Finance, Technology, and Recent Innovation Finance and technological development have been inextricably linked throughout history. (Possibly, quite literally. The technology of writing in early civilization may have developed to record payments and debts. ) As a result, the term fintech is used to refer to a broad set of technologies being deployed across a variety of financial industries and activities. Although there is no consensus on which technologies qualify as new or innovative enough to be fintech, it is generally understood to mean recent innovations to the way a financial activity is performed that are made possible by rapid advances in digital information technology. Underlying, cross-cutting technological advancements that enable fintech include increasingly widespread, easy access to the internet and mobile technology; increased data generation and availability and use of Big Data and alternative data; increased use of cloud computing services; the development of algorithmic decisionmaking (and the related technological evolutions toward machine learning and artificial intelligence); and the coevolution of cyber threats and cybersecurity. The complementary use of these technologies to deliver financial services could potentially create benefits. Many technologies aim to create efficiencies in financing, which reduce costs for financial service providers. Certain cost savings may be passed along to consumers through reduced prices. With lower prices, some customers that previously found services too expensive could enter the market. In addition, some individuals and businesses that previously could not access financial services because of price or lack of available financial information could gain access at lower prices or through increased data availability and improved data analysis. Fintech also may allow businesses to reach new customers that were previously restricted by geographic remoteness or unfamiliarity with products and services. Increased accessibility may be especially beneficial to traditionally underserved groups, such as low-income, minority, and rural populations. However, fintech may also generate risks and result in undesirable outcomes. Predicting how an innovation with only a brief history of use will perform involves uncertainty, particularly without the experience of having gone through a recession. Thus, technologies may not ultimately allocate funds, assess risks, or otherwise function as efficiently and accurately as intended; they may instead generate unexpected losses. Some technologies aim to eliminate or replace a middle man, but in certain cases the middle man may in fact be useful or even necessary. For example, an experienced financial institution or professional may be able to explain and advise consumers on financial products and their risks. In addition, new fintech startups may be inexperienced in complying with consumer-protection laws. These characteristics may increase the likelihood that consumers using financial technology engage in a financial activity and take on risks that they do not fully understand and which unduly expose them to losses. Furthermore, some studies suggest that fintech's use can result in disparate impact on protected groups, and that the increasing use of high-speed internet and mobile devices in finance may be leaving behind groups that cannot afford those services and devices. As financial activity increasingly uses digital technology, sensitive data are generated. On the one hand, data can be used to assess risks and ensure customers receive the best products and services. On the other hand, data can be stolen and used inappropriately, and there are concerns over privacy. This raises questions over data ownership and controlâincluding consumers' rights and companies' responsibilities in accessing and using dataâand whether companies that use and collect data face appropriate cybersecurity requirements. Given that fintech may produce both positive and negative outcomes, Congress and other policymakers may consider whether existing laws and regulations appropriately foster the development and implementation of potentially beneficial technologies while adequately mitigating the risks those technologies may present. This report examines (1) underlying technological developments that are being used in financial services, (2) selected examples of financial activities affected by innovative technology, and (3) some approaches regulators have used to integrate new technologies or technology companies into the existing regulatory framework. Policy issues that may be of interest to Congress are examined throughout the report. Additional CRS products and resources also are identified throughout the report and in the Appendix . For a detailed examination of how fintech is regulated, see CRS Report R46333, Fintech: Overview of Financial Regulators and Recent Policy Approaches , by Andrew P. Scott. Selected Underlying Technological Developments Fintech is generally enabled by advances in general-use technologies that are used to perform financial activities. This section examines certain of these underlying technologies, including their potential benefits and risks, and identifies policy issues related to their use in finance that Congress is considering or may choose to consider. Proliferation of Internet Access and Mobile Technology6 The proliferation of online financial services has a number of broad implications. One consideration is that online companies can often quickly grow to significant size shortly after entering a financial market. This could enable the rapid growth of small fintech startups, possibly through capturing market share from incumbent financial firms. Adopting information technology, however, may require significant investment, which could advantage existing firms if they have increased access to capital. Larger technology firmsâincluding Amazon, Apple, Facebook, and Googleâhave started financial services operations, and thus may become competitors to or partners with traditional financial institutions. Some industry experts predict that platforms offering the ability to engage with different financial institutions from a single channel will likely become the dominant model for delivering financial services. These developments may raise concerns that offering finance through digital channels could drive industry concentration. Another consideration in this area involves consumer disclosures for financial products. In the past, voluntary or mandatory disclosures were designed to be delivered through paper. As firms move more of their processes online, they have begun to update these disclosures with electronic formats in mind. Consumers may interact differently with mobile or online disclosures than paper disclosures. Accordingly, firms may need to design online disclosures differently than paper disclosures to communicate the same level of information to consumers. Possible Issues for Congress The internet raises questions over what role geography-based financial regulations should play in the future. Many financial regulations are applied to companies and activities based on geographic considerations, as most areas of finance are subject to a dual federal-state regulatory system. For example, nonbank lenders and money transmitters are primarily regulated at the state level in each state in which they operate and are subject to those states' consumer-protection laws. Fintech proponents argue the internet facilitates the provision of products and services on a national scale, and 50 separate state regulatory regimes are inefficient when applied to internet-based businesses that are not constrained by geography. However, state regulators and consumer advocates assert state regulators' experience and local connection are best situated to regulate nonbank fintech companies. An Office of the Comptroller of the Currency (OCC) initiative to accept applications for special-purpose bank charters that would allow certain fintechs to enter the national bank regulator regime, and subsequent lawsuits filed by state regulators to block such charters, exemplify this policy debate. Another example is the debate over how a bank's geographic assessment area should be defined for the purposes of the Community Reinvestment Act ( P.L. 95-128 )âa law designed to encourage banks to meet the credit needs of the communities in which they operateâwhen so many services are delivered over the internet instead of at a physical branch location. Another area in which the internet raises concerns is how effective disclosure requirements are if they are sent electronically and read on a screen, when many disclosure forms may have been designed to be delivered and read on paper. Thus, although electronic disclosures can eliminate costs of printing and physically delivering disclosures, they may hinder customers' ability to read and understand them. Currently, financial regulatory agencies are responsible for implementing consumer-disclosure laws. Often, these agencies create either mandatory or safe harbor form designs that firms use to comply with these laws. Some financial regulatory agencies are either required or choose to test new consumer disclosures themselves before implementing a new disclosure requirement on the entities they regulate. In the past, when most consumer credit origination occurred in person, this testing generally focused on paper delivery. As firms move more of their origination processes online, financial regulatory agencies might consider updating their consumer testing research with this format in mind. Big Data16 Today, companies can easily collect, cheaply store, and quickly process data, regardless of its size, frequency, type, or location. Big Data commonly refers to the vast amounts and types of data an information technology (IT) system may handle. Big Data data sets share characteristics that require different hardware and software in IT systems to store, manage, and analyze those data. The four characteristics of Big Data are volume, velocity, variety, and variability. Volume refers to a data set's extensive size. Velocity refers to the rate of flow for the data coming into, being processed by, and exiting the IT system. Variety refers to the differing types of data in a data set, such as information entered by a company analyst, images, data from a partner database, and data scraped from a website. Variety can also refer to different types of devices and subsystems in an IT system handling the data. Variability refers to the recognition that Big Data data sets can change with regard to the first three attributes. A data set may grow or shrink in volume, data may flow at different velocities, and a data set may include a different variety of data from one point in time to another. Changes in data variability drive IT systems to have a scalable architecture in order to manage the data sets. Big Data is used to generate insights, support decisionmaking, and enable automation. Big Data allows extensive and complex information to be analyzed with new methods (e.g., cloud computing resources, which