CBPC Roadshow: Trust Is More Than a Handshake - Paulo Barbosa [Episode #4]

Speaker A: Hello and welcome to PIT Exchange, a podcast by Currency Research. Join us as we discuss the latest in payments innovation and technology with the industry's most innovative thought leaders. Today we're bringing you something special, the CBPC Roadshow. Four exclusive conversations with leaders from across the global payments ecosystem leading up to the Central Bank Payments Conference this August. Today's payments are changing and moving around the world faster than ever before and PIT Exchange gives you the knowledge and insights to keep up. Sit back and relax as we join Currency Research, exchanging ideas with today's CBPC Roadshow guest.

Speaker B: Hello everybody. Thank you for joining us on this next episode of the PIT Exchange where we talk about the latest in payments innovation and technology. Um, I'm your host this week, Sean Ferrari with Currency Research. And we're excited this week to bring you another episode of our Road to the Central Bank Payments Conference, our Road to CBPC episode series, um, where we have uh, another one of our great partners for the event, Benfico, joining us and we have Paulo Barbosa who's the coo, um, at Banfico. Um, Paulo, nice to, nice to see you.

Speaker C: Hi John, thanks for having me. Happy to be here.

Speaker B: It's a pleasure and we're thrilled to welcome you also to Istanbul in a few weeks. It's looking to be a great program and can't wait to talk to you in person there. But um, in the meantime, great to talk virtually. Um, maybe before we jump into um, trust and trust frameworks in payments which we're going to spend some time on today, uh, and also when you're there in Istanbul, we can learn a little bit more about yourselves, about Benfico. Um, so I'll turn over to you for a little bit to tell us, uh, you know, what is, what is it that excites you in this space? What are you working on? Tell um, us a little bit about Benfico. Um, take it away.

Speaker C: Sure. So Benefico, it's a reg tech company. So we have been building technology for banks, central banks and other, you know, payment service providers, it's the word in Europe to this umbrella term that includes Siemens institutions, payment institutions. So every entity which is impacted by uh, regulations and they need to build something technical to be compliant with that. So we have been doing that since 2017. We are London based company with subsidiaries in, uh, Brazil, Saudi Arabia, Germany and India. Um, and we have clients pretty much, uh, all over the globe. Um, and it's been a very interesting journey. So I joined a few years ago. Um, but my background personally has Nothing to do with technology or even payments. I studied uh, international politics. But life takes you where it takes you. But it's, it's been very interesting and challenging. Um, and I became the Chief operating officer of the group. Um, I've been driving the international growth of the company and I've been following a lot of these regulatory um, changes. And I've been recently appointed um, to join the Payment Systems Market Expert Group from the European Commission. So it will also give me an opportunity to you know, bring a lot of these lessons learned from different parts of the world, um, and hopefully you know, make it that Europe will be able to in a way catch up with other initiatives that were uh, very, very successful, um, in different parts of the globe.

Speaker B: Awesome. No, thanks for that. I was gonna see, I was uh, going through your, your LinkedIn information and I was going to mention your appointment to the European Commission's um, Payment System Market Expert Group. Um, congratulations on that. It sounds exciting and can't um, wait to talk to you again in a little bit after you've had some time on that to, to hear what's being discussed and see uh, where that goes.

Speaker C: But sure, happy to.

Speaker B: Great. Um, it is funny, I mean you mentioned your, your background in international, international politics. Clearly there's a lot going on in that space now. Um, myself too, I was a government and economics major coming out of school and uh, here we are talking all about payments and um, all the latest. It's ah, it's fascinating for sure. Um, but maybe, you know, today, uh, I think where we want to spend most of our time is really talking about, about trust, um, trust protocols and instilling trust in payments. And there's so much moving in this space, um, in terms of uh, agentic payments and in terms of different technologies that are allowing payments to happen um, faster. And if we look back through time, I think everybody was relying on um, over the past few years, APIs was the big thing. It was like, oh well we have APIs. Surely that'll take care of this. That'll help the communication, which obviously it does. But tell um, us a bit about why aren't APIs enough in this world as we build these digital ecosystems.

