Responsible innovation in the payment system

Speech

Speech by Executive Director Torbjørn Hægeland at Finance Norway's Payments and Digitalisation Conference, 7 November 2024.

Please note that the text below may differ from the actual address.

Introduction

Good afternoon and thank you for inviting me today. As always, I greatly appreciate the opportunity to speak to you here at the payments and digitalisation conference. This is an important arena for discussing current issues and for keeping abreast of the latest developments in payments.

As the central bank of Norway, our mission includes the promotion of an efficient and secure payment system. Norway has such a system today. Having said that, improvements are necessary. I stand by a remark I made at this same conference two years ago: What constitutes an efficient payment system, changes over time. And a lot has happened since then. So, I would like to take the opportunity today to shine the central bank's spotlight on some of the changes that are underway and some that might emerge later.

However, let me begin with a concept that has endured: "Responsible innovation". We have referred to this before. On many occasions. So, it's nothing new, but important enough to bear repeating. It encapsulates how we, as a central bank, think of and approach the payment system of the future.

In contrast to the motto coined by some global corporations: "move fast and break things", "responsible innovation" sends a different signal. Because when it comes to money, we need a gentler approach.

There are two sides to money. The technical side fulfils the necessary functions of money as a medium of exchange, a unit of account and a store of value.

Money also has a social and political side; an institution dependent upon general acceptance and trust to function. Building such trust is a lengthy process but trust can disappear in an instant.

These two sides of money are inseparable and define some important parameters for how money and payments can and should be designed in the future - through responsible innovation.

The first of these parameters concerns availability and efficiency. The payment system must enable user-friendly payments that are processed quickly and inexpensively. Users' needs must be adequately met while maintaining cost-efficiency.

Another parameter is security and contingency planning. Payments must reach the correct recipient, and we need to be reasonably confident that we can use money to make payments even when the payment system is subjected to serious disruptions. Making the payment system less vulnerable to fraud is also a vital part of strengthening systemwide security.

A third parameter concerns inclusion. The legitimacy of common institutions and functions such as money depends on universal accessibility, ease of use and acceptance.

We may need to make trade-offs between these three parameters for the payment system as a whole. Keep that in mind as we explore them one by one.

The payment system needs to function well

First: functionality. There are several initiatives underway which may have a major impact on how and how well the payment system can do its job in the future.

Norges Bank has looked into settling instant payments in NOK via the Eurosystem's TIPS service. In a press release in August this year, we concluded that by participating in TIPS we facilitate the best possible development of Norwegian instant payments. Norges Bank therefore intends to enter into an agreement with the European Central Bank concerning the use of TIPS for the settlement of Norwegian instant payments in central bank money.

Instant payments ensure that payees receive money directly into their accounts seconds after payments are made - 24/7. Achieving widespread instant payments is not the objective. But end users should be able to pay efficiently in real time where such needs arise. A well-functioning solution for instant payments is therefore an important part of an efficient payment system. Participation in TIPS will mean that the settlement of instant payments between banks occurs in the TIPS system on behalf of Norges Bank. The infrastructure for settlement of instant payments in NOK will therefore follow developments in the rest of the Nordic countries and Europe. TIPS also paves the way for improved cross-border payments.

Another important ongoing project is the introduction of the messaging standard ISO 20022 both in Norges Bank's settlement system, NBO, and in banks. This standard will enable messaging across financial market infrastructures and increase cross-border standardisation. In addition, the ISO 20022 format is more structured, and messages can contain more information. This facilitates increased automation in payment processing. The adoption of ISO 20022 is an extensive project. The work is going well - not least thanks to active participation from you in the banking industry. We are therefore on schedule to go live with the new standard in March next year.

Norges Bank's settlement system is the core of the payment system. It ensures settlement finality in central bank money of interbank payments in NOK. The current settlement system in Norges Bank is efficient, stable and secure, and must remain so. We are therefore evaluating the next generation settlement system. As part of this evaluation, two alternative models are being considered: a stand-alone dedicated solution for payment settlement at Norges Bank, and T2, the Eurosystem's common platform for payment settlement. The jury is still out, so I will leave this topic for another day.