are discussed in more detail below), leading users to understand and use the data in novel ways. Loan underwriting (evaluating the likelihood that a loan applicant will make timely repayment) is an example from the financial services industry. Loan underwriting has relied on an in-person process, using only a few data sources that might have been months or years old. Big Data enables underwriting to be performed online using a greater variety of more current data sources, potentially allowing for greater speed, accuracy, and confidence in loan decisions, but raises concerns over privacy and questions over what information is appropriate to collect and use. In recent years, new technologies have led to the development of new products in the financial services sector. For example, as account information has become electronic, some products allow consumers to combine accounts with several financial services providers on a single software platform, sometimes in combination with financial advisory services. The underlying technology providers for these platforms are sometimes known as data aggregators, which refers to companies that compile information from multiple sources into a standardized, summarized form. One technology commonly used to collect account data is web scraping , a technique that scans websites and extracts data from them, and in general can be performed without a direct relationship with the website or financial firm maintaining the data. As an alternative to web scraping, the financial institution managing the account may provide customer account information through a structured data feed or application program interface (API). Advantages and disadvantages exist when accessing alternative data by API rather than web scraping. For example, in certain circumstances web scraping may be an easier way for companies to gather data because it does not rely on bilateral company agreements, but some industry observers assert that APIs are more secure in terms of cybersecurity and fraud risks. Using API banking standards to facilitate data sharing between financial firms is sometimes called open banking . New financial products that take advantage of data aggregation and open banking could provide benefits to consumers by enabling them to manage personal finances, automate or set goals for saving, receive personalized product recommendations, apply for loans, and perform other tasks. However, increasing access to these data may pose data security and privacy risks to consumers. Possible Issues for Congress Questions exist about how current laws and regulations should apply to Big Data. Typically, these questions relate to concerns about privacy and cybersecurity. One area of debate is whether data security standards should be prescriptive and government defined or flexible and outcome based. Some argue that a prescriptive approach can be inflexible and harm innovation, but others argue that an outcome-based approach might lead to institutions having to comply with a wide range of data standards. In addition, questions exist about whether relevant data security laws continue to cover all sensitive individual financial information, or whether the scope of these laws should be expanded. Alternative Data26 Alternative data generally refers to types of data that are not traditionally used by the national consumer reporting agencies to calculate a credit score. It can include both financial and nonfinancial data. New technology makes it more feasible for financial institutions to gather alternative data from a variety of sources. For example, the Consumer Financial Protection Bureau (CFPB) included the following list of alternative data in a 2017 Request for Information: Data showing trends or patterns in traditional loan repayment data. Payment data relating to non-loan products requiring regular (typically monthly) payments, such as telecommunications, rent, insurance, or utilities. Checking account transaction and cashflow data and information about a consumer's assets, which could include the regularity of a consumer's cash inflows and outflows, or information about prior income or expense shocks. Data that some consider to be related to a consumer's stability, which might include information about the frequency of changes in residences, employment, phone numbers or email addresses. Data about a consumer's educational or occupational attainment, including information about schools attended, degrees obtained, and job positions held. Behavioral data about consumers, such as how consumers interact with a web interface or answer specific questions, or data about how they shop, browse, use devices, or move about their daily lives. Data about consumers' friends and associates, including data about connections on social media. Alternative data could potentially be used to expand access to credit for consumers, such as currently credit invisible or unscorable consumers, but also could create risks related to data security or consumer-protection violations. Financial institutions can mitigate some of these risks through data encryption and other robust data governance practices. Moreover, some prospective borrowers may be unaware that alternative data has been used in credit decisions, raising privacy and consumer-protection concerns. Additionally, alternative data may pose fair lending risks if alternative data elements are correlated with prohibited classes, such as race or ethnicity. Alternative data could potentially increase accuracy, visibility, and scorability in credit reporting by including additional information beyond that which is traditionally used. The ability to calculate scores for previously credit invisible or nonscoreable consumers could allow lenders to better determine their creditworthiness. Arguably, using alternative data would potentially increase access toâand lower the cost ofâcredit for some credit invisible or unscorable individuals by enabling lenders to find new creditworthy consumers. However, alternative data could potentially harm some consumers' existing credit scores if it includes negative or derogatory information. Possible Issues for Congress The main statute regulating the credit reporting industry is the Fair Credit Reporting Act (FCRA; P.L. 91-508), enacted in 1970. The FCRA requires "that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit ... in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." Using alternative data for credit reporting raises FCRA compliance questions. For example, alternative data providers outside of the traditional consumer credit industry may find FCRA data-furnishing requirements burdensome. Some alternative data may have accuracy issues, and managing consumer disputes requires time and resources. These regulations may discourage some organizations from furnishing alternative data, even if the data could potentially help some consumers become scorable or increase their credit scores. In addition, consumers may not know what specific information alternative credit scoring systems use and how to improve the credit scores produced by these models. The CFPB and federal banking regulators have been monitoring alternative data developments in recent years, and in December 2019 they released a policy statement on the appropriate use of alternative data in the underwriting process. The release followed a February 2017 CFPB request for information from the public about the use of alternative data and modeling techniques in the credit process. Information from this request led the CFPB to outline principles for consumer-authorized financial data sharing and aggregation in October 2017. These nine principles include, among other things, consumer access and usability, consumer control and informed consent, and data security and accuracy. In addition, the CFPB issued its first (and, to date, only) no-a ction letter in 2017 to the Upstart Network, a company that uses alternative data, such as education and employment history, to make credit and pricing decisions. In 2018, the Treasury Department released a report about regulatory recommendations, with a chapter on consumer financial data, including data sharing, aggregation, and other technology issues. Automated Decisionmaking and Artificial Intelligence45 Performing financial activities often involves making decisions about how to allocate resources (e.g., whether a particular borrower should be given a loan or whether shares of a particular stock should be purchased at the current price) based upon analysis of information (e.g., whether the borrower has successfully paid back loans in the past or how much profit the stock-issuing company made last year). Historically, these complex tasks could only be performed by a human. More recently, technological advances have enabled computers to perform these tasks. This development creates potential benefits and risks, and has a number of financial regulatory implications. Financial firms have used algorithmsâprecoded sets of instructions and calculations executed automaticallyâto enable computers to make decisions for a number of years, notably in the lending and investment management industries. Such automation may produce benefits if algorithmic analysisâperhaps using Big Data and alternative data, discussed previouslyâis better able to assess risks, predict outcomes, and allocate capital across the financial system than traditional human assessments. Eliminating inefficiencies through such automation could reduce the prices and increase the availability of and access to financial services, including for consumers, small businesses, and the underserved. Automation can also create certain concerns, particularly if automated programs may not perform as intended, possibly resulting in market instability or discrimination against protected groups. Algorithms can fail to perform as expected for reasons such as programmer error or unforeseen conditions, potentially producing unexpected losses. Because algorithms can execute actions so quickly and at large scale, those losses can be quite large. An illustrative event is the Flash Crash of May 6, 2010, in which the Dow Jones Industrial Average fell by roughly 1,000 points (and then rebounded) in intraday trading. The event was caused in part by an automated futures selling program that made sales more quickly than anticipated, resulting in tremendous market volatility. In addition, automated decisions may result in adverse impacts on certain protected groups in a discriminatory way. In lending, for example, these discriminatory outcomes may include higher rates of denial for minority loan applicants than for white applicants with similar incomes and financial histories. Such discrimination can occur for a number of reasons, even if algorithm developers did not intend to discriminate. For example, the data set used to train the lending program is likely historical data of past loan recipients, and minorities may be underrepresented in that sample. By using these data to learn, the algorithm may similarly make fewer loans to underrepresented groups. Possible Issues for Congress Programs enabled