Banking in the near future: optimising risk management and resilience in the digital age

Char­lotte Bran­field — Head of oper­a­tional resilience, Citi

Jason Maude — Chief tech­nol­o­gy advo­cate, Star­ling Bank

Andrea Brody — Chief mar­ket­ing offi­cer, Riskon­nect

Ralph Nash — Chief com­pli­ance offi­cer, HSBC UK

Marc Leaver — Euro­pean chief oper­at­ing offi­cer, Stan­dard Char­tered Bank

Suresh Viswanathan — Chief oper­at­ing offi­cer, TSB

What is the cur­rent state of per­son­al­i­sa­tion in bank­ing in the UK and around the world?
RN: Last year’s events have accel­er­at­ed some of the trends already emerg­ing in bank­ing. These include the increased use of automa­tion and dig­i­tal­i­sa­tion and the con­cept of “the bank in your pock­et”. Branch net­works will remain impor­tant, but increas­ing­ly we see demand-led inter­ac­tion around dig­i­tal and that’s some­thing we need to sat­is­fy. A greater dig­i­tal focus cre­ates both risk and oppor­tu­ni­ty from a sta­bil­i­ty and resilience per­spec­tive. There are some risks, both tech­ni­cal and eth­i­cal, but if we get it right, it could be a win-win sce­nario for the bank and the cus­tomer. We are at an excit­ing junc­ture.

JM: In the next decade, afford­ing cus­tomers imme­di­ate and secure access to their data in the same way they have access to their mon­ey will become a require­ment, rather than a “nice to have”. If you, as a bank, can­not offer that con­nec­tiv­i­ty or appli­ca­tion pro­gram­ming inter­face (API) capa­bil­i­ty, you will be like a town the rail­road missed out, and you will weak­en and die. Cus­tomers, includ­ing small and medi­um-sized enter­pris­es, are not going to do busi­ness with a bank that relies on paper process­es.

CB: What makes a good bank is how fast they reach the cus­tomer, to solve their prob­lems and pro­vide finan­cial ser­vices con­ve­nient­ly, effi­cient­ly and respon­sive­ly. There­fore, the con­cept of a bank is evolv­ing from the tra­di­tion­al bricks-and-mor­tar bank to an “embed­ded finance” mod­el. Dri­ven by the demand for high-qual­i­ty seam­less cus­tomer expe­ri­ence and fin­tech part­ner­ships, banks will become hubs where prod­ucts can be plugged in and out. When you think about banks’ busi­ness mod­els, that’s pret­ty rev­o­lu­tion­ary. The whole sys­tem is chang­ing and it’s an excit­ing time to be involved in oper­a­tional resilience.

ML: I agree that we are at an inflex­ion point in bank­ing: if we don’t change the tra­di­tion­al way of deliv­er­ing prod­ucts and ser­vices to clients, we will be redun­dant in the dig­i­tal age. We see our­selves as a bank that con­nects clients, prod­ucts and mar­kets. To do this we utilise dig­i­tal offer­ings to tap into the dig­i­tal needs of our clients. Three pil­lars to build this: inno­v­a­tive part­ner­ships explor­ing dis­rup­tive busi­ness mod­els; invest­ment in fin­techs; and, arguably the most chal­leng­ing ele­ment, greater inter­nal inno­va­tion.

SV: The def­i­n­i­tion of where a bank starts and fin­ish­es is trans­form­ing. Pre­vi­ous­ly we have been con­strained by phys­i­cal infra­struc­ture and ana­logue sys­tems. As we emerge from a post-pan­dem­ic world, the march to dig­i­tal is inevitable. How­ev­er, as we move towards a world dri­ven by open bank­ing and APIs, you lose con­trol of when demand hits. Peo­ple trust banks and I think now it is oblig­a­tory to ensure we deliv­er more val­ue to cus­tomers than just a cur­rent account, a loan, a mort­gage and a card. It’s a unique posi­tion to be cus­to­di­ans of cus­tomer data and lever­age that trust, and it means we, as banks, can offer them more con­nec­tiv­i­ty.

