Naavi.org

After a long wait, the Limited Liability Circular issued on August 11, 2016  (Also refer an earlier article), has now been operationalized.

In a notification released today, RBI has finally issued the circular as an operational circular. (Earlier circular was a draft circular for pubic comments).

We welcome the circular which is definitely going to help some of the customers. Bankers will also have a breather since in cases where they can prove that the customer has parted with the credentials for a phishing call, they may try to avoid the liability.

The essence of the circular is that Bankers should have a linked mobile of the customer and should not fail to issue an SMS alert for every debit to the account. In case of any unauthorized transaction, if the customer informs the Banker within 3 days, he shall have zero liability. If the information is given after 3 days but before 7 days, the liability shall be limited to Rs 5000 for BSBD SB acccounts.

In case of other SB Accounts, Pre-paid Payment Instruments and Gift Cards, Current/ Cash Credit/ Overdraft Accounts of MSMEs, Current Accounts/ Cash Credit/ Overdraft Accounts of Individuals with annual average balance (during 365 days preceding the incidence of fraud)/ limit up to Rs.25 lakh and Credit cards with limit up to Rs.5 lakh, the liability will be limited to Rs 10000/-

In other cases (All other Current/ Cash Credit/ Overdraft Accounts and Credit cards with limit above Rs.5 lakh) the liability will be limited to Rs 25000/- .

If the Bank is informed beyond 7 days, the Bank will still be liable but the extent of liability would be as per the Bank’s policy (Which needs to be defined).

These limits will be applicable where the customer has no “Contributory Negligence” where he has parted with information on his account to phishing calls.

We will discuss a more detailed implication of this circular and also some services which Naavi.org would provide to Bank customers to take advantage of the circular in subsequent posts.

Naavi

Police in Patiala have reportedly busted an “Abduction” (Kidnapping) case in which the ransom demand was made in Bitcoins. This has therefore raised a question once again about the role of Bitcoins as a  “Currency of Criminals” and the need to treat it as such.

See the report about Kidnapping here

According to the report a trader by name Ashu Jain was kidnapped by 6 persons on May 30 and demanded 20 Bitcoins (approximately Rs 40 lakh equivalent) from his family. He was released after 6 days and we should presume that the family was compelled to buy bitcoins as indicated and deliver it to them. The purchase would have been done through perhaps ZebPay or Coinsure or some such Bitcoin exchanges .

The king pin was one Mr Deepak who is a B.Sc (IT) and an MBA graduate. Unfortunately, he has applied his technical knowledge and business acumen in a wrong way discrediting his educators as well.

The Police will have a strong case under IPC for Abduction, Illegal Confinement, Threat to Murder, Asking for Ransom etc… The punishment could be several life sentences and I wish this is strongly pressed and the person denied bail.

We can use this opportunity to also discuss what is the responsibility and liability of the Bitcoin exchanges who have aided and abetted in this transaction where by the family was forced to shell out its white money to buy bitcoins and deliver it to the criminals as reward for their offence. In the process the white money has become “Criminal Earnings” and the exchange has abetted in this offence under Prevention of Money Laundering Act (PMLA). Also just like Afzal Guru was tried for funding a terror activity, the exchanges are liable to be treated as abettors of the Kidnapping activity and they can be tried for life imprisonment.

If Mr Avnish Bajaj could be tried under Section 67 (ITA 2000) for his company facilitating sale of obscene video file for a total gain of around less than rs 1000, there is no reason why the owners of Bitcoin Exchanges which were involved in this transaction should not be tried for life imprisonment for abetting a crime which may fall under Sections 364, 364A, 365 etc of IPC.

As regards the Bitcoin Exchanges, they have represented to the family that “Bitcoin is a currency” and hence are liable under RBI act to promote an “Electronic piece of paper” as a “Legal Tender”. Also the commodity is being traded for and against Rupee without SEBI registration as “Commodity Traders” and hence there would be penalties under SEBI Act also to be considered.

If the sale involves any dealings with a non resident, then there would be also the FEMA considerations.

Apart from these, we all know that Bitcoin (and other AltCoins) are promoted as an innovative currency that is “Deregulated” and “eliminates the need for a Central Banking Agency like RBI and the Banks who are licensed for money exchange”.  The Indian Bitcoin exchanges have been aggressive in this aspect particularly in the last couple of months.

Now just think, If any person says that

“I want to destroy the Central Banking System of the country and float my own system of Currency”,

what would it be?

In my opinion it would amount to “Treason” and punishable as such under IPC for waging war against the Nation.

RBI is also a Critical Information Infrastructure and any direct or indirect attempt to kill the system would also amount to an offence or an attempt to commit an offence under Section 66F of ITA 2000/8. This is called “Cyber Terrorism”.

To these, apply Section 85 and Section 79, the CEO and the Directors of the Bitcoin Exchanges can be easily booked under ITA 2000/8.

It is upto them to these exchanges to come out and voluntarily  assist the prosecution and claim to be treated as “Approvers” and friends of the law enforcement. They can otherwise try to defend themselves under Section 79 of ITA 2000/8 and claim that they have exercised due diligence as an intermediary and take a chance.

I request Mr A.S.Rai, the IG of Patiala and Chief Minister Captain Amarinder Singh to pursue this angle so that in future no Indian will ever dare to ask Bitcoins as ransom either for physical kidnapping or for injecting ransomware into to the IT systems. For this purpose FIR has to include the Bitcoin Exchanges (unknown at this point of time) who have assisted in providing the Bitcoins and investigate the log records of each of the Bitcoin exchanges operating in the country to identify how the Bitcoins were sourced by the family.

This would be a deterrent measure to promote Cyber Security.

I hope the members of the “Taskforce” of the Bitcoin Regulation committee of the Ministry of Finance, and Reserve Bank of India, as well as SEBI and MCX will all take note of this development and understand that if they try to legitimize Bitcoins for whatever consideration, they will be guilty of supporting an act of Treason and Cyber Terrorism in India.

Naavi

Peer to Peer Lending (P2P lending) is a relatively recent innovation in the “FinTech” business space. It is an interesting development enabled by the development of technology platforms which can bring together people with complimentary needs instantly.

The Uber, Ola platforms are similar. BlaBla cars and other car pooling mechanisms are also similar attempts. Out of these, taxi operators have now been brought under a regulatory regime as if the technology platforms are themselves taxi operators. Even the GST has specified the manner in which these taxi operations will be taxed. States have already passed legislations in their transport laws on regulatory mechanisms for these entities. E Commerce market places including OLX or Quikr etc dealing with “Goods” on a peer to peer basis also have been operating for some time under the regulations of ITA 2000/8.

However, P2P lending is in the financial sector and may have to be dealt with differently when it comes to regulations. P2P lending is a system where persons with surplus money to invest will directly lend to persons who require to borrow. It therefore comes close to what may be called “Banking” which is a heavily regulated sector by tradition. Apart from Banking regulation act, RBI act, there could be other legislation that limit the rate of interest or manner of recovery etc. We need to therefore look at this sector differently from other technology platforms dealing with C2C transactions.

We are aware that the classic definition of “Banking” is “Accepting Deposits from public