Speaker C: Yeah. So a lot of the new payment schemes are based on APIs because it's a very flexible technology, it's quite easy to implement. Uh, so that's the backbone of for example the um, open banking implementations, which was at least in Europe. And going back to the politics side of things because in the end everything is linked. Uh, there Was um, the intention to push for a uh card to account payments and instant payments, uh, so basically to try to uh, decrease the dependencies on the card schemes, especially the foreign uh, card schemes. And that discussion is going, it's coming back again uh, more and more when you talk about payments sovereignty and how um, at least in Europe we're trying to build new initiatives to, to not being dependent on foreign uh, payment systems. APIs have been greatly used to push for the implementations of those schemes. But if you think about APIs, it gives you the instructions, the technical instructions for the two systems to talk. So if I build an API, I will be able to connect um, with other counterparts in a programmatically way. Um, and it works pretty, pretty well. It's a proved model, it works fine. But then if we move into more of an ecosystem uh approach where it will no longer be one to one interactions, it's many to many, uh, that the scalability can be a bit uh, complicated. So that's why we talked about um, other things to bring the uh, rules and regulations and um, the validations for you to be, so you can talk to the ones that you're supposed to be talking. And so API itself gives you the plumbing but not um, the rest of the trust. So you can make sure you're trying to talk with the person you're supposed to be talking with.

Speaker B: Right. So it's a, they're, they're tools to facilitate or to accomplish the, the communication but it doesn't, it doesn't tell you yes, you, you should be talking to this person or, or this is a, even a valid maybe transaction or what's going on exactly behind the scenes. Yeah. Okay. So if I think about how particularly in the open banking world where you all spend a lot of your time, there's so many banks, fintech companies, regulators, um, talking to each other that uh, in a world where we used to kind of work on one on one trust like I verify you, you verify me. Okay, now we can make a transaction. Um, does that scale in an ecosystem like we're in currently?

Speaker C: It doesn't. And if you look at Europe that's been one of the biggest issues um, with the success and the spe, the rollout that we had with uh, openmaking implementations in Europe, uh, where there is no trust framework, um, enabling for the dynamic um, connection between all these parties. So basically the fintechs need to do one on one onboarding and it's a model that is really hard to scale and maintain um, and that requires manual due Diligence, bilateral contracts, um, certificate exchanges and we saw in some other parts of the world including UK where there's um an open banking directory allowing for this M dynamic client registration for example which speeds up the onboarding but also on the real time operations you see that having this um trust framework allows for the interactions to happen in a more secured way and uh, more um automated ways. So it sort of fixes the real world friction um avoiding onboarding delays, um, or inconsistencies on how the security ah framework has been interpreted and implemented by the different parties. Um so we do see it that yeah um, it has direct implications on the outcome of the success of this open making implementations but also any other API uh implementation if you leave it to the market to, to come up with, with solutions without having um. Yeah something sitting on top that it's coordinating all these uh interactions. It's possible but it's I would say it's less secure to some extent and it's uh, for sure more difficult.

Speaker B: Gotcha. Okay, so really we're talking about like this federated trust framework then that is that's needed to, to help a market, this ecosystem kind of accomplish what it needs to do in terms of verify payments and let the community um interact with each other. So maybe just I know we talked about it just a little bit but stepping back um, just for everybody to understand and listen to um, in a high level kind of put simply how would you describe this federated trust framework?

