Impact of Digital Payments on FinTech in India
Impact of Digital Payments on FinTech in India
T
INTRODUCTION Digital payment and neo banks also come within the
umbrella of fintech. Since the fintechs work online, there is
he Indian FinTech industry has been a low operational cost and a wider reach in comparison to
bristling with activity over the past few years. a traditional setup requiring brick-and-mortar infrastructure.
The gradual shift towards digitalisation in
India has fuelled the growth of financial Any financial system has few risks associated with it and so is
technologies (“fintechs”)1 that help to set the case with fintechs Cyber security is the biggest challenge
up a buoyant alternative credit mechanism. for Fintech businesses. The risk of information leakage,
The term FinTech was first coined in the malware, security break, cloud-based security risk, phishing,
21st century to describe the technology used in the back-end and identity threat is making the Fintech businesses helpless at
systems of established financial organizations. The winds of some point or others. For instance, digital payments generally
change in this industry are being driven by advancements involve three parties, i.e., source bank, payment system
in technologies like automation, data science, AI/ML, platform and customer, hence the customer shares significant
smartphones, and telecommunication which are ushering in a sensitive personal information with the other two parties
new era in of FinTech players who are on one hand usurping involved in the transaction, posing trust on the other two
business from traditional players while also collaborating with parties that not only the transaction is secured but also his/
them to expand the market in other areas. On the other hand, her personal data is safe with the other two participants. If
the pandemic while being transitorily disruptive, has provided any of the parties (other than the customer) fails to maintain
a fillip towards digitalization of financial services. Consumers adequate security in relation to the transaction concerned
are eager to adopt digital, contactless, and remote services. or the data shared with them, the customer may suffer
significant loss and damage. It may also be noted that since
Today, however, FinTech spans various sectors and there is a significant degree of online verification, there are a
industries, including education, retail banking, non-profit host of permissions and accesses granted by the customer
ARTICLE
to these digital payment platforms, which interalia involve,
reading customer’s messages, using microphone and camera
of the customer, access their photo gallery etc. As the online
mechanism has associated potential cyber security and data
protection risks, there are a host of regulations and guidelines
to ensure that the cyber security and data protection issues
are taken care of while interacting with such digital platforms.
Regulators (RBI, IRDAI, and SEBI) have undertaken There is a lack of a consolidated set of guidelines
numerous measures to ensure increased accountability and on digital payments and neo banks. On the digital lending
the uninterrupted availability of secure and affordable digital side, the Reserve Bank of India (RBI) has indicated
financial systems. Indeed, financial inclusion has become a a recent policy move towards increased regulation. A
viable reality for the citizens of India. summary of laws, regulations, and guidelines applicable
to digital payments and neo banks are provided below:
COVID CRISIS HAS PROMOTED NEO The Payment and Settlement Systems Act, 2007
BANKS AND DIGITAL PAYMENTS (“PSSA”). It is the principal legislation governing payment
systems in India.
Shocks of various kinds can drive technological adoption in
unanticipated ways. The COVID-19 pandemic has had an The NPI Guidelines on Unified Payment Interface (“UPI”)
economic ripple effect across various sectors including the which enumerate the procedural guidelines to be followed
traditional banking system. This unprecedented situation by UPI platforms.
ARTICLE
Notifications, circulars, and directions in relation to Non-
Banking Financial Companies (“NBFCs”) by Reserve
Bank of India (“RBI”) (applicable in case a digital platform
comes within the category of NBFC, as defined in the RBI The government and regulators are one of the
Act, 1934).
key catalysts for the growth of the FinTech
The Guidelines on Regulation of Payment sector in India. Few of the government
Aggregators and Payment Gateways dated 17 March programs that have played a key role in
2020, issued by RBI, apply to the payment intermediaries,
namely the payment aggregators and payment gateways. propping up FinTech are; Jan Dhan Yojana,
Startup India, license for payments banks,
The RBI’s Master Direction on KYC provides guidelines
on the KYC of customers during risk assessment to tackle Digital India program, recognition of P2P
cyber security issues. lenders as NBFCs, regulatory sandboxes by
The Data privacy and Protection Laws including the Infor-
RBI, and IRDAI for FinTechs, and National
mation Technology Act, 2000 and the Technology (Rea- Common Mobility Card (NCMC). The robust
sonable Security Practices and Procedures and Sensi- public digital infrastructure (Aadhar, UPI,
tive Personal Data or Information) Rules, 2011. account aggregation, GST, OCEN etc.) and
Besides the aforesaid, the Personal Data Protection Bill, related supportive regulatory environment
2019 (“PDP Bill”) is pending before the Parliament of has helped power India’s FinTech
India. The PDP Bill is modelled along the General Data
Protection Regulation (“Gdpr”) and is inspired by its key innovations.
principles like purpose limitation, data storage restriction
amongst others.
