Payments Industry Regulatory Compliance

A Look Under the TARP at the Payments Industry

brooxp@bwplawyer.com (Broox Peterson) — Wed, 19 Nov 2008 09:57:41 GMT

Scott Loftesness at Glenbrook Partners had some intriguing thoughts he shared with me last week (he called them "black swans"). What would happen if Visa or MasterCard tried to acquire Amex? What would happen if Visa or MasterCard went bankrupt? What if the associations permitted non-banks like Wal-Mart to become members? These are probably not purely hypothetical questions these days, a measure of the extraordinary times we are suffering, so a few thoughts on Scott's questions are worth a post. By the way, for the record, I have no stockholder stake in any outcome (just a taxpayer stake). I did recently, though, and wasn't that fun.

Could Amex Be Acquired?

It is known that Amex has recently had difficulty funding its receivables in the capital markets, and its recent emergency conversion to a bank holding company gives it access to the TARP funding as well as the ability to acquire a bank or start taking deposits at the one they already own. I have no idea how badly Amex needs taxpayer money to survive, but it is not a foregone conclusion for me that they would get it if they became or were close to becoming insolvent.

In simpler times competition policy might argue for a bail-out, but concerns about industry concentration seem pretty far down the public policy hierarchy these days. In past years there were rumors that Citibank was in discussions to acquire Amex, and it is possible that the government would prefer that approach if Amex is in trouble, as they did with Washington Mutual. I am also not sure that an Amex failure would pose the same magnitude of systemic risk as Washington Mutual's potentially did, since it largely operates outside of the banking system (or did). Which is not to say that its failure would not be greatly upsetting, but at this point, stand in line.

As for a possible acquisition of Amex by Visa or MasterCard, that does not seem a likely scenario. It is true that the newly-corporate bankcard companies have considered entering the acquiring business over the years, and of course, they may like to get their hands on some of the Amex processing technology, but as Scott suggested, they would want to spin off the Amex issuing business to avoid competing with their customer banks (among other reasons).

I think that it is more likely that a large bank would be the successful bidder. Such a bank could acquire a valuable new brand and marketing expertise as well as a global acquiring and processing network. I believe Visa and MasterCard would fail in any attempt to acquire Amex in competition with a bank since that would effectively eliminate Amex as a competitive brand in the marketplace, and unless Amex was failing and there was no other reasonable offer for Amex, the Department of Justice Merger Guidelines would most likely, if not certainly, bar the transaction. If no bank was interested in acquiring a failing Amex, the government might then decide to step in to preserve Amex as a competitor rather than seeing it dismantled by Visa or MasterCard.

Visa or MasterCard Bankruptcy?

It has already been reported that debit and credit card sales volume is down, and perhaps this recession will be the event that breaks the decades-long record of unceasing annual sales volume growth for the industry (most of the time in the double digits). Since Visa and MasterCard revenues primarily come from fees on member bankcard sales volume, acquiring volume, and transaction processing, these revenues will suffer along with the economy. Cost-cutting measures will likely result, although it will be very difficult to trim expenditures for issuer incentive payments, since the largest issuers will likely be looking for more, not less support for their ailing card programs.

As the numbers of large players in the banking industry continues shrinking, the revenues of Visa and MasterCard depend increasingly on the loyalty of a few large issuers, and the loss of a large issuer would hurt, badly. This is why the possible acquisition of Amex by a large issuer is an interesting scenario to consider. The acquisition of Amex would give a large issuer the integrated payment network system to run a global card business independent of Visa and MasterCard that large issuers have dreamed about (and threatened Visa and MasterCard with) for years.

Amex aside, since issuer incentive payments are based on issuer sales growth (leaving aside marketing and product development support payments), large issuers will likely seek to cushion their loss-ridden bottom line with more lucrative incentive agreements from Visa and MasterCard containing less stringent growth requirements, with the threat of defection to the "other brand" implicit in these "requests". Ironically, the fact that Visa and MasterCard are now both publicly traded (and closely followed) probably gives the large banks even more leverage over the former associations than when they were 100% owned by banks.

