<h3>“My husband wanted to start a small business but he could not get a big enough loan from the cooperative and did not qualify for a bank loan. The coyote, however, had no problem giving him a large loan to take him to America. My husband sends me money every month and I take the cash to the coyote to repay the loan.”</h3>
<h4 style="text-align: right;">– Anonymous woman from Santa Apolonia, Guatemala</h4>
Immigration to the United States from Guatemala is motivated by a myriad of factors, including rising rates of local violence and climate-change induced impacts on agriculture, but the main accelerant is extreme poverty without prospects for economic mobility. Guatemalans view the enormous potential for economic opportunity abroad as a pull factor, especially in contrast to the limited financial prospects that they face at home. This presents the financial sector in Guatemala with both the opportunity and imperative to support Guatemalans hoping to build and maintain wealth in their home country. This blog shares how the <a href="https://www.usaid.gov/" target="_blank" rel="noopener noreferrer">United States Agency for International Development (USAID)</a> is helping deepen financial access and usage among low-income and marginalized Guatemalans to create more economic opportunities within their communities.

Guatemala has the largest economy in Central America, an achievement fueled primarily by agricultural production, as the nation produces and exports some of the highest quality coffee and spices in the world. Guatemala also has rich cultural diversity, with a <a href="https://www.macrotrends.net/countries/GTM/guatemala/population" target="_blank" rel="noopener noreferrer">population of over 18 million</a>, over 40 percent of whom identify as one of the country’s more than 20 <a href="https://www.pionerophilanthropy.org/guatemalas-indigenous-community-a-struggle-against-poverty-racism-and-exclusion/" target="_blank" rel="noopener noreferrer">Indigenous communities</a>.
<blockquote class="pullquote--right">The financial sector in Guatemala has the opportunity and imperative to support Guatemalans hoping to build and maintain wealth in their home country.</blockquote>
Despite its rich culture and economic standing in the region, Guatemala has high social inequity, including a <a href="https://www.worldbank.org/en/country/guatemala/overview" target="_blank" rel="noopener noreferrer">poverty rate of 52.4 percent</a>, which has been further exacerbated by factors such as climate change and COVID-19-induced economic shocks. The country’s economy benefits from significant remittance inflows—which make up <a href="https://country.eiu.com/article.aspx?articleid=221764805&amp;Country=Guatemala&amp;topic=Economy&amp;subtopic=Forecast&amp;subsubtopic=Economic+growth" target="_blank" rel="noopener noreferrer">18 percent of the country’s GDP</a>—but this has yet to translate into significant reductions in poverty. In terms of financial access, according to the <a href="https://www.worldbank.org/en/publication/globalfindex" target="_blank" rel="noopener noreferrer">latest Findex Data from 2022</a>, only 35 percent of adults have access to formal bank accounts, down nine percent from 2017 when 44 percent of adults had an account. The gender gap is six percent: 34 percent of women had an account in 2022 versus 40 percent of men, a one percent increase in the gender gap from 2017 when it was five percent. Many do not rely on formal lending sources, with only 11 percent of adults borrowing from a financial institution last year. The Center for Financial Inclusion wrote about<a href="https://www.centerforfinancialinclusion.org/rural-poor-and-pressured-by-climate-change-migration-and-financial-inclusion-in-guatemalas-western-highlands"> the potential for financial services to support rural opportunities in Guatemala</a>.

To break the poverty cycle in Guatemala, low-income families need access to financial services that will build and protect their wealth, enabling them to be more resilient in the face of climate-induced economic shocks and other unanticipated crises. Presently, low-income earners primarily interact with formal financial service providers, including banks, in an over-the-counter (OTC) manner, to cash out remittances without accessing the full suite of benefits that digital financial services can offer such as lower costs, higher speed, and security, as well as building a credit history to access loans.

As smartphone ownership rises in countries around the world, digital financial services (DFS) are a more efficient way to support low-income earners in wealth creation and management by offering convenience, cost savings, economic security, and broad accessibility—and removing the need to go to a physical bank or financial institution. Unfortunately, these service offerings are nascent in Guatemala—and even more so in the country’s rural areas. For example, according to the latest Findex, just 26 percent of adults made or received a digital payment in the last year—a low rate even in comparison to neighboring countries such as El Salvador (28%) and Honduras (32%). While DFS are gaining traction in Guatemala, more work needs to be done to make them accessible, practical, and useful to a broader consumer group.
<blockquote>While DFS are gaining traction in Guatemala, more work needs to be done to make them accessible, practical, and useful to a broader consumer group.</blockquote>
In partnership with DAI’s Digital Frontiers and ConsumerCentrix, USAID recently conducted qualitative customer market research to offer the Guatemalan financial sector concrete recommendations on how it might leverage DFS to positively impact the financial security of low-income and marginalized populations in Guatemala. This research, conducted with 112 participants in Guatemala City, Quiché, and Chimaltenango, identified clear segments and sustainable commercial potential, debunking common misunderstandings about the needs and demands of financially underserved Guatemalans. 

Here are a few key findings: 
<h2>While low-income communities are among the clientele of established providers, banks tend not to treat these communities as strategically critical customer segments deserving of tailored services.</h2>
Most banks mainly offer OTC services to low-income populations, failing to transition these customers to full account holders. The few banks that dominate the financial sector provide bank accounts to only four million people out of the country’s over 18 million population. They offer banking OTC to about five million remittance receivers and one million government-to-person (G2P) and humanitarian aid recipients. Tigo Money, the mobile money provider, offers OTC services to about 700,000 people. The main financial account providers are rural cooperatives, which have about three million clients, and microfinance institutions, which serve about half a million primarily urban clients. 
<h2>A widely-held assumption among financial institutions—that low confidence and limited education are the main barriers to access and use among low-income individuals—is not backed by evidence.</h2>
Providers name literacy, confidence, and aversion to formal financial services as the primary reasons why low-income earners are not formally banked. Yet this study demonstrated that poor customer service, including non-transparent banking fees, which is closely related to low trust in the financial sector, is a major issue alongside stringent requirements for accessing credit—a need among those looking to build a better future for themselves. 
<h2>Latent demand for formal finance exists, and there is awareness of and openness to using digital channels for financial transactions.</h2>
Research participants across all age groups and localities have smartphones and sufficient network connectivity to access DFS. Research found that digital financial literacy is present, particularly among younger segments, and that these segments can and are willing to support their older relatives in using technology. While concerns exist around protecting their security and making mistakes online, there is a shared understanding among participants that DFS is the future, and they are open to using DFS where it can save time and money. Most existing users have prior experiences with bank and cooperative mobile banking applications, generally as complementary to an account. There is little to no awareness of other DFS solutions or even how mobile banking applications could be used more broadly—representing a real opportunity for the financial sector.
<blockquote class="pullquote--left">There is little to no awareness of other DFS solutions or even how mobile banking applications could be used more broadly—representing a real opportunity for the financial sector.</blockquote>
Considering the nascent status of digital finance in Guatemala, financial service providers can start by tailoring products to the most viable segments to first create a critical mass before reaching out to those most in need: the lowest income and most rural consumers. Using criteria around population size, aggregation potential, income regularity, and digital readiness, the research identified two consumer segments with the strongest opportunities for DFS with the most potential use cases, regular income flows, and capacity for aggregation: 1) domestic remittance senders (such as domestic workers) and their recipients, and 2) international remittance recipients. 

Research showed opportunities in digitizing domestic remittance transfers and receipt of international remittances to an account that can be used for a broader set of financial needs including utility payments, savings, and credit facilities based on remittance flows to be used for a microbusiness or household needs. 

Low-income and vulnerable Guatemalans need financial products that help them manage their variable cash flows and to manage risks, including those arising from climate change, and to help them access more economic opportunities. Prototype testing of a potential solution is underway, and the team will produce a full Digital Financial Services Market Assessment Report that outlines these DFS opportunities in greater detail. Stay tuned for the full report—expected in spring 2023.

Letting the Consumer Speak: The Reality of Access to Finance in Guatemala

The pandemic <a href="https://www.worldbank.org/en/news/press-release/2022/06/29/covid-19-drives-global-surge-in-use-of-digital-payments" target="_blank" rel="noopener noreferrer">accelerated the adoption of digital financial services</a>, especially in emerging economies, largely due to the number of people who <a href="https://www.un.org/sustainabledevelopment/blog/2021/12/as-internet-user-numbers-swell-due-to-pandemic-un-forum-discusses-measures-to-improve-safety-of-cyberspace/" target="_blank" rel="noopener noreferrer">began using the internet for the first time</a>. The <a href="https://www.worldbank.org/en/publication/globalfindex" target="_blank" rel="noopener noreferrer">Global Findex 2021</a> found that of the adults in developing countries who paid utility bills directly from an account, one-third did so for the first time during the pandemic. In India, more than 80 million adults made their <a href="https://www.worldbank.org/en/news/press-release/2022/06/29/covid-19-drives-global-surge-in-use-of-digital-payments" target="_blank" rel="noopener noreferrer">first digital merchant payment</a> after the start of the pandemic; in China, over 100 million adults did the same. However, the Findex 2021 data also showed a rise in consumer protection risks and cautioned that less experienced financial consumers were more vulnerable to such risks.

As digital financial services proliferate, new risks emerge. One of these risks is known as <a href="https://www.deceptive.design/" target="_blank" rel="noopener noreferrer">deceptive designs</a>, which are tricks used by companies when designing user interfaces that have the effect – either deliberately or otherwise – of obscuring, subverting, or impairing consumer autonomy, decision making, or choice. In other words, deceptive designs are used to manipulate people into making decisions that may not be in their best interest. Deceptive design is all around us and is increasing with rapid digitalization.

Those most vulnerable to deceptive designs are consumers with low digital capability, low financial means, or are those who are vulnerable because of life events or mental health issues. The use of deceptive designs in financial services, especially when catering to low-income and vulnerable consumers, can cause harm such as loss of agency and risks of data privacy, and can extend to financial losses that increase vulnerabilities and erode trust in the usage of digital financial services.

While the implications of deceptive designs on user privacy and data protection are beginning to be discussed among regulators, consumer protection concerns have yet to be addressed. This is partly because design is hard to regulate, and manipulative design can exploit existing laws and legal loopholes.
<h1>Deceptive Design Patterns Are Ubiquitous</h1>
In the last week, how often have you used an app on your smartphone or a website to order groceries? To shop for clothes? Or logged in to read online news? Chances are at least once. It is also likely that you encountered several deceptive designs during that time. Harry Brignull, who raised awareness of deceptive design, features nearly <a href="https://www.deceptive.design/hall-of-shame/all" target="_blank" rel="noopener noreferrer">400 examples of deceptive design practices</a> on his website. The New York Times, a publication that was one of the earliest to speak about deceptive designs, uses deceptive designs to make their paywall “smarter” and <a href="https://www.techdirt.com/2022/08/19/when-tech-companies-do-it-the-ny-times-calls-it-dark-patterns-when-the-ny-times-does-it-its-called-being-smart/" target="_blank" rel="noopener noreferrer">make it difficult to cancel subscriptions</a>.

In Kenya and Tanzania, <a href="https://www.cgap.org/sites/default/files/Focus-Note-Consumer-Protection-in-digital-Credit-Aug-2017.pdf" target="_blank" rel="noopener noreferrer">CGAP’s research</a> found several challenges with how digital lenders disclose actual pricing to consumers, using monthly or weekly interest rate figures instead of a standardized calculation like an annualized percentage rate (APR). <a href="https://wiredspace.wits.ac.za/server/api/core/bitstreams/d6e32783-24e7-4e50-8bcf-8c58f84bd872/content" target="_blank" rel="noopener noreferrer">Research by Mazer and Rowan (2016)</a> also found that some digital lenders only disclosed the price after consumers clicked the “I accept” button and the loan was executed. Insurance, a financial product that often is accused of mis-sale, can also use deceptive designs when sold online. In the UK, Currys, a well-known retailer, <a href="https://twitter.com/darkpatterns/status/1561031067334844418" target="_blank" rel="noopener noreferrer">nudges online shoppers during check out</a> by preventing them from moving forward unless they choose to buy insurance. In India, until laws changed recently to prevent the mis-sale of travel insurance, it was common to see travel portals use <a href="http://rsrr.in/wp-content/uploads/2021/04/UNPACKING-DARK-PATTERNS-UNDERSTANDING-DARK.pdf" target="_blank" rel="noopener noreferrer">pre-checked buttons to bundle travel insurance</a> with ticket purchase.
<h1>Focus on Consumer Protection by Design</h1>
The nature of these emergent risks requires new partners to work together – including designers, researchers, technologists, civil society actors, and lawyers who work on consumer rights, along with regulators, supervisors, investors, financial service providers, and tech-based providers. To kick off this work, CFI and <a href="https://www.credit-suisse.com/us/en.html" target="_blank" rel="noopener noreferrer">Credit Suisse</a> are partnering to leverage the diverse talent and expertise of Credit Suisse employees through the Innovation for Impact series, a spinoff of the bank’s <a href="https://www.credit-suisse.com/careers-news/en/articles/careers/spark-ideas-explore-new-trails-202012.html" target="_blank" rel="noopener noreferrer">Future of Banking Hackathon</a>. Applying Credit Suisse’s Fresh Perspectives! Framework, the bank’s innovation lifecycle approach, teams of Credit Suisse employees will be guided through addressing the challenges that low-income consumers can face from the use of deceptive designs in financial services. The teams will work together to generate novel ideas, and rapidly test, learn, and adapt their solutions to address the presented challenges.

