Episode 13: Addressing the risk in the payments industry before, during and after COVID-19

Transcript of the recording

Cyrielle Chiron:
Today more than ever, the importance of resiliency is in the spotlight as Canada's national payment systems continue to operate safely and reliably even in the face of the evolving COVID-19 pandemic. To operate in the midst of a global health crisis, it's really imperative to have strong business continuity practices in place in order to adapt in a deliberate and decisive manner.

Cyrielle Chiron:
This is especially relevant in the payments industry where both Canadian financial institutions, government and businesses, must be prepared to constantly adjust systems to meet change in economic conditions and also consumers' behavior. I'm Cyrielle Chiron, your host for season two of The PayPod which talks about all aspects of Canada's ambitious payments modernization mission and explores the topics that influence payments in Canada and around the world.

Cyrielle Chiron:
Like many organizations, Payments Canada has robust business continuity practices and is well prepared to continue to adapt and respond to the evolving situation of the global health and economic crisis. Though we have multiple layers of contingency plan already in place, our team remains vigilant in finding ways to increase resilience. They perform further planning and testing to account for unique challenges that emerge almost daily.

Cyrielle Chiron:
In doing so, we're able to remain responsive while keeping the health and well-being of employees as well as operations of our system top priorities. To further our discussion on risk and how Payments ecosystem is responding to new risk brought by the COVID-19 virus, we'll be speaking with Peter Dodic, Payments Canada's chief risk officer. Peter is a very busy man these days as he's responsible for enterprise-wide risk management programs and leading the organization business continuity planning.

Cyrielle Chiron:
Through his role, Peter brings further risk expertise to Payments Canada preparing us well for the future as our payments modernization program shifts into execution mode. We are also joined by Sonia Baxendale, president and CEO, Global Risk Institute in Financial Services. Sonia and her team dedicate their work to researching and advancing best practices in financial services risk management, as well as disseminating knowledge on the latest FinTech innovations around the world. Thank you both for joining me on today's episode.

Peter Dodic:
Good afternoon Cyrielle. Thanks for having me on.

Sonia Baxendale:
Hello there. Great to be here.

Cyrielle Chiron:
I believe you have been both very busy these days, right? COVID-19 really tested and is still testing how resilient we all are and if the different plans we put in place are actually working or not. I'd like to start with you Peter, because Payments Canada is at the center of the economy. It's not the only entity at the center, but it is a big one. Payments is everywhere so making sure our payment system is working is extremely important.

Cyrielle Chiron:
Can you talk to us about the contingency plans put in place by Payments Canada to ensure that Canada's payment system operates reliably and securely during the COVID-19 pandemic?

Peter Dodic:
Sure. Our contingency plans are just one part of our enterprise risk management framework. If I can just step back for a bit, my team is responsible for building framework and tools to manage financial and operational risk. My sense is this pandemic definitely falls into the operational risk category and it is something that we were ready for in as much you can be ready for a once-in-a-hundred-years pandemic.

Peter Dodic:
Our enterprise risk management framework has an emerging risk monitoring program. That emerging risk program did detect COVID in early 2020 so we were aware of what could be coming before it became a top risk for us. We knew if the COVID situation were to escalate, we had the appropriate plans and strategies in place to address the situation as best we could. Let me break it down a little bit for you. Late last year, we updated and tested our crisis management plan.

Peter Dodic:
That plan really serves as our overarching business continuity plan for the organization. That timing in late 2019 around testing and updating was a bit of a lucky break for us as our crisis teams were really familiar with our process and familiar with the plans. When we did have to invoke plans in March to the COVID, we were ready, prepared, and we had a recent experience of how that system works and what they had to do.

Peter Dodic:
I'm sure as Sonia knows, in any kind of risk situation, it's important for people to know their roles and responsibilities, what they own and don't own and what's on their docket. When what I consider what we planned for, it was a few big things that we looked at. One was limiting travel. Our planning considered that. We have an office in Toronto, an office in Ottawa. How do we manage that? Our frequent travel today versus infrequent travel post-COVID.