with artificial intelligence or machine-learning capabilities (i.e., automated programs that are able to change themselves with little or no human input) raise a number of policy concerns. The programs' complexity and the lack of human input needed to change their decisionmaking processes can make it exceedingly difficult for human programmers to predict what these programs will do and explain why they did it. Under these circumstances, the ability of regulators or other outside parties to understand what a program did, and why, may be limited or nonexistent. This poses a significant challenge for companies using AI programs to ensure they will produce outcomes that comply with applicable laws and regulations, and for regulators to effectively carry out their oversight duties. In order to address this black box problem, some observers assert that regulators should set standards for how AI programs are developed, tested, and monitored. If Congress decided such standards were necessary, it could encourage or direct financial regulatory agencies to develop them. In addition, it could direct the agencies to implement rules regarding the development and use of AI programs. Cloud Computing52 Some have jokingly referred to cloud computing as "someone else's computer." Although this is a facetious characterization, it succinctly describes the technology's core tenet. Cloud computing users transfer their information from a resource (e.g., hard drives, servers, and networks) that they own to one that they lease. Cloud computing alleviates users from having to buy, develop, and maintain technical resources and recruit and retain the staff to manage those resources. Instead, cloud computing users pay providers who specialize in building and managing such resource infrastructures. Cloud and high-performance computing architectures are better suited to processing Big Data than desktop computing. For many, this makes Big Data and cloud computing inextricably linked, and many commenters may refer to them interchangeably. Although this may be common practice, it is not technically accurate. Cloud computing refers to the computing resource (e.g., servers, applications, and service), whereas Big Data refers to the data a computing resource may use. Cloud computing is used extensively by financial institutions, including banks, insurers, and securities firms. Most financial firms store and process large amounts of data related to customer accounts and transactions. Typically, they also provide internet-based access to accounts and services through websites and mobile device apps and attract customers with these services. Meeting these business needs requires significant IT infrastructures and capabilities. For some financial companies, it may be less costly to pay a cloud service provider than to do everything in-house. Cloud computing introduces certain information security considerations and risks. Because data are not physically under the user's direct control (i.e., the data are no longer on a local, owned or controlled data server), the risk that access to those data may spread beyond intended users may be higher. Cloud providers counter that although they have physical access to the data, they do not necessarily have logical access to the data, nor do they own the data. In other words, they argue that although the data are hosted on their servers, they are encrypted or otherwise segmented from the provider's ability to access them. Another related potential risk is commonly referred to as the insider threat âthe risk that a trusted insider may purposely harm an employer or clients. Although users may limit unauthorized access to their data through encryption, an insider may be able to manipulate the encrypted files in such a manner that the information is kept confidential, but is no longer available. Users would then depend on the provider to restore a functioning backup of the data to resume data access. Or, the provider may offer encryption and key-management services to the user. In doing so, providers keep the data in their servers confidential between clients, but in a way that continues to afford that provider access to the user's data through encryption and decryption protocol maintenance. It should be noted that financial institutions that keep IT operations in-house also face the insider threat. However, migrating to cloud computing adds the cloud service provider's employees to the set of people that could pose an insider threat. In addition, a portion of the risk shifts from being internally managed by the financial institution to being externally managed by the cloud service provider. How well a financial institution manages these changing risk exposures depends on the quality of its policies, programs, and relationship with its cloud provider. Possible Issues for Congress Policymakers may examine whether the existing regulatory framework and rules appropriately balance the goals of guarding against the risks cloud computing presents to individual financial institutions and systemic stability, while not hindering beneficial innovations. Firms face operational risk (including legal and compliance risks) whether they operate and maintain IT in-house or outsource to a cloud provider. Arguably, the risk of system disruptions and failures can be reduced by using a cloud provider with technical specialization in operating, maintaining, and protecting IT systems. Nevertheless, the nature of operational risk exposure changes when an institution adopts cloud computing. This dynamic potentially raises friction between banks, cloud providers, and regulators regarding how banks' relationships with cloud providers should be regulated. The Bank Services Company Act (BSCA; P.L. 87-856) requires regulators to subject activities performed by bank service providers to the same regulatory requirements as if they were performed by the bank itself. This could place substantial regulatory burden on banks and cloud services providers that see potential benefit to working together. The BSCA gives bank regulators supervisory authority over service providers. Exercising this authority over cloud service providers, however, may raise challenges. At least initially, bank regulators may be unfamiliar with the cloud service industry, and cloud service providers may not be familiar with what is expected during bank-like examinations. The Federal Reserve's April 2019 examination of Amazon Websites Services (AWS; a cloud provider with bank clients) anecdotally illustrates the frictions in this area. Reportedly, AWS was wary of the process, and when examiners asked for additional documents and information, "the company balked, demanding to first see details about how its [AWS's] data would be stored and used, and who would have access and for how long." The cloud computing industry could pose risk to broader financial system stability in addition to risk at individual financial firms. Cloud computing resources are pooled, meaning cloud service providers build their resources to service many users simultaneously. This means many financial institutions could be using the same cloud provider, and are likely doing so because the cloud computing industry is highly concentrated at a small number of large providers (as discussed in more detail in the next section). Before cloud computing was available, successful cyberattacks or other technological disruptions would occur in individual institutions' systems. With cloud computing, an incident at one of the main cloud service providers could affect several firms simultaneously, thus affecting large portions of the entire financial system. Large, systemically important banks are reportedly moving significant portions of their operations onto cloud services, which could exacerbate the effects of a disruption at a cloud service provider. Certain financial regulators have mandates to ensure financial stability, so policymakers may choose to consider whether their authorities to regulate cloud service providers are appropriately calibrated. Data Security63 Cybersecurity is a major concern of financial institutions and federal regulators. In many ways, it is an important extension of physical security. For example, banks are concerned about both physical and electronic theft of money and other assets, and they do not want their businesses shut down by weather events or denial-of-service attacks. Maintaining the confidentiality, security, and integrity of physical records and electronic data held by banks is critical to sustaining the level of trust that allows businesses and consumers to rely on the banking industry to supply services on which they depend. Enormous amounts of data about individuals' personal and financial information are now generated and stored across numerous financial institutions. This could create additional opportunities for criminals to commit fraud and theft at a scale not previously possible. Instead of stealing credit cards one wallet at a time, someone hacking into a payment system can steal thousands of credit cards at once, and the internet allows stolen credit cards to be sold and used many times. For example, the 2013 Target data breach compromised approximately 70 million credit cards. Whereas a traditional criminal method might involve stealing tax refund checks from individual mail boxes, the IRS announced in May 2015 that its computer system was hacked, allowing unknown persons to file up to 15,000 fraudulent tax returns worth up to $50 million total. The Equifax breach that occurred between May and July 2017 potentially jeopardized almost 148 million U.S. consumers' identifying information. Possible Issues for Congress To mitigate cybersecurity risks, financial institutions are subject to an array of laws and regulations. The basic authority that federal regulators use to establish cybersecurity standards emanates from the organic legislation that established the agencies and delineated the scope of their authority and functions. In addition, certain state and federal lawsâincluding the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank; P.L. 111-203 ), the Gramm-Leach-Bliley Act of 1999 (GLBA; P.L. 106-102 ), and the Sarbanes-Oxley Act of 2002 ( P.L. 107-204 )âhave provisions related to the cybersecurity of financial services that are often performed by banks. In addition, regulators issue guidance in a variety of forms designed to help banks evaluate their risks and comply with cybersecurity regulations. The existing framework was implemented before certain developments in financial technology, and risks related to cybersecurity arguably have increased with digitization's proliferation in finance. Successful hacks of financial institutions, such as those mentioned above, highlight the importance of financial services cybersecurity oversight. The framework governing financial services cybersecurity reflects a complex and sometimes overlapping array of state and federal laws, regulators, regulations, and guidance. However, whether this framework is effective and efficient, resulting in adequate protection against cyberattacks without imposing