There are broadly two ways to frame regulations:
- Regulations that tell you ‘what’ to do (technically, these are principle-based regulations); or
- Regulations that tell you not just ‘what’ to do, but also ‘how’ to do it (technically, these are rule-based regulations).
Principle-based regulation uses general statements that may apply to a wide range of situations (like ‘lenders must treat customers fairly’). It focuses on ‘what’ to achieve instead of ‘how’ to get there. In contrast, rule-based regulations lay down the specific requirements that market players must meet (like ‘lenders must notify customers 24 hours before an auto-debit for an EMI’).
Regulators across the world have trouble deciding which of these two approaches they must adopt for the regulation of fintechs. So, which approach to regulation has India’s much-feared and little-appreciated banking and payments regulator adopted so far? And how has that impacted India’s fintechs and consumers? Let’s dive in and look at a few examples.
Know your customer (KYC) and anti-money laundering: KYC serves an important function – that of identifying who is actually undertaking a transaction or engaging in a financial activity; and preventing the usage and movement of tainted funds.
In the master directions on KYC (KYC MD), the RBI has followed a rule-based approach. The RBI has prescribed in granular detail how financial institutions (FIs) must perform each mode of KYC, thus offering certainty. For KYC of individuals, the regulator has attempted to ease the KYC process with newer modes like video KYC (where identification happens via a video call) or downloading records from a central KYC registry.
However, the RBI’s decision to follow rule-based regulation mars the scalability and ease of adoption of these KYC modes. For example, the RBI’s KYC MD insists that FI officials must perform video KYC on a live call. This not just adds to the cost of video KYC, but also restricts fintechs from coming up with newer modes of video KYC (like AI-driven video KYC) that eliminate the need for a human presence on call.
So, would a principle-based (and risk-based) approach for KYC work better? The industry and India’s finance minister think so.
Elsewhere, KYC regulations are already moving towards a principle-based approach. Like under Bank Negara Malaysia’s (the Malaysian central bank) latest policy document on e-KYC, FIs are not bound to use any specific modes of KYC. They’re free to adopt KYC methods so long as they adopt authentication requirements commensurate with the risks (for instance, high-risk products like savings accounts need higher diligence).
The policy document does lay down the modes through which FIs may authenticate and identify a customer, but these are indicative and not prescriptive.
While this may not exactly be the solution that works for India, both customers and FIs will benefit from a principle-based regulation of KYC.
Peer-to-peer lending (P2P): The RBI introduced the master directions on P2P lending platforms (P2P Directions) to regulate the disbursal of loans through online platforms that connect lenders with borrowers. The RBI proactively notified the P2P Directions when the industry was still developing. Perhaps this was done to avoid the fate incurred by Chinese regulators whose ‘wait-and-see’ approach failed to catch undercover miscreants running Ponzi schemes under the guise of P2P platforms.
In the P2P Directions, the RBI has stipulated certain principles that need to be adopted by P2P players. For instance, P2P platforms can only act as intermediaries connecting lenders and borrowers – they cannot lend on their own, hold any funds received for loan disbursal or repayment on their books or provide assured returns.
However, the RBI has also taken a prescriptive approach by setting out granular requirements on the operation of P2P platforms. Case in point: Under the P2P Directions, an individual lender needs to approve the borrower before the disbursal of each loan.
This is cumbersome. It is unsurprising that contracts executed between lenders and P2P platforms include an auto-invest clause – through which lenders authorise P2P platforms to invest and re-lend their monies as per a lending criteria without any manual intervention. However, the RBI deputy governor recently warned that some creative approaches and interpretations (including the structuring of transactions) adopted by P2P players could be non-compliant.
The Association of P2P Lending Platforms is engaging with the RBI and seeking clarifications on the regulatory viability of key features (like the auto-invest feature) offered by the P2P industry players.
What happens when there is regulatory uncertainty? The increased regulatory scrutiny of P2P players coupled with regulatory uncertainty about certain business practices have slowed down P2P partnerships and growth.
The RBI recently barred P2P platforms from offering investment-like offerings with assured returns and instant withdrawals and from deploying lenders’ funds other than as provided under the P2P Directions. However, the jury is still out on auto-invest features.
We believe that there should also be room for P2P players to innovate and make P2P lending and borrowing flows simple, user-friendly and easy while meeting the principles set out in the P2P Directions.
As we can see, rule-based regulations offer certainty. But the downside is that they can be rigid and are much less adaptable to change. Besides, businesses might push the envelope and find creative ways to get around specific, rule-based regulations.
On the other hand, as the RBI deputy governor put it, the principle-based approach focuses on the desired outcome and gives entities the room to adapt and innovate within the broad contours. Businesses are held responsible for complying with the principles and there is little room for clever workarounds.
For example, it is an established principle that the RBI’s authorisation is needed to operate a payment system, i.e., to enable a payment transaction between a payer and a beneficiary by offering services like clearing or settlement. The RBI recently asked a card network to stop facilitating card-based business payments to businesses that do not accept credit card payments, through certain intermediaries, because this principle was violated.
Let us break this down. There are no roadblocks in making payments via cards to vendors with facilities to accept card-based payments – like to vendors that are onboarded as merchants by payment aggregators (say, payments to software vendors). The difficulty is in making card-based payments to small-scale vendors that do not have such facilities (say, payments to office canteen operators).
To solve this, a few fintech entities stepped in – they collected card-based payments from businesses (on behalf of the vendors), pooled monies in their escrow account and settled it to the vendors subsequently through IMPS/RTGS/NEFT, after deducting a commission.
The RBI flagged this as an unauthorised payment system, stressing on the principle that the pooling and settlement of money is a regulated activity.
Where a layer of third-party unregulated entities exist in the fund flow, there could be KYC lapses and tracking the end-use of funds becomes tougher, thereby exacerbating money laundering risks. Similar payment flows facilitating peer-to-peer credit card payments – like rent and tuition fees – via intermediaries are being scrutinised by the RBI as well.
Broadly, the reasons we’ve discussed above also explain the reasons why principle-based regulation generally works better for consumers. Since it spurs more innovation in the market, it gives consumers more choices. And since it limits ‘clever’ interpretations of regulation, it makes it harder for businesses to devise workarounds that sometimes deceive or mislead consumers.
Given this, it is laudable that the RBI is increasingly moving towards a risk and principle-based approach to regulation. Recently, it issued a draft framework on alternative authentication mechanisms for digital payments; the draft framework gives issuers the discretion to choose the appropriate additional factor of authentication based on their risk assessment of the customer and the transaction.
The RBI is not alone; the growing consensus amongst regulators globally is that principle-based regulation works better.
On the road ahead to regulation, we share the RBI deputy governor’s enthusiasm to take the route of a principle-based regulatory approach.
Priyam Jhudele and Priyanka Sunjay are fintech lawyers.
