3.5. Unique Risks In Mobile Payment Systems: A Multi-layered Analysis
3.5.1. Risks at the Mobile Network Operator Level
An MNO is a telecommunications company that provides and extends the wireless network messaging functionality to provide payment services that enable customers to remit funds that are settled through its own established agent network.201
Individual payment transactions occur entirely within the MNO and do not require the service user to have a bank account.202 The funds in transit—paid in by the remitter but
not yet withdrawn by the recipient—are in principle on deposit203 in a segregated account
with one or more banks (Trust Account in Kenya), and so are within the formal financial system.204 Since the service provider is only executing client payment instructions and is
not performing the credit evaluation and risk management function of a bank, these services do not, according to the Banking Act CAP 488,205 constitute ‘banking’. The Act
describes ‘banking’ as accepting money from members of the public on deposit repayable on demand or at the expiry of a fixed period or after notice. It also describes it as accepting
(2010) 71 <http://mobile-financial.com/blog/mobile-financial-services-risk-matrix> accessed 3 September 2014.
201 Joy Malala, ‘Consumer Protection For Mobile Payments In Kenya : An Examination Of The Fragmented Legislation And The Complexities It Presents For Mobile Payments’ (2014) Kenya Bankers Association , Centre For Research On Financial Markets And Policy Working Paper Series No 7 <http://www.kba.co.ke/workingpaperseries/img/pdf/Working%20Paper%20WPS-07-13.pdf> accessed 3 September 2014.
202 Mobile-Financial.com, ‘Mobile Financial Services Risk Matrix’ (2010) 71 <http://mobile- financial.com/blog/mobile-financial-services-risk-matrix> accessed 3 September 2014. The M-Pesa can operate with the mobile device serving as a store of value. Chapter 4 Part II.
203 Joy Malala (2014) (n 208) 16. 204 Joy Malala (2014) (n 208) 20. 205 The Banking Act 1969 s 2 (a) (1).
119
money from members of the public on current account and payment on and acceptance of cheques; and the employing of money held on deposit or on current account, or any part of the money, by lending, investment, or in any other manner for the account and at the risk of the person so employing the money. Therefore, the MNOs in principle, seem to have avoided the level of regulatory oversight needed for the ‘deposits’ held in banks. The depository bank, then, has no involvement in or responsibility for payments through the MNO’s system. The MNOs provide the infrastructure and communications service, while providing agent oversight and quality control. However, this thesis questions whether this oversight and control is sufficient for mobile payments.
Kenya’s best known MNO is Safaricom which, although it provides telecommunication services, is also a de facto mobile money issuer. As no law or regulation in Kenya establishes206 MNO as a distinct type of institution that provides financial
services, Although the National Payment System Act 2011, describes non-financial institutions that provide payment services as ‘payment providers’ it still does not offer clarification as to their functions and the CBK’s mandate in their oversight.
Safaricom could begin operating pursuant to a ‘No Objection’ letter agreement with the Central Bank of Kenya;207 it enjoys freedoms other financial services providers
do not.208 Through M-Pesa, Safaricom operates under an MNO-led209 payment model,
with the MNOs offering mobile payment services as a means to add value to their core
206 Joy Malala (2014) (n 208) 23.
207 This refers to the Letter issued to Safaricom by the Central Bank of Kenya authorising its operations after a risk assessment was conducted in February 2007. Alliance for Financial Inclusion, ‘Enabling Mobile Money Transfer: The Central Bank of Kenya’s Treatment of M-Pesa’ (2010) <http://www.gsma.com/mobilefordevelopment/wp-
content/uploads/2013/09/enablingmobilemoneytransfer92.pdf> accessed 3 September 2014. Also Bankable Frontier Associates LLC, ‘Enabling Mobile Money Transfer – The Central Bank of Kenya’s Treatment of M-PESA’ (2010) Alliance for Financial Inclusion.
208 See Chapter 2 on the introduction of mobile payment systems.
209 This model requires the MNO, rather than a financial institution, to provide the payment functions and technology.
120
communications services.210 This presents legal challenges that this study highlights in
Chapter 4, and imposes risks to stakeholders. The MNO incurs both operational risk and technological risks through its own system as a private institution, and through the introduction of funds that are not properly screened.
For instance, the MNO or a subsidiary holds customer funds in a prepaid account. In some jurisdictions, even if the MNO assumes the bulk of the financial risk and operational responsibility of offering the service, a partner bank formally holds the licence. If the funds are post-paid, the MNO has effectively provided short-term credit or payment service to its customers, in the same way as some third-party payment card schemes.211
Agents are generally not employees of the MNO and thus are related only through contractual arrangements.212 If an MNO fails to adequately train and supervise agents and
super agents who act on its behalf, these agents may damage the MNO’s business reputation with both the public and regulators. For instance, if agents fail to meet the required regulatory AML responsibilities, depending on the division of responsibilities where AML procedures may be carried out by agents. If roles are not clearly stipulated and enforced, the CBK will impose capacity challenges.213 MNO-led models concentrate
transaction activities in the hands of one or only a few large telecommunications institutions, which is not only a function of the ‘first mover’ establishing market dominance, but also of the telecom industry players’ already well-established and
210 This means that aside from providing data and voice functions in their capacity they provide mobile financial services.