undue cost burdens on banks, is an open question. Concerns about data security aside, generating and analyzing data also raises privacy concerns. Individuals' transactions are increasingly recorded and analyzed by financial institutions. Debates over how financial institutions should be allowed to use or share consumer data between institutions remain unresolved. For more information on these issues, see CRS Report R44429, Financial Services and Cybersecurity: The Federal Role , by N. Eric Weiss and M. Maureen Murphy; CRS In Focus IF10559, Cybersecurity: An Introduction , by Chris Jaikaran; and CRS Report R45631, Data Protection Law: An Overview , by Stephen P. Mulligan, Wilson C. Freeman, and Chris D. Linebaugh. Selected Technological Innovations in Finance When innovative financial technology is developed for a specific financial market, activity, or product, it might raise questions over the degree to which existing applicable laws and regulations foster the potential benefits and protects against potential risks. This section examines certain fintech innovations, including their potential benefits and risks, and identifies related policy issues that Congress is considering or may choose to consider. Lending71 Traditionally, consumer and small business lenders worked in person with prospective borrowers applying for a new loan. These lenders employed human underwriters to assess prospective borrowers' creditworthiness, determining whether the lender would extend credit to an applicant and under what terms. The underwriting process can be relatively laborious, time consuming, and costly. Dating back to at least 1989, with the debut of a general-purpose credit score called FICO, automation has increasingly become a part of the underwriting process. In general, automation in underwriting relies on algorithmsâprecoded sets of instructions and calculations executed by a computerâto determine whether to extend credit to an applicant and under what terms. In contrast, human underwriting relies on a person to use knowledge, experience, and judgement (perhaps informed by a numerical credit score) to make assessments. More recently, with the proliferation of internet access and data availability, some new lendersâoften referred to as marketplace lenders or fintech lenders ârely entirely or almost entirely on online platforms and algorithmic underwriting. In addition, the abundance of alternative data about prospective borrowers now available to lendersâeither publicly accessible or accessed with the borrower's permissionâmeans lenders can incorporate additional information beyond traditional data provided in credit reports and credit scores into assessments of whether a particular borrower is a credit risk. Potentially, more data about a borrower could allow a lender to accurately assessâand thus extend credit toâprospective borrowers for whom traditional information is lacking (e.g., people with thin credit histories) or insufficient to make a determination about creditworthiness (e.g., small businesses). However, such practices raise questions about what kind of data should be accessible and used in credit decisions and whether its use could result in disparate impacts or other consumer-protection violations. Although fintech lending remains a small part of the consumer lending market, it has been growing quickly in recent years. According to the GAO, "in 2017, personal loans provided by these lenders totaled about $17.7 billion, up from about $2.5 billion in 2013." Possible Issues for Congress A general issue underlying many of the policy questions involving fintech in lending is whether the current regulatory framework appropriately fosters these technologies' potential benefits while mitigating the risks they may present. Some commentators argue that current regulation is unnecessarily burdensome or inefficient. Often these criticisms are based largely or in part on the argument that the state-by-state regulatory framework facing nonbank lenders is ill-suited to an internet-based (and hence borderless) industry. Opponents of this view assert that state-level licensing and consumer-protection laws, including usury laws (laws that target lending at unreasonably high interest rates), are important safeguards that should not be circumvented. Additional policy questions arise in cases where banks and nonbanks have partnered with each other to issue loans, such as in an arrangement depicted in Figure 1 . Fintech companies and banks enter into a variety of such arrangements in which one or the other may build the online, algorithmic platform; do the underwriting on the loan; secure the funding to make the loan; originate it; and hold it on its own balance sheet or sell it to investors. These arrangements generally require a bank to closely examine its compliance obligations related to vendor relationship requirements, discussed in more detail in this report's " Banks and Third-Party Vendor Relationships " section. In addition, certain arrangements have raised legal questions concerning federal preemption of state usury lawsâspecifically, whether federal laws that allow banks to export their home states' maximum interest rates apply to loans that are originated by banks but later purchased by nonbank entities. Whether applicable laws and regulations governing these arrangements are appropriately calibrated to ensure availability of needed and beneficial credit or expose consumers to potential harm through the preemption of important consumer protections is a matter of debate. Another area of debate is how consumers will be affected by fintech in lending. Fintech lending proponents argue that, because financial technologies increasingly use quantitative analysis of new data sources, the technologies may expand credit availability to individuals and small businesses in a fair, safe, and less costly way. Thus, these proponents argue that overly burdensome regulation of these technologies could cut off a beneficial credit source to individuals who may have previously lacked sufficient credit access. However, some consumer advocates argue that inexperienced fintech lenders with a relative lack of federal regulatory supervision could inadvertently violate consumer-protection regulations. For example, these lenders may make loan decisions that unintentionally have a disparate impact on protected groups, violating fair lending laws. Also, when lenders deny a loan application they generally must send a notice to the applicant explaining the reason for the denial, called an adverse action notice . Some commentators question how well lenders will understand and thus be able to explain the reasons for an adverse action resulting from a decision made by algorithm. For more detailed examination of these topics, see CRS Report R44614, Marketplace Lending: Fintech in Consumer and Small-Business Lending , by David W. Perkins; and CRS Report R45726, Federal Preemption in the Dual Banking System: An Overview and Issues for the 116th Congress , by Jay B. Sykes. Banks and Third-Party Vendor Relationships87 As more banking transactions are delivered through digital channels, insured depository institutions (i.e., banks and credit unions) that lack the in-house expertise to set up and maintain these technologies are increasingly relying on third-party vendors, specifically technology service providers (TSPs), to provide software and technical support. In light of banks' growing reliance on TSPs, regulators are scrutinizing how banks manage their operational risks , the risks of loss related to failed internal controls, people, and systems, or from external events. Rising operational risksâspecifically cyber risks (e.g., data breaches, insufficient customer data backups, and operating system hijackings)âhave compelled regulators to scrutinize banks' security programs aimed at mitigating operational risk. Regulators require an institution that chooses to use a TSP to ensure that the TSP performs in a safe and sound manner, and activities performed by a TSP for a bank must meet the same regulatory requirements as if they were performed by the bank itself. The Bank Service Company Act (BSCA; P.L. 87-856) and the Gramm-Leach-Bliley Act (GLBA; P.L. 106-102 ) give insured depository institution regulators a broad set of authorities to supervise TSPs that have contractual relationships with banks. The BSCA directs the federal depository institution regulators to treat all activities performed by contract as if they were performed by the bank and grants them the authority to examine and regulate third-party vendors that provide services to banks, including check and deposit sorting and posting, statement preparation, notices, bookkeeping, and accounting. Section 501 of GLBA requires federal agencies to establish appropriate standards for financial institutions to ensure the security and confidentiality of customer information. Hence, the prudential depository regulators issued interagency guidelines in 2001 that require banks to establish information security programs. Among other things, banks must regularly assess the risks to consumer information (in paper, electronic, or other form) and implement appropriate policies, procedures, testing, and training to mitigate risks that could cause substantial harm and inconvenience to customers. The guidance requires banks to provide continuous oversight of third-party vendors such as TSPs to ensure that they maintain appropriate security measures. The regulators periodically update and have since released additional guidance pertaining to third-party vendors. Possible Issues for Congress Regulation aimed at banks' relationships with third-party vendors such as TSPs has benefits in mitigating operational risks but imposes costs on banks that want to utilize available technologies. Banks, particularly community banks and small credit unions, may find it difficult to comply with regulator standards applicable to third-party vendors. For example, certain institutions may lack sufficient expertise to conduct appropriate diligence when selecting TSPs or to structure contracts that adequately protect against the risks TSPs may present. Some banks may also lack the resources to monitor whether the TSPs are adhering to GLBA and other regulatory or contract requirements. In addition, regulatory compliance costs are sometimes cited as a factor in banking industry consolidation, because compliance costs may be subject to economies of scale that incentivize small banks to merge with larger banks or other small banks to combine their resources to meet their compliance obligations. For more detailed examination of this issue, see CRS In Focus IF10935, Technology Service Providers for Banks , by Darryl E. Getter. Consumer Electronic Payments92 Consumers have several options to make electronic, noncash transactions, as shown in Figure 2 . For instance, consumers can make purchases by swiping, inserting, or tapping a card to a payment terminal; they can store their preferred payment information in a digital wallet; or they can use an app to scan a barcode on a mobile phone that links to a payment