Research into central bank digital currency - CBDC - is also a strategic initiative. We are assessing whether CBDC is a suitable instrument to ensure access to a means of settlement trusted by all, even in new payment arenas, and whether it will facilitate responsible innovation and improved payment contingency arrangements. In many ways, the research concerns being alert to developments that could carry innovation opportunities or threats to an efficient and secure payment system in NOK.

As many here already know, CBDC is a form of electronic money issued by the central bank in the official unit of account. It can take two main forms, retail or wholesale, the latter involving settlement between account holders at the central bank. An issue that has recently come to the fore is how we can ensure settlement in central bank money of payments and trades from tokenised platforms. This issue has also garnered increased attention internationally.

Tokenisation is a process to represent assets in such a way that allows transactions to be programmed to occur if and when specific events take place. Programming is done in smart contracts, where one or more conditions are configured to enable the automated execution of transactions. All types of assets can be tokenised, everything from bank deposits to securities holdings to non-financial assets. Tokenisation enables immediate, simultaneous and conditional settlement without a third party also on digital platforms.

Tokenisation can contribute to streamlining, reducing some types of risk and enabling new functionality and new business models. Nevertheless, the technology entails the introduction of new risks and requires new regulation. It is also uncertain whether tokenisation will proliferate. Regardless, critical settlements should take place in risk-free central bank money, not in alternatives like stablecoins. Perhaps central bank settlement in itself is important for the development of tokenisation.

To enhance the understanding of tokenisation and CBDC, we have invited the banking sector to get involved in testing and experimenting within our technological sandboxes dedicated to core CBDC infrastructure. Once again, this is a standing invitation.

Retail CBDC will be publicly available in line with cash and bank deposits. The introduction of such money raises complex issues, and Norway's current payment system already functions well. This implies that we should not proceed with undue haste. We need to carefully assess which problems we can address with CBDC and whether other instruments are more appropriate, such as regulation and the further development of current payment solutions.

The research will provide a decision basis for, and an assessment of, whether Norges Bank should work towards introducing a CBDC, and if so, which type.

We at Norges Bank are not the only ones thinking about this. Most central banks are researching different types of CBDC. The purposes vary, depending on the respective financial and economic conditions.

Amongst the central banks in advanced economies, the ECB has likely made the most headway in retail CBDC research. However, whether or not to introduce retail CBDC has not yet been decided. The digital euro is part of the EU's work on a European digital agenda, which includes, among other things, digital identities. Like the development of EU regulation, the introduction of a digital euro could impact the payment system in Norway and other countries.

An important justification given by the ECB for its digital euro project is that there currently is no common European digital alternative means of payment that covers the entire eurozone. This is the ECB's ambition, and it is easy to understand why.

In Norway, we are familiar with the benefits of well-functioning common solutions. Early on, Norway established BankAxept, our national debit card system. This has given us a common, digital payment solution for card payments and cash withdrawals - and not least a backup solution for payment network outages.

An efficient domestic debit card solution has contributed to low costs in the Norwegian payment system compared with other countries. The growing use of mobile payments backed by international cards at physical points of sale, however, is pushing up payment costs.

The increase in the use of mobile payments in Norway has likely been curbed somewhat by the fact that some card issuers do not support Apple Pay. This has been justified by, among other things, the fact that Apple has not permitted other payment services to use near-field communication technology in iPhones, which facilitates user-friendly solutions. As Apple has now signalled that in-app contactless transactions will be available for use by other parties, the use of mobile payments may become even more widespread.

There is likely to be fierce competition to become consumers' preferred mobile payment app at points of sale. Vipps, Apple Pay and chain-specific apps have ambitions to expand. Competition is good. But a plethora of individually user-friendly apps does not necessarily make for a user-friendly payment system. Regardless of which apps individuals end up using, it is important for cost efficiency that alternatives such as BankAxept and solutions for account-to-account payments are made available for mobile payments.

A main concern is that we uphold the Norwegian tradition of cooperation on common interoperable infrastructure and competition in providing end-user services. This tradition has served us well, and we have a shared responsibility to keep it alive. The benefits of shared infrastructure are often long-term, which individual parties may easily overlook in their eagerness to reap short-term benefits by choosing other solutions.

It is also key that there is a sufficient element of robust, regulatable entities. Large market shares for bigtechs and other entities difficult to regulate makes it more difficult to ensure a well-functioning payment system that safeguards Norwegian societal interests.

