Go back to menu

EBA Reports on the impact of FinTech on incumbent credit institutions' business models and the prudential risks and opportunities arising for institutions from FinTech

How incumbent firms are changing their business models

11 July 2018

On 3 July 2018, the European Banking Authority (EBA) published two reports addressing some of the priorities set out in its FinTech Roadmap. The Impact Report provides an overview of the current FinTech landscape and considers how FinTech is changing banks' business models. The Risk Report analyses the potential risks and opportunities for institutions in embracing innovative new technology, focusing on seven specific FinTech use cases.

In preparing the Impact Report the EBA made use of a number of different sources of information. These include industry feedback on the EBA's Discussion Paper on FinTech, discussions and interviews with 15 EU credit institutions (mainly globally systemically important institutions or other systemically important institutions), answers to the October/November 2017 EBA Risk Assessment Questionnaire provided by 37 European banks, discussions with a number of competent authorities and desk research.

Five Key Takeaways

The five key takeaways from the Impact Report and Risk Report are:

  • Incumbent firms are changing their business models in two ways: digital transformation is internally driven and aims to digitalise existing processes and digital disruption is driven by competitive forces and aims to create a new market for financial services.
  • The changes to incumbents' business models are often made alongside changes to governance, culture and operational processes.
  • Incumbents engage with FinTech in a variety of ways, the most popular of which is partnering with new entrant FinTech firms.
  • Engagement with FinTech firms can alter incumbents' risk profiles either by creating new risks or potentially amplifying existing risks.
  • Engagement with FinTech firms also creates opportunities for incumbents to improve security, reduce costs and administrative burden and improve the customer experience.
Key drivers of incumbents' changing business models

Incumbent institutions see FinTech as a way to increase revenue and expand their customer base. The Impact Report identifies four key drivers that are shaping and inducing changes in incumbents' business models. These are changing customer expectations, profitability concerns, increasing competition, and regulatory changes.

Customers increasingly expect quick and easy access to financial services through intuitive interfaces. In practice this can mean institutions are required to provide customers with 24/7 access, moving beyond the traditional branch model and emphasising mobile applications and communications. One of the biggest advantages that incumbent institutions possess is the loyalty of their customers. However, the customers increasingly use daily banking, payment or investment services provided by new entrants and FinTech companies and increased customer mobility will be a significant driving force in the future.

Incumbents are also under pressure as a result of low profitability, largely driven by the current low interest rate environment. This factor has led incumbents to use digitalisation to increase efficiency and reduce costs, as well as to close physical branches in an attempt to both reduce costs and adapt to changes in customers' needs.

New entrants, such as FinTech firms and technology providers (including BigTech - As defined by the Basel Committee on Banking Supervision), put competitive pressure on incumbents to adapt and innovate. Regulatory changes have also affected the competitive environment. For example PSD2 allows new entrants to access data and systems traditionally only available to incumbents. Separately, new requirements under PSD2 and GDPR pose challenges for all players in the FinTech landscape from technological, operational and strategy perspectives.

Key approaches to FinTech and implementation of technology-based projects

When analysing incumbent institutions' engagement with FinTech, the Impact Report differentiates between digital transformation and digital disruption.

  • Digital transformation is largely driven by internal factors and typically accompanies organisational change. It involves transforming internal processes with the aim of reducing operating costs and increasing efficiency. Such programmes often run in parallel with cost-cutting programs such as physical branch closures.
  • Digital disruption, on the other hand, is driven by competitive forces and aims to use technology to develop a new market in banking, satisfying customer needs and finding new streams of revenue. Some incumbents have chosen to disrupt their own businesses by launching new digital banks, whereas others have sought to transform into a digital bank.

To implement new technology projects many incumbents are moving away from their traditional waterfall / pipeline approach by introducing an agile, iterative and team-based approach, enabling rapid delivery. Incumbents increasingly make use of internal innovation labs and accelerators.

Two key areas for incumbents are the changes in governance and culture needed to support technological innovation. Incumbents tend to establish two dedicated innovation teams: the first dedicated to the overall strategic investment in FinTech firms (such as start-ups) and the second responsible for the development of innovative technological solutions, either with or without the participation of external parties. The latter team is usually comprised of technology experts and is supported by other key functions such as legal and compliance. Some institutions also make use of advisory panels of appointed technology experts to support their technological innovation.