of their choice. Merchants also enjoy electronic payments innovations that allow them to accept a range of payment types while limiting the need to manage cash. Despite the technology surrounding noncash payments, electronic payment networks eventually run through the banking system. Accessing these systems typically involves paying fees, which may be burdensome on certain groups. For instance, while most Americans have a bank account, a 2017 survey found that almost a third of those who left the banking system did so because of fees associated with their account. While some services, such as prepaid cards, allow individuals to make electronic payments without bank accounts, these options also often involve fees. As a result, cash payments may be the most affordable payment option for certain groups. Possible Issues for Congress If electronic payment methods significantly displace cash as a commonly accepted form of payment, that evolution could have both positive and negative outcomes. Proponents of reducing cash use argue that doing so will generate important benefits, such as reducing the costs associated with producing, transporting, and protecting cash. Conversely, opponents of reducing cash usage and acceptance argue that doing so would further marginalize people with limited access to the financial system. Although consumers tend to prefer using debit cards and credit cards, cash maintains an important role in retail payments and person-to-person (P2P) transfers, especially for smaller transactions and lower-income households. Electronic payments and cash displacement have various implications for the security and privacy of consumers and merchants. For example, not having cash on store premises can reduce the risk of theft while increasing fees paid to payment card processors. Similarly, consumers may be denied services if they only use cash, but if they transition to electronic payments, the privacy offered by cash transactions' anonymous nature is eroded. Further, as more transactions occur over electronic payment systems, the data processed in these transactions are exposed to cybersecurity attacks. Policymakers may examine whether they should encourage or discourage an evolution away from cash based on their assessments of such a change's benefits and costs. For more information on this topic, see CRS Report R45716, The Potential Decline of Cash Usage and Related Implications , by David W. Perkins. Real-Time Payments97 There are several steps in the process of completing a payment, involving multiple systems run by various actors. End user payment services accessed by consumers and retailers are only run by the private sector. On the other hand, bank-to-bank payment messaging, clearing, and settlement can currently be executed through systems run privately or by the Federal Reserve. The processing of these bank-to-bank electronic payments currently results in payment settlement occurring hours later or on the next business day after a payment is initiated. However, advances in technology have made systems featuring real-time payments (RTP)âpayments that settle almost instantaneouslyâpossible. The Federal Reserve plans to introduce an RTP system called FedNow in 2023 or 2024. FedNow would be "a new interbank 24x7x365 real-time gross settlement service with integrated clearing functionality to support faster payments in the United States" that "would process individual payments within seconds ... (and) would incorporate clearing functionality with messages containing information required to complete end-to-end payments, such as account information for the sender and receiver, in addition to interbank settlement information." FedNow is to be available to all financial institutions with a reserve account at the Federal Reserve. It will require banks using FedNow to make funds transferred over it available to their customers immediately after being notified of settlement. Several private-sector initiatives are also underway to implement faster payments, some of which would make funds available to the recipient in real time (with deferred settlement) and some of which would provide real-time settlement. Notably, the Clearing House introduced its RTP network (with real-time settlement), which is jointly owned by its members (a consortium of large banks), in November 2017; according to the Clearing House, it currently "reaches 50% of U.S. transaction accounts, and is on track to reach nearly all U.S. accounts in the next several years." Possible Issues for Congress According to Federal Reserve Chair Jerome Powell, "the United States is far behind other countries in terms of having real-time payments available to the general public." Businesses and consumers would benefit from the ability to receive funds more quickly, particularly as a greater share of payments are made online or using mobile technology. A faster payment system may provide certain other benefits for low-income or liquidity-constrained consumers (colloquially, those living "paycheck to paycheck") who may more often need access to their funds quickly. In particular, many lower-income consumers say that they use alternative financial services, such as check cashing services and payday loans, because they need immediate access to funds. Faster payments may also help some consumers avoid checking account overdraft fees. Note, however, that some payments that households make would also be cleared fasterâdebiting their accounts more quicklyâthan they are in the current system, which could be harmful to some households. The main policy issue regarding the Federal Reserve and RTP is whether Federal Reserve entry in this market is desirable. Some stakeholders question whether the Federal Reserve can justify creating a RTP system in the presence of competing private systems. They fear that FedNow will hold back or crowd out private-sector initiatives already underway and could be a duplicative use of resources. The Treasury Department supports Federal Reserve involvement on the grounds that it will help private-sector initiatives at the retail level. Others, including many small banks , fear that aspects of payment and settlement systems exhibit some features of a natural monopoly (because of network effects), and, in the absence of FedNow, private-sector solutions could result in monopoly profits or anticompetitive behavior, to the detriment of financial institutions accessing RTPs and their customers (merchants and consumers). From a societal perspective, it is unclear whether it is optimal to have a single provider or multiple providers in the case of a natural monopoly, particularly when one of those competitors is governmental. Multiple providers could spur competition that might drive down user costs, but more resources are likely to be spent on duplicative infrastructure. RTP competition between the Federal Reserve and the private sector also has mixed implications for other policy goals, including innovation, ubiquity, interoperability, equity, and security. For more information on this topic, see CRS Report R45927, U.S. Payment System Policy Issues: Faster Payments and Innovation , by Cheryl R. Cooper, Marc Labonte, and David W. Perkins. Cryptocurrency114 Cryptocurrencies are digital money in electronic payment systems that generally do not require government backing or the involvement of an intermediary, such as a bank. Instead, system users validate payments using public ledgers that are protected from invalid changes by certain cryptographic protocols. In these systems, individuals establish an account identified by a string of numbers and characters (often called an address or public key ) that is paired with a password or private key known only to the account holder. A transaction occurs when two parties agree to transfer digital currency (perhaps in payment for a good or service) from one account to another. The buying party will unlock the currency used as payment with her private key, allowing some amount to be transferred from her account to the seller's. The seller then locks the currency in her account using her own private key. From the perspective of the individuals using the system, the mechanics are similar to authorizing payment on any website that requires an individual to enter a username and password. In addition, companies offer applications or interfaces that users can download onto a device to make transacting in cryptocurrencies more user-friendly. Individuals can purchase cryptocurrencies on exchanges for traditional government-issued money like the U.S. dollar (see Figure 3 ) or other cryptocurrencies, or they can earn them by doing work for the cryptocurrency platform. Many digital currency platforms use blockchain technology to validate changes to the ledgers. In a blockchain-enabled system, payments are validated on a public or distributed ledger by a decentralized network of system users and cryptographic protocols. In these systems, parties that otherwise do not know each other can exchange something of value (i.e., a digital currency) because they trust the platform and its protocols to prevent invalid changes to the ledger. Cryptocurrency advocates assert that a decentralized payment system operated through the internet could be faster and less costly than traditional payment systems and existing infrastructures. Whether such efficiencies can or will be achieved remains an open question. However, the potential for increased payment efficiency from these systems is promising enough that certain central banks have investigated the possibility of issuing government-backed, electronic-only currenciesâcalled central bank digital currencies (CBDCs)âin such a way that the benefits of certain alternative payment systems could be realized with appropriately mitigated risk. How CBDCs would be created and function are still matters of speculation at this time, and the possibility of their introduction raises questions about central banks' appropriate role in the financial system and the economy. Possible Issues for Congress Whether cryptocurrencies are appropriately regulated is an open question. Cryptocurrency proponents argue that regulation should not stifle the development of a potentially beneficial payment system, while opponents argue that regulation should protect against criminals using cryptocurrency to evade or hide their activities from authorities, or consumers potentially suffering losses from an untested technology. For anti-money laundering purposes, cryptocurrency regulation occurs at the exchanges that allow people to buy and sell cryptocurrencies either for government-backed fiat currencies or other cryptocurrencies. Generally, these exchanges must register as money transmitters at the state level and must report to the U.S. Treasury's Financial Crimes Enforcement Network as money services businesses at the federal level, and are subject to the applicable anti-money laundering requirements those types of companies face. However, cryptocurrency critics warn that their pseudonymous, decentralized nature nevertheless provides a new avenue for criminals to launder money, evade