators' ability to take such steps, considering these approaches could result in better interactions between U.S. regulators and fintech firms and help regulators increase their understanding of fintech products. This would be consistent with GAO's framework calling for regulatory systems to be flexible and forward looking to help regulators adapt to market innovations.

What GAO Recommends

GAO is making numerous recommendations related to improving interagency coordination on fintech, addressing competing concerns on financial account aggregation, and evaluating whether it would be feasible and beneficial to adopt regulatory approaches similar to those undertaken by regulators in jurisdictions outside of the United States. In written comments on a draft of this report, the agencies stated that they concurred with GAO's recommendations and would take responsive steps.