Through its <a href="https://www.credit-suisse.com/about-us/en/our-company/corporate-responsibility/economy-society/financial-inclusion.html" target="_blank" rel="noopener noreferrer">Financial Inclusion Initiative</a> (FII), Credit Suisse has partnered with Accion for over a decade, including as a founding supporter of CFI. Through the FII, Credit Suisse aims to support the availability of innovative and financially inclusive solutions to help advance progress towards the UN Sustainable Development Goals (SDGs) by providing both financial as well as human resources. The Innovation for Impact series provides a win-win opportunity for Credit Suisse employees to leverage and develop their expertise and innovation capabilities while at the same time contributing to an important challenge facing the inclusive finance sector.

The partnership between Credit Suisse and CFI is a way to begin generating awareness of deceptive designs with investors and financial service providers, and the harms they can cause to low-income consumers. The work on deceptive designs is part of a larger body of work that CFI is developing that looks at how to embed consumer protection by design for systemic change to create digital, inclusive financial systems that are more equitable, less discriminatory, and more empowering.

CFI is launching a strategic area of work around ‘Consumer Protection by Design’ to identify and address newer risks that emerge as inclusive finance is digitalized. This area of work will define the term consumer protection by design, identify newer risks (including deceptive designs), and assess whether these risks tend to be prevalent in specific geographies, industries, and company stages, and if they target specific user groups that are more susceptible. CFI will also conduct a landscape analysis of the specific harms posed to vulnerable consumers with a focus on identifying market monitoring tools and regulatory solutions that can be used to mitigate these harms.

The Hidden Traps of Deceptive Design: Embedding Consumer Protection into DFS

The recent results from the <a href="https://worldbankgroup-my.sharepoint.com/personal/sansar1_worldbank_org/Documents/Findex%20report%202021/Dissemination/globalfindex.worldbank.org" target="_blank" rel="noopener noreferrer">Global Findex 2021</a> show global gains in account ownership and in account usage in 2017—good news given the widespread financial impact of the pandemic. Today, 71 percent of adults in developing economies have a financial account. Yet the findings on financial well-being show that there is more work to do. 
<blockquote class="pullquote--left">71% of adults in developing economies have a financial account, yet the findings on financial well-being show that there is more work to do. </blockquote>
As the type of risks facing low-income consumers evolve, including rising food and fuel prices, and climate shocks increasing in frequency and intensity, we need an expanded definition of responsible finance in which all stakeholders – providers, policymakers, investors, donors, and more – are not just reacting to client protection risks but also anticipate and proactively work to build resilience, mitigate risks, and improve the financial well-being of consumers for the long term. 

Improving how we measure consumer outcomes is critical for an expanded definition of responsible finance. A sway of new research – recently discussed in the <a href="https://globalrff.org/events/june-2022" target="_blank" rel="noopener noreferrer">Responsible Finance Forum</a> – has shown that while access to finance is growing globally, financial health and well-being are stagnating or even declining.   

The Global Findex 2021 introduced a new set of metrics on <a href="https://www.worldbank.org/en/publication/globalfindex/brief/the-global-findex-database-2021-chapter-3-financial-resilience" target="_blank" rel="noopener noreferrer">financial well-being</a>. The data measures three dimensions of financial well-being: (a) managing unexpected financial events (financial resilience); (b) experiencing limited financial stress; and (c) having the confidence and capability to independently use financial products. The data suggests that while there have been gains in account ownership and in account usage since 2017, there is a need for more emphasis on all three components.  
<h1 aria-level="2">55 Percent of Adults in Developing Economies Are Resilient to Financial Shocks </h1>
The Global Findex survey measures “resilience” as the ability to access money equal to 5 percent of gross national income—or about $3500 in the US and 350 Rupees in India-- within 30 days without much difficulty when faced with an unexpected expense. In developing economies, only 55 percent of adults could do so. For comparison, that share is 79 percent in high-income economies. Resilience is an increasingly important dimension of responsible finance as extreme natural disasters are estimated to <a href="https://www.worldbank.org/en/news/press-release/2016/11/14/natural-disasters-force-26-million-people-into-poverty-and-cost-520bn-in-losses-every-year-new-world-bank-analysis-finds" target="_blank" rel="noopener noreferrer">push 26 million people into poverty</a> each year, and the financial sector industry has a role to play in promoting <a href="https://www.centerforfinancialinclusion.org/green-inclusive-finance-a-framework-for-understanding-how-financial-services-can-help-low-income-people-weather-climate-related-risks">adaptation, resilience,  mitigation, and transition</a> of livelihoods affected by climate change.  
<blockquote class="pullquote--right">Women and the poor are less likely than men and richer individuals to be resilient.</blockquote>
Women and the poor are less likely than men and richer individuals to be resilient. One reason is that both women and adults living in poorer households are more likely to rely on family/friends as their front-line source of emergency money. Yet friends and family are among the least reliable sources of money in every developing economy region. There are a number of reasons for this. One is that family and friends may be confronting the same sources of financial stress at the same time, as is the case during the COVID-19 pandemic, or with a natural disaster such as a drought, flood, fire, or earthquake, or in a systemic economic downturn. In contrast, the Global Findex finds that <a href="https://www.weforum.org/agenda/2022/07/financial-resilience-promote-savings/" target="_blank" rel="noopener noreferrer">personal savings</a> are the most reliable source of emergency money. 

&nbsp;
<h4>Adults in developing countries identifying the source of, and assessing how difficult it would be to access, emergency money (%), 2021</h4>
&nbsp;

<img class="size-full wp-image-45211 aligncenter" src="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2022/10/Findex-blog-pic1.png" alt="" width="744" height="396" /> 

&nbsp;
<h1 aria-level="2">The Majority of Adults in Developing Economies Worry About Finances </h1>
The objective reality of not having enough money—or not being able to obtain necessary funds in time to address emergencies—contributes to the more subjective sense of feeling financially worried. In developing economies, more than two-thirds of adults say they are very worried about one or more common sources of financial stress: living expenses for old age; medical costs from a serious illness/accident; monthly bills and expenses; and school or education fees. Twenty-two percent of developing economy adults are very worried about all four of the specified issues.  

In high-income economies, in contrast, only a fifth of adults say they are very worried about one of those four issues, and the share of adults who are very worried about all four is only 4 percent.  

Medical expenses were the biggest financial worry for both men and women in every world region. The financial impacts of COVID-19 likewise register as a significant source of worry, particularly in low- and low-middle-income economies. 
<h1 aria-level="2">Limited Financial Experience and Ability Can Expose Consumers to Financial Abuse </h1>
Beyond resilience and stress, low financial ability makes it difficult for adults to navigate the marketplace for retail financial services. Both account holders and the unbanked display low ability in certain markets. The Global Findex 2021 found, for example, that 31 percent of mobile money account owners in Sub-Saharan Africa couldn’t use their account without help from a family member or a mobile money agent. About two-thirds of unbanked adults similarly said that if they opened an account (excluding mobile money) at a financial institution, they could not use it without help. This lack of financial ability makes current and prospective account holders vulnerable to bad information and to exploitation.  
<blockquote>Low financial ability makes current and prospective account holders vulnerable to bad information and to exploitation.  </blockquote>
Financial service providers can exacerbate that challenge—sometimes unintentionally—when their fees or terms of service are unclear; when they use aggressive marketing; and when they have poor dispute resolution processes.  

One way in which low financial ability can affect account holders can be seen in the Global Findex 2021 finding that about 20 percent of wage recipients in developing economies paid higher fees than expected in order to receive wages directly into their account. In certain economies, that share is as high as 40 percent of wage recipients. We cannot know if the account holder simply didn’t understand the disclosed fee schedule, or if the fee terms were never disclosed. Either way, the fact that account holders are paying more than they expect to use services offers one example of how having an account and using it do not inevitably lead to well-being.  
<h1>Encouraging Responsible Finance and Improving Financial Well-being </h1>
Economies tend to put the burden of financial well-being on the consumers themselves. Making progress will require instead that policymakers and the financial sector industry treat consumer well-being as a shared responsibility. The policy environment also needs to prioritize both consumer protection and attention to the shifting nature of consumer risks. As the nature of these risks evolve, responsible finance has an important role to play in improving resilience and reducing financial stress. This includes, for example:  
<ul>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">Encourage the design of high-quality products that help consumers build resilience and their capacity to prepare for, navigate through, and recover from financial shocks.  </li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="2" data-aria-level="1"><a href="https://www.unsgsa.org/publications/measuring-financial-health-concepts-and-considerations" target="_blank" rel="noopener noreferrer">Measure</a> and evaluate how these solutions are resulting in changes in well-being. </li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="3" data-aria-level="1">Ensure financial service providers clearly disclose product features and fees so that consumers understand what products are most suited for their needs, how to responsibly use these products, and when and how much they will be charged. </li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="4" data-aria-level="1">Inform consumers about the risks of predatory financial practices and what they look like, in plain language and in a format that users can easily understand.</li>
 	<li data-leveltext="" data-font="Symbol" data-listid="1" data-list-defn-props="{&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}" aria-setsize="-1" data-aria-posinset="4" data-aria-level="1">Incentivize financial institutions to incorporate <a href="https://www.poverty-action.org/program-area/financial-inclusion/consumer-protection-initiative" target="_blank" rel="noopener noreferrer">behavioral insights</a> and design research into their products and services. For example, product design features that help people act on pre-established intentions (like building savings for an emergency or for a specific goal) </li>
</ul>
The vast progress of the past decade on increasing account ownership should be lauded. But these gains also mean that the remaining unbanked consumers are among the hardest to reach and the most vulnerable to financial exploitation. Taking steps now to reduce the barriers to financial well-being can improve the financial lives of existing account holders and prepare the financial ecosystem to benefit some of the most vulnerable in our economies.

Responsible Finance and its Role in Improving Financial Resilience and Well-Being

On August 10, the Reserve Bank of India (RBI) released their <a class="Hyperlink SCXW9814176 BCX0" href="https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=54187" target="_blank" rel="noreferrer noopener">recommendations on digital lending</a>. This is a significant moment, especially since the Indian government recently withdrew the data protection bill that aimed to protect consumers from the risks of digitalization and data proliferation. The bill, launched in 2019, was designed in light of concerns about data misuse by private players. A new bill is proposed as an alternative. However, while India awaits this, data regulation depends on sectoral regulations. These new recommendations on digital lending will help to regulate the multitude of digital lending apps that have exploded across India, and how they use consumer data.
<h1>Background on India’s Digital Lending Regulations</h1>
In this age of rapid digitalization, innovation opportunities grow as fast as the risks they pose to consumers, making it challenging for regulators to keep abreast of the changes. The RBI Working Group on digital lending reported that the <a class="Hyperlink SCXW115547155 BCX0" href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189#S24" target="_blank" rel="noreferrer noopener">volume of digital credit has grown twelve-fold</a> between 2017 and 2020. <a class="Hyperlink SCXW115547155 BCX0" href="https://www.cgap.org/blog/evolving-nature-and-scale-consumer-risks-digital-finance#:~:text=These%20risks%20include%20mobile%20app,may%20result%20in%20over%2Dindebtedness." target="_blank" rel="noreferrer noopener">CGAP’s research on risks</a> in digital financial services (DFS) reveals that as of 2021 there are over 60 identified consumer risks, compared to only seven risks identified in 2015; and this list only continues to evolve.
<blockquote class="pullquote--left">India has been at the epicenter of DFS growth, but this growth has been accompanied by growing concerns about consumer risks.</blockquote>
India has been at the epicenter of <a href="https://www.imf.org/external/pubs/ft/fandd/2021/07/india-stack-financial-access-and-digital-inclusion.htm" target="_blank" rel="noopener noreferrer">DFS growth</a>, driven by extensive investments by the government in digital infrastructure, <a href="https://indiastack.org/" target="_blank" rel="noopener noreferrer">India Stack</a> – a comprehensive digital identity, payments and data management system, and investments. The <a href="https://www.investindia.gov.in/sector/bfsi-fintech-financial-services#:~:text=The%20digital%20investment%20market%20is,to%20%2410%20tn%20by%202026." target="_blank" rel="noopener noreferrer">digital investment market</a> in India is projected to be worth $14.3 billion in 2025, growing at a 5-year CAGR of 22.4 percent. This growth in DFS has been accompanied by growing concerns about consumer risks, such as <a href="https://themorningcontext.com/internet/why-does-upi-fail-so-often-for-banks-like-sbi" target="_blank" rel="noopener noreferrer">high failure rates in digital payments</a>, fraud, and poor redressal, among other challenges. Digital lending has been leading the charge on both innovations and rising consumer risks and, in response, the Reserve Bank of India (RBI) <a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189#S1" target="_blank" rel="noopener noreferrer">constituted a working group</a> on digital lending in 2021.

This is not the first time the RBI has needed to formulate regulations to protect consumers. The RBI’s past interventions in <a href="https://www.rbi.org.in/Scripts/PublicationsView.aspx?id=20377" target="_blank" rel="noopener noreferrer">microfinance</a> and <a href="https://www.rbi.org.in/Scripts/FS_report.aspx" target="_blank" rel="noopener noreferrer">digital payments</a> have allowed them to balance their conflicting goals of inclusion, consumer protection, stability, and growth-led innovation.

Digitalization and modularization of financial services create new regulatory challenges. Three challenges that stand out in the Indian context are lower entry barriers, India’s complex legal regime, and the absence of guidelines about what consumer data apps can collect.

To allow innovation, entry barriers are low, a concern raised in the<a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189" target="_blank" rel="noopener noreferrer"> working group’s report</a> especially as the market matures – a <a href="https://www.tuko.co.ke/378517-digital-lending-fixing-credit-access-barriers-fostering-growth-smes.html#:~:text=Digital%20lending%20is%20uniquely%20positioned%20to%20fix%20credit,poverty%20reduction%20and%20boosting%20national%20wealth%20and%20development." target="_blank" rel="noopener noreferrer">problem that previously has been seen and addressed</a> by regulators in Kenya. In India, this led to the <a href="https://www.centerforfinancialinclusion.org/combating-the-rise-in-fraudulent-fintech-apps">creation of lending apps, several of which were fraudulent and predatory</a>, and were launched during the pandemic when demand was high due to consumers’ loss or drop in income, loss of jobs, and health shocks.