taxes, or sidestep financial sanctions. Consumer groups and other commentators are also concerned that digital currency users are inadequately protected against unfair, deceptive, and abusive acts and practices. The way cryptocurrencies are sold, exchanged, or marketed can subject cryptocurrency exchanges or other cryptocurrency-related businesses to generally applicable consumer-protection laws, and certain state laws and regulations are being applied to cryptocurrency-related businesses. However, other laws and regulations aimed at protecting consumers engaged in electronic financial transactions may not apply. For example, the Electronic Fund Transfer Act of 1978 (EFTA; P.L. 95-630 ) requires traditional financial institutions engaging in electronic fund transfers to make certain disclosures about fees, correct errors when identified by the consumer, and limit consumer liability in the event of unauthorized transfers. Because no bank or other centralized financial institution is involved in digital currency transactions, EFTA generally has not been applied to these transactions. Finally, some central bankers and other experts and observers have speculated that widespread cryptocurrency adoption could affect the ability of the Federal Reserve and other central banks to implement and transmit monetary policy, if one or more additional currencies that were not subject to government supply controls were also prevalent and viable payment options. For more information on these issues, see CRS Report R45427, Cryptocurrency: The Economics of Money and Selected Policy Issues , by David W. Perkins; CRS Report R45116, Blockchain: Background and Policy Issues , by Chris Jaikaran; and CRS Report R45664, Virtual Currencies and Money Laundering: Legal Background, Enforcement Actions, and Legislative Proposals , by Jay B. Sykes and Nicole Vanatko. Capital Formation: Crowdfunding and ICOs125 Financial innovation in capital markets has generated new forms of fundraising for firms, including crowdfunding and initial coin offerings . Crowdfunding involves raising funds by soliciting investment or contributions from a large number of individuals, generally through the internet. Initial coin offerings (ICO) raise funds by selling digital coins or tokensâgenerally created and transferred using blockchain technologyâto investors; the coins or tokens allow investors to access, make purchases from, or otherwise participate in the issuing company's platform, software, or other project. In cases where crowdfunding and ICOs meet the legal definition of a securities offering, they are subject to securities law and regulation by the Securities and Exchange Commission (SEC). Four kinds of crowdfunding exist: (1) donation crowdfunding, where contributors give money to a fundraising campaign and receive in return, at most, an acknowledgment; (2) reward crowdfunding, where contributors give to a campaign and receive in return a product or a service; (3) peer-to-peer lending crowdfunding, where investors offer a loan to a campaign and receive in return their capital plus interest; and (4) equity crowdfunding, where investors buy stakes in a company and receive in return company stocks. Donation and reward crowdfunding are relatively lightly regulated because contributors are in effect giving without expectation of gaining anything of monetary value in return or preordering a product, respectively. Equity crowdfunding may meet the criteria of a securities offering, and in such cases it is subject to SEC regulation, as are certain peer-to-peer lending arrangements in which a security is issued. ICOs are a relatively new approach to raising capital. A typical ICO transaction involves the issuer selling new digital coins or tokensâalso referred to as digital assets or, in cases in which they qualify as securities, digital asset securities âto individual or institutional investors. Investors can often pay in traditional fiat currencies (e.g., U.S. dollars) or cryptocurrencies (e.g., Bitcoin, Ethereum) pursuant to the terms of each individual ICO. ICOs are often compared with the traditional financial world's initial public offerings (IPOs) because both are methods companies use to acquire funding. The main difference is that IPO investors receive an equity stake representing company ownership, rather than a digital asset. Coin or token purchasers can generally redeem the coins for goods or services from the issuing enterprise, or hold them as investments in the hope that their value will increase if the company is successful. Although every ICO is different, issuers are generally able to make transfers without an intermediary or any geographic limitation. Possible Issues for Congress Policymakers are now considering whether these new innovations fit well within the existing regulatory framework, or whether the framework should be adapted to address the risks and benefits that they pose. In general, policymakers and regulators have attempted to provide regulatory clarity and investor protection without hindering financial innovation and technological advancements. Currently, equity crowdfunding debates typically involve questions over how broadly crowdfunding exemptions from certain SEC registration requirements should be applied. Generally, public equity offerings, such as stock issuances, involve a number of costs, including paying an investment bank to price the stock and find investors. In addition, the offering must be registered with the SEC and the company must disclose certain information to investors. Crowdfunding may be less costly than traditional public offerings in certain respects and thus might present a new avenue for small businesses without the resources or expertise to complete a traditional IPO to raise funds. In 2012, Title III of the Jumpstart Our Business Startups Act (JOBS Act; P.L. 112-106 ) created an exemption from registration for internet-based securities that made offerings of up to $1 million (inflation-adjusted) over a 12-month period. Certain companies that are still relatively small by some measures may nevertheless not qualify for the exemption, and certain of those companies may find the costs of raising funds through an equity issuance prohibitively high. Title III includes certain investor protection provisions, including limitations on investors' investment amounts and issuer disclosure requirements. However, exempting an issuer from registration may weaken investor protections. Thus, what the appropriate criteria should be to allow an equity crowdfunding issuer to forego registration requirements is a matter of debate. Regarding ICOs, issuers and investors face varying degrees of uncertainty when determining how or if securities laws and regulations apply to them. It may not always be clear whether a digital asset is a security subject to SEC regulation. Meanwhile, ICO and digital asset investorsâwhich may include less-sophisticated retail investors, who may not be positioned to comprehend or tolerate high risksâmay be especially vulnerable to new types of fraud and manipulation, leading to questions about whether investor protections in this area are adequate. There appear to be high levels of ICO scams and business failures. For example, one 2018 study from the ICO advisory firm Satis Group found that 81% of ICOs are scams and another 11% fail for operational reasons. Digital assets may be an attractive method for scammers since transactions in digital assets do not have the same protections as traditional transactions. For example, banks can delay, halt, or reverse suspicious transactions and link transactions with user identity, while many digital asset transactions are generally irreversible. The SEC has taken initiatives to address some of these issues. In September 2017, the SEC established a new Cyber Unit and increased its monitoring of and enforcement actions against entities engaged in digital asset transactions. Since that time, the SEC has increased the frequency of enforcement actions against issuersâthe end recipients of ICO fundingâas well as market intermediaries (i.e., broker-dealers and investment managers). In addition to the enforcement activities against entities for noncompliance with securities regulations, the SEC has obtained court orders to halt allegedly fraudulent ICOs. For more information on these issues, see CRS Report R46208, Digital Assets and SEC Regulation , by Eva Su; CRS Report R45221, Capital Markets, Securities Offerings, and Related Policy Issues , by Eva Su; and CRS Report R45301, Securities Regulation and Initial Coin Offerings: A Legal Primer , by Jay B. Sykes. High-Frequency Securities and Derivatives Trading153 Although, there is no universal legal or regulatory definition of high-frequency trading (HFT), the term generally refers to a subset of algorithmic trading in financial instruments, such as equity securities, derivatives, and cryptocurrencies, that is conducted by supercomputers executing trades within microseconds or milliseconds. It has grown substantially over the past 15 years and currently accounts for roughly 50% to 60% of the trading volume in domestic equity markets. Depending on trading strategy and market conditions, evidence suggests that HFT in some cases can have either certain positive effects on market quality (e.g., increased liquidity, smaller spreads, decreased short-term volatility, and improved price discovery) or certain negative effects (e.g., decreased liquidity, higher volatility, and higher transaction costs for certain investors). Generally, traders who employ HFT strategies are attempting to earn a small profit per trade on a huge number of trades. This is achieved through automated trading by computers programmed to execute certain kind of trades in response to specific market data and involves rapid order placement. Broadly speaking, these strategies can be categorized as passive or aggressive strategies. Passive strategies include arbitrage trading âattempts to profit from price differentials for the same stocks or their derivatives traded on different trading venues; and passive market making , in which profits are generated by spreads between the difference or the spread between the prices at which securities are bought and sold. Aggressive strategies include those known as order anticipation or momentum ignition strategies. Regulators have been scrutinizing HFT practices for years. The SEC oversees HFT and other trading in the securities markets and the more limited securities-related derivatives markets that it regulates. The CFTC oversees any HFT, along with other types of trading, in the derivatives markets it regulates. These markets include futures, swaps, and options on commodities and most financial instruments or indices, such as interest rates. Possible Issues for Congress HFT's supporters argue that by quickly executing many trades, often in response to a perceived price inefficiency, HFT improves market quality in a number of ways. Surveys of empirical research suggest that in both equity and foreign exchange markets, HFT appears to have narrowed bid-ask spreads, bolstered market liquidity, reduced