AB: We talk with our finan­cial ser­vices cus­tomers all the time. The same top­ics are dis­cussed; the dri­ve for greater automa­tion and data ana­lyt­ics is tak­ing cen­tre stage because of the need for con­nec­tiv­i­ty. It’s imper­a­tive to lever­age tech­nol­o­gy, but improved risk man­age­ment in cor­po­rate strat­e­gy is required and the pan­dem­ic has exac­er­bat­ed the need for bet­ter report­ing.

What are banks’ biggest oper­a­tional chal­lenges in 2021 and what prob­lems are on the hori­zon? 
RN: The last year empha­sised the impor­tance of banks as a trans­mis­sion mech­a­nism of gov­ern­ment pol­i­cy to sup­port indi­vid­u­als and busi­ness­es through the coro­n­avirus cri­sis. We have effec­tive­ly done years of lend­ing in a few months, at an unprece­dent­ed lev­el. Man­ag­ing the exit from gov­ern­ment sup­port schemes will be a sig­nif­i­cant oper­a­tional chal­lenge for HSBC and the indus­try, this year and next, par­tic­u­lar­ly in the UK. Cus­tomers’ pay­ment hol­i­days will end, but some will be unable to resume repay­ment on their debt. His­tor­i­cal­ly banks have been wor­ried about cash and keys, and now they should treat data and sys­tems as crown jew­els and focus on build­ing resilience for the lat­ter. The oper­at­ing mod­el and tech­nolo­gies need to sup­port that, as well as meet­ing reg­u­la­to­ry and soci­etal expec­ta­tions.

JM: To keep pace with those expec­ta­tions, it’s essen­tial to have the archi­tec­ture to oper­ate faster. It’s often thought that for banks there is a see­saw-like bal­ance between secu­ri­ty and reli­a­bil­i­ty on the one side and speed of deliv­ery on the oth­er. At Star­ling Bank, we have con­struct­ed a sys­tem that makes these two things mutu­al­ly rein­forc­ing. We rapid­ly deploy fea­ture changes, new prod­ucts and ser­vices, and seek bugs dai­ly to increase resilience. This sys­tem will be vital as we look to enter new mar­kets glob­al­ly in 2021.

ML: Stan­dard Char­tered Bank has moved to a cloud-first strat­e­gy and we are look­ing to shift our core bank­ing plat­form into the cloud by 2025, sub­ject to reg­u­la­to­ry approvals. Reg­u­la­tors are begin­ning to become more com­fort­able with banks’ evo­lu­tion to dig­i­tal and famil­iar with safe data stor­age. Cer­tain­ly, the strides made by Star­ling Bank and oth­ers are fab­u­lous for the indus­try and the cus­tomers we serve. Part­ner­ships with tech­nol­o­gy spe­cial­ists are crit­i­cal to our strat­e­gy because we know clunky plat­forms and tra­di­tion­al bank­ing meth­ods are not sus­tain­able, frankly.

SV: Today, 90 per cent of TSB’s cus­tomer ser­vices are dig­i­tal, as is 70 per cent of our sales. In terms of oper­a­tional resilience, it is very impor­tant to have a mul­ti­chan­nel approach because you want to com­fort and sup­port cus­tomers and be read­i­ly avail­able. We are march­ing to the cloud and, as net­works become much smarter and 5G is more wide­spread, we can push more con­tent through the pipes into the hands of devices cus­tomers hold. That capa­bil­i­ty gives us the abil­i­ty to edu­cate cus­tomers and improve finan­cial lit­er­a­cy. A key imper­a­tive, though, is to become more holis­tic in our man­age­ment of risk.

CB: I agree that banks need to embrace holis­tic risk man­age­ment and think about process­es dif­fer­ent­ly. At Citi, our pri­or­i­ties lie in bet­ter under­stand­ing our clients’ expe­ri­ence of using our ser­vices and improv­ing upon it. As an indus­try, we have to move away from the mind­set that cyber­se­cu­ri­ty, for exam­ple, is only a tech expert’s respon­si­bil­i­ty. That approach caus­es a dis­con­nect con­cern­ing oper­a­tional risk because, in today’s dig­i­tal econ­o­my, the fun­da­men­tal com­modi­ties at risk are trust, data and con­nec­tiv­i­ty, not just mon­ey. If we want to man­age cyber risk prop­er­ly, we are going to have to have far greater engage­ment from the client rela­tion­ship man­agers, the user expe­ri­ence design­ers, and the prod­uct sales and devel­op­ment teams, and not just with­in bank­ing, but in the pub­lic sec­tor as well.