211 Joy Malala (2014) (n 208) 25. Also in this model, the issuer (having the relationship with the cardholder) and the acquirer (having the relationship with the merchant) is the same entity. This means that there is no need for any charges between the issuer and the acquirer. Since it is a franchise set-up, there is only one franchisee in each market, which is the incentive in this model. There is no competition within the brand; rather the competition is with other brands.
212 These contractual arrangements are likened to franchise agreements; however they tend to favour the MNO rather than the agent.
121
expansive mobile phone user networks; this concentration introduces systemic risk. Moreover, MNOs tend to concentrate trust accounts in one, or a few, large commercial banks, leading to a concentration risk of the account.214
Safaricom, the dominant MNO, for instance, holds its customer funds in Commercial Bank of Africa.215 Furthermore, Safaricom’s dominant position in Kenya
means that it creates a large institution in itself by virtue of the nature of the transactions, being low value, high volume transactions, and those undertaking the transactions, who are a large population of previously unbanked and under banked, which increases the inherent risks of the transactions themselves.216 MNOs should train and supervise
through policies and procedures that are acceptable to regulators, which should be standardised to avoid the flagrancy of their misconduct, but this has not yet occurred. Moreover, high concentration of risk leads to systemic risk within the broader economic context in which the mobile financial services take place. Figures reported by Safaricom as of January 2014 include US $320 million per month in person-to-person transfers.217
On an annualised basis, this is equivalent to roughly 10 per cent of Kenyan Gross
Domestic Product (GDP).218 Furthermore, 27219 companies are using M-Pesa for bulk
distribution of payments. Since the launch of the ‘bill pay’ function in 2009, hundreds of companies are using M-Pesa to collect payments from their customers. Utility companies such as the electric and water companies have more than 20 per cent of their millions of
214 Maria C Stephens, ‘Promoting Responsible Financial Inclusion: a Risk-based Approach to Supporting Mobile Financial Services Expansion’ (2011) 27 Banking and Finance Law Review 329 In this case the trust account which is discussed in Chapter 4.
215 This is a commercial bank in Kenya.
216 Joy Malala, ‘Consumer Protection For Mobile Payments In Kenya: An Examination Of The Fragmented Legislation And The Complexities It Presents For Mobile Payments’ (2014) Kenya Bankers Association , Centre For Research On Financial Markets And Policy Working Paper Series No 7 <http://www.kba.co.ke/workingpaperseries/img/pdf/Working%20Paper%20WPS-07-13.pdf> accessed 3 September 2014.
217 Ibid. 218 Ibid.
122
customers pay through M-Pesa.220 These figures point to the systemic importance of
payment institutions,221 which have served as the transactional channel through which a
significant portion of Kenya’s GDP-associated financial and economic funding flows.222
I estimate M-Pesa’s role in relation to Kenya’s overall GDP will only increase.223
However, the unravelling or forced unwinding of large numbers of illegitimate mobile payment transactions could have the opposite effect on economic growth and financial stability.224 To the extent that M-Pesa has captured the global imagination as a successful
MNO-led model, its hypothetical fall could lead to a negative effect for many MNO-led models, causing a domino effect if several MNOs’ business strategies and operations are
intertwined.225 In summary, MNOs should pose no greater risk than banks. MNOs do
not necessarily face inherent higher Money Laundering/Finance of Terrorism (ML/FT) risks than banks through mobile payments, nor do they pose inherently higher ML/FT threats than banks. The risks and threats are largely influenced by the risk mitigation measures, namely effective risk-based regulations and supervision. So if MNOs are not appropriately regulated, the risk of illicit flows through these MNOs increases, independent of the risk that is inherent to payments. The lack of appropriate regulation has highlighted that risks are not related to the types of transactions but to the weakness in the supervisory regimes and supervision applicable to MNOs. Those wishing to hide illicit financial flows are likely to seek unsupervised entities to reduce their chance of detection.226
220 Ignacio Mas and Dan Radcliffe, ‘Mobile Payments go Viral: M-PESA in Kenya’ (2010) 353–369 <http://siteresources.worldbank.org/AFRICAEXT/Resources/258643-1271798012256/M-
PESA_Kenya.pdf> accessed 3 September 2014. 221 Ibid.
222 Ibid.
223 See Chapter 2 on the enabling environment for mobile payments systems. 224 Joy Malala, (2014) (n 208) 26.
225 Maria C Stephens, ‘Promoting Responsible Financial Inclusion: A Risk-Based Approach To Supporting Mobile Financial Services Expansion’ (2011) 27 Banking and Finance Law Review 329.
123