The Norwegian payment system is efficient and on the whole functions exceptionally well. There is little downtime, and payments can be made quickly at low cost. This is a great achievement, for which everyone here today deserves considerable recognition.

But we cannot rest on our laurels. Not only do we need the payment system to function well - on the whole. We also need it to function well - no matter what.

The payment system must function no matter what

The payment system has become more complex. Digitalisation has made the payment system more dependent on underlying infrastructure, such as electricity, telecommunications and the internet. New payment solutions and service providers have entered the market, and supply chains have become longer. IT and data centre service providers have undergone consolidation, which in many instances may have contributed to better practices and resilience, but also to concentration risk.

The threat landscape has also deteriorated in recent years. Russia's war against Ukraine and heightened tensions in many parts of the world are increasing the risk of targeted attacks. Cyber attacks have become more sophisticated and digital interconnectedness and interdependencies in Norway's financial sector and internationally mean that the consequences of cyber attacks can rapidly escalate.

Given the increasing complexity of payment systems and the threat landscape in Norway's neighbouring regions, security and contingency efforts have become both more important and more challenging than previously. These efforts must be prioritised throughout: by individual entities, the financial sector and across sectors and national borders.

This is why I am pleased to note that both the authorities and the industry are seriously committed.

On the regulatory side, a lot is currently being done to strengthen resilience in the financial sector. I would like to highlight a new electronic communications act that was proposed in spring. The bill entails regulating data centres for the first time. A number of payment system operators and other critical functions depend on the same data centres, which play a key role in critical infrastructure. Regulation will provide a more holistic and efficient approach to security and preparedness in data centres.

Another area of activity where the prioritisation of security and contingency arrangements is particularly evident to us in Norges Bank is testing and exercises. In collaboration with Finanstilsynet, we are identifying businesses in the banking and payment system that are responsible for critical functions and facilitating red team testing according to the TIBER framework. These tests are demanding, where critical functions and processes in individual entities face simulated attacks based on real-life threat scenarios. To date, four Norwegian TIBER-tests have been carried out. In addition, bank branches in Norway are also being subjected to cross-border tests.

The tested entities themselves own the test results. This is crucial because the tests can reveal sensitive business information. However, sharing experiences is also important, strengthening the overall ability of the payment system to bolster its defences. We have therefore established the TIBER-NO Forum, where participants are provided with the opportunity to exchange information and experiences in a confidential setting, with meaningful discussions on current and pressing issues. Our firm opinion is that the tests themselves and the exchange of knowledge strengthen the resilience of the individual systems and the financial infrastructure as a whole.

We expect payment system operators that participate in the TIBER-NO Forum to conduct tests according to the framework. Norges Bank has now finished testing its own system - NBO. So far, testing is voluntary but will be required when DORA enters into force. It is not yet clear when it will be implemented in Norway, but what is clear, is that cyberattacks will continue, and the testing of critical functions must continue while we wait for DORA. We therefore cannot delay testing critical functions.

In contingency arrangements and handling incidents, effective cooperation is crucial. I have already mentioned one example. Others include working with the participants in our own settlement system through the NBO Continuity Forum and the broad cooperation in the Financial Infrastructure Crisis Preparedness Committee.

We are currently also collaborating with you, the industry, in a working group appointed by the Ministry of Finance. The purpose of the working group is to assess whether contingency arrangements in the payment system should be strengthened, and the group will provide concrete suggestions for improvement. The working group will assess measures that can provide greater assurance that payments can be carried out in more extreme scenarios, including the need for more independent contingency arrangements.

Norges Bank has also recently taken the initiative to establish a Norwegian payment forum. The aim is to create an arena for exchanging information and discussing measures and strategies that contribute to the development of the payment system in Norway and towards other countries. The forum held its first two meetings in June and October 2024.

The payment system needs to function for everyone

In Norway, we have a long tradition of exploring key issues in society openly and together in order to build a strong basis for creating instruments and measures. I am very lucky to have been given the opportunity to chair the government-appointed Payment Commission. We will submit our report on 15 November, so you will need to wait a week or so before you can read the Commission's conclusions and recommendations. Simply put, the Commission's mandate is to answer the question of how to ensure simple and secure payments for all. These words express our high ambitions. Together, they raise the bar even higher. And the bar should be high - the payment system must function for everyone.