AB: Con­sid­er­ing the cus­tomer’s view­point is a per­fect way to look at risk holis­ti­cal­ly. Every depart­ment in a bank is respon­si­ble for risk. Thus, silos need to be bro­ken and com­mu­ni­ca­tion between the dif­fer­ent func­tions improved, and this can now be enabled by tech­nol­o­gy.

How can tech­nol­o­gy help opti­mise risk man­age­ment?

RN: Increas­ing­ly, we feel there are some chal­lenges in using data from an eth­i­cal per­spec­tive. How do we ensure we don’t end up with unin­tend­ed con­se­quences due to mod­el­ling our cus­tomers’ data? For instance, if we become more sophis­ti­cat­ed at mod­el­ling the propen­si­ty of a cus­tomer to com­mit finan­cial crime, or pose a com­pli­ance risk, do we end up inad­ver­tent­ly becom­ing less inclu­sive and less able to tar­get the unbanked at a time when prob­a­bly we should be try­ing to do the com­plete oppo­site? There is also the ques­tion of staff sur­veil­lance; what is legal but fails on the “creepi­ness” test?

ML: The debate about vac­cine pass­ports has dom­i­nat­ed the news recent­ly, show­ing that the ethics of han­dling cus­tomer data is no longer a hori­zon risk. As banks, we are grap­pling with the same chal­lenges: we know if we use data-dri­ven insights, we can make bet­ter busi­ness deci­sions and we can improve the way we serve our clients. But what is the tip­ping point? While cus­tomer data pro­tec­tion has long been part of the design of a bank’s process­es and sys­tems, with increas­ing dig­i­tal­i­sa­tion, data man­age­ment best prac­tice needs to be embed­ded into its DNA. Ulti­mate­ly, the cus­tomer’s data is a gift and we must keep it secure.

JM: We think of cyber­crim­i­nals as com­peti­tors who are try­ing to steal our busi­ness, so we com­bat them by mak­ing it too expen­sive for them to spend time try­ing to hack our sys­tems. A secu­ri­ty bug is a big draw because it allows you to hit mul­ti­ple peo­ple all at once and in banks no one has cod­ed every­thing from scratch. Chaos engi­neer­ing is going to become more preva­lent in our indus­try. We delib­er­ate­ly attack our sys­tems in a con­trolled man­ner to test and prove we are resilient.

SV: There is a lot of arti­fi­cial intel­li­gence (AI) and machine learn­ing in the bank­ing indus­try, though some appli­ca­tions are more mature than oth­ers. Smart part­ner­ships that dri­ve inno­va­tion will be vital to deliv­er­ing super spe­cial­i­sa­tion, for exam­ple if you want to opti­mise the noise-to-sig­nal ratio in ATM fraud. It’s about adding val­ue to the cus­tomer, but not at the cost of impact­ing oper­a­tional resilience. For this rea­son, we need to be bold, be inno­v­a­tive, fail fast and move on.

CB: There are so many shiny new tech toys and it’s easy to think a bank has to have the lat­est gad­gets and be deploy­ing the lat­est piece of AI, but with­out actu­al­ly under­stand­ing why. It’s crit­i­cal to go back to basics and back to your first prin­ci­ples. Ask your­self, “What ben­e­fit is this bring­ing to either the busi­ness or my cus­tomers?” It’s an excit­ing time to be involved in resilience and risk man­age­ment because it means look­ing care­ful­ly at your organ­i­sa­tion­al struc­ture and cul­ture. 

AB: It is indeed an excit­ing time and there is clear­ly a real focus on oper­a­tional resilience in the dig­i­tal age from those in the finan­cial ser­vices space. There are many chal­lenges, but a bank’s tech­nol­o­gy stack must sup­port the desired out­comes. It will be fas­ci­nat­ing to see how the ethics and com­pli­ance con­cerns evolve in the com­ing years.

For more infor­ma­tion please vis­it
riskonnect.com

Spon­sored by

Riskon­nect