Incumbents aim to foster an innovation-friendly environment with some appointing a digital champion in each team, responsible for driving digital transformation. However, some incumbents consider the current mindset within their institution to be an impediment to the implementation of their innovation strategies. Another potential impediment in some institutions is a lack of appropriate human resources, skills and expertise.

Two main approaches are seen for financial planning and budgeting for innovation-related expenditure. Incumbents use either a single budget or two separate budgets, with one dedicated to digital transformation projects and a second dedicated to FinTech investment or digital disruption. The latter tends to have a flexible funding model where ad hoc funding is requested and justified to the board when needed. Despite measuring and monitoring being embedded in the existing internal processes of most incumbents, some struggle to quantify the benefits from investment in FinTech.

Methods of Interaction with FinTech

The Impact Report finds that incumbents interact with FinTech using four different approaches. The approaches are not mutually exclusive and incumbents may engage in all four at once. However the level and pace of FinTech development varies across the EU and the level of engagement by incumbents with FinTech can depend on, or be restricted by, the speed of FinTech development in the jurisdictions in which the incumbents operate.

Partnering with new entrant FinTech firms

This is the predominant mode by which incumbents interact with FinTech, with 95% of firms surveyed stating that they had an ongoing relation with FinTech firms. Institutions tend to engage with selected FinTech firms whose business aligns with their innovation strategy. Both incumbents and new entrant FinTech firms are keen to form partnerships. Smaller new entrant firms offer innovation and expertise and incumbents provide finance and market reach, along with, frequently, dedicated spaces such as incubators or accelerators. For incumbents trust is an important component of any partnership and they seem to apply their third-party due diligence to FinTech firms as they would any other third party. In seeking to attract interest from FinTech firms, incumbents often run events such as hackathons, competitions or other networking events. However, most of the time new entrant FinTech firms approach incumbents to explore potential collaboration.

Investing in new entrant FinTech firms

Most incumbents take a strategic view when investing in FinTech. Incumbents invest predominantly through venture capital funds, with 76% of firms surveyed stating that they invested in FinTech in this way. Incumbents also invest in new entrant FinTech firms directly but activity in this area is low, possibly because FinTech is at an early stage of development. In the EU the focus of recent acquisitions is the area of online banking, payments and retail credit.

Collaborating with other stakeholders

Certain technologies, such as blockchain, require collaboration between stakeholders in order to reach their potential. This has resulted in the creation of consortia such as R3 and Enterprise Ethereum Alliance. These consortia seek to join forces to develop new and innovative solutions. Funding, governance and commitment are key factors for the success of consortia. However, alliance between peers can be difficult given the competitive nature of the financial services sector.

Developing FinTech solutions internally

A number of incumbents have initiated cross-business transformation through increased investment in ICT and digitalisation projects. Internal research and development is often conducted through internal accelerators with a dedicated team assessing FinTech opportunities to identify the best solutions that fit the institution's strategy and profile. The aim is to trigger internal motivation to find new solutions, replacing old inefficient processes. 87% of incumbents surveyed said they were developing their own products and services in house, without cooperating with FinTech firms.

Risk Factors impacting the sustainability of business models

Many incumbents are rethinking their business models to react to technological changes. These new business models should ensure incumbents remain viable in the new technological landscape. However, there are a number of factors that could impact the sustainability of incumbents' new business models.

For example, an incumbent's digitalisation strategy may impact the sustainability of their business model. Aggressively proactive institutions risk changing too fast, without a clear strategic objective or appropriate governance and operational changes. On the other hand, reactive or passive institutions risk being unable to react adequately to the changing environment.

Incumbents are also restrained by their complex legacy ICT systems which can impede their agility and flexibility. This poses particular problems for firms who wish to develop APIs for third party users, meaning they must face the challenge of linking their APIs to legacy ICT systems.

Incumbents need to adapt their internal culture to become more technologically driven. As mentioned earlier, many incumbents see their current mindset as an impediment to innovation. In addition, there is strong competition for top ICT expertise and technology talent, with demand outstripping supply. A lack of access to appropriate expertise could prevent incumbents from progressing.

Lastly, incumbents face strong competition from new entrants such as FinTech start-ups. Incumbents have noted that BigTech firms have the potential to become significant competitors in the financial services market due to their size and global exposure.