The mandate is broad in scope, but a key part is assessing how cash can contribute to simple and secure payments for all. In addition to appointing the Payment Commission, the political authorities have recently tightened regulations to ensure consumers' right to pay cash.

Like other means of payment and instruments, cash is a means to an end. For cash to fulfil its functions in the payment system - and here Norges Bank has placed particular emphasis on contingency planning and financial inclusion - it needs to be usable. For it to be usable, it needs to be accessible to people.

Norges Bank has an essential responsibility here: We provide a sufficient supply of high-quality cash for distribution through banks. For security reasons, Norges Bank does not talk much about its cash reserves. I can however assure you that there is not much of an echo in our vaults.

The other part, making cash available to businesses and consumers, is the responsibility of banks. The closure of bank branches and downsizing of in-house cash handling services in recent years have made banks more dependent on third parties to be able to fulfil this responsibility. In this regard, I would like to point out two issues that banks in Norway must actively address:

The first concerns the fact that, in practice, there are only two providers that offer secure and efficient cash handling services on a large scale. If one or both of them were to cease operating, banks themselves would need to seek alternative solutions for their cash handling. The obligation to make cash available applies regardless of a well-functioning service provider market.

The second issue is related to the need for cash services provided to businesses. In-store cash services have become widespread for deposits and withdrawals from bank accounts. However, the solution is not always ideal for businesses that intend to deposit daily revenue. The recent clarification of consumers' right to pay cash also highlights corporate customers' need for cash services. We expect banks to meet the demands of this customer group as well.

If you consider the payment system as a whole, such factors may appear marginal. But as the seasoned runners here among us know, even the smallest pebble in your shoe can cause a painful blister.

This brings us back to my initial point. Hopefully you'll recall that there are two sides to money. On one side, money is technology, and on the other, money is a social and political institution because its functions rely on general acceptance and trust.

The premise of general acceptance and trust applies to the whole and to the individual parts. This is far from trivial. It is in fact existential.

When Governor Ida Wolden Bache gave a panel presentation at the BIS annual conference last summer on the remit of central banks, she focused on "The singleness of money". In plain English, this means that all means of payment denominated in domestic currency have the same value. This parity is doubted by none. This principle holds regardless of whether the money is issued by the central bank or by different commercial banks. Such parity is not a given.

Ensuring this parity is both an essential part of the central bank's mission and a prerequisite for fulfilling it. In advanced economies, such parity has long been taken for granted. However, as the Governor pointed out, there are two developments that could challenge the singleness of money in the years ahead: The demise of cash as an available alternative and the emergence of entirely new forms of money, such as cryptocurrencies and stablecoins.

We must adopt different strategies to meet these two challenges and to ensure continued parity between different types of NOK-denominated money. As the Governor mentioned in her presentation, the new solutions we need to implement are not a given. An option for the public to convert bank deposits into central bank money may bolster confidence in bank deposits. But final settlement in central bank reserves and securing bank deposits with deposit insurance and other regulations may well be just as crucial for trust and parity. At the same time, the emergence of new types of money means that existing public and private forms of money need further development in order to provide functionality that is similar or better. Central bank money should be available as a means of settlement trusted by all, even when the payment arenas are undergoing change.

What is given, is that future solutions - with all their potential forms of money - require general acceptance and trust. Under the Central Bank Act, Norges Bank plays a key role. This is our raison d'être. Let there be no doubt, Norges Bank will take all necessary measures to sustain an efficient and secure payment system - where all forms of NOK have the same value and function effectively. No matter what. For everyone.

Conclusion

Hopefully, this has both updated you and elaborated on what we at Norges Bank mean when we talk about responsible innovation in the payment system - and prepared fertile ground for further discussions, not least with regard to the exciting topic of the debate later today.

Responsible innovation has been a hallmark of the development of the current payment system. Our ambition is that this will also be the case in the future. Payment solutions today are of a high standard, and ongoing initiatives mean that we can look forward to continued improvement. If we are able to bring everyone along on our journey, I am certain that, in a few years' time, we will be able look back on what we have built together and call it responsible innovation. Thank you for your attention.