Big Tech: From here to the entity

Lyndon Nelson looks at the challenges of finding an appropriate framework for regulating Big Tech’s growing importance in the financial system, as some banks call for tech firms that are active in financial services to be regulated by function. This article first appeared in Financial World in February 2023.

It is possible that, even before homo sapiens evolved as a species distinct from other early humans, there was the specialisation of labour and, as technology like the use of tools advanced, some specialisms became redundant and new ones were created.

In that light, not much has changed over the past 300,000 years. Technological advancement still comes with both opportunity and the potential for uncomfortable consequences. However, in financial services, the issues that innovation trigger are not just questions for the industry itself – about which business models will survive and how the sector will change – but also for wider society and for the regulators that often represent the interests of society.

The very real risk for regulators, as financial services business models break up, is that they end up overseeing an increasingly irrelevant backwater, while the meaningful business flow is elsewhere. That’s because regulation is based largely on a vertically integrated model – that is it assumes that regulated financial services firms control all aspects of a product in-house – much as AT&T used to own forests that provided telegraph poles. If you manage the firm, you have a grip on the function. However, the increasing adoption of technology by existing financial services players, and the increasing penetration of financial services by technology companies, mean that vertical integration no longer holds.

Same activity, same risk, same regulation?

In any debate on the structure of regulation, there will often be a concern to maintain a level playing field. There is even a rallying cry of ‘same activity, same risk, same regulation’. As intuitively attractive as this might appear, in reality it is more complex. Getting regulation right critically depends on a correct understanding of the context of the activity and the risk it represents.

After all, why regulate financial services at all? There are many reasons why a society decides to regulate, but two tend to dominate for financial services. The first is to reduce risk at the macro-level, because the financial system provides key functions to the real economy such as managing risks and uncertainty, facilitating investment and allocating resources. The overall aim there is financial stability.  The second reason to regulate is at the micro-level and it concerns consumers’ interaction with the financial system and whether, given the many asymmetries involved, it is fair. That comes under the umbrella of consumer protection.  

Although it is the functions carried out by financial services that drive the case for regulation, generally regulators have struggled to define functions clearly enough to provide a basis for a  statutory system – ie one that puts limits on those functions into law. Instead, they have focussed on activities such as the provision of a financial service like payments, or deposit taking.

However, when looking at activities, context is key. Making a deposit as an advance payment on that kitchen you have always wanted is one thing, but a deposit that might be used in payments and as a source of funding for lending and investment is quite another. In many cases, decisions on how and what to regulate will quickly become decisions about the strength of the balance sheet of the entity providing the services. When we make a deposit with a bank, we become a creditor of that bank. Whether we can get that deposit back will partly depend on whether the bank is liquid and solvent.

So, even though a regulator may care most about the activities carried out, in many cases the entity that carries them out is also important. This leads to two forms of regulation:

activity-based – which focuses directly on how entities carry out an activity – and

entity-based, which focuses on the entities that perform activities and seeks to strengthen their resilience.  

In activity-based oversight, regulation should not normally vary with the entity that carries out the activity – although again the context is key here. To be successful, regulators need to be capable of influencing the probability, and impact, of the failure of a particular activity, independently of the provider’s other activities and, in extremis, of the failure of the entity itself. Examples of such regulation are conduct of business rules for the sale of a mortgage and operational standards for payments provision.

Entity-based regulation is indirect regulation of the activity and will typically look at the probability, and impact, of the entity failing. By its nature, entity-based regulation is best suited to regulating combinations of activities. Examples of such regulation are minimum capital requirements and concentration limits.

To the entity and beyond

Within themselves, both entity and activity-based regulation can be level playing fields. However, if the context is one where either or both trigger a macro or financial stability risk, then there will be differentiation between those generating a macro risk and those that do not. For example, there are higher operational resilience standards for entities that have a significant market share of payments activity, and additional capital is required for systemically important banks. This, of course, breaks the purist form of ‘same activity, same risk, same regulation’ unless ‘same risk’ covers both a micro and macro context.

Given that both activity and entity-based regulation have strengths and weaknesses depending on the circumstances, in many cases the regulatory approach is a hybrid. Typically, that means prudential and financial stability regulators focussing on the entity and securities and conduct regulators focussing on activities.

Techs and balance

Financial services firms have often been very early adopters of new technology. The most recent wave of technology is different in that technology firms are entering the financial services market directly. The move started in areas such as infrastructure, fulfilment, customer analytics and customer interfaces, which were areas of strength for tech firms, and the work was done in partnership with incumbent financial services firms. But, increasingly, the technology companies are moving into direct competition. This has meant positioning in product design – most commonly in payments. An activity-based approach could allow regulators to impose the same regulatory measures on these technology companies as on others performing the same activities – this would include differentiated (ie higher) requirements where technology companies have a systemic significance. However, this is unlikely to be sufficient. Just as in financial services, the business models of technology companies are a complex web and these interactions and interdependencies may mean that it is difficult to isolate the activity. Also, in some cases, we have already passed the point where there would be systemic implications if one of these technology companies were to fail. This suggests a focus beyond the activity to include entity-based regulation, which may need to be differentiated if macro-risks are also high.

Although it’s an obvious point, it bears re-stating that an entity-based system relies on an easily definable entity that engages in what the regulator is interested in. What seems inevitable is that a functioning entity-based approach for tech companies will take some time to set up, even at the domestic level. An internationally agreed entity-based system of regulation is likely to be someway off, if only because tech firms do so much business cross-border. Fundamentally, the legislation required is not there in many cases. Further, technology companies understandably have not organised themselves with financial (or, indeed, other) regulation in mind and the regulatory community has yet to work out how they will organise the regulation of technology companies.

Reality tech

It is likely that regulation of technology companies will continue to evolve, with regulators trying to make the most use of their existing powers where possible, this probably means some form of enhanced disclosure initially, but inevitably a specific entity-based regime will need to be created. This will need clear international standards and some re-structuring of technology companies. These are both steep cliffs to climb, but they need to be tackled before a failure highlights the inadequacy of the system we have now.