Prudential risks and opportunities

In the Risk Report the EBA notes that the rapid evolution of FinTech has the potential to significantly alter the risk profiles of incumbent institutions by creating new risks and potentially amplifying existing risks. The Risk report describes seven use cases for FinTech and the associated prudential risks and opportunities presented in each case. The EBA asked 37 banks to indicate their engagement with the seven use cases and found different levels of adoption for each, reflecting different levels of development of the associated FinTech solutions. The use of biometric authentication for customer identification and the use of digital wallets for mobile payments using near-field communication are the most widely adopted use cases, with 58% and 53% of institutions respectively having implemented these for commercial use. Cloud computing for material activities, the use of big data and machine learning for credit scoring and the use of robo-advisors for investment advice have been commercially launched by some institutions and are under discussion/pilot testing in others. The use of distributed ledger technology and smart contracts for trade finance and the use of distributed ledger technology for digital identification are the two use cases with the lowest level of commercial implementation and are both still very much in the early stages of development. Across the seven use cases several main prudential risks are identified.

ICT Risk

All use cases represent a potential increase in various ICT risks. The use of biometric identification tools can impact ICT security risk. For example, where fingerprints are used to identify a customer this information can be stolen, e.g. from everyday objects the customer touches. If stolen, fingerprints cannot be changed in the way a password can. The use of big data for credit scoring also increases ICT security risk as big data sets containing customer data can be very attractive targets for hackers. The use of distributed ledger technology increases ICT security risk because although data and software can be distributed to multiple nodes, this can mean there are more nodes to protect, each potentially with a different level of security.

Increased ICT change risk can be an issue where distributed ledger technology is used, as each node needs to be kept up to date with the latest software, which can be a complex process. ICT outsourcing risk may be increased by the use of cloud computing providers and of third party providers of digital wallets. In addition, a concentration risk can arise if multiple institutions rely on the same providers of distributed ledger technology, cloud computing resources, digital wallet providers or biometric authentication software.

Legal and compliance risk

Many of the use cases analysed in the Risk Report involve processing personal data. Legal, conduct and reputational risks could therefore arise due to a potential breach of GDPR if this data is not handled properly. The use of big data for credit scoring can increase conduct risk if machine learning algorithms begin to discriminate against users who are less willing to share their data online.

The use of distributed ledger technology and smart contracts for trade finance could increase legal risk. The legal value of smart contracts is still unclear and the law applicable to a contract executed on a distributed ledge that may have nodes physically located in multiple jurisdictions is also unclear. Compliance risk may be increased by the use of distributed ledger technology for digital identification. In this use case multiple organisations use the same information stored in the distributed ledger for CDD verification. However, an invalid, incorrect or incomplete verification by one institution could lead to non-compliance for others. As each institution is responsible for its own CDD this increases compliance risk.

Compliance risk is also an issue where robo-advisors are used to provide investment advice. Some robo-advisors may be based on AI technology that implements unsupervised learning. This can lead to advice whose rationale is difficult to understand and which may be unsuitable for the customer, increasing compliance risk for this use case.


Each use case also presents opportunities for incumbents.

  • Biometric identification has the potential to improve customer experience and potentially improve security, whereas the use of robo-advisors can reduce costs and increase accessibility for customers that may traditionally not have been able to afford investment advice. 
  • The use of distributed ledger technology for trade finance can reduce the administrative burden on banks as the verification of trade documents could be digitalised. Similarly, the use of distributed ledger technology for CDD may reduce costs associated with duplicative CDD processes as once a customer is verified by one institution that verification can be relied on by all institutions. This may also improve customer experience due to decreased wait times. 
  • The use of mobile digital wallets offers significant benefits to customers and institutions, for example enhanced security, reduced transaction costs and an improved customer experience. 
  • The use of big data and machine learning for credit scoring may also offer benefits to institutions, for example, more robust credit scores could improve their resilience. More accurate credit scores may also improve the customer experience, leading to better outcomes for customers. 
  • Material outsourcing to cloud providers may lower costs for institutions and potentially help institutions scale their operations more easily.

The Impact Report finds that incumbent institutions are keen to embrace new and emerging technologies. The Risk Report has identified the main risks and opportunities associated with incumbents' engagement with FinTech. A diverse level of activity and involvement in different FinTech solutions is observed across the EU with incumbents engaging with FinTech in four main ways. The predominant relationship between incumbents and FinTech is one of partnership and collaboration with FinTech firms. The EBA will continue to monitor both the impact of FinTech on incumbents and the associated risks and opportunities of FinTech going forward.

Written by Lisa Fogarty, Trainee, Clifford Chance LLP