India’s <a href="https://prsindia.org/files/policy/policy_committee_reports/1370600640_FSLRC%20Report%20Summary.pdf" target="_blank" rel="noopener noreferrer">complex and fragmented regulatory and legal regime</a> has been written about extensively in the past, and was acknowledged as a challenge by the RBI Working Group on digital lending in their recent report. In an era of modularization, where efficiency in delivery of digital credit is driven by partnerships with banks and non-bank finance companies, call centers, collection agents, and others, not all entities are directly regulated by RBI. This adds a layer of complexity to India’s already complex legal system that governs lending.

Earlier this month, India’s government <a href="https://themorningcontext.com/internet/india-withdraws-personal-data-protection-bill?type=short" target="_blank" rel="noopener noreferrer">withdrew the data protection bill</a>, which sought to empower citizens with rights related to their data. The removal of this bill now creates challenges for consumers in India, especially women and minority groups who can be targeted and don’t have control over how their data is used. Recent research in India showed that the very act of going online can <a href="https://www.dai.com/fi-cyber-user-trust.pdf" target="_blank" rel="noopener noreferrer">violate societal expectations of women</a>. Besides the obstacle this creates in narrowing the gender gap in India, the lack of laws and guidelines has led digital lending apps to seek <a href="https://www.cgap.org/blog/digital-consumer-credit-india-time-take-closer-look#:~:text=While%20there%20is%20no%20official%20count%20of%20the,least%20157%20apps%20operating%20as%20of%20July%202021." target="_blank" rel="noopener noreferrer">disproportionate permissions</a>, and then use consumer data to <a href="https://www.ft.com/content/16c86479-e88d-4a28-8fa4-cd72bace5104" target="_blank" rel="noopener noreferrer">“debt shame”</a> consumers who delay repayments. The prospect of social censure can be a powerful barrier for women in adopting DFS.
<blockquote class="pullquote--right">Digital environments exacerbate financial services risks that have existed for a long time.</blockquote>
It is worth repeating that digital environments exacerbate financial services risks that have existed for a long time. There are several ways that we see risks evolve in a digital era. Digital lenders in India communicate about prices in different ways, making it harder for consumers to compare and choose. Digital lenders requested processing fees upfront, regardless of whether or not a loan would be disbursed – a scheme profitable for lenders, but detrimental to consumers. Complaint channels in a digital environment are often non-existent or dehumanized, causing many consumers <a href="https://www.cgap.org/blog/analyzing-social-media-spot-digital-consumer-credit-risks-india" target="_blank" rel="noopener noreferrer">to resort to social media</a> to air their complaints. The absence of well-designed complaint channels can be a barrier to consistent use and can contribute to a lack of trust, especially among women. Finally, credit reporting during the pandemic took a backseat due to loan moratoria, and the modularized nature of digital lending meant that fintech lenders would often not report to credit bureaus, weakening existing credit reporting mechanisms even as the digital lending space evolved.
<h1>Positives of the New Recommendations</h1>
Not all digital lending is bad. We know that <a href="https://www.imf.org/-/media/Files/Publications/covid19-special-notes/en-special-series-on-covid-19-digital-financial-services-and-the-pandemic.ashx" target="_blank" rel="noopener noreferrer">timely access to affordable loans can help smooth cash flows, address emergency liquidity requirements, and offer consumers greater choice</a>. Therefore, the RBI’s recommendations based on the working group’s report are an encouraging first step to addressing consumer risks before trust in digital lending is eroded.

The <a href="https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=54187" target="_blank" rel="noopener noreferrer">recommendations for implementation</a> made by the RBI on August 10, include direct execution of loans, mandates to reveal the annualized percentage rate (APR), and a cooling off period that allows consumers to change their minds.

Now with these recommendations in place, regulated entities – institutions that are directly regulated by the RBI – must disburse directly to borrowers’ bank accounts, except in a narrow set of cases of co-lending transactions. This is a positive step that reduces the bargaining power of intermediaries that may be involved and clearly positions that the risk of lending lies with banks and non-banks and not the originators of loans. Therefore, the onus of consumer protection lies with the institution taking on the risk of lending.

The mandate to reveal the APR creates a standard playing field for all lenders and allows consumers to compare rates – a crucial step. Finally, the cooling off period with loans is an excellent move and sets a positive precedent for regulators in other jurisdictions. While this feature is normally associated with insurance products, the extension to loans provides consumers with choice and the ability to change their minds without facing financial losses. However, the operationalization of this recommendation will require consultation with market players, since it does impact lenders’ cash flows.
<blockquote>Even though these guidelines are not a perfect replacement for a comprehensive data protection bill, they do protect against misuse of consumer data gathered through digital lending apps.</blockquote>
While India awaits a new data protection bill and eventually a new law, individual regulators must safeguard consumers’ data privacy interests. Even though these guidelines are not a perfect replacement for a comprehensive data protection bill, they do protect against misuse of consumer data gathered through digital lending apps. They prevent disproportionate permissions from being sought by lending apps, allow access to camera, microphone, and location data as a one-time event during onboarding or checking KYC, and outline standards to be achieved in case of a security breach.
<h1>Gaps That Still Need to Be Filled</h1>
More is needed to establish a common understanding of consumer protection risks and redress mechanisms among all regulated entities and institutions involved in the delivery of loans.

While being transparent about APR is a positive first step, in a market with hundreds of lending apps and several more that launch daily, consumers must be able to compare lenders. This need presents a market opportunity: while price comparison sites exist for insurance products, it is time to have them for digital loans. Ideally, lenders would compete to provide the best terms to borrowers but we likely will need to wait some time for this advancement.

Complaint channels need to be redesigned to be consumer-friendly and regulators need to use <a href="https://www.cgap.org/topics/collections/market-monitoring/tools">appropriate market monitoring tools</a> to analyze and identify early warnings. This also presents an opportunity to test and evaluate consumer complaint mechanisms that exist – an area of emerging research interest for CFI.

And finally, the RBI proposes that underwriting algorithms used by lenders should be subject to audits. The RBI noted that while this recommendation was accepted in principle, it would require further examination prior to implementation. This is an important first step to ensure that high-stakes algorithms aren’t <a href="https://www.centerforfinancialinclusion.org/digital-credit-algorithms-in-india-expanding-access-or-cementing-exclusion">further cementing</a> financial exclusion. At the same time, algorithmic auditing, particularly by regulators of private sector algorithms, is a nascent field and must balance accountability with a company’s proprietary intellectual property. <a href="https://dai-global-digital.com/how-four-awardees-are-paving-the-way-for-a-more-equitable-ai-powered-future.html">Global research on this topic</a> is just beginning and partnerships with regulators would enable practical action.

It Is the Best of Times, and the Worst of Times: India’s New Digital Lending Recommendations

Imagine you’re a young mother living on the outskirts of Kampala, Uganda. Due to unexpected medical expenses for your son, you decide to apply for a digital loan. You download a credit app that you heard about from a neighbor, answer a few questions about yourself, consent to have data on your phone shared, and wait 30 minutes. Then, you receive a rejection message: “Your credit limit is 0 UGX.”

You heard that having an active mobile wallet would increase your chances of being approved for a loan and made sure your MTN mobile wallet was active before applying. You’re confused about why your loan application was rejected and wonder how to improve your future chances. Most importantly, you’re still unsure how you will cover your son’s medical expenses.

Understanding the reasons behind credit decisions is increasingly more difficult as algorithms, rather than front-line staff, make and communicate outcomes. <a href="https://centerforfinancialinclusion.org/accountability-for-algorithms-a-balancing-act-for-governments/">Complex algorithms</a>, fueled by alternative data, are driving finance decisions about and for customers -- from underwriting to insurance to <a href="https://centerforfinancialinclusion.org/responsible-social-protection-lessons-from-covid-19-digital-cash-transfers/">eligibility for social protection</a>. As algorithms become more commonplace, we must look for ways to increase transparency around decisions and inform low-income customers about their options for rectification.
<h1>In the Dark on Automated Decisions</h1>
In honor of <a href="https://www.consumersinternational.org/what-we-do/world-consumer-rights-day/" target="_blank" rel="noopener noreferrer">World Consumer Rights Day</a>, CFI is researching how credit decisions are made and communicated to low-income consumers, the rights consumers deserve, and the tools they need to understand – and be able to challenge – those decisions.

In the not-so-distant past, most financial institutions relied on front-line staff to make and communicate decisions to customers. If a customer was rejected for a loan or insurance product, she could ask a loan officer to explain how her history was evaluated and could work with the officer to correct data errors. However, as digital models leveraging algorithms gain traction, the transparency that customers used to rely on from their in-person engagements with loan officers or agents has disappeared.
<blockquote class="pullquote--right">As digital models leveraging algorithms gain traction, the transparency that customers used to rely on from their in-person engagements with loan officers or agents has disappeared.</blockquote>
Because most customers are unaware of how an underwriting algorithm works or what data inputs are used, many customers are also unclear about how a decision is made or whom to ask for more information. This lack of clarity was evident from <a href="https://centerforfinancialinclusion.org/trust-of-data-usage-sources-and-decisioning-perspectives-from-rwandan-mobile-money-users/">CFI’s survey-based research</a> in Rwanda. Out of a sample of 30 digital borrowers in Rwanda, 16 respondents had been rejected for a digital loan but only 10 of those recalled an explanation for the denial. Of those 10 who received an explanation, six were dissatisfied with the provider’s communication; some received only a basic explanation such as, “Your credit limit is zero.”

When the full survey sample was asked to describe what an acceptable explanation of loan denial might look like, there was a clear ask for more specificity and more communication. A 52-year-old woman shared her experience: “They denied me a loan because I delayed to repay when I was in a hospital and very sick. If they had called to explain the reason for the denial, I would have explained my condition.” A 38-year-old woman reasoned: “When you delay to repay, they call to remind you about the loan. They should then do the same when you are denied a loan.”
<h1>Help for Consumers: Legislation, Awareness, Support</h1>
So, what can consumers do in this increasingly digital era? Most data protection frameworks give consumers the right to access and rectify their data. However, our Rwanda research suggests that consumers are largely unaware of what is being inputted in the first place. While data protection efforts – like the 2019 Kenyan Data Protection Act that gives individuals the right to request the rectification of personal data that is “inaccurate, out-of-date, incomplete or misleading” – are a good first step, more needs to be done to communicate to customers about the inputs, decisions, and digital rights.
<blockquote class="pullquote--left">More needs to be done to communicate to customers about the inputs, decisions, and digital rights.</blockquote>
Many nascent data protection frameworks offer consumers the right to be informed if they’ve been subjected to an automated decision by an algorithm, for example. For instance, the <a href="https://www.minijust.gov.rw/fileadmin/user_upload/Minijust/Publications/Official_Gazette/_2021_Official_Gazettes/October/OG_Special_of_15.10.2021_Amakuru_bwite.pdf" target="_blank" rel="noopener noreferrer">Rwandan Data Privacy Law</a> mandates that individuals should be informed about the logic involved in their automated decision at the time of personal data collection. <a href="https://www.dataguidance.com/notes/brazil-data-protection-overview" target="_blank" rel="noopener noreferrer">Brazil’s Data Protection Act</a> gives consumers the ability to ask for a review of a decision made with their personal data taken solely through automated processing; included in the review should be the criteria and procedures used for the decision.

But what this will look like in practice, and how it will be enforced, remains to be seen. And given what we know about the challenges facing low-income consumers in accessing and feeling empowered to use grievance redressal mechanisms, there is concern that these data rights will not be fully exercised in a way that keeps companies accountable.

Consumer advocacy organizations are a potential avenue to help raise the voice of consumers vis-à-vis their digital rights. For instance, <a href="https://centerforfinancialinclusion.org/responsible-social-protection-lessons-from-covid-19-digital-cash-transfers/">our research</a> on government-to-person digital payments during COVID-19 found that civil society organizations often were the first to sound the alarm about digital systems failing or customers poorly served.

Whether it’s a mother in Kenya applying for a credit product to pay for medical expenses, or a farmer looking to insure his crops in the face of an increasingly unpredictable climate, we must support consumers’ voices and increase transparency around how digital decisioning is made.

Along with other leading consumer advocates around the world and in partnership with <a href="https://www.consumersinternational.org/" target="_blank" rel="noopener noreferrer">Consumers International</a>, we’re excited to participate at the <a href="https://www.consumersinternational.org/fair-digital-finance-forum-2022/" target="_blank" rel="noopener noreferrer">Fair Digital Finance Forum</a> this week. Take a look at their <a href="https://www.consumersinternational.org/fair-digital-finance-forum-2022/" target="_blank" rel="noopener noreferrer">program</a> to get a lay of the land and stay up to date with CFI’s <a href="https://www.centerforfinancialinclusion.org/research/consumer-protection">consumer protection</a> workstream.

Understanding the Decision: Consumer Rights and Algorithmic Decision-Making

The past decade has seen an increase in predatory and fraudulent practices in digital finance and fintech. In the last 10 months, there has been an increase in anecdotal evidence that the COVID-19 pandemic has led to a proliferation in the methods and tools predatory and fraudulent providers are using to exploit vulnerable households and businesses (see recent media coverage <a href="https://www.bloombergquint.com/law-and-policy/financial-frauds-have-seen-a-spike-due-to-dependence-on-digital-payment-platforms-ajit-doval" target="_blank" rel="noopener noreferrer">here</a> and <a href="https://www.mediapost.com/publications/article/354201/finance-mobile-apps-most-exposed-to-fraud-gaming.html/" target="_blank" rel="noopener noreferrer">here</a>).