Peter Dodic:
We talked about splitting operations, which would allow our critical functions to have more locations and reduce the likelihood of teams overlapping and getting each other sick. Maybe most importantly, I think over the last few years Pay Can, I would say, has made the necessary investments in technology specifically that allows employees to work from home. We've been working remotely since March 13th and it's been pretty seamless.

Peter Dodic:
Early in our response, we published a playbook to further support our work, but if I can just say one last thing. Beyond that internal testing and industry testing and planning and playbooks, there's a couple of other things that we have that really safeguard the systems. One is we have arrangements with vendors. If we were in the position to not be able to run some of our systems, we do have proxy agreements with vendors who could do it on our behalf.

Peter Dodic:
It's never happened, but if it ever got to that situation, we do have agreements in place to support our work if we couldn't do it ourselves. One last thought on resiliency is our planning doesn't just focus on pandemics. We have an all-hazards approach. We try to have contingency plans for any event that could affect their business. This is an op risk perspective, because it's difficult to predict what's going to come.

Peter Dodic:
One year it could be an earthquake, it could be a flood or it could be a pandemic. It's better to have an all-hazards approach that you be ready for any kind of event and then tailor your response if and when it happens.

Cyrielle Chiron:
Yeah. I think you're right. It's very hard to predict the future, but I think correct, as you said, that planning, testing and I like the fact you mentioned collaborations is not only internally, but also including vendors is important. It's more than one person. I think that that was a great call. I'd like to have one key question because I bet everybody has this in mind, and it's about payments modernization, right?

Peter Dodic:
Yeah.

Cyrielle Chiron:
We've been pretty clear on the fact that we had other plan in place to make sure that we are resilient for the employees, but also for the payment system. We are obviously in the path of big initiatives, payment modernizations. The situations were right now, will this change the journey that we started a few years ago?

Peter Dodic:
A couple of thoughts here. Kind of short answer is no. I think this pandemic in my mind really serves to reinforce our mission, right? The mission to modernize the payment systems in Canada and really the idea to provide Canadians with ease easier and more efficient ways to make payments. My sense is in times like these, it drives home I think our collective need to move money in a safe, seamless and digital way. I think one thing did happen.

Peter Dodic:
This pandemic and I think our effective response to it, I think it gave our organization capacity to help. I think instead of firefighting internal COVID issues and problems we're having with recovery, this pandemic really gave us an opportunity to help and to support the ecosystem. I would say that we facilitated industry COVID responses. For example, we facilitated and helped drive the recent CRA direct deposit initiative to help Canadians sign up for payment relief and other federal initiatives to support them financially.

Peter Dodic:
Now we're looking at things like check reduction initiatives. Having the plans in place and being ready for something like this and having a pretty seamless transition to work from home, gave us capacity to do more and add more. If anything, I think it reinforces our mission and gives us this new area where we have this facilitational role where we can help people and we can help the industry move forward.

Cyrielle Chiron:
No. Well, that's great. That's great to hear. I'd like to move to you Sonia because the Global Risk Institute recently published research that you've done on operational resilience, pre and post-COVID-19. I think it will be great if you could walk us through the key findings of that research.

Sonia Baxendale:
Sure. I'd be happy to. Maybe what I should do though, is start by defining operational resilience in the way that we think about it at the Risk Institute and in supporting our members. Operational resilience put simply, is our ability to prevent, respond to, recover and to learn from operational disruptions to our most critical business services. Clearly, a state that has been well tested with COVID, and as Peter has described.

Sonia Baxendale:
Operational resilience is essentially built on a premise of focusing on the customer and our ability to deliver our most critical business services end to end over a sustained period of time. You might ask, how does the operational resilience differ from business continuity or disaster recovery? The answer to that is that operational resilience takes into account of, but goes beyond business continuity or disaster recovery.

Sonia Baxendale:
Some of the key differences are that it's centered specifically on critical business services and on addressing them end to end. That means that it requires an explicit understanding of the impact tolerances that the firm has an appetite for. Clearly some of the things that come into play when we're thinking about the payments industry and the ability to move money. What I mean by this is it requires the identification of a timeframe and magnitude of impact that you're prepared to tolerate for each service.