[I think the spin-off of Visa and MasterCard by the banks was brilliant for this and other reasons: monetizing an illiquid investment at the peak of its game for a pile of cash, for little loss of meaningful "control", and at a time when the enforceability and profitability of the interchange reimbursement fee model may be headed downward. Who says the banks always get it wrong? But I digress.]

Relatively inelastic issuer incentive payments on top of sharply lower fee revenues would certainly hurt margins and lead to cost-cutting, but probably not to bankruptcy. Visa and MasterCard are well-capitalized and should be able to weather an economic downturn. However, the former associations have a number of contingent liabilities that could in extraordinary, but not inconceivable, circumstances push them into insolvency.

The multi-state interchange fee (and other) litigation continues with capital in escrow to fund settlements. The availability of treble damages in antitrust litigation is perilous for defendants, and depending on how damages are calculated in the interchange litigation, could be catastrophic. Of course, these cases will be settled, but at what cost? So far $2 billion per Visa settlement agreement has been the going rate, but there is no guarantee that that is any sort of cap.

Visa and MasterCard have the obligation to guarantee settlement of bankcard transactions if a member fails. Visa and MasterCard have collateral from riskier issuers but, at least historically, the largest issuers have been deemed "too big to fail", and the only backstop in those cases are lines of credit and capital to fund the settlement guarantee. "Too big to fail" seems a slender reed in these extraordinary times, and if WAMU and Wachovia had been permitted to fail, would Visa and MasterCard have been able to make up the shortfall and complete settlement without becoming insolvent? Will there be more large bank failures, in the U.S or elsewhere in the world?

There are other potentially-sizable contingent obligations as well, such as that of Visa, Inc. to repurchase the (non-publicly-traded) stock owned by the European banks, at a valuation that could be quite large depending on the circumstances at the time.

If Visa or MasterCard were to suffer an extraordinary event and become insolvent, would the Treasury or the Federal Reserve step in and help the bankcard companies? I suppose this would depend on the perceived systemic effects of failure. During these times when banks are afraid to lend to anyone, might a failure or threat of failure of Visa or MasterCard cause a freeze-up of card acceptance and further damage the economy? The Government might think so and bail them out.

Wal-Mart an Member of Visa or MasterCard?

I believe the greater risk in these times to Visa and MasterCard may be the defection of one or more large members, such as in the Amex acquisition scenario above. Discover might also find itself an acquisition target of a large bank. If the largest members pull their volume out of the bankcard companies might that be the stimulus for some rethinking of the traditional bankcard association membership model in the U.S. to allow non-banks to join as members? It would not be unprecedented in the sense that non-banks have been allowed as members of one type or another in some parts of the world already; Canada and South Korea come to mind. In Visa, anyway, there also is no longer the impediment of the financial institution members being able to block a change permitting a non-bank to be a member, since the only approval required is that of Visa Inc. and the banks do not control Visa, Inc.

Wal-Mart has been unsuccessful in its attempt to acquire an industrial loan bank so far, so would it welcome a chance to become a non-bank member of the bankcard companies (and would it be welcomed)? Without an industrial loan bank Wal-Mart would need state lending licenses to issue cards and would not be able to export rates and fees, so it might find itself at a competitive disadvantage to national issuers. Nonetheless, its loyal customer base might be a marketing advantage in itself, and the ability to issue a national payment system card attractive. On the acquiring side, the advantage is less clear since Wal-Mart already pays rock-bottom fees after incentives from Visa and MasterCard, but as everyone knows, every cent counts for Wal-Mart.

The advantage of Wal-Mart membership to Visa and MasterCard would be more cards issued and more sales volume, although how much would actually be incremental vs. cannibalization from other issuers of existing sales volume is not clear.

Thanks again to Scott for his intriguing questions.

Payments Industry "Business Process" Patents - A Dent in the Holy Grail?

brooxp@bwplawyer.com (Broox Peterson) — Mon, 10 Nov 2008 09:23:24 GMT

On October 30, 2008 the United States Court of Appeals for the Federal Circuit decided In re: Bilski, __F.3rd__ (Fed. Cir. 2008) (in banc), a decision that will likely reverberate widely in the payments and financial industry. With this decision the Federal Circuit, the federal court of appeals with jurisdiction for patent matters, snugged up the standards for patent eligibility of business processes and methods that had been loosened by its 1998 decision in State Street Bank & Trust vs. Signature Financial Corp.