In exploratory work using high-frequency mobile application data for 71 countries, we document the <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3588453" target="_blank" rel="noopener noreferrer">increasing scale and scope of these new methods</a>. We observe that some of the most downloaded mobile apps in a number of countries following the outbreak of COVID-19 include finance-related apps that show signs of being either predatory or entirely fraudulent. For example, there is a growth in personal lending apps luring new users to pay nominal service fees to obtain access to cheap loans, but which are revealed to offer no actual service. The release dates of these apps coincide with the onset of COVID and related government lockdowns and are initially buttressed by extremely high ratings driven by tens of thousands of apparently fake reviews. After a duration, some appear to be eventually removed or blocked on the app stores.

For this and other reasons, we categorize these apps as being highly likely instances of fraud. The graph below depicts this after the onset of lockdowns in India, where we saw a wave of lenders fitting these criteria pop up and quickly attract many users. Notably, the adoption of these fraudulent lending apps surpasses that of pre-existing lending apps from known, legitimate providers during this period. We also observe examples of apps set up to mirror legitimate sites (e.g., mimicking existing government or finance apps), but that appear to be designed to phish sensitive information from unsuspecting users. (India is used to illustrate such issues, but similar examples occur in a range of other markets, such as Nigeria, Philippines, etc.)

Combating the Rise in Fraudulent Fintech Apps

Just over one year ago, I joined the Center for Financial Inclusion (CFI), and what a year it has been. <a href="http://financialinclusionweek.org" target="_blank" rel="noopener noreferrer">Financial Inclusion Week</a> presents a great time for me to reflect on this past year and to share with you CFI’s plans for our next chapter. We are using Financial Inclusion Week to feature the work of so many of our partners. And we are also using the week to focus attention on the themes we have identified in our new strategy as the pillars for this week’s <a href="http://financialinclusionweek.org/event-calendar-2020" target="_blank" rel="noopener noreferrer">calendar of events</a>.

CFI emerged from the rubble of the financial crisis to spearhead the most pressing issue the inclusive finance field needed at the time: improved consumer protection. We are now well into our second decade and our industry is reeling from the ravages of the COVID-19 pandemic. It is perhaps the right time for CFI to reenergize its mandate and spearhead what we believe is needed to “build back better” as the saying goes. As tragic as the pandemic’s consequences have been and continue to be, it has at least laid undeniably bare the failures of the status quo and has created a heightened sense of urgency, for financial services to build back better.

CFI was founded at a particular moment when it was becoming more apparent that market forces alone would not ensure positive outcomes for financial inclusion, and that sustained intentionality would be necessary. The coronavirus pandemic has, at the September 2020 time of writing, infected more than 33 million people and killed nearly 1 million. Beyond the rapid and catastrophic spread of illness and death, the pandemic has devastated global economies. Millions of micro, small, and medium enterprises (MSMEs) around the world have seen revenues plummet and have suspended operations or gone out of business altogether. Hundreds of millions of families have lost jobs and incomes, and many of them live in countries where social safety-net protections are patchy at best. The pandemic also reversed, seemingly overnight, social and economic development gains that had taken decades to achieve: the World Bank estimates that 70 million people are at risk of falling back into poverty. Women and children have been among those most affected: children because schools around the world have been shuttered, and women because they are more likely than men to lose their jobs and to shoulder the responsibility of supervising and homeschooling children.

For CFI, the pandemic has reenergized our purpose. Financial services are critical to reducing low-income populations’ vulnerability and helping them to recover from this and other recurring crises in their lives. We believe we have a leadership role to play in this intensified global effort. We have more than a decade of recognized global leadership in understanding the financial needs and behaviors of low-income vulnerable populations. Complementing this demand-side expertise, our recent <a href="https://content.centerforfinancialinclusion.org/mix-and-cfi-announce-strategic-integration-to-drive-industry-knowledge-for-inclusive-finance/" target="_blank" rel="noopener noreferrer">integration</a> with MIX brings supply-side expertise to the table, as they have been studying and reporting about financial service providers for the past 20 years. These complementary strengths, combined with our history of thought leadership and our role as conveners, positions CFI to pursue an ambitious three-year strategy made all the more urgent in the context of the pandemic.
<blockquote>The pandemic has reenergized our purpose.</blockquote>
The strategic plan which will guide CFI’s work through 2024 focuses on four thematic areas. All of them, to significant degrees, have either been exacerbated by the pandemic or have been revealed by this crisis as urgent and under-attended priorities. The common thread among the themes is that progress in these areas is essential to ensuring that all people have the financial tools needed to improve their lives and to prosper.
<h2>Financial Services to Respond to the Risks of Climate Change</h2>
Just as the pandemic’s effects have been most severe on those who were already the most vulnerable, so too are the effects of climate change. Low- and moderate-income countries (LMICs) in the Global South are likely to experience longer, hotter heat waves and more extreme storms which in turn will create income loss, food insecurity, adverse health effects, and displacement that will hit already-vulnerable LMIC populations hardest.
<blockquote>Financial services are an indispensable tool to help prepare for climate-related shocks and recover.</blockquote>
CFI recognizes that climate change is ultimately an issue requiring long-term systemic changes to entrenched patterns of production and consumption. In the short term, however, financial services are an indispensable tool to help low-income vulnerable people prepare for climate-related shocks and recover from them when they happen. Our work in this theme will focus on understanding what those people need and the constraints they face, uncovering product innovations that can help, and then pilot testing such innovations and scaling-up lessons learned.
<h2>Women’s Financial Inclusion</h2>
Around the world, in many different geographies and socioeconomic contexts, women occupy a “last in, first out” position of vulnerability. The fall-out from the pandemic has made this abundantly clear. Whether it is a workplace where the more recently hired woman is let go before the more senior man, or a financial system that only prioritizes women’s needs when times are good, women’s economic inclusion is seen as a nice-to-have rather than a must-have. Women’s financial inclusion is powerfully shaped by broader societal norms, the unspoken assumptions and values governing men’s and women’s roles. CFI believes that efforts that focus solely on process fixes or product design will not succeed in women’s financial inclusion unless those efforts also seek to transform, rather than merely acknowledge, the underlying norms.

Our work in this area will accordingly include an intensive focus on research into successful norms-transformative initiatives, and how those might be scaled up. We will also work to improve the digital and financial capability of subsegments of women customers, and to influence the policy environment for women’s financial inclusion.
<h2>Data Risks and Opportunities</h2>
The pace of change created by the technology revolution is much faster than law, policy, or social mores can match. Although data privacy and protection regimes have begun to emerge, especially in wealthy countries, data by its nature is universal. To date, there is no universal framework setting forth who even owns personal data, much less governing how it can be used, by whom, and under which circumstances. The COVID-19 pandemic has provided a powerful illustration of both the risks and the opportunities of digitized data. The public health benefits of documenting and following diagnosed COVID-19 cases, and of tracing patients’ contacts, are obvious. But the risks to patients of stigmatizing, discrimination (whether of access to insurance, housing, employment, or otherwise), and other abuses are also very real.

Similarly, in financial services, data is the key that can unlock access to a full range of personalized, effective products that can help low-income people achieve their goals. The risk is that many LMICs have no effective consumer data protection regimes in place and that even where those exist, people with low levels of digital and financial sophistication may, in their eagerness to receive financial services, sign away their rights without even fully understanding them.
<blockquote>CFI will focus on means to bring transparency to data practices in DFS.</blockquote>
CFI’s work in this area will focus on means to bring transparency to the data practices of digital financial service (DFS) providers. We will also study how financial service providers use algorithms, which can be biased against already-underserved populations, in automated decision-making. We will monitor emerging frameworks around the world to document what does and does not work to advance financial inclusion while safeguarding data privacy, portability, and other consumer rights.
<h2>Consumer Protection in the Digital Economy</h2>
As the inclusive finance landscape evolves, so too must the approaches to consumer protection. Social platforms, ecommerce giants, fintechs, and pay-as-you-go providers are all relatively recent entrants into the field, and this means a multi-pronged approach is necessary to ensure safe practices are the norm. This is especially true since many of these business models fall beyond the scope of existing banking regulation. Consumer protection is an evergreen challenge, and one where CFI has long been active.
<blockquote>Consumer protection is an evergreen challenge.</blockquote>
We plan to devote intensive study to the practice of government-to-person (G2P) digital cash transfers, since these are often the on-ramp to digital financial services for low-income populations. We want to understand the risks that digitized G2P transfers present and how governments are mitigating those risks. We also want to document innovations around redress of grievances, financial capability-building add-on services, resolution of connectivity issues, and other relevant lessons learned.

In addition, CFI will partner with regulators and supervisors to test new technologies, such as chatbots or algorithmic audit tools, that can allow supervisors to be in direct dialogue with consumers, without consumer voices being mediated via the financial service providers. Such a dialogue can ultimately improve customers’ experience with financial services and democratize the financial sector by involving customers in the development of financial sector policies. To date, much of the recent work in regulatory technology (RegTech) and supervisory technology (SupTech) has prioritized the data reporting and compliance, but CFI believes its potential for advancing consumer protection has been underappreciated.
<h2>Conclusion</h2>
CFI developed its three-year strategic plan by weighing the needs of the inclusive finance industry against what we see as our own comparative advantages. We recognize that the four thematic priorities we intend to pursue are not an exhaustive list of everything that needs to happen to ensure positive outcomes for low-income people, and we also recognize that other individuals and organizations are doing excellent work in the areas we intend to pursue. We look forward to collaborating with all stakeholders who share the vision of a world where all people are able to equitably participate in the economy and are able to use financial tools to improve their lives and to prosper.

We hope you will participate in the rest of Financial Inclusion Week, which is packed with amazing speakers, events and activities. And, we want to hear from you. Please participate and tell us what you think about CFI’s thematic priorities.

Reflecting on the Past and Charting a New Direction

<h1>Why Consumer Rights and Responsibilities?</h1>
The <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> provide a common framework for financial service providers (FSPs), policymakers, and clients to better understand and discuss consumer protection issues. While much of the Center for Financial Inclusion’s (CFI) work with the financial inclusion industry has focused on providers and regulators, there is a third crucial constituency: clients.

Client awareness and capability is a critical component of effective financial consumer protection. Clients have the right to demand fair treatment and lodge complaints with government authorities, but these rights mean little if they don’t know what constitutes lawful treatment or how to access complaints channels. Similarly, clients play a role in protecting themselves by practicing behaviors to maintain their privacy and safety. While FSPs can institute protective processes and regulators can craft policy safeguards, improving client awareness of their rights and responsibilities helps consumers play their part to support a sustainable financial system.

This report provides lessons learned from initiatives in Ghana, Uganda, and Benin to raise consumer protection awareness among clients through multimedia campaigns, digital tools and other outreach strategies. It covers country-specific consumer protection issues and the individualized campaigns to address these issues. We also offer five key takeaways to help inform future client protection and empowerment awareness building activities.

Clients Deserve to Know: Using Radio to Educate and Empower Consumers in Africa

As more people are connecting to more financial services digitally, we’re seeing growing calls for individuals to have greater control over how their data is being used and by whom. At the heart of consumers’ ability to control their data is the notion of consent, but what consent means in practice can vary considerably and can often be difficult for providers to ascertain in a meaningful way from a consumer standpoint.