Speaker C: So in the end it's some sort of a shared system uh so it can have the form of a directory um root of trust which enforces the rules that everyone has to, to play by. So instead of every. So if you talk on the bank side for example again using the open banking example where they need to trust that the fintech that is trying to connect to their APIs for payment initiation or to get access to the payment account uh data they need to do some checks, some KYC on that entity. So having a uh central directory or a central registry listing all these verified participants that already helps the banks uh quite a lot. So they can go and check. Well this entity is actually uh authorized by the Central bank of Portugal or Spain or uh, whatever um and that they have the certificate, the trust, um the security certificate that they are supposed to be doing. Um they have the um, yeah the authorization to act in a specific country if in Europe, you know within the single market they need to go through what is called the passporting uh process. So all of that can be uh Centralized in a trust, uh directory which will automatically update that information once the um, authorization is revoked by the central bank, for example. So you, you can be certain that as a bank you're only giving access to the entities that are supposed to have access. And now if we move from an open banking, uh, logic where we are talking about payment accounts to an open finance where we are talking about other types of uh, participants like insurance companies or even uh, open everything where you can give access to uh, m, anyone that has data on you. Uh, then it gets a bit more complex uh, because the certificates, the security certificates used today for this uh, fintech to bank interactions or bank to bank interactions will not be working in this new, with this new type of participants. So having this um, directory or trust framework is really important so everyone can, can trust on the other uh, participants. Because if that trust chain is broken, either from me as a consumer of my bank client or using a fintech service, if the trust is broke on, is broken on my side, that will just create um, you know, a chain of events that will, you know, create implications for everyone. So the, the same thing with a fintech interaction with, with a bank, if they have um, if they are accessing things that they did not get the consent to get access to, there are some liability consequences that they are exposing themselves to. So having a directory, it will fix a lot of these issues.

Speaker B: Okay, so with this directory, how does this actually, like what technology does this or what is it running on? Like how does this actually function? I feel like I can't get through a discussion without, you know, at least saying the word blockchain. Is this a blockchain type thing? Is it, is it not? Um, look, well how does this work?

Speaker C: Can be, it can be. So, you know, more, more than the technology itself. Um, I think it's, it's important to explain what, what they do then the, the building blocks that you do it to, to implement it, it can of course be uh, blockchain technology, um, in some aspects, uh, it can be of course some cryptographic, uh, building blocks for the certificate, uh, validation and issuance and the entire lifecycle management of security, uh certificates. But in the end the trust framework is doing um, different things. So they are verifying that you are legally the entity that you are claiming to be. And they do that through different M means. Uh, in Europe it includes validating the qualified certificate that you have on your power, which is equivalent to uh, a passport. So the trust provider that gives you that certificate, it will make you go through a process that it's giving certainty to the entire market that indeed if you have that certificate, you are the person that you're claiming to be, then the trust framework, they are validating that that certificate is valid, that it was given uh, to you by a company that has the authority as a qualified um, certificate issuer to give you that um, identification. And then once this sort of trust is established, there are different things that this trust framework can enable. It can verify that the messages that you're, you're sending, the information that you are exchanging is aligned with certain, um, with certain technical specifications that it follows, you know, everyone is following the same rules and um, uh, yeah, rule books of that scheme, if we're talking about a scheme, so it enforces that um, everyone is playing by the same rules and then the players that are playing this game are entities that they are supposed to, um. And having this sort of technology in the middle enables all of that. Then the way the technology itself, as I said, is given. Uh, so typically the interactions with this um, platform are through um, APIs, which again is very flexible and it's mostly over the Internet, uh, connectivity. So it's, it's very accessible. Um, but then it builds all the trust layers around it to make it uh, secure and trustworthy.

Speaker B: Yeah, no, for sure. And I think it always comes back to, as you say, if a chain breaks somewhere and you lose trust, then um, kind of the cascading effect of that uh, is problematic for sure. And it sounds like these types of technologies help maintain that validity all the way through which, through the transaction, which is, which is critical. Um, and to that point you mentioned a bit about what's going on in the EU currently and a bit about why this is urgent. But why do you think in the next few years um, everybody should be moving to something like, like this federated trust framework, um, or why is it essential given everything that's going on right now?