Not all original inventions, discoveries or bright ideas are eligible for patent protection. In particular, abstract ideas, mental processes or fundamental principles of nature standing alone cannot be patented, as these are the foundations of civilization and progress, and belong to no one. An invention that utilizes one of these abstract ideas or principles to create a useful application in the world we live in can be patented, though, assuming it is novel and non-obvious. The maintenance and application of this distinction has bedeviled the Patent and Trademark Office, the courts and patent attorneys (not to mention us civilians) in recent years.

The distinction was easier to maintain before the advent of computers and software, and the heavy reliance on them that has come to characterize commerce and much else of daily life. Inventions largely used to be implementations of abstract ideas or fundamental principles in physical objects or transformations of physical objects: machines, manufacturing processes, chemicals etc. With the creativity potential offered by computers and software, the economy has become increasingly service-based and process-driven, and applications for patents and granted patents have reflected this change. The challenge posed to the patent system by process-based business models, usually involving software, is separating what is patentable business process from what is not. Prior to State Street, certain software applications implementing processes had been deemed patentable, including ones implementing processes transforming CT scan data into graphical form, heartbeat data into electrocardiogram signals, and controlling the curing of raw rubber, but in these cases the patented process transformed physical properties, or data representing them, into another form. This limitation prevented the exclusion of other uses for the abstract ideas or fundamental principles that were implemented by the software programs. Although there was no actual prohibition in patent law on patenting business process, until State Street software patents usually required transformation of physical things.

In the State Street case, the Federal Circuit upheld a patent on a software-implemented method of pooling, processing and accounting centrally for the assets of multiple mutual funds (a so-called "hub and spoke" configuration). It overturned a lower court decision finding the patent invalid on the then-prevalent view of software as a math-like algorithm tantamount to abstract ideas. The lower court had found that the mere processing of numbers into another form involved no physical transformation and was thus not a patentable process. The Federal Circuit in State Street created a new standard for the patent eligibility of software, from causing a physical transformation to producing "useful, tangible and concrete results". The Federal Circuit also made it clear that there was no per se exclusion from patent eligibility of business processes.

The State Street decision is viewed by some as having opened the door to a flood of business process and software patent applications and granted patents in the last decade , although to some degree the decision merely reflected and justified what had already been occurring at the Patent Office. State Street was decided during the dotcom boom in the late 1990's, and many patent applications during that period were for Internet-based processes, many, but not all, of them marketing-related. A particularly infamous patent was issued in 1999 to Amazon for a "one-click" on-line ordering and payment process. This is not the place to catalog the variety of types of business processes for which patent protection has been sought and granted, but the point is that seeking patent protection for business process and method became a key focus of many start-up and established businesses in and after the late 1990's. At the same time critics worried that the liberal standards for obtaining business process patents were stifling creativity and innovation, and requiring allocation of attention and resources to patent matters (offensive and defensive) that were better spent by businesses on developing and marketing products and services.

In the ten years since State Street was decided the Patent Office has struggled to find the limits of patent eligibility of business processes and software. Many of the patents that have been granted contained a technological component and thus could satisfy even pre-State Street standards, but the line was murky for many others. During the time I was responsible for the Visa patent program (2000-2005) I do not recall any instances where patent counsel felt an "invention", usually business process-based, could not be patented. Obviously this was a good time for the patent bar.