some measures of price volatility, and improved the price discovery process. Some commentators argue that HFT is just the latest technological innovation in a financial activity that has a long history of coevolution with technology, and that market participants and regulators are well practiced at incorporating such innovations. Some studies suggest, however, that aggressive HFT strategies should be a matter of public policy concern. Such strategies arguably share similarities to practices such as front-running (when an entity conducts a securities trade while knowing of a future transaction that will have an effect on the price of the securities being traded) and spoofing (offering to buy or sell securities with an intent to cancel the bid or offer before execution), both of which can be illegal. In addition, regulators have expressed concerns over whether certain aggressive HFT strategies may be associated with increased market fragility and volatility, such as that demonstrated in the Flash Crash of May 6, 2010, in which the Dow Jones Industrial Average (DJIA) fell by roughly 1,000 points (and then rebounded) in intraday trading. Arguably the most ambitious market surveillance project in SEC history, the ongoing implementation of Consolidated Audit Trail (CAT) is a direct response to the perceived dearth of market data available during the regulatory analysis of the Flash Crash's causes and the role HFT traders played during that event. First approved by the SEC in 2012, CAT is planned as a single data repository that will consolidate trade orders, trade quotes (the most recent prices at which a trade on a particular stock was executed), and general trade data across domestic equities and options markets. According to then-SEC Chair Mary Jo White, by virtue of CAT "[R]egulators will have more timely access to a comprehensive set of trading data, enabling us to more efficiently and effectively conduct research, reconstruct market events, monitor market behavior, and identify and investigate misconduct." The system, which has raised some cybersecurity concerns, has also earned prospective praise as a tool that will make HFT more transparent, broadening what the SEC will be able to see as it surveils such trades. CAT phase-in began in late 2019, and it is projected to be fully operational in 2022. Policymakers have taken a number of other actions in recent years to address concerns related to HFT. Whether these strike the appropriate balance between fostering HFT's potential benefits while appropriately mitigating risks associated with it is an open question. For example, the SEC and CFTC have either approved or not opposed requests by several securities exchanges (including the NYSE American, the IEX, and the gold and silver futures markets at ICE Futures U.S.) to adopt trading delay mechanisms aimed at removing HFT traders' speed advantages. For more information on these issues, see CRS Report R44443, High Frequency Trading: Overview of Recent Developments , by Rena S. Miller and Gary Shorter; and CRS Report R43608, High-Frequency Trading: Background, Concerns, and Regulatory Developments , by Gary Shorter and Rena S. Miller. Asset Management167 Asset management companies pool money from various individual or institutional investor clients and invest the funds on their behalf for financial returns. The SEC is the asset management industry's primary regulator. The asset management industry is increasingly using fintech to conduct investment research, perform trading, and enhance its client services. A prominent example is the proliferation of robo - advisor services, in which automated programs give investment advice to clients. There is also potential to apply artificial intelligence and machine learning within asset management, both in robo-advisory services and other functions such as risk management, regulatory compliance, and trading and portfolio management. Another notable development in the industry is that some large, prominent technology companies have begun to offer asset management services and partner with incumbent asset managers. The term robo adviser generally refers to an automated digital investment advisory program offering asset management services to clients through online algorithmic-based platforms, such as websites or mobile applications. The main differences between human and robo advisers are the amount of human interaction available to investors and the reliance on algorithmic-based platforms for providing financial advice. The potential benefit of this technology is that robo advisers may be able to serve more customers at lower costs than human advisors, thus potentially enabling more affordable consumer access to investment advisory services. Robo advising is a fast-growing segment of the investment management industry. According to one report, direct-to-consumer robo-advisory platforms reached $257 billion in size at the end of 2018 and are projected to have $1.26 trillion in assets under management by 2023. As mentioned above, big tech firms like Amazon, Facebook, Google, and Apple have started financial services operations as potential competitors and partners to the asset management industry. These types of companies could provide investment management through their widely used platforms, potentially disrupting the asset management industry. The potential of big tech asset management platforms has already been realized in certain overseas markets. For example, Ant Financial, an affiliate of Alibaba Group, now manages the world's largest money market mutual fund of $168 billion as of year-end 2018, with a third of the Chinese population, or 588 million Alipay users, already invested in the fund. Possible Issues for Congress In general, robo advisers present similar policy issues as all asset managers do related to striking the right balance between protecting investors and mitigating risks while allowing for innovation, appropriately informed risk taking, and financial returns. However, robo advising could also present additional policy considerations. Some observers have expressed concerns that robo advisers may cause risks and excess volatility if they result in herding , in which very large numbers of investors are all directed to the same investments at the same time. AI- or machine learning-enabled robo advising could also be subject to policy concerns related to black box algorithm-based decisionmaking, wherein it is not entirely clear how computer programs have assessed risks or arrived at decisions, and so are effectively unexplainable and unauditable. Some observers are also concerned about the assignment of responsibilities when large losses in an AI-recommended investment occur. For example, questions surround how to assign blame if an investment loss occurred through an AI-based systemâshould the designer of the AI system or the investment manager incorporating its use bare the blame and penalty? If asset management continues to become increasingly automated, policymakers may weigh these risks and concerns against possible benefits, such as reduced cost and increased access. Insurance178 Fintech's application to insurance offers a similar potential transformation in the insurance industry as in other aspects of financial services. Fintech could affect insurance throughout the business, including insurance products, underwriting, claims, and marketing, and across all lines of insurance (life, health, and property and casualty [P&C]). Potential aspects of insurtech include peer-to-peer insurance, Big Data, artificial intelligence, blockchain, mobile technology, and insurance on demand. Specific examples could include life or health insurers offering discounts for people wearing devices that track activity and fitness; auto insurers offering discounts for cars that include telematics devices tracking drivers' behavior; and insurers scanning social media as an underwriting tool or to detect fraud. In 2017, the fastest-growing P&C insurer by direct premiums written was an auto insurer, Metromile Insurance, offering per-mile insurance with a telematics tracker. In 2018, the fastest-growing P&C insurer was Root Insurance, also a telematics-based auto insurer, and the second-fastest growing was Lemonade Insurance, a homeowners and renters insurer using technology like chatbots and AI to sell and service policies. Unlike banks or securities firms, the primary regulators for insurers are the individual states. An insurer is required to obtain a charter or license in every state in which it operates. The states coordinate insurance regulatory policies through the National Association of Insurance Commissioners (NAIC) and have been active in addressing issues raised by technology. In 2017, NAIC created an NAIC Insurance and Technology task force and adopted a model law relating to insurer data security. A U.S. Department of the Treasury report specifically encouraged states to adopt the model law and, as of August 4, 2019, seven states had adopted the model with another state considering adoption. All 50 state insurance regulators have identified a specific point of contact for "InsurTech, Innovation & Technology" in order to introduce the regulatory process for new entrants. Possible Issues for Congress The state regulatory system for insurance originated following a Supreme Court decision in 1868, but since a further decision in 1944, its foundation has been statutory, not constitutional. The 1945 McCarran-Ferguson Act generally provides for a state-based system, but Congress can enact laws overriding the states and has done so on a number of occasions. Congress has also conducted oversight on specific aspects of the insurance regulatory system and encouraged the states to act on issues without enacting specific statutes at the federal level. Given the breadth of technology's potential impact on insurance, Congress might question numerous aspects of the states' approach to the new technology, including the impact on consumers and the potential for regulatory arbitrage between the federal regulatory approach for banks and securities firms and the state regulatory approach for insurers. Risk Management and Regtech187 Risk-management and compliance functions in financial firms frequently rely on data analysis to assess the risk of bad outcomes, such as wrongdoing or financial losses. For example, in anti-money laundering compliance, financial firms are required to file suspicious activity reports (SARs) when transactions by a customer appear potentially to be tied to illicit crime, fraud, money laundering, terrorist financing, or other transgressions. In addition, banks may also be subject to requirements involving stress testing, modeling risks, forecasting, and monitoring employees and internal risk (e.g., the probability that a risky trade under consideration could imperil a bank's capital or liquidity positions). Regulators also must monitor for certain risks or unfolding events (e.g., securities markets regulators trying to detect illegal trading practices). Companies are increasingly using innovative technology in these risk management