Sonia Baxendale:
Then this in turn drives the level of protection monitoring and recovery required for each of these services. I think very importantly work had happened around operational resilience and explicitly addressing this pre-COVID. I think post-COVID we will see an increased focus of regulators on the importance of operational resilience as a key measure of an organization's preparedness for a significant sustained business interruption. We've already seen some initiatives in this regard globally, and we'll continue to see more in Canada.

Sonia Baxendale:
Coming back to the key findings, I think you're referring to the top 10 risks ranked by severity of their impact in our report. Although it's unlikely that any financial institution in Canada did not identify pandemic as an emerging or a potential risk, they did not identify it as a top 10 current risk to the Canadian financial system. The top three risks were cyber, geopolitical and economic. What's interesting though, is that with the possible exception of climate risk, a pandemic event is clearly a key catalyst for all of the top 10 risks that were identified.

Sonia Baxendale:
This is to say that although not identified explicitly, preparedness was well-developed. We see that in our industry responses and certainly as evidenced in some of the things that Peter described, that allowed the payments industry to continue serving its millions of clients. One other point that I would make is I think it's really worth noting the significant contagion risk that came from this global pandemic, which may not have been fully appreciated in all of the scenario planning exercises that had taken place previously.

Cyrielle Chiron:
Yeah. I think it's interesting you're saying that because for me, I get what the two of you are saying, planning for the unknown, it's really not an easy task to do, right? You try to get a lot of different scenarios, but you really go with the unknown. Planning for that, it's really hard. You really don't have an easy job, both of you. I'd like to go back to you Peter, and especially where saying that, even Sonia mentioned, we have to deliver to millions of Canadians.

Cyrielle Chiron:
Knowing that millions of Canadians actually rely on financial institutions every day, right? Working from home or not working from home. What do you think of their planning and response to the pandemic so far?

Peter Dodic:
Yeah. I think in short, I would say our financial institutions have done remarkably well. I think you'll likely remember our banks were the gold standard in terms of safety and performance during the Great Recession over 10 years ago. I would say today is no different. In my opinion, our banks have stepped up. My sense is they put the customers first and they've done all they can to support business and Canadians alike. I think similar to Payments Canada, all Canadian FI's are required to maintain and test their pandemic plans on a regular basis.

Peter Dodic:
I would say this understanding and testing surely helped the banks from a resiliency perspective. In terms of specific actions, I think it's noteworthy that the FI's did a few big things and did them well. I mentioned earlier the collaboration with Payments Canada on online enrollment for the CRA benefits. That was a big thing that the banks did. They stepped up in record time to allow an avenue for Canadians to register through the CRA without going through the usual process, which could take much longer than a day or even a week.

Cyrielle Chiron:
Yes. Indeed.

Peter Dodic:
That was a big thing.

Cyrielle Chiron:
Yeah.

Peter Dodic:
Beyond on that and on a financial basis, is they've worked with individuals and small businesses and other customers, I think, to create plans to really manage the uncertainty and to build a bit of a bridge towards a stronger future. When I think of that, I'm thinking things like payment deferrals, and I'm thinking of fee waivers and hardship relief. I'm sure this customized a vital support across their entire suite of products from credit cards to mortgages, to lines of credits, to business loans. Cyrielle, I think our banks did all the right things and I think again, we should be proud of the role that they're playing.

Cyrielle Chiron:
Good. Good. It's always good to hear. Because they changed a lot of things, as you said, and even like the direct deposit initiatives and you mentioned reducing checks earlier.

Peter Dodic:
Yeah.

Cyrielle Chiron:
Do you think the payments industry will change once we are out of this pandemic? If you think they will change, how will it change?

Peter Dodic:
The million-dollar question. Yeah. I recently broke my crystal ball, so it's a tough one, but if I had to guess on some of the lasting effects of the pandemic will be for our payments industry, I might suggest one big one. That's, I think, they use of cash. I think cash is dying. I think it was already on the decline before COVID and I suspect that trend to continue. I think people have likely made more than a few habits over the last few months, and I think not handling cash is likely one of them.

Peter Dodic:
To me, this really underscores the need for a new real-time payment system. Something that moves money in a safe, efficient way. Something with a risk model that ensures the finality of the payments and that is right in the wheelhouse of the work that we're doing.