In the EU, the GDPR has <a href="https://gdpr.eu/gdpr-consent-requirements/">defined consent</a> as being free, informed, specific and unambiguous. It also necessitates an opt-out option for data subjects, allowing for the partial or complete withdrawal of any previously given consent, and for the removal of all gathered personal data. But while these requirements may be good for consumers, they’re also tough for providers to implement. Just ask Google, which was <a href="https://www.reuters.com/article/us-google-privacy-france/france-fines-google-57-million-for-european-privacy-rule-breach-idUSKCN1PF208">fined 50 million euros</a> last year after the French data protection authority concluded that it “lacked transparency and clarity in the way it informs users about its handling of personal data and failed to properly obtain their consent for personalized ads.”
<h2>Flexibility Needed for Smaller Providers</h2>
So, if a tech giant, operating in Europe with all the resources and expertise at their disposal, can run afoul of these new consent requirements, does it make sense for governments in developing countries to try to adopt similar rules? India’s response for now has been yes. The current version of its pending data protection bill incorporates the same consent principles as GDPR. However, one legal observer we spoke to expressed concerns that the bill says nothing about what this consent architecture will look like and the ways in which consent will be sought. For smaller providers like microfinance institutions, fintechs and small finance banks that are trying to reach underserved segments with higher levels of illiteracy, obtaining consent as currently defined in the bill would pose a significant challenge, as elaborated below. Moreover, providers leveraging digital technologies to serve customers who might not be that digitally literate or understand the ways their data can be used may find it nearly impossible to meet such high standards of consent. The likes of Google might be able to figure it out over time, but smaller providers would need more flexible rules and support to comply.
<blockquote>Google might be able to figure out high-standard consent, but smaller providers would need more flexible rules and support.</blockquote>
For further evidence on how providers are already coming up short on consent, a recent <a href="http://documents.worldbank.org/curated/en/677281542207403561/Financial-Consumer-Protection-and-New-Forms-of-Data-Processing-Beyond-Credit-Reporting">World Bank report on new forms of data processing</a> laid out many limitations of practices around consent, such as lengthy and complex consent forms, incomplete information, and standardized, inflexible terms offered on a “take it or leave it” basis. As a result, providers are often seen to be doing the bare minimum to comply with existing data protection requirements. In recounting the deficiencies identified in a study by the Centre for Internet and Society on fintech privacy policies in India, a <a href="https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights">recent article</a> noted that one rule “requires a fintech company to provide an option to withdraw consent. Twenty-three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums, but they did not allow the user to withdraw their consent completely.” Such findings have led various observers to rightly question <a href="https://www.cgap.org/blog/data-protection-and-financial-inclusion-why-consent-not-enough">how effective consent really is</a> in practice and to propose <a href="https://www.cgap.org/research/publication/making-data-work-poor">other approaches</a> to give consumers more meaningful control over their data.
<h2>The Futility of Trying to Keep Up with New Approaches to Consent</h2>
This all stands to reason, but it again begs the question as to how providers who are already having a hard time complying at a minimal level could ever keep up with these new approaches. Indeed, in discussing the variety of data protection principles and standards that already exist around the world, the previously mentioned World Bank report also hastened to point out that “such principles may often be difficult to implement, particularly in low-capacity environments and/or where changes in the financial sector are fast paced.” As our interviewees attested, low-capacity environments and fast-paced changes are very much the rule, not the exception, and the path from principles to implementation is littered with landmines.
<blockquote>Low-capacity environments and fast-paced changes are very much the rule, not the exception.</blockquote>
One case we encountered centered around the issue of informed consent. Last year, the Reserve Bank of India <a href="https://economictimes.indiatimes.com/industry/banking/finance/banking/rbi-slaps-rs-5-crore-penalty-on-airtel-payments-bank-for-violation-of-norms/articleshow/63235308.cms">fined Airtel Payments Bank</a> the equivalent of roughly $700,000 for “contravening the Operating Guidelines for Payments Banks and directions issued by RBI on Know Your Customer (KYC) norms.” Airtel Payments Bank is majority owned by Bharti Airtel, one of the largest mobile operators in India, and in 2017 complaints started to emerge among mobile subscribers that Airtel Payments Bank had opened new bank accounts without their consent. According to <a href="https://www.financialexpress.com/economy/uidai-airtel-payments-bank-case-company-claims-no-wrongdoing-heres-how-you-can-avoid-the-trap/979401/">reports</a>, when new Airtel mobile subscribers first opened their Airtel mobile app, a pre-ticked consent box would appear on the welcome screen which, unless unchecked, would authorize the use of the same <a href="https://uidai.gov.in/what-is-aadhaar.html">Aadhaar</a>-based eKYC verification required to open the mobile account to also open an Airtel Payments Bank account. Over 2.3 million customers reportedly had new bank accounts created that they did not realize had been opened. Further complicating the matter was the fact that government subsidies would automatically be sent as direct benefit transfers to each beneficiary’s most recent Aadhaar-linked bank account, resulting in the equivalent of about $6.6 million in subsidies being deposited into these accounts. Airtel Payments Bank maintained that it had properly obtained consent to open these accounts but committed to working with the government to ensure compliance. We spoke with Akhil Verma, the current Chief Information Security Officer of Airtel Payments Bank, and he said the bank’s failure to notify customers of this caveat and obtain their explicit permission before allowing this was considered grounds for insufficient consent.
<h2>Out of Step With Modern Digital Reality</h2>
Another concern we heard from the other side of the globe was that some consent requirements are out of step with modern realities. According to Mariano Fuentes, Legal Advisor with ASBANC, the banking association in Peru, its data protection law (which was originally passed in 2011) is outdated for the digital times we now live in and does not do a thorough job of clarifying the ways consent can be obtained. Banks in Peru can obtain consent for personal data digitally, but “sensitive” personal data, which not only includes data on things like race or health, but also biometric data and data pertaining to “personal habits” that could come from things like mobile phone usage patterns, still requires written consent. Since Peru’s data protection law was passed in 2011, it would not have been able to fully anticipate the ways in which people’s lives have been digitized and the new types of data that would emerge, so it’s not surprising that it was reported last June that the National Authority for the Protection of Personal Data in Peru had issued <a href="https://elcomercio.pe/economia/negocios/tres-anos-han-puesto-1-246-sanciones-faltas-proteger-datos-noticia-646513-noticia/">1,246 sanctions within three years</a> (across all sectors).  A scan of the sanctions imposed by the data protection authority also reveals that a significant share of these violations resulted from failures to properly obtain consent.

Whether these cases amount to violations is often a matter of interpretation. Mariano Fuentes of ASBANC underscored this by pointing out that five member banks are currently appealing their penalties because they disagree with the arguments made by the data protection authority. “The complete idea of consent is not represented by any technology, which is damaging in today’s times and is used against us to levy sanctions,” he added. Despite these challenges, Peru consistently ranks as one of the top country-wide regulatory environments for financial inclusion in the Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2019">Global Microscope</a> assessment. In the 2019 version, it came in second partly because it “showed the greatest improvement in the consumer protection domain—specifically, for its data protection framework for financial customers.”
<h2>So How Are Consumers Supposed to Understand?</h2>
Given all the shortcomings with current consent practices around the world, it’s simply unfair to expect consumers to be able to fully understand what can and cannot happen with their data right at the point when they are about to access a new service or download an app. But at the same time, placing the burden on providers, especially those that are on the frontlines of underserved areas, to understand and apply high standards of consent is also proving to be a challenge. The reality is that this is a burden that both consumers and providers need to share, but not on their own. They need the right mix of policy and technology to help them get there. There are some emerging regulatory technology – or “regtech” – solutions providers in developed markets (like <a href="https://www.trunomi.com/">Trunomi</a>) that enable consent-based data sharing, for example.
<blockquote>This is a burden that both consumers and providers need to share, but not on their own.</blockquote>
As these solutions continue to advance, perhaps governments in developing countries could seek to attract such providers to adapt these solutions for their markets. It’s this type of innovation and collaboration that is needed to make consent work. The burden should be broadly shared.

Data Consent: Let’s Share the Burden for Effective Consumer Protection

All is not well in the country that pioneered mobile credit. A new <a href="/making-digital-credit-truly-responsible">report on digital credit in Kenya</a> from <a href="https://www.microsave.net/">MSC</a>, commissioned by <a href="/about/what-we-do/the-smart-campaign">the Smart Campaign</a> and the <a href="https://sptf.info/">SPTF</a>, shows that with continued dramatic growth rates, the sector also experiences cripplingly high default and delinquency, enabled by poor business practices and weaknesses in both the credit reporting infrastructure and regulatory jurisdiction.

Most notably, the report reveals very high rates of delinquency and default. Among active digital loans, more than a quarter are non-performing. About 2.2 million Kenyans are said to have delinquent loans. In some cases, liberal use of refinancing and rescheduling hides this level of delinquency in lender portfolios. At the same time, the report points out that about half of these non-performing loans are for amounts less than $10. These findings are broadly consistent with results cited by CGAP in 2016, which found that 50 percent of digital borrowers in Kenya repaid their loans late, and 12 percent defaulted.
<blockquote>Despite continued growth of digital credit in Kenya, high delinquency, default and interest rates persist in the market and credit bureaus haven't yet caught up with the digital age.</blockquote>
The report also details shortcomings in credit reporting, given that many digital lenders neither consult nor report to the credit reporting bureau as fully or regularly as they should. The credit reporting bureaus were clearly set up for a pre-mobile era, which suffer from issues related to inclusion of all types of lenders, frequency of uploading data (monthly, when daily is more relevant for today’s short term loans), and ease of connection among all the players in the credit reporting ecosystem. As a result, many lenders are not consistently using credit bureaus—neither ensuring that the information is updated and correct, nor fully consulting it prior to lending.

Pricing is also an issue. The market leader, M-Shwari, which accounts for about two-thirds of all digital loans, charges an annual percentage rate (APR) of 90 percent. The low-price option provided by Kenya Commercial Bank is a fairly reasonable 44 percent APR, but the high end of the price range includes providers charging APRs well into the hundreds. Granted that these are small, short term loans where interest payments are not expected to be sustained for an entire year. Nevertheless, the promise of digital to bring down prices does is not yet in sight.

Other issues noted in the report include non-transparency regarding portfolio quality, identity theft, misuse of client data, multiple borrowing and loan bicycling by clients, and client use of loan proceeds for sports betting.

The picture that emerges suggests that the still-exploding market of very small, “nano” loans needs to be brought into more orderly operation. Consumers and providers are operating in risky ways. The current state of the market is not beneficial for either.
<blockquote>Raising the bar for blacklisting customers and public awareness about defaulting on loans are among our recommendations for improving digital credit.</blockquote>
One issue specific to this nano-loan market concerns the reporting of very small non-performing loans to credit bureaus, with negative consequences, such as curtailing of access to credit, for hundreds of thousands of borrowers. MSC, the Smart Campaign and SPTF recommend that regulations be put in place such that delinquencies and defaults among loans below some fixed amount not be reported to the credit bureau (whether US$2, $5 or $10 – the report actually recommends a cutoff of 5% of the monthly per capita GDP). It also recommends that the government launch a public awareness campaign about how credit bureaus work and the consequences of default so consumers will better understand the risks involved in borrowing.

The regulators, credit reporting agencies and lenders in Kenya are aware of these concerns and working to improve the situation. A new association of digital lenders (Digital Lenders Association of Kenya) has been formed to create consumer protection standards and the central bank is exploring ways to upgrade the credit reporting ecosystem. The Smart Campaign recommends that both lenders and regulators consider adopting the <a href="http://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles/digital-credit-standards">digital credit standards</a> and <a href="https://www.smartcampaign.org/tools-a-resources/1210-handbook-on-consumer-protection-for-financial-inclusion">model regulations</a> covering issues ranging from transparency, to the fair use of algorithms, to protection of customer data.

Kenya’s unprecedented dynamism in mobile money, digital credit and financial inclusion is envied across the world. If authorities and providers can bring the participants in these sectors into a better-functioning marketplace, Kenya will benefit greatly from the innovation the country continues to spawn.

Red Flags in Kenya’s Nano-Credit Market

Diana Boncheva-Gooley

Veronica Karpoich

Jayshree Venkatesan

Leora Klapper

Pia  Roman Tayag

Alexandra (Alex) Rizzi

Jonathan Fu

Mrinal Mishra

Mayada El-Zoghbi

Malacci Ohrt

Alex Kessler

Ethan Loufield

Shweta Vashisht

Elisabeth Rhyne

John Owens

Carmen Paraison

Robin Brazier

Patrick Traynor

Kyle Burgess

Guatemala

Latin America and The Caribbean

India

South Asia

Benin

Ghana

Uganda

Peru

Kenya

Sub-Saharan Africa

United States

Dominican Republic

Paraguay

Access Usage Gap

Consumer Protection

Data Transparency

Digital Financial Services

Enabling Environment

Financial Health

Resilience

Data Privacy

Responsible Product Design and Delivery

Responsible Digital Finance

Credit

Policy, Regulation and Government Initiatives

Alternative Data

Fintech

Fintechs

Fraud

Challenges and Crises

Financial Inclusion Strategy

Tech-Touch Balance

Underserved Groups

Women

Financial Capability

Customer Centricity

Mobile Banking

Agent Banking

Microfinance Institutions

Blog Post

Report

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

The majority of Kenyans have mobile money accounts; their activity demonstrates digital financial services’ potential. Accion helps Kenyan innovators harness emerging technologies to create new financial services.

As digital credit providers have grown exponentially over the past few years, and as digital products and models have proliferated, so too have concerns around consumer protection. In the recently published report, <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1036-responsible-digital-credit">Responsible Digital Credit</a>, I argue that ensuring that digital credit customers receive responsible treatment requires more than enhanced consumer protection laws and regulations. It also requires strong commitment from the digital credit industry. Finally, it needs consumers who are empowered to play a more proactive role in managing their digital credit responsibly.

Over the past year, I have interviewed digital credit industry associations, credit providers and their third-party data analytic providers, regulators, policy makers, and various consumer protection leaders. Many of these groups are working to develop responsible digital lending principles. With their input, my report proposes a guiding framework for responsible digital lending.  The framework uses the Smart Campaign <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> as a basis for grouping the issues. In addition, I propose an eighth principle: security and fraud protection.