The Federal Circuit apparently was having second thoughts itself about the effects of its decision in State Street when it decided to rehear en banc an appeal from the decision of the Patent Board of Appeals and Interferences rejecting as patent ineligible the claims of one Bernie Bilski (Ex Parte Bilski (BPAI 2006)). Bilski involved patent claims for a system of hedging against bad weather for a distributor of commodities like grains, essentially consisting of contracting in advance a fixed price from its suppliers and a fixed price to its buyers. There was no technological component to the process, which could be performed entirely in the mind. Although these claims probably failed even the State Street test requiring a "tangible and concrete result", the Federal Circuit took the case as a vehicle to re-examine the standard of patent eligibility created in State Street, and ultimately rejected that standard in favor of the more restrictive standard State Street had replaced:

"A claimed process is surely patent-eligible under § 101 if: (1) it is tied to a particular machine or apparatus, or (2) it transforms a particular article into a different state or thing."

In other words, there must be a central physical component to a business method or software claim for it to qualify for patent protection. The meaning of this in the context of the transformative test in (2) above is that for software or process to be eligible for patent protection it must transform physical objects or representations of them into something else. It is hard to imagine an invention in the financial or payments industries being able to meet that test, and the key to patent eligibility after In re: Bilski will likely have to be meeting the "particular machine or apparatus" test in (1) above. Unfortunately, In re: Bilski provides no guidance in that area, with the Federal Circuit expressly deferring any guidance as to how that test can be satisfied to a future, more appropriate case. As one bit of clarification, though, the Patent Board of Appeals and Interferences has already held that "[a] general purpose computer is not a particular machine, and thus innovative software processes are unpatentable if they are tied only to a general purpose computer." See, for instance, Ex parte Langemyr (May 28, 2008) and Ex parte Wasynczuk (June 2, 2008).

The ultimate impact of In re: Bilski on the future of patents in the financial and payments industries is not clear yet, but it is important that the decision did not reject the patentability of business processes or software altogether. Although the decision is likely to slow the filing of new applications in these industries, there will likely still be many patent applications filed seeking to test the limits of the "particular machine or apparatus" test. Another consequence of the decision is to call into question the validity of those patents already granted under the rejected State Street test, requiring holders of these patents to review the claims under the In re: Bilski test and perhaps seek to correct any problems by adding claims more likely to survive a Bilski review through continuation or reissue proceedings.

In the long run, if patents cease to be the Holy Grail in the financial and payment industries, that may not be a bad thing. A patent is no substitute for being first to market with a well-executed, profitable business model. A strong patent can buttress a business position, but if seeking and waiting for one hinders being first to market it can hurt more than help.

FTC Red Flags Rule Enforcement Delay -"What Red Flags Rules?"

brooxp@bwplawyer.com (Broox Peterson) — Mon, 03 Nov 2008 13:48:19 GMT

On October 22, 2008 the Federal Trade Commission (FTC) announced a six month extension, to May 1, 2009, for entities under its jurisdiction to comply with the "Red Flags" rules (16 CFR 681.1) adopted on November 7, 2007. The original compliance deadline was November 1, 2008, and the extension applies only entities under FTC jurisdiction. Banks and other financial institutions regulated by the Federal Reserve, the Office of Thrift Supervision (OTS), the Office of the Comptroller of the Currency (OCC), the National Credit Union Administration (NCUA), or the Federal Deposit Insurance Corporation (FDIC) are still subject to the November 1, 2008 deadline.

The Red Flags rules require, among other things, that covered entities: (1) assess what risks of identity theft are involved in their services or products, (2) determine what circumstances or behaviors could be signs of identity theft-related activity involving the services or products (i.e., red flags), and (3) adopt a written "identity theft prevention program" based on that assessment and the potential "red flags" of identity theft. These requirements are in addition to, or supplementary to, existing Customer Identification Program (CIP) or other information security, fraud prevention or anti-money laundering programs an entity may have or be required to have under other regulation. In other words, while a covered entity may have a good start from previous information security, anti-fraud and anti-money laundering efforts and programs, a written program addressed specifically to compliance with 16 CFR 681.1 must be adopted after the analysis specified in the regulation.

The FTC discovered during outreach and education attempts after adoption of the regulation that many of the entities subject to the Red Flags rule were not aware that such a rule existed, much less that they were subject to it, or even that they were subject to FTC jurisdiction at all. Since many of those entities became aware of the requirements too late to put a compliant program in place prior to the original deadline, the FTC extended it.