Speaker C: Yeah, so in. We tend to do a lot of things in Europe, um, because a lot of these regulations are then exported to different parts of the world and adopted and adapted in uh, different parts of the world. That's what we see with uh, data protection regulations, with uh, open banking, with PST2, um, even with uh, instant payments and verification of PE. So it's a very interesting um, place to be because of the nature of the region as well. So when we talk about Europe it's uh, we're talking about very combination of very different countries in terms of technology, culture, language, uh, everything. Um, so for the uh, Directives that require national um transposition. So taking that piece of law and adopting its international regulation then the implications are quite interesting. So it, it shows the need to have this shared infrastructure to make sure that this cross uh border um interactions are, are secure and working and are happening in a um in the way they were designed to. So back to your question. In Europe there are a few regulations coming. So PST3 the third payment service directive is coming to fix a lot of the issues that were there with the uh, OpenMac implementation, uh, that was done with PST 2 um including all the issues that we had with um, interoperability and um, where the lack of uh, a central directory was um, was quoted as one of the reasons to look into this. PSC3 Then there are other API based schemes like verification of pe, um, or these fraud sharing arrangements that are coming with uh the Payment service regulation that require the trust framework. Um and then in the bigger scheme of things a lot of these obligations are being implemented uh, on the global aspect. Yeah. So if you look at the G20 agenda for the implementation of uh fast payment systems and we were in South Africa presenting this to the G20M where they are discussing uh implementing overlay services like uh account verification services. Um, you need to have some sort of uh trust framework to make it work properly. Um and that's you know we are working a lot of these aspects in how to make this new upcoming um regulatory obligations work better with our trust framework. But also in other parts of the world. How can you know a fast payments um system between two countries in Africa, for example, can you bring the certification of payee in a, in a good way so that you don't, you're not opening a uh highway of fraud, um and you can establish this uh verification of B model so people are 100% sure that they are sending money to the person they are intending to send money to. So time is critical in Europe but I would say it's, it's a bit of a global trend uh as well. Um and I know in Istanbul the audience will be very international so we are happy to, to show how this is relevant for pretty much uh, every country and every region uh of the globe working on fast payment implementations or any API based scheme that requires uh, having this trust framework sitting on top to govern these interactions.

Speaker B: Yeah, no, for sure I think you're right. It is a global um issue that everybody should be thinking about um, particularly as you consider cross border and other things for sure. No doubt. So we've talked a lot about kind of the compliance aspects of, of the federated trust framework. But um, there's more to it than that.

Speaker A: Right?

Speaker B: There's, there's also real benefit, real um, efficiencies and benefits that folks can realize by implementing this type of framework. So maybe if you could just put a finer point on it and talk a little bit about what are those real world advantages uh, of implementing a uh, framework like this.

Speaker C: Yeah, so the key points, uh, even outside regulation is how uh, fast and easy can this implementation happen and how successfully these implementations are. So we see every time that having this uh, umbrella sitting on top of um, a scheme rollout, this trust framework will just make sure that everything happens much um, much faster and in a better way. Um, and then it's not only um, on the technical aspects, it's if you don't have this, uh, there are some liability exposures that um, the PSPs can be exposing uh, themselves to. So if this, if we, as we mentioned before, if this trust is broken, uh, someone needs to be liable uh, for it. So not having this will for sure expose everyone uh, to these uh, risks. Um, so I think it's not really a choice now. Um, and also the way the world is moving, uh, with AI and everything, I don't want to be that annoying guy bringing AI to the discussion, but it has real world uh, impacts um, and uh, it's making access to fraudulent behavior much easier. So you need to bring all the um, all the safeguards that, that you can and this, this one for sure. It's uh, I would say it's, it's a must even outside any regulatory uh, obligation.

Speaker B: No, that's helpful. And we, we had a conversation um, a few weeks ago with a uh, different podcast guest, um, talking all about kind of uh, agentic AI payments and how, how that's really changing the game in terms of um, both of the elements you just talked about. Not only trust, um, in terms of you know, making sure my agent has the ability and the authorization to talk to your agent, but also on the liability side, um, where that then opens up a whole can of worms about who actually authorized it, who, who was um. Was it the, the agent? Was it the company that runs the agent? Was it the person that quote unquote intended to make the purchase? So it's a fascinating area and I think you're absolutely right that you need this type of um, trust framework to be able to implement all those. So to that end, I mean you mentioned AI and uh, but where does this go next with all of the new payment um developments that are happening in this space.