and regulatory compliance activities. Sometimes in the latter case, the technology is referred to as regtech . Algorithms are especially well suited to sifting through, analyzing, and identifying patterns in large data sets, and so potentially could be used in these risk assessment and compliance functions. Algorithms' increased sophistication and the development of machine learning and artificial intelligence have fueled strong interest in the financial industry in further using these technologies to automate risk-management and compliance functions. For example, FINRA predicts that such tools will help with anti-money laundering processes; surveilling internal firm employees involved in placing trades on a firm's behalf; broker-dealer trade execution for customers; ensuring customer data privacy and preventing security risks; and centralizing supervisory control systems for additional risk management. In large part, the goal of cost savings is driving the development and adoption of automation in compliance. Some financial firms argue that because they are relatively more regulated than firms in other industries, they must deploy automation wherever possible to reduce compliance costs and remain profitable and competitive. Certain industry observers predict that the cost of processes that involve prediction will drop in coming years and the accuracy of automated prediction processes will continue to increase. However, exactly how these technologies will develop and be deployed in regulatory compliance, and what outcomes they will produce if deployed, remains to be seen. Possible Issues for Congress The possibility that automation's ability to identify risks and suspect behaviors may surpass that of humans in certain cases raises questions over the role and power existing human compliance officials should have in deciding whether to take actions against individuals or institutions. While automation could more efficiently collect and act on information, individuals may be uncomfortable that their transactions and private information could be instantly reported to the government or their financial situation affected through a process that involved no human judgement or oversight. For example, should a human have to file a SAR about a customer to the Treasury Department, or should the filing of such reports be completely automated? To take this example a step further, should the decision to close a customer's account be fully automated as well? Regtech tools also raise similar privacy and cybersecurity risks as the other technologies discussed in this report. After all, certain regtech programs involve the automated monitoring of individuals' and private companies' financial transactions, flagging some of those transactions as suspicious, and reporting those transactions to government agencies. Policymakers may consider under what circumstances certain regtech processes inappropriately impinge on people's privacy. To the extent that certain processes or functions can be automated to achieve greater regulatory efficiency or effectiveness, questions exist concerning whether regulators need to be more active in deploying compliance technologies themselves and allowing the institutions they regulate to do so. For example, the American Bankers Association lists "regulator buy-in" as one of the challenges to such adoption. Potential Regulatory Approaches192 Given that most of the federal financial regulatory framework was created prior to the development and deployment of many recent technologies, fintech companies often face uncertainty over howâor whetherâexisting federal laws and regulations may apply to them or their products. Thus, policymakers may consider ways to reduce regulatory uncertainty and integrate fintech into the regulatory framework. This often involves balancing efforts to encourage innovation while protecting consumers and the financial system from excessive risk. Many still-evolving terms are used to describe different programs regulators have implemented or proposed to address fintech uncertainty. Such programs are often informally called sandboxes or greenhouses . Generally, such programs use at least one of a variety of approaches. One such approach involves fostering communication between fintech firms and regulators. Communication can help these firms better understand how regulators view a developing technology and potential regulatory concerns. Communication also helps make regulators aware of new fintech innovations when developing new or interpreting existing regulations. As discussed below, certain regulators have established offices within their organizations to conduct outreach to fintechsâincluding maintaining outreach websites, participating in fintech conferences, and organizing office hours with fintech firms. In another approach, some regulators have announced research collaborations with fintech firms to improve their understanding of new products and technologies. Such initiatives could include jointly designing a research trial or fintech firms sharing data about their product performance with regulators. Another potential approach policymakers may use if they determine that particular regulations are unnecessarily burdensome or otherwise ill-suited to a particular technology is to exempt companies or products that meet certain criteria from such regulations. Similarly, a regulator could issue a no-a ction letter âan official communication stating a regulator does not expect to take enforcement actions in certain situations. Regulators will often only provide such special regulatory treatment to companies that first demonstrate that consumers will not be exposed to undue harm or meet other conditions, like agreeing to share data with regulators for research purposes. Regulatory uncertainty can be resolved if regulators offer or require certain fintech firms to enter a regulatory regime with well-defined permissions, restrictions, and responsibilities. For example, a regulator could offer or require a specific charter or license for certain firms. Financial regulators have begun to implement some of these approaches through a number of rulemakings and by establishing programs and offices and taskforces within agencies. For a detailed examination of these initiatives, see CRS Report R46333, Fintech: Overview of Financial Regulators and Recent Policy Approaches , by Andrew P. Scott. Possible Issues for Congress The regulatory approaches described above could be supported or opposed by various stakeholders depending on how they are designed and implemented and which firms or products are affected. For example, while fintech firms may want to reduce regulatory uncertainty and operate under one set of rules nationally (rather than different rules in each state), they may also oppose new or additional data-reporting requirements. Incumbent financial institutions may argue that regulatory tailoring and exemptions for fintech firms would put incumbents at a competitive disadvantage. State regulators and consumer advocates may oppose any federal charter that would preempt state consumer-protection laws. Congress or financial regulators may consider various regulatory approaches. Policymakers choosing to tailor regulation for fintechs could apply a different regulatory treatment either to companies or to products. If the goal is to provide new, inexperienced firms an opportunity to learn how they and their products would be regulated, institution-based regulation for firms meeting criteria associated with start-up companies may be the better option. But if the goal is to integrate a new technology regardless of the size or sophistication of the firm offering it, the differentiated regulatory treatment could apply to the product rather than the firm. Policymakers could also choose to tailor regulation for fintechs meeting certain objective criteria. Alternatively, regulators could use discretion in determining which fintech companies or products would qualify for such tailoring, potentially based on authorities or directions enacted in legislation. Policymakers may also consider how long to apply a particular regulatory treatment to a fintech company or product. For example, a specific charter could last indefinitely, while an exemption or no-action letter might last for only a finite period. For more information on these issues, see CRS Report R46333, Fintech: Overview of Financial Regulators and Recent Policy Approaches , by Andrew P. Scott; and CRS In Focus IF11195, Financial Innovation: Reducing Fintech Regulatory Uncertainty , by David W. Perkins, Cheryl R. Cooper, and Eva Su. Appendix. CRS Fintech Products Cybersecurity CRS Report R44429, Financial Services and Cybersecurity: The Federal Role , by N. Eric Weiss and M. Maureen Murphy. CRS Report R45631, Data Protection Law: An Overview , by Stephen P. Mulligan, Wilson C. Freeman, and Chris D. Linebaugh. CRS In Focus IF10559, Cybersecurity: An Introduction , by Chris Jaikaran. Lending CRS Report R44614, Marketplace Lending: Fintech in Consumer and Small-Business Lending , by David W. Perkins. CRS Report R45726, Federal Preemption in the Dual Banking System: An Overview and Issues for the 116th Congress , by Jay B. Sykes. Payments CRS Report R45927, U.S. Payment System Policy Issues: Faster Payments and Innovation , by Cheryl R. Cooper, Marc Labonte, and David W. Perkins. CRS Report R45716, The Potential Decline of Cash Usage and Related Implications , by David W. Perkins. Banks and Third-Party Vendor Relationships CRS In Focus IF10935, Technology Service Providers for Banks , by Darryl E. Getter. Cryptocurrency and Blockchain-Based Payment Systems CRS Report R45427, Cryptocurrency: The Economics of Money and Selected Policy Issues , by David W. Perkins. CRS Report R45116, Blockchain: Background and Policy Issues , by Chris Jaikaran. CRS Report R45664, Virtual Currencies and Money Laundering: Legal Background, Enforcement Actions, and Legislative Proposals , by Jay B. Sykes and Nicole Vanatko. CRS In Focus IF10824, Financial Innovation: "Cryptocurrencies" , by David W. Perkins, Financial Innovation: "Cryptocurrencies", by David W. Perkins. Digital Assets and Capital Formation CRS Report R46208, Digital Assets and SEC Regulation , by Eva Su. CRS Report R45221, Capital Markets, Securities Offerings, and Related Policy Issues , by Eva Su. CRS Report R45301, Securities Regulation and Initial Coin Offerings: A Legal Primer , by Jay B. Sykes. CRS In Focus IF11004, Financial Innovation: Digital Assets and Initial Coin Offerings , by Eva Su. High-Frequency Securities and Derivatives Trading CRS Report R44443, High Frequency Trading: Overview of Recent Developments , by Rena S. Miller and Gary Shorter. CRS Report R43608, High-Frequency Trading: Background, Concerns, and Regulatory Developments , by Gary Shorter and Rena S. Miller. Regulatory Approaches and Issues for Congress CRS Report R46333, Fintech: Overview of Financial Regulators and Recent Policy Approaches , by Andrew P. Scott. CRS In Focus IF11195, Financial Innovation: Reducing Fintech Regulatory Uncertainty , by David W. Perkins, Cheryl R. Cooper, and Eva Su.