Cyrielle Chiron:
Yeah. I agree. I think we all changed how we purchase things since we're all staying at home. We're more staying at home, so we are not going out to buy-

Cyrielle Chiron:
... to buy stuff. Yeah. Sonia, I'd like to go back to your research. You mentioned a key point saying the pandemic was not identified as a top risk and it was not identified also by financial institutions in Canada as a top risk to the financial system. I would personally not have thought of a pandemic to be honest. I think it's something that is always saying planning for the unknown. Now that the ecosystem is in the midst of adapting to the new normal that we talk all the time.

Cyrielle Chiron:
The new normal and for payments, we just talked about earlier with the decline of cash, et cetera. What are some key learnings that financial institutions can take away from this experience?

Sonia Baxendale:
Sure. Well, a few comments I would make in that regard and Peter touched on just financial institutions and dealing with pandemics in their disaster readiness planning. I think if we think back to that, I think there was a lot of preparation that took place, maybe not having anticipated exactly the way things unfolded. We did have a small test of all of this when we dealt with SARS back in 2003, which I think really got financial institutions initially focused on this and allowed them to build it into their risk management foundation.

Sonia Baxendale:
When I really think about what's the biggest learning, the number one learning from this pandemic? I think the most important one is that we need to be prepared for big shocks. You know, whether they're black swans or white swans or any other. These big shocks and the interconnectivity and the contagion associated with big shocks that we really need to be better prepared for when we move forward. We started with a health crisis, a pandemic. That led us to an economic crisis, which then moved into social crisis related to race.

Sonia Baxendale:
Now, I think probably one of the biggest things we're facing is this growing mental health crisis. All of these things are interconnected. I think that being able to think about it in that kind of an interconnected way, and in many ways, I think this may be a precursor to the climate challenge we have facing us. This might be a bit of a real life stress test in terms of that issue and ensuring that we're well prepared for it. I think that's the big learning for me out of this.

Sonia Baxendale:
Two other things that I would comment on in terms of learning, and again, Peter's touched on this a little bit, but it's the adaptability. What has been really impressive to me is how quickly both as organizations and as individuals we adapted to a new reality. Change in travel. I mean, some of us have spent half our lives on planes and have not spent as much time-

Cyrielle Chiron:
Yeah. I'm one of them.

Sonia Baxendale:
Exactly. Have not spent as much time at home in the last 10 or 20 years, but everybody has adapted to a different reality how to run our businesses differently, video conferencing, et cetera. I think adaptability is something that's been really impressive and quite a learning. Then the other thing that I would comment on is what I would describe as cooperation between government regulators and industry.

Sonia Baxendale:
Which I think has really been impressive in terms of the collaboration that took place in terms of putting Canadians in most need at the forefront of decision making, and ensuring that the ecosystem continued to function. I think probably the best example of that is the one that Peter referred to that Payments was so intricately involved in, and that is the CRA payments mechanism. When we think about that, that's a change that is permanent.

Sonia Baxendale:
Checks are as close to eliminated as we've seen. Cash is disappearing. Although these things were always on or have been on the strategic planning horizon for many years, we've accomplished in days and weeks and months, what was in the plan to take place over a number of years. I really think that while the path may not have changed, it's certainly been accelerated.

Cyrielle Chiron:
Yeah. I think you're right. I agree with you with the fact that things have been accelerating a lot, I would say, because of or thanks to pandemic. I don't know how to put it, but it accelerated. A lot of different initiatives has been put in place globally actually, not only in Canada. I'd like to actually continue on that thought. With payments modernization being there and then payments changing, we can see there is a lot of technological advances and innovations that are coming up, right?

Cyrielle Chiron:
When it comes to new technologies to help with risk management, what have you seen that's promising for the industry in term of accomplishing modernization goals? Is there anything out there that we can use?

Sonia Baxendale:
Sure. Well, again, I would highlight that COVID-19 has really shone a spotlight on global risks and trends, amplifying and accelerating them. I think it has provided an opportunity to really move the bar in so many areas that we would have liked to move faster on strategically, in terms of online purchasing, flexible work environment. You know, two of the biggest. With the increased technological adoption came increased risk.