Speaker C: Yeah obviously payments are changing and it's very exciting time to be working in industry. Uh but you also have things like uh, digital identity wallets, you have digital um, currencies, um cross border kyc. There are some um, AML obligations that require for some communication to happen between uh countries. Um of course agentic payments are a ah big thing. Um and all of these new initiatives have you know something in common. Um so you know it requires parties to communicate with each other to exchange uh information. So bringing this trust layer for all of these uh communications be it in the scope of payments or um, anything else, it's very uh, relevant then now I think uh, AI agents are a big thing um on no one knows exactly the impact that will have in the payments, what that will mean in terms of liability. Um but I think for sure that's having um, someone that is able to um, validate this uh, programmatic payments between agents, uh and make sure that the agents are authorized to represent someone and making sure that this, this chain of trust that needs to be there for a payment. Uh, for the funds to move from point A to point B, even if they are initiated by agents. It's really important to have um this trust framework, um, making sure that all of those interactions are happening in a compliant way. Both technically but also even legal to some extent.

Speaker B: Yeah, absolutely. Uh, a brave new world out there. Um, with, with all of this and, and all of it requires um, all of it again comes back to trust. So what I guess is the. As we kind of run out of time, don't want to give away everything you're going to be, be talking about in, in Istanbul. So we'll leave people wanting a little bit more. Um, but if you could give our listeners one thing to kind of take away one thing to remember, um, what would that be?

Speaker C: Yes, I would say um, trust doesn't really scale by shaking more hands. It should be scaling by building some infrastructure that makes handshakes uh unnecessary. And that's exactly what we are building. Um, and I think it's just the start of the conversation. So every country will have uh, different needs, every region will have uh, different um, pain points. Uh so we are happy to sit with anyone that is interested to learn more about this and explaining how this uh, how can we do the combination of these different modules uh, to help the implementation and governance of these uh, schemes in uh, the different countries. So there's one, there's no solution that will you know, magically fit, uh, every single need. And I think that's where we as Benfico have been very successful on. It's on building and um, deploying technology that are solving real world problems and really adapted to the needs of our clients, um, and partners. So happy to continue these discussions in Istanbul. Uh, also with a very nice view. It's uh, an amazing city so I think it can be an interesting subject to have on a face to face.

Speaker B: No, awesome. And that's what it's all about, continuing those discussions. And as you say, uh, we're particularly looking forward to it with so many countries that'll be there in the room and getting everybody's perspectives and talking about how to implement these types of technologies across the world. Um, so thank you for taking the time to be here and also can't uh, wait to see you in Istanbul.

Speaker C: Awesome. Thank you.

Speaker B: You're welcome. Well, thanks everybody for listening. We hope you enjoyed this discussion with Paulo and uh, Benfico. It, uh, was a great, great, interesting half hour. Um, I hope you found it interesting as well. Um, and for those of you that haven't already signed up to be in Istanbul, please consider doing so. You can go to the currency research website@ah, currencyresearch.com to get more information on that. Um, and uh, with that, uh, thanks for listening. Uh, please do tune in again for our next epis of the PIT exchange. Uh, and in the meantime, like subscribe, download, do whatever it is, wherever it is you do it with your podcasts. Um, we're happy to be with you. So until next time, thanks for joining us. Take care.

Speaker A: Thank you for listening to PID Exchange, a podcast by Currency Research. This episode is part of our CBPC Roadshow Series 4 conversations leading up to the Central Bank Payments Conference this August. Watch the full series at Central Bank Payments Conference.

Speaker C: Com.

Speaker A: Check out our, um, upcoming events and publications at Currency Research and join us for the next stop on the CBPC Roadshow. We'll see you at the Central Bank Payments Conference this August.