In January 2021, the RBI constituted a Working Group
the Information Technology (Reasonable Security Practices
to review digital lending activities by regulated as well as
and Procedures and Sensitive Personal Data or Information)
unregulated entities with the objective of forming a regulatory
Rules, 2011 (“Rules”) which define SPDI in depth, apply to
framework for digital lending. Following the submission of
body corporates or persons located within India and relate
the Working Group’s recommendations to the RBI, it is likely
to information about natural persons. A bank collecting SPDI
that the digital lending sector will see greater regulation.
has to abide by the Rules for collection, storage and disposal
In order to combat the above failings, RBI must consider
of data. In case a wrongful loss or wrongful gain to any
direct regulatory overseeing of nascent sector. In 2019, it
person is caused by the negligence on the part of a body
had introduced a new regulatory sandbox for testing new
corporate in possessing, dealing, or handling his/her SDPI
financial technologies. Similar regulatory sandbox should
then such body corporate shall be liable to pay damages by
be introduced for neo-banks considering their potential to
way of compensation to the person affected. As per S. 72A
accelerate financial inclusion of the masses.
of the IT Act, in case any person including an intermediary,
while providing services under a lawful contract, accesses
DATA PROTECTION AND CYBER SECURITY any personal information of a person with an intent to cause
FOR ADDRESSING PRIVACY CONCERNS wrongful gain or wrongful loss, and discloses such information
to any other person without the person’s consent or in breach
The Constitution of India does not list the right to privacy of the lawful contract, then the penalty imposed shall be of
as a fundamental right. However, this right is granted to the imprisonment up to a term of three years and/or fine which
citizens of India basis the interpretation taken by the Indian may extend to INR 5 lakh.
Supreme Court in 2017 in the landmark judgment of Justice
K. S. Puttaswamy (Retd.) and Anr. v. Union of India And However, one had to acknowledge that the
Ors. Herein, the Hon’ble Supreme Court primarily interpreted Amendment and Rules came into force in the years
Article 21 of the Constitution viz. the fundamental right to life 2009 and 2011 respectively. The punishments as per the
of Indian citizens as being inclusive of the right to privacy Amendment are trivial in comparison to the potential harm
and inter-alia, the right to protection of citizens data and that can be caused. Thus, they are not adept enough to
informational privacy. The PDP Bill was tabled in the Indian take into consideration the newest cyber security issues
Parliament by the Ministry of Electronics and Information concerning neo banks.
Technology (“Ministry”) on December 11, 2019. On 16
December 2021, the Joint Parliamentary Committee has Also, the Amendment does not provide for any framework
published its report along with the finalised Data Protection for data localisation, consequently, the Amendment does not
Bill, 2021. When passed into law, this has the potential make it mandatory for hosting the servers of big data collecting
to change the way in which data is used by businesses. companies like Facebook and Google, locally within India. This
India does not presently have an omnibus data protection leads to a scenario, where suing these big players becomes an
legislation. impossible dream with merely their marketing subsidiaries
within the geographical boundaries of India. This free flow of
In the meanwhile, the Information Technology Act, 2000 (“IT data outside the country without the person’s consent makes
Act”) was amended to include S. 43A and S. 72A to protect the entire mechanism to safeguard personal data, futile. To
personal data and sensitive personal data and information tackle this issue, the PDP Bill was introduced to ensure better
(“Spdi”). On 11 April 2011, the Government brought into effect data protection. One of the stipulations under the PDP Bill
ARTICLE
The Information Technology Act, 2000 despite providing
some degree of data protection does not live up to varied
kinds of cyber breaches that can take place in the latest
The creation of a new Data Protection times. It is crucial that the PDP Bill is also modified taking into
consideration all the loopholes and thereby passed into an act
Authority (DPA) under the Bill, with soon so that its authority is established firmly. It is also essential
extravagant powers and the imposition that a specific set of laws on digital payments and neo banks
of blanket provisions without adequate exists to ensure that they have a clear and concise checklist.