Sonia Baxendale:
Breached data records, phishing attacks, privacy issues, all those sorts of things. Where I think that we are seeing innovation being aggressively pursued, and it's really critical, is in the areas of AML and KYC. Anti-money laundering, knowing your client, there are numerous initiatives to address the modernization of these important aspects of a technological environment, because really both AML and KYC have historically been built around face-to-face and human interaction operating model.

Sonia Baxendale:
Now we've moved dramatically beyond that in such a short period of time. That remains a significant risk and an area that I think there's a lot of work happening and we will see more and more get tested in this area. I think that's really important. The other comment I would make as we continue to focus on the modernization of payments technology, is that we need to build in resilience against third-party and vendor risk.

Sonia Baxendale:
This is an area that, again, I think that as we look at the initiatives, as we look at how the industry in payments is evolving, this is a linkage that we need to ensure that we don't have some unintended consequences that come between the safe travel of money. This is an area where, again, I think there's investment being made and a number of initiatives. We'll see more acceleration in this whole area of third-party and vendor relationships.

Cyrielle Chiron:
Yeah. Totally. Is there anything you want to add, Peter?

Peter Dodic:
Yeah. If I can add to that just a couple of thoughts. From strictly a risk perspective to me, payments are really all about safety and reliability. When I think of new and innovative risk-reduction tools that might be available now to banks or to infrastructure like Payments Canada, I think of things like artificial intelligence and machine learning. They're really being used by banks already today in the detection of fraud. I think they're used to support internal control systems.

Peter Dodic:
They're also used for credit monitoring and credit approvals. I don't want to go into a whole AI thing today. It's probably another topic for another PayPod. My sense is that we're collectively just scratching the surface, I think, with what AI can deliver in the risk compliance and lending space. With that said, I would say AI is no substitute for an effective risk framework, effective tools, and maybe more importantly, an effective risk culture. I think here it's critical to go back to basics and have people being aware of their risk management role, because we all have one.

Peter Dodic:
We all have a role, right? People must be aware of the tools and the process available to them to help mitigate those risks. I think that's also really important to not lose sight of, yeah, tech is great, but having the basics and the essentials in place and things like frameworks and tools and culture, really support the rest of it.

Cyrielle Chiron:
Great. You're right. That's actually good. We talk about a few, like Sonia, you talked a little bit of the lesson learned, and then Peter you mentioned so we have a role to mitigate those risks. That's good, because I would like now talk about, and finish on that, on the lesson learned that we can take from that experience. Sonia, you mentioned be prepared for big shocks, understand how they are interconnected, adaptability also was mentioned, and corporation was mentioned and also, making sure that Canadians stays at the forefront of everything.

Cyrielle Chiron:
I'd like to see if there is anything else that we can see or we can learn. If we can start maybe by talking a little bit in general, what other lesson learned that we can have in general and then maybe we can speak about payments specifically. Maybe if I could start with you Sonia and see in general, what else do you see in everything that you talk about, that we can learn about mitigating and identifying risks?

Sonia Baxendale:
When we think about COVID and the health crisis, this pandemic is clearly global in nature. I think it's fair to say that the payment system is also global in nature. They both rely on the cooperation and open trade of information between nations. I think that's a really critical component where the two are very similar. Having said that, I see the risk and I see the concern being in the increase in tensions around the world, which places this international cooperation at potential risk.

Sonia Baxendale:
That is something that I think we have to mitigate for and ensure that we have the most appropriate redundancy and protection plans in place, because this is an area that is hard to anticipate at times. I think a perfect example that we're seeing play out as we speak is the situation in Hong Kong right now.

Cyrielle Chiron:
Yeah.

Sonia Baxendale:
We have to really have a heightened sensitivity to the impacts around our global interactions. I also think that the payments industry is in the midst of a great change, which as Peter highlighted has been significantly accelerated by this pandemic. I do think it places even greater importance and greater relevance on how it influences and shapes how we participate in the global economy. I think that that has a very significant impact. One area that we haven't talked about is small business.