FTC published guidance to date has probably contributed to any confusion that exists, since only a lawyer could love the subtleties of the explanations and examples. For instance, in guidance published in June, 2008 (http://www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm), the FTC explains that "financial institutions" and "creditors" with "covered accounts" are subject to the regulation. "Financial institutions" are defined as the usual suspects (banks, thrifts etc.) but also "any other entity that holds a 'transaction account' belonging to a consumer." A transaction account is defined as "a deposit or other account from which the owner makes payments or transfers." As examples, the guidance lists checking accounts, NOW accounts, savings deposits subject to automatic transfer, and share draft accounts. Maybe it's just me, but if the coverage of the Red Flags rules is in fact very broad, which it is, it was not helpful to use only examples of types of transaction accounts offered only by traditional financial institutions, and my guess is that the examples hurt more than they helped.

As one example, I wonder if start-up companies seeking to utilize network-branded prepaid cards as delivery vehicles for value-added services in the health care field (or any other field) understand that they could have Red Flags compliance responsibilities to consider. A prepaid card account could be a transaction account under the broad definition of the term. Although the prepaid card is issued by a financial institution, if it is marketed and distributed by the company as an agent of the bank, the obligation for compliance may be the agent's (and the issuing bank would probably insist). Further, any written program adopted in compliance with the Red Flags rule must address how to ensure compliance by any third party to whom any part of the business is outsourced. Since outsourcing is a common practice in the payments industry, this requirement also will require attention. Of course, just for amusement, there is in the prepaid cards industry the question of exactly who is the outsourcer and who is the outsourcee, so you can't say this isn't fun.

If there is any comfort to share, it is that the FACTA legislation that created the Red Flags requirements seems to expressly bar any private (i.e. consumer) right to sue for violations of the Red Flags requirements (although a drafting glitch in the legislation has already caused different courts to come to different conclusions on this). Enforcement will be by the FTC and possibly state attorneys general.

Visa IPO - Big Changes?

brooxp@bwplawyer.com (Broox Peterson) — Thu, 20 Mar 2008 11:21:48 GMT

$17.9 Billion. Wow, good deal, if you can get it! They are partying in California now. Now the adjustment to public company pressures begins. Note that Visa has promised $300 million in cost reduction to enhance returns of its stockholders in the coming year.

But what can we expect to change at the association aside from continuing to squeeze out the fat, which has always been considerable, although melting away in recent years? Some commentators speculate that large issuers may now be more inclined to push off on their own and create their own networks, and that Visa will start to compete with its issuers by offering value-added services to merchants and possibly cardholders. (http://www.creditslips.org/creditslips/2008/03/the-visa-ipo.html#more)

My take on this is quite different.

First of all, aside from the litigation planning aspects of the IPO, I believe the large issuers understood that their very good deal with Visa in terms of favorable pricing and "scholarships" was not likely to change after Visa went public. After all, where do Visa's revenues derive from? Answer: Sales volume or its proxy, transaction volume. And what drives these numbers more than any other factor? Answer: The number of cards issued. And who issues most of these cards? I know, annoying.

If anything, there will be even greater pressure on the Visa Inc. Board to keep the big issuers happy, so that sales volume and thus revenues continue to rise. Losing a big issuer would be a very expensive proposition for Visa Inc. stockholders, not to mention Visa management. The objectives of the independent directors will be happily aligned with those of the large issuers (and management), and the Board of Directors of public Visa Inc. may even be more solicitous than the banks were to themselves when they controlled (and actually were) the Board of Directors. This solicitousness may also dampen any new initiatives by a newly-emboldened Visa staff that might be deemed competitive by the large issuers. Nothing new there from the good old days.

The other factor that separation speculators seem to minimize is that it would be an extremely non-trivial matter for a large issuer to set up its own closed payment network. With enough money and time anything can be done (witness Discover), but how can an issuer justify doing so if it already has in place a highly-profitable payment product and pays little for the privilege of issuing it (the aforementioned "scholarships")? Oh, I think things will pretty much percolate along as before, except that the banks that used to own Visa are $10 Billion dollars richer. Beats subprime mortgages, which is another topic.