This shall ensure that these entities deliver their functions but
consideration of its impact on the financial at the same time do not compromise on privacy.
sector, may lead to a regulatory overlap with
the existing bodies that supervise financial It is essential that the data protection and cyber security
laws in India develop in their entirety. Currently, there lacks
entities in the country currently, including a consolidated set of guidelines to adhere to. Despite
the RBI, SEBI, IRDAI, etc. Such regulated the hindrances, such as the lack of virtual licenses to neo
entities are required by these sectoral banks in India, digital payments and neo banks have grown
steadily in India. Indian regulatory regime does not allow
regulators to collect certain personal data as for the granting of virtual banking licenses. RBI, through
part of their KYC processes and to prevent its 2015 Master Circular on “Mobile Banking Transactions
money laundering or tax evasion. in India – Operative Guidelines for Banks”, has mandated
the requirement for digital banking service providers to
have some physical presence. As a result, neo-banks can
provide banking related services only through outsourcing
their banking responsibilities to licensed banking institutions
unnecessary. Entire processes, and many of the skills that and non-banking financial companies. In many cases, such
previously had to be hired, can be replaced with automation banks and fintech companies are structured as an outsourcing
or expert systems. This has also given room for third parties arrangement where the non-banks verify data for credit
to step in, such as cloud service providers. Digital identity (ID) requests or undertake the preliminary work for opening current
and know your customer (KYC) registries are implemented accounts. This arrangement shall be governed by the 2006
and can help redefine the onboarding and authentication RBI Guidelines on “Managing Risks and Code of Conduct in
process that has long required in-person verification at Outsourcing of Financial Services by banks” as well as the
a branch. A majority of industries have increased their 2010 RBI Guidelines on “Financial Inclusion by Extension of
proportion of digital talent out of the total amount of talent Banking Services – Use of Business Correspondents (BCs)”.
they hire. This signifies a greater emphasis being placed on It is imperative that the RBI facilitates neo banks to operate
equipping the workforce with digital skills. The reality of the within the ecosystem of virtual licensing.
skills gap means organisations are looking for talent with
a hybrid set of complementary skills. A hybrid skill set also To ensure that the digital payment and neo banks grow
indicates to an employer that this kind of talent will be open exponentially in the future, it shall be essential that they bank
to learning, reskilling, and upskilling as per the constantly on secure technology platforms by adhering to a consolidated
changing directions of the business. set of laws provided by the government.
CONCLUSION REFERENCE:
Experts estimate that the total market growth potential 1. The evolution of Neo Banks in India-Impact on the
for India’s digital lending sector between 2021-2023 is financial ecosystem
approximately USD 820 billion Therefore, to capitalize on this
2. Digital Banks : A proposal for Licensing & Regulatory
potential, many investors have infused a lot of capital into
Regime for India - Discussion Paper of Niti Aayog
digital lending businesses.
3. The Winds of Change -Trends Shaping India’s Fintech
Several key drivers that have contributed to this growth Sector
include the following:
4. Ernst & Young LLP
Improved mobile and internet penetration
5. Reserve Bank of India, ‘Guidelines on “Financial Inclusion
Regulatory and government policy push towards financial by Extension of Banking Services -Use of Business
inclusion Correspondents (BCs)’ (2010) https://rbidocs.rbi.org.in/
rdocs/notification/PDFs/CPC28092010.pdf.
Emergence of low-cost real-time payment methods
6. A Wider Circle – Digital Lending and the changing
Rising tech-savvy millennial population Landscape of Financial Inclusion – Price Waters Coopers
(PWC)
A vocal FinTech community that is driving the innovation
agenda 7. Fintechs are paving path for greater financial inclusion in
India: https://www.financialexpress.com/industry/banking-
COVID-19 induced need for contactless means of finance/fintechs-are-paving-path-for-greater-financial-
payments inclusion-in-india/2327874/ CS