Digital credit, and especially the use of mobile phones, significantly alters interactions between borrowers and lenders. Lenders utilizing the mobile channel to advertise, acquire and transact with customers must pay particular attention to the limitations of mobile interaction with customers and follow industry <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/03/Best-Practices-2016-1.pdf">mobile best practices</a>. While many of the standard consumer protection practices continue to apply, new concerns, or more accurately, new faces on older concerns, have emerged. In this post, I want to highlight several of the considerations I found most important and relevant for the digital lending industry.
<h2>Responsible Algorithms</h2>
Many digital credit models rely on algorithms to process data about clients and make credit decisions. Because most lenders consider their algorithms proprietary, it is difficult for observers to know on what basis credit decisions are actually made. This opaque situation raises the spectre of discrimination. Attributes that are considered inappropriate bases for differentiation, such as religion, language, gender, or ethnic origin, are areas of particular concern with regard to algorithm-based lending practices. As highlighted by a Smart Campaign <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/916-smart-brief-tiny-loans-big-questions">report</a>, while credit offers may differ based on risk analysis, such differentiation should be consistently applied, stated in advance, and made with the goal of benefitting clients. To prevent discriminatory digital credit practices, some recommendations include:
<ul>
 	<li><a href="https://www.whitecase.com/publications/insight/algorithms-and-bias-what-lenders-need-know">Pretest, test and retest for potential bias</a>. Digital credit providers and third-party data analytics providers should continuously monitor the outcomes of their algorithmic programs to identify potential problems. Such testing could involve running scenarios to identify unwanted outcomes and developing and building controls that prevent adverse outcomes.</li>
 	<li><a href="http://www.ijmo.org/papers/43-A10212.pdf">Document the rationale for algorithmic features</a>. Digital credit providers should be able to provide visualization and a decision tree for the factors their algorithms analyze, as well as the justification for relying on these factors. The rationale should address how borrower debt capacity is assessed, given the importance of this concept in traditional underwriting.</li>
 	<li>Independent review of companies' proposed data sets and/or algorithms.</li>
</ul>
A self-regulatory approach could be used to develop best practices guidelines for data inputs and the development of nondiscriminatory artificial intelligence systems, following the model that has been successful for the Payment Card Industry Security Standards Council.
<h2>Indebtedness Monitoring</h2>
Because digital lending is often based on non-traditional underwriting criteria, to prevent over-indebtedness among digital borrowers it may be relatively more important to monitor outcomes at the portfolio level. Some of the ways to do this include:
<ul>
 	<li>Avoidance of debt traps by ensuring that clients are not forced into automated repeat loans.</li>
 	<li><a href="http://www.responsiblebusinesslending.org/">Responsible credit reporting</a> – Better compliance with reporting strengthens markets and leads to better client protection practices.</li>
 	<li><a href="http://www.centerforfinancialinclusion.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">Monitoring digital credit provider’s portfolio quality</a> – Industry benchmarks for portfolio quality can help to advance the understanding of risks and avoid business models that rely for their success on high default rates.</li>
</ul>
<h2>Digital Transparency </h2>
Digital credit platforms allow for 24/7 communications with clients that, if harnessed properly, can assist them with immediate technical support, remind them about upcoming payments and even identify counselors or resources for clients in financial stress. However, when communication is totally digital, there are heightened concerns about ensuring that clients really know what they are signing up for. Disclosure must lead to client understanding. Borrower disclosure standards should address:
<ul>
 	<li>Standards for honest advertising and penalties for misleading marketing materials of credit products. Furthermore, providers should advertise the name of the financial regulator they report to in all advertising materials.</li>
 	<li>Readability and format – Disclosures need to be easy to comprehend, available in the customer’s local language, and provided in print and digital formats.</li>
 	<li>Comparative tools – Standard summary disclosure documents would allow borrowers to compare credit offers, both digital and traditional.</li>
 	<li>Adequate notice periods – Consumers should be notified in advance of changes to interest rates, fees or terms and conditions.</li>
</ul>
A somewhat different but related and relevant concern, often overlooked in this context, is the vulnerability of individual investors who put their money into pure peer-to-peer (P2P) lending platforms. Protections need to be extended to them as well, with a focus on ensuring that they receive the information they need to evaluate risks and that they have recourse channels when something goes amiss.
<h2>Data Privacy and Usage Standards</h2>
While many regulators and most industry groups agree that it is important to protect the confidentiality and security of customers’ information, data use and the level of disclosure about its use are challenging topics. In the <a href="http://ec.europa.eu/justice/data-protection/reform/index_en.htm">EU</a> and in countries such as <a href="https://www.pc.gov.au/inquiries/completed/data-access/thedraft">Australia</a>, regulators are enacting rules mandating that individuals be notified about the use of their personal data and allowed to opt out. Opt-out rules should be considered as a potential requirement for all digital credit providers, especially in markets where mobile push-marketing has become problematic.

Over the next several years it will be important for laws or regulations to be put in place to protect consumer data privacy and guide information sharing. The rules need to:
<ul>
 	<li>Provide for informed consent, such that customers explicitly permit electronic data collection prior to its collection and use, and are given the option to consent or not.</li>
 	<li>Require providers to have a clear data collection and handling policy which limits the amount of data collected as well as the timeframe it is stored.</li>
 	<li>Inform clients about their data trails and credit histories, including the ability to ensure accuracy and correct for any errors or discrepancies.</li>
 	<li>Give regulators the power to discipline providers who repeatedly allow personal data to be misused.</li>
</ul>
<h2>Fraud Prevention and Security </h2>
New security vulnerabilities arising from digital credit strongly point to fraud and cyber-security as consumer protection concerns. It is increasingly urgent for digital credit providers to adopt standard security compliance measures and then to regularly test and update them. Providers must also be responsible for ensuring that the third-parties they use, including lead generators, brokers, agents, and data analytics providers, also have adequate security in place. Ultimately, providers need to be responsible for the actions of their third-parties (e.g., agents, contractors, lead generators, brokers and collectors).

Consumers should be made aware of the potential for fraud and encouraged to report suspected fraud cases or security breaches. Consumer awareness campaigns on the most common incidents of fraud (via the internet, SMS alerts, signage at agent kiosks, etc.) can help with this.

While the recommendations just listed do not apply in all markets, they do point to the urgent need for regulators, industry bodies, individual providers and consumers to work together to construct the ground rules for responsible digital credit that will ensure that consumers are adequately protected.

Editor's Note: This research was made possible by support from Mastercard Foundation and other partners.

&nbsp;

A Framework for Responsible Digital Credit

Can your skin color help predict whether you may be financially exploited in the United States? Unfortunately, even in 2018, the answer is still yes.

In February of this year, Wells Fargo was <a href="http://www.wisebread.com/how-to-fight-back-against-mortgage-discrimination">sued</a> by the city of Sacramento, California for allegedly discriminating against black and Latino mortgage borrowers since 2004. The specific charge, raised against the country’s third-largest bank in terms of assets, was providing these clients with more expensive loans compared to those offered to white borrowers.

Across the country, in Baltimore, Maryland, <a href="https://www.nytimes.com/2015/05/31/opinion/sunday/racial-penalties-in-baltimore-mortgages.html">a study</a> that found that black homeowners were charged higher interest rates and disadvantaged at every stage in the borrowing process compared to similarly qualified white borrowers – even taking into account factors such as credit scores, income and down payments. Over the span of a 30-year loan, the researchers say, discrimination against black borrowers cost them an extra $14,904 each, compared with white borrowers.

Homeownership is one of the most important ways for working and middle class families to build generational wealth. According to the U.S. Census Bureau, <a href="http://www.nareb.com/site-files/uploads/2017/09/SHIBA2017-final-for-web-0918.pdf">69 percent</a> of a household’s net worth in America lies in the net equity in their home. And investigations have repeatedly shown that people of color pay a heftier price to achieve wealth than their white counterparts.

What are the economic implications of financially exploiting people of color in home ownership? More expensive mortgage loans translate into higher monthly payments, lower savings, and a higher risk of default and foreclosure. On a macro-level, consequences include a stagnant homeownership rate among people of color, a yawning (<a href="https://qz.com/1087711/the-racial-wealth-divide-is-worse-than-people-think-and-its-growing/">and growing</a>) racial wealth gap, and continued institutional discrimination against people of color in the United States.

As a national consumer advocacy entity, the Consumer Financial Protection Bureau (CFBP) is designed to investigate claims of nefarious behavior among financial service providers and ensure that providers treat consumers fairly. However, its Office of Fair Lending and Equal Opportunity was <a href="https://www.americanbanker.com/news/cfpbs-mulvaney-strips-his-fair-lending-office-of-enforcement-powers">stripped of its power</a> earlier this year, with the removal from its mandate of oversight and enforcement. Commenting on the move, Lisa Donner, executive director of Americans for Financial Reform <a href="https://www.bostonglobe.com/news/politics/2018/02/01/trump-administration-strips-consumer-watchdog-office-enforcement-powers-lending-discrimination-cases/p7L5FAbNZisXTAuUvkeeAP/story.html">remarked</a>, ‘‘These changes . . . threaten effective enforcement of civil rights laws, and increase the likelihood that people will continue to face discriminatory access and pricing as they navigate their economic lives.”

The burst of the U.S. housing bubble yielded the Great Recession, which spread throughout world. Its origins in reckless lending in the subprime market convinced many people involved in the financial sector that consumer protection was urgently needed. In response to this gap, the 2010 Dodd-Frank financial reform law was passed. However, the current administration has since rolled back banking regulations, making it harder to detect discriminatory mortgage lending practices. <a href="https://www.stltoday.com/business/local/discriminatory-mortgage-lending-harder-to-detect-as-banking-regulations-rolled/article_c31cdd14-7b9e-5f55-80dd-28bbdf2fb6e3.html">Signed in May 2018</a>, the new Economic Growth, Regulatory Relief and Consumer Protection Act would exempt <a href="https://www.huffingtonpost.com/entry/bank-bill-deregulation-congress_us_5b043b70e4b0c0b8b23ea6cd">85 percent</a> of banks from reporting detailed information about mortgage loan applicants. This means it will be more difficult to identify systemic issues, conduct research about them, and respond with corrective action.

As borrowers of color in the U.S. continue to access credit with the goal of owning a home, and the steady deliberate weakening of institutional watchdogs and regulations continues, the future of consumer protection in financial services for all remains in jeopardy. As banks continue to backslide into more discriminatory and predatory practices towards people of color, we as consumers and advocates should continue to be aware of and vigilant about them.

&nbsp;

Skin Color Still Costly: Discrimination in the U.S. Mortgage Market

March 15 is <a href="http://consumersinternational.org/what-we-do/world-consumer-rights-day/">World Consumer Rights Day</a> (WCRD), a day marked by the consumer movement each year to raise global awareness about consumer rights and needs. It’s an opportunity to demand that the rights of all consumers are respected and protected, and to protest against market abuses and social injustices which undermine those rights. The Smart Campaign marks this occasion by talking about the importance of transparency and grievance redressal as key tenets of client protection and building consumer trust.

WCRD’s theme this year is “Making Digital Marketplaces Fairer.” With the volume of online transactions increasing, consumers are exposed to new – sometimes not fully understood – risks. For this reason, WCRD 2018 is calling for access to fair and secure internet for all, action against scams and fraud, and better consumer protection online.

According to Consumers International, <a href="http://consumersinternational.org/media/154916/e-commerce-overview-report.pdf">nearly half</a> of consumers that have access to internet but do not shop online cite lack of trust as the reason. Similarly, <a href="http://consumersinternational.org/what-we-do/world-consumer-rights-day/2018-making-digital-marketplaces-fairer/">almost 70 percent</a> of online consumers worry their digital payments are unsafe. What contributes to this lack of trust? The causes vary, but they often hinge on two things: lack of transparency and insufficient grievance redressal mechanisms.
<h3>Transparency</h3>
For the Smart Campaign, transparency means much more than disclosure agreements. Even when these are in place, <a href="http://smartcampaign.org/storage/documents/Synthesis_Report_ENG_FINAL.pdf">research shows</a> that low-income clients rarely fully understand the terms and conditions (T&amp;Cs) of the product they purchased. Many times, when the T&amp;Cs are explained simply and thoroughly, they are <a href="https://www.itu.int/en/ITU-T/focusgroups/dfs/Documents/01_2017/ITU_FGDFS_Report-on-Review-of-DFS-User-Agreements-in-Africa.pdf">often in English</a> instead of in the language of the customer. Sometimes <a href="http://www.cgap.org/sites/default/files/Working-Paper-Competition-in-MFS-Kenya-Tanzania-Jan-2016.pdf">third-party charges or hidden fees</a> aren’t fully disclosed up front, but only after the purchase is finalized. In other cases, the entire price is hidden until <a href="http://www.cgap.org/sites/default/files/Focus-Note-Consumer-Protection-in-digital-Credit-Aug-2017.pdf">after the completion of the purchase</a>.

On World Consumer Rights Day, we remind digital financial service providers and online marketplaces to transparently and effectively convey important product information so their customers fully understand. As pointed out in our recent Smart Brief, <a href="http://smartcampaign.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">“Tiny Loans, Big Questions,”</a> clients should also be able to store and save T&amp;Cs related to their digital purchase or transaction, just as they should for a face-to-face one. If clients are confused or feel misled by the provider, trust is eroded. Alternatively, when providers meet consumers where they are by using their language and being completely transparent about business practices and pricing, they are taking an important step in building customer trust and loyalty.
<h3>Recourse Mechanisms</h3>
<img class="alignright wp-image-25279" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/03/pull-quote-2.png" alt="" width="315" height="207" />Consumers of practically every product or service are bound to have complaints or questions regarding their purchase or transaction. This issue is especially relevant in digital marketplaces, since there tends to be limited human interaction. On top of that, customers who are new to the technology or not familiar with digital interfaces may be confused and are therefore likely to require customer service. <a href="http://smartcampaign.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">“Tiny Loans, Big Questions”</a> points out that problem resolution can be particularly difficult when clients are using a lending service that involves multiple companies, as in the case of mobile lenders using a mobile network operator’s agent network for cash-in and cash-out payments. Borrowers in this situation are interacting with agents who are not full-time employees and likely do not work for the lender. Although agents offer a human touch, as cash transactions are their primary duty, they may have little ability to field questions or resolve problems related to the loan product.

On World Consumer Rights Day, the Smart Campaign stresses the right of consumers to access simple, fair redress. We know that if customers do not have an easily accessible grievance redressal mechanism when things go wrong, they will be less likely to trust the product or service they’re buying. However, if the customer feels heard and sees that their needs are adequately addressed, trust is strengthened. Fair redress can be achieved by setting up well-staffed call enters or establishing online chats between staffers and customers, for example. <a href="http://www.centerforfinancialinclusion.org/storage/Uniting_TechandTouch_Kenya_FINAL.pdf">CFI Fellow Alexis Beggs Olsen</a> advocates for “centaur solutions” combining digital and human interfaces to best support low-income customers using digital financial services, while improving customer acquisition and retention.
<h3>Moving Forward</h3>
At the Smart Campaign, it’s our job to stay on top of risks to clients around the world and to work with financial service providers and other parties to help mitigate those risks.  While the risks themselves change over time, one thing remains constant: if consumers do not trust the service, product, provider or platform, these entities will struggle to reach their full potential and it will be harder to achieve meaningful financial inclusion.  At the end of the day, customers being heard and respected through grievance redressal channels and transparent business practices are two of the most critical components to building consumer trust. Only when this trust is in place can digital marketplaces and financial services providers do their part in making a <a href="https://twitter.com/search?q=%23BetterDigitalWorld&amp;src=tyah">#BetterDigitalWorld</a>.