Sonia Baxendale:
I think that a lot of what we have seen take place in terms of the change to some of this online transacting and repositioning of how we deal with payments, is going to be really helpful to small businesses. I think small business hasn't always effectively moved as quickly as some might have liked because of a whole host of challenges, which has been the cost to do so, the platforms to do so. I think that the current scenario we'll see some positives from a small business perspective on payments.

Sonia Baxendale:
Just a third spot in terms of additional lessons learned. I touched on third-party suppliers and vendors, but I would just emphasize the importance of this as we move forward, again, from both a risk and an opportunity perspective. Just in terms of what we've seen with regard to supply chain disruptions becoming commonplace and therefore the need for contingency planning. We've seen firsthand the need to potentially reclassify the status of vendors and partners.

Sonia Baxendale:
For example, video conferencing would not have been in the critical or high category, and so that has changed significantly. How are our vendors managing health and safety of their employees, particularly if they're in offshore markets and the risks of that? Are they having financial issues? There's quite a number of things that I think have been brought to the forefront in this regard that requires both regular monitoring as well as remediation plans.

Sonia Baxendale:
I guess the only last thing, or maybe the one little thing that I would add, and we might not have said it explicitly, is the payments ecosystem really requiring some careful and thoughtful navigation between innovation relative to safety and security. Although we need to always ensure that we have the utmost in safety and security, because that's the foundation, it's clear that modernization is essential, innovation is essential. We just need to keep that moving.

Sonia Baxendale:
We've seen how fast we can adapt and being able to maintain a cadence that is maybe not the same as it has been during this crisis, but that is somewhere between that and our normal planning process timeframes.

Cyrielle Chiron:
Yeah. I think I like the fact you mentioned about small business and then for example, video conference, it was not the thing that a lot of companies thought about it before, because we were all at the office, but in fact now it's pretty critical. There's a lot of businesses that didn't want necessarily to go through this digital transformation as fast as others went through and this definitely accelerated it, right. They were not really digital before COVID.

Cyrielle Chiron:
They really struggled during the fact that we were all in lockdown and now they're trying to play catch-ups with the different platforms that they need to ... investments, sorry, that they have to put in their system. Peter, is there anything you would like to add on that on lesson learned and ways to mitigate and identify risk? It could be in general or specifically for payments.

Peter Dodic:
Yeah. I mean, I think Sonia said it all. It was a very thorough answer. Maybe a couple of things I might add. When I think in terms of identifying and mitigating risk, I think what I've learned is it's almost too late to plan for risk and try to manage risk after the event has happened. To me, this pandemic only reinforces in my mind the need to build a few things before events happen. When I say a couple of things, I'm thinking about having a resilient organization and building a strong risk culture, what I mentioned earlier.

Peter Dodic:
By resilience, again, we're talking building blocks. Frameworks, plans, and protocols in place to handle all hazards internally, but maybe more importantly, externally. It's important that tools are frequently tested, so the team, so the firm, so the industry knows who does what if a situation arises. By risk culture, I mean, having the awareness, the understanding and the experience to manage risk across the entire organization and/or the industry.

Peter Dodic:
Folks at Payments Canada know that my team is not here to manage risk for them. We're here to build frameworks and tools to empower them to manage their risks. That's the key thing. They need to manage their own risks. Only when my colleagues understand that role and the active role that they play, are you really ready to handle something like a pandemic.

Cyrielle Chiron:
It's actually a good learning to make us own the race that we ... First of all, having us identify those risks and own it, and really try to think about it. That's really helpful internally when we do things, but that was just maybe me as a Payments Canada mentioning it. Well, thank you very much both of you for sharing your expertise. I'm sure this session was an eyeopener for a lot of us I really appreciate the time.

Peter Dodic:
Thanks for having me.

Sonia Baxendale:
Thank you.

Cyrielle Chiron:
As the payment industry continues to navigate the pandemic and identify and mitigate risk brought by the COVID-19 pandemic, the key to success is to keep operational resilience at the forefront. Knowing that millions of Canadians rely heavily on financial institutions, the payments ecosystem must couple robust business continuity planning with operational resilience to successfully mitigate risk.

Cyrielle Chiron:
That's all the time we have for today, but be sure to join us next time as we dig deeper into Canada's payments ecosystem. I'm Cyrielle Chiron. Thanks for tuning into The PayPod.