Have you read?

<a href="https://cfi-blog.org/2017/06/05/the-smart-campaign-promotes-stronger-client-protection-and-sector-collaboration-in-uganda/">The Smart Campaign Promotes Stronger Client Protection and Sector Collaboration in Uganda</a>

<a href="https://cfi-blog.org/2017/08/03/the-microfinance-ceo-working-group-reports-out-consumer-protection-by-the-millions-and-other-updates/">The Microfinance CEO Working Group Reports Out: Consumer Protection By the Millions and Other Updates</a>

<a href="https://cfi-blog.org/2017/12/19/nigeria-needs-to-include-consumer-protection-in-its-ambitious-financial-inclusion-plans/">Nigeria Needs to Include Consumer Protection in Its Ambitious Financial Inclusion Plans</a>

&nbsp;

&nbsp;

&nbsp;

This World Consumer Rights Day, Let’s Build Trust

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, explains the second part of his research effort on the security and privacy of data in digital lending applications. Patrick’s previous post, explaining the first part of his research on evaluating the privacy policies of digital lending applications, can be found <a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">here</a>.

“I’m sorry, but we are just not interested in providing security for our customers.”

Here is a phrase that you are unlikely to see from any company, at least if they want to stay in business. In fact, you are far more likely to see statements to the opposite. Yet time and again, the same services that tout security as something they care about prove to be tremendously vulnerable. Think about it – when was the last week that you didn’t hear about stolen Bitcoins, ransomware attacks, or data breaches?

If companies care so much about security, what is going on?
<h2>What Does "Secure" Mean?</h2>
Security is one of the least well-defined terms I know. By itself, it completely lacks context. Secure against what? Against whom? Under what conditions? Based on what assumptions?

As an analog, think about a restaurant that claims to care about “consumer health.” Is this statement regarding ingredients in their meals? Calories? What about cleanliness? How is the food prepared? Do employees really wash their hands after using the restroom? Most would agree that it is insufficient to simply trust such claims, and we rely on external entities (e.g., health department ratings, government regulations for calorie counts on menus, etc.) to give “consumer health” more measurable meaning.

The answers to my above “security in context” questions become deeply technical very quickly. In fairness, it is debatable whether it is realistic for the general public to understand these details. Regardless, this gap between specificity and understanding often permits real security considerations to end at exceedingly broad public statements. If nobody checks or bothers to define what security means, the thinking often goes, why bother to go further?

That’s where my team comes in – think of us as the health department for the security of online credit systems.

Before I go into further details, let’s make something clear. “Security” is hard. Even if you answer all of the context questions above, ensuring that you get it right all of the time in every location is something that nobody seems to know how to do well. Unlike most other engineering, where major assumptions remain within a predictable range (e.g., when building a bridge, winds, currents and the pull of gravity are all accounted for in the design), security faces the problem of constantly evolving adversaries. That means that what worked perfectly well yesterday may do very little to protect systems tomorrow. That said, we cannot write off security as an inevitable failure just because it is hard. Moreover, there are many tried and true techniques that absolutely should be in place for anyone to begin tossing around the word security. Our job is to ensure that we see these techniques in place and working correctly.
<h2>What Are We Measuring?</h2>
If we are specific about what we claim is secure, it is possible to understand the ways in which systems are likely to be strong. For my <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">CFI Fellowship research</a> on the security of online credit applications, I am measuring the characteristics of the connection between mobile devices and the server within the application provider’s network. While it possible to measure the security of many parts of an online credit system, the most critical is ensuring that connections between mobile devices and the service provider’s servers is secure. Accordingly, we focus our attention here. The figure below shows this in more detail.

[caption id="attachment_23960" align="aligncenter" width="616"]<a href="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png"><img class="wp-image-23960" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png" alt="" width="616" height="215" /></a> A high-level overview of our security analysis[/caption]

Why is this the right thing to measure? Simply, if a user cannot communicate securely with a company’s server, nothing else matters. An adversary need not bother to try to breach other security if this portion is poorly executed. Think of it this way – if the online credit provider’s system were a castle, we are most interested in the protections around the drawbridge over the moat. If nobody is watching who and what comes across that drawbridge, it does not matter how high the castle walls may be. Said differently, systems that do not get this part of security correct might as well be saying that quotation from the beginning of this post.

My team will characterize security with regards to the following metrics. First, we will look to see whether or not the mobile device uses strong encryption algorithms to protect the confidentiality (i.e., the secrecy) and integrity of all communications. Mobile platforms contain many different encryption algorithms, but even the best algorithms can be used in dangerous ways. Accordingly, we will reverse engineer mobile applications (where available) and determine which algorithms their developers have chosen.

Second, we will measure how mobile devices confirm the identity of the server. This is critical – when done poorly, a mobile device is happy to divulge any and all secrets to an adversary on the other end of a connection. There are some standard ways that an expert would expect this step to be done, and our previous published work on mobile money (<a href="http://www.cise.ufl.edu/~traynor/papers/reaves-usenix15a.pdf">Reaves, et al., Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World, Proceedings of the USENIX Security Symposium (SECURITY), 2015</a>) showed that approximately 50 percent of applications analyzed in that space did so incorrectly.

Finally, we will measure the configuration of the servers with which a mobile device communicates. Poor configuration here could again render the connection vulnerable as an adversary may be able to force the selection of weak/no cryptographic algorithms encrypting communications.

One major advantage to this analysis is that fixes to these problems can also be achieved at relatively low cost. Specifically, any faults that we find will not require impacted companies to spend hundreds of thousands of dollars to deploy advanced detection systems. Rather, a combination of changes by their development team and administrators can potentially address these issues in short order. We intend to alert all of the impacted companies prior to the release of our final report.

As a final note, finding no faults in this portion of a system does not mean that everything is secure. Moreover, this kind of analysis requires significant resources and time to carry out. It is our hope that each of the companies we study see these results as a first step, and use them to start a broader internal discussion about what they are doing to ensure security inside their company (e.g., creating policies about software updates and patching machines, establishing mechanisms for researchers who discover vulnerabilities to provide responsible disclosure of vulnerabilities, deployment of mechanisms for the secure storage of sensitive data, etc.).

No single analysis can measure all aspects of security. However, we look forward to sharing our results with the general public and the financial inclusion community in the near future. Together, we can ensure the transformative power of these systems while minimizing risks to users.

Have you read?

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

How Secure Are Emerging Digital Credit Services?

&gt; Posted by Kyle Burgess, Executive Director and Editor in Chief, Consumers Research

[caption id="attachment_23631" align="aligncenter" width="490"]<img class="wp-image-23631 size-large" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/05/4880265002_5bf1a62db3_z.jpg?w=490" alt="From cash to digital currency" width="490" height="210" /> Image Credit: <a href="https://www.flickr.com/photos/famzoo/">FamZoo Staff</a>. No alterations made. <a href="https://creativecommons.org/licenses/by-sa/2.0/">CC BY-SA 2.0</a>[/caption]

Digital currencies, such as Bitcoin and its underlying blockchain protocol, introduce a technical platform for a new global payment infrastructure that <a href="http://consumersresearch.org/research/bretton-woods-2015-white-paper/">has the potential</a> to level the playing field for the 2.5 billion people across the globe who are unbanked or underbanked. The immutable and distributed nature of digital currencies and a number of the platforms built on top of blockchain protocols can provide improved security, efficiency, affordability, privacy, and transparency in financial transactions, as well as a whole host of other transfers of value or information. Furthermore, thanks to the proliferation of mobile devices, blockchain-based digital currencies can even remove the middleman, and serve as a bank in your pocket. However, fully removing a third party intermediary comes with significant risks, as there’s no one to call if you lose your private key (which functions as your password), break your hardware wallet (which acts as your digital vault), or want to dispute a payment because the goods you purchased are damaged (because digital currency transactions are irreversible). Like any other product, consumer protection must be at the forefront of the development and implementation of digital currency and blockchain-based financial services.



Over the last few years, policy makers and federal regulators have been advising the blockchain community to develop a set of best practices to address such consumer protection concerns. Several have even cautioned that government solutions may prove to be over-burdensome if the industry fails to demonstrate that it takes consumer protection seriously. This has the potential to diminish the benefits of blockchain technology and limit its ability to foster financial inclusion. Each year <a href="http://consumersresearch.org/">Consumers’ Research</a> hosts a workshop in Bretton Woods, New Hampshire, in the spirit of the first such conference in 1944. The <a href="http://www.brettonwoods2016.com">Bretton Woods 2016</a> conference brought together representatives from legislative, regulatory, and enforcement bodies, as well as a diverse array of fintech, traditional financial industry, and blockchain experts in order to tackle these consumer protection challenges collaboratively. Consumers’ Research, along with the help and expertise of its workshop participants, produced the first industry-led, self-regulatory consumer protection effort in the digital currency space.

The guiding principles document, “<a href="http://consumersresearch.org/research/bretton-woods-2016-protecting-consumers-in-the-digital-currency-economy/">Consumer Protection in the Digital Economy</a>” has four main components:
<ol>
 	<li> The State of Consumer Protection in the Financial Services Industry&nbsp;

This section identifies the assumptions from which current consumer protection models are derived – the first being that consumers must trust their money and information to third parties in order to participate in the formal economy and the second being that individual consumers are ill-equipped to assess the trustworthiness of third parties. It then describes how blockchain-based digital assets, such as bitcoin or a tokenized property title, challenge those assumptions. This section also identifies which types of digital currency entities the proposed guiding principles are meant for, and reviews the U.S. government entities that have released consumer advisories, taken enforcement actions, or developed rules regarding bitcoin, other digital currencies, and the entities utilizing digital currencies and assets."</li>
 	<li> Consumer Bill of Rights &amp; Guiding Principles&nbsp;

A consumer bill of rights and 14 parallel guiding principles address consumer protection challenges in terms of security, privacy, usability, and disclosures and liability. The bill of rights outlines the baseline "rights" of consumers along with the minimum standards needed to protect those rights. Furthermore, it encourages companies to uphold these guiding principles by implementing processes and detailed protocols that are well-suited to their unique business models, instead of prescribing a one-size-fits all set of mechanisms that may work for some businesses but not others.</li>
 	<li> Consumer Protection Challenges&nbsp;

This section examines the flaws, failures, and weaknesses of existing financial industry frameworks, as well as newer digital currency and distributed ledger products and services. Using a top down approach, this section identifies the problems faced by consumers using traditional financial services and digital currency or distributed ledger financial services, as well as the source of those problems – be it regulation, corruption, or bad design.</li>
 	<li> Recommended Solutions&nbsp;

Working from the bottom up, this section recommended solutions to the problems posed in the previous section are offered, identifying which guiding principles address the various challenges faced by consumers.</li>
</ol>
Across the globe, policymakers and regulators that are prioritizing financial inclusion efforts, tend to achieve the most success in places where policy and regulatory environments protect consumers while fostering innovation and encouraging competition through “regulatory sandboxes.” As such, it’s urgent that the blockchain industry demonstrates that it takes consumer protection seriously in order to stave off regulation that hampers the value proposition of digital currencies and blockchain technologies. If the industry fails to take action to put consumers first, it is possible that government entities will take a reactionary and overzealous approach to solving issues as they arise.

We are already seeing U.S. regulators shoehorn some digital currency businesses into ill-fitting or inappropriate regulatory frameworks. For example, some state licensing regimes apply money transmitter laws to <a href="https://coincenter.org/entry/food-for-thought-a-federal-safe-harbor-for-non-custodial-cryptocurrency-users">non-custodial blockchain businesses</a> that do not have custody of or control the movement of digital currencies; rather, they manage and supply the infrastructure that enables other businesses or individuals to hold and move digital currencies. This harms American consumers, because these businesses cannot afford to operate in an environment that requires unnecessary licenses. Instead, these businesses seek safe harbor abroad, taking their innovations and product offerings with them.

Furthermore, no consumers are better off when the regulatory environments of states with strong institutions and effective rule of law are so cumbersome that businesses flee to states where consumer protection laws are paltry or unenforced. Thankfully, as blockchain businesses adopt consumer protection best practices, regulators may be encouraged to put down Maslow’s hammer and focus on offering light-touch regulation, only where necessary. This will give businesses the breathing room they need, and it will afford consumers greater access to these transformative technologies, along with the protections necessary to safeguard their meaningful participation.

Protecting Consumers in the Digital Currency Economy

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, is launching his research effort on the security of data in mobile lending applications.

Mobile phones and networks are transforming the world of financial inclusion. However, we know that we cannot simply “copy and paste” traditional financing mechanisms into this mobile context and expect widespread inclusion. For example, the traditionally-excluded often lack the standard data lenders use to underwrite credit decisions (such as government audited tax forms, formal pay stubs, property deeds, and so forth). A plethora of companies are attempting to measure creditworthiness using alternative data – including the data trail created through mobile money applications. Alternative data for underwriting holds the potential to dramatically expand access to credit if successful, but it also poses new challenges.

For instance, how secure is data used in digital credit?

In my CFI Fellowship, I will measure the state of data security in the mobile money space and provide both a goal and a path towards responsible online credit.

My team and I are performing an extensive teardown of mobile applications including those offering online credit. After a technical analysis of these applications and how they handle user data, we plan to evaluate the privacy policies for each application to see if they describe how the data will be protected, how it will be used, and the recourse available to users should it be incorrect.

It is only by having deeply characterized the behaviors of the industry that we can begin to offer recommendations for what responsible online credit looks like and how far the industry is from achieving it. We expect to find that the integrity of data gathered from mobile money applications will vary dramatically and that the lack of a process to verify and/or challenge such information will limit the reach of alternative efforts to establish creditworthiness.

Methodological approach:

My past research looked at the security of mobile money applications for the Android mobile platform. Through that work, I was able to demonstrate that much of the industry fails to adhere to security best practices. Moreover, the terms of service dictated by companies in this space hold users liable for all fraud. These findings have called the industry to attention and provoked corrective efforts. Under the CFI Fellowship, I will conduct a similar analysis targeting specifically online credit applications for mobile money users.
<ul>
 	<li>App Identification and Gathering: The first step is to work with stakeholders throughout the community to identify candidates for analysis. This process will allow to identify the most relevant players in this space (i.e., those with the largest potential market and impact), and ensure a geographically representative sample.</li>
 	<li>App Teardown and Analysis: Analysis of the collected mobile applications will involve automated techniques. The tools that allow rapid assessment of the state of communications security between the mobile device and the online credit provider’s back end servers. This analysis will include not only a determination of whether or not the mobile application properly determines identity at the other end of communications, but also whether the back end servers are properly configured against the most up-to-date attacks against the SSL/TLS security suites.</li>
 	<li>Policy Analysis: Each application comes with a terms of service document. My past experience demonstrated that such documents place the consequences of fraud solely upon the user regardless of the technical soundness of the application. Accordingly, in this round, I will analyze terms of service documents for online credit providers, looking specifically for language that indicates 1) which data will be targeted by the provider, 2) how it will be used to determine creditworthiness, 3) how users can challenge or confirm the validity of such data, and 4) if such data can be resold to other parties without further explicit notification to the user.</li>
</ul>
All technical advances made as part of this work will be offered to the public as free, open-source projects. One broad objective of the work is that these tools will enable students from universities across the world to be trained in the security analysis of applications, and that the companies in this industry will recreate the methodology and apply it to future offerings of their products to improve security.

Have you read?

<a href="https://cfi-blog.org/2017/03/01/mobile-money-in-myanmar-going-directly-from-cash-to-digital/">Mobile Money in Myanmar: Going Directly from Cash to Digital</a>

<a href="https://cfi-blog.org/2017/02/07/modelo-peru-whats-next-for-the-groundbreaking-mobile-money-platform/">Modelo Peru: What’s Next for the Groundbreaking Mobile Money Platform?</a>

<a href="https://cfi-blog.org/2016/02/01/why-do-we-so-often-get-the-mobile-money-agent-value-proposition-wrong/">Why Do We So Often Get the Mobile Money Proposition Wrong?</a>

&nbsp;

How Secure Is Data Used in Digital Credit?

When most microfinance clients start out, they’re first-timers at a formal financial institution. Like anything unfamiliar, a first foray with banks can be intimidating. You don’t want to be duped or make a mistake and lose precious savings. Peace of mind was granted to clients of two microfinance institutions, one in Paraguay and the other in the Dominican Republic recently as the first <a href="http://smartcampaign.org/certification/">Smart Certifications</a> in those countries were awarded. Fundacion Paraguaya and Banco ADOPEM were certified as meeting all the standards needed to treat their clients with adequate care. This certification demonstrates to prospective clients as well as investors and other industry stakeholders that their institutions are operating responsibly.

Fundacion Paraguaya and Banco ADOPEM are both market leaders in their own right. Banco ADOPEM is one of the largest microfinance institutions in the Dominican Republic. According to the MIX, 351,000 depositors in the Dominican Republic bank with Banco ADOPEM. When Banco ADOPEM pursues and achieves Smart Certification, that sends a message to MFIs and other stakeholders in the country that client protection is a key priority. In 2014 ADOPEM was named “Most Innovative Microfinance Institution of the Year” by Citi, in part because of <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=1&amp;cad=rja&amp;uact=8&amp;ved=0ahUKEwiqm5rRtcvNAhVBVT4KHQJ6A7AQFggfMAA&amp;url=http%3A%2F%2Fwww.bancoadopem.com.do%2Fapp%2Fdo%2Fproductos.aspx%3Fid%3D1408%26iid%3D1406&amp;usg=AFQjCNGgptkSBD2J3D7ZsUJPbBnM2oBakA&amp;sig2=2F9CvETC8A2D75Fe1H3ozw">ATA-Movil</a>, a portable electronic application that allows credit advisers to assess customers in their businesses or in their homes. The mobile information system also allows for convenient and direct communication with clients.

Mercedes de Canalda, President and Founder of Banco ADOPEM, told the Smart Campaign that the MFI’s decision to pursue Smart Certification was to evaluate the institution’s policies and practices against the industry’s best practices in areas like transparency and communication with clients. She said, “The deep evaluation of our policies and procedures opened our eyes to what we can improve. The biggest advantage is that it gave us reasonable and concrete goals and a specific timeline to improve our practices. It was a detailed requirement. It challenged us to innovate and continue to improve to ensure that clients are treated well and that they are heard.”

Fundacion Paraguaya has long been a leader and innovator in microfinance and in the broader fight against poverty, contributing to areas like <a href="http://www.fundacionparaguaya.org.py/?page_id=490">poverty assessment</a>, <a href="https://cfi-blog.org/2013/09/05/disability-inclusivity-and-the-smart-campaign-at-fundacion-paraguaya/">financial inclusion for persons with disabilities</a>, and <a href="http://www.fundacionparaguaya.org.py/?page_id=77">youth empowerment</a>. The <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/global-microscope">Global Microscope</a> 2015 reports that client protection regulation in Paraguay is lacking. For example, it lacks strong grievance redressal mechanisms and does not adequately prevent aggressive collection practices. The report also finds there are mounting concerns over over-indebtedness among lower-income groups in the country and that the government needs to devise and implement a national program to ensure greater education about financial services. Fundacion Paraguaya, along with its strong client protection practices, offers <a href="http://www.fundacionparaguaya.org.py/?page_id=491">a range of financial education services</a>, including services to <a href="http://www.fundacionparaguaya.org.py/?page_id=517">children and youth</a> via uniquely structured, financially sustainable programs.

There have been a number of other recent Smart Certifications: Amret Microfinance, Prasac, Sathapana Bank, and VisionFund in Cambodia; Grooming Centre and Fortis Microfinance Bank in Nigeria; AgroInvest in Serbia; Pro Mujer in Nicaragua; FINCA in Georgia; Annapurna Microfinance in India; Tamwil El Fellah in Morocco; Pichincha Microfinanzas in Ecuador; and FINCA in Mexico. The total number of certified institutions is now 60, and together these institutions serve over 26 million consumer protected clients.

For more on Smart Certification, including a listing of certified institutions, visit <a href="http://smartcampaign.org/certification/certified-organizations">the Smart Campaign website</a>.

Have you read?

<a href="https://cfi-blog.org/2016/03/21/a-client-protection-milestone-50-smart-certified-institutions-25-million-clients-covered/">Disability Inclusion, in Ecuador and Around the World: An Interview with Larry Reed</a>

<a href="https://cfi-blog.org/2016/03/21/a-client-protection-milestone-50-smart-certified-institutions-25-million-clients-covered/">A Client Protection Milestone: 50 Smart Certified Institutions; 25 Million Clients Covered</a>

<a href="https://cfi-blog.org/2015/03/26/smart-certification-kashf-foundation-takes-the-lead-in-pakistan/">Smart Certification: Kashf Foundation Takes the Lead in Pakistan</a>

&nbsp;

Client Protection Firsts in Paraguay and the Dominican Republic

Jeffrey Riecke

If you’re plugged into the world of online marketplace lending then you heard this week’s <a href="http://www.pymnts.com/news/alternative-financial-services/2016/lending-club-investigation-renaud-laplanche/">news</a> about Lending Club’s internal scandal which culminated in the resignation of its founder, chairman, and chief executive, Renaud Laplanche. Lending Club, a U.S.-based company, is the first billion dollar online lending marketplace, and Laplanche was viewed by many as the industry’s biggest advocate and one of its pioneers. Accordingly, industry participants and followers are wondering what Lending Club’s news means for the future of the company and the industry. Is this a sign that the promise of marketplace lending is too good to be true?

For dramatic pause, and context, a few facts on what happened. On Monday, after an internal review, Lending Club <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">announced</a> that $22 million in subprime loans sold in March and April of this year to a single investor went against the investor’s expressed terms. Furthermore, certain staff members, including Laplanche, were aware that the loans did not meet the investor’s criteria, and during the review process there was less than full disclosure by staff including Laplanche, which the board deemed unacceptable.

The review also revealed that, in an unrelated matter, Laplanche failed to disclose personal interests he held in a third-party fund while Lending Club was considering an investment in the same fund. Lending Club conducted the review under the supervision of a sub-committee of its board of directors with the assistance of independent outside counsel and other advisors.

Laplanche and three other senior staff resigned or were fired. The company’s stock price slid dramatically, and investors <a href="http://www.marketwatch.com/story/goldman-jefferies-stopped-buying-lendingclub-loans-2016-05-10">Jeffries LLC and Goldman Sachs paused their purchase of loans from Lending Club</a> as they review the events. Jeffries, for example, had been looking to package roughly $150 million of Lending Club loans into bonds for investor sales in early May.

What does this mean? In the immediate aftermath of the announcement, industry players and commentators had mixed reactions. Some pointed to Lending Club’s falling stock prices and <a href="http://www.pymnts.com/news/alternative-financial-services/2016/lending-club-investigation-renaud-laplanche/">other signals</a> from marketplace lenders as evidence of industry weakness. Others are taking a more <a href="http://www.bloomberg.com/news/videos/2016-05-10/is-lendingclub-a-warning-on-peer-to-peer-lending">optimistic view</a>, asserting that as an emerging asset class, marketplace lending needs greater transparency as part of the process of reaching maturity.

Lending Club for its part, has managed to sustain impressive <a href="http://www.nbcnews.com/business/business-news/lendingclub-founder-s-surprise-exit-leaves-industry-lurch-n572066">year-on-year growth</a>. The company had $1 billion in loan originations in 2012, $7 billion in 2014, and at the end of the most recent quarter (ending March 31, 2016) it neared $18 billion. During this same quarter, Lending Club reported a  modest <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">$4.1 million net profit</a>.

Looking to the future, marketplace lending is <a href="http://www.businessinsider.com/goldman-sachs-and-jefferies-stop-buying-lendingclub-loans-following-ceos-exit-2016-5">forecasted to grow immensely</a>. Lending Club started out in consumer loans and has since begun lending to small businesses and medical offices. It’s estimated that small businesses make up 99 percent of companies in the United States as well as 54 percent of total sales and 55 percent of all jobs. However, only half of small businesses with $100,000 to $1 million in annual revenue received at least a portion of the financing they applied for from conventional banks in 2015. Business Insider estimates that the volume of potential loans that are not made reached nearly $100 billion in the fourth quarter of 2015.

But of course, this forecasted growth is only as the good as growth in borrower and investor interest, and marketplace players’ abilities to sustainably match the two. While the models first started as peer-to-peer lenders, sourcing funds from individuals, they have for several years been dominated by institutional investors. Indeed, to sustain its volume of lending outfits like Lending Club need big investors. It is notable that the issues raised in this episode raised all relate to dealings with investors, not placement of funds with borrowers, so that aspect of the business model has not been challenged.

Some investors are <a href="http://www.bloomberg.com/news/videos/2016-05-10/is-lendingclub-a-warning-on-peer-to-peer-lending">already declaring</a> that the way Lending Club is handling the situation provides the assurance they need to continue trusting that the company’s operations, including their alternative credit-scoring methods, are sound. In a <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">press release</a> Lending Club reported: “The Company took, and will continue to take, remediation steps to resolve the material weaknesses in internal control over financial reporting identified in the first quarter of 2016 -- one related to the sales of non-conforming loans and the other to the failure to disclose the personal investment interests -- and to restore the effectiveness of its disclosure controls and procedures.”

Notably, last month Lending Club <a href="http://blog.lendingclub.com/lending-club-partners-funding-circle-prosper-launch-marketplace-lending-association/">partnered</a> with Funding Circle, Prosper and other marketplace lenders to form the Marketplace Lenders Association, which seeks to promote responsible business practices and sound public policy to benefit borrowers and investors. The Association established Marketplace Lending Operating Standards, addressing transparency for investors, responsible lending, governance and controls, and risk management.

A day after Lending Club’s news broke, the U.S. Department of Treasury <a href="https://www.treasury.gov/press-center/press-releases/Pages/jl0452.aspx">released</a> a white paper on marketplace lending, which offers an overview of the evolving market landscape, acknowledges its risks and benefits, reviews stakeholder opinions, and provides policy recommendations.

It is hard to say at this point whether Lending Club’s scandal represents minor growing pains, significant company concerns, or issues that are widespread and threatening for the entire industry. Though regardless, it’s never a bad investment to instill strong internal controls and transparency, especially when strong – and sustainable – growth is planned.

Have you read?

<a href="https://cfi-blog.org/2015/09/15/insights-into-an-evolving-peer-to-peer-lending-industry-in-china/">Insights into an Evolving Peer-to-Peer Lending Industry in China</a>

<a href="https://cfi-blog.org/2013/09/27/financially-included-through-crowdsourced-financing/" target="_blank" rel="noopener">Financially Included Through Crowdsourced Financing?</a>

<a href="https://cfi-blog.org/2014/10/30/fueling-the-economic-engine-global-experiments-in-small-enterprise-lending/">Fueling the Economic Engine: Global Experiments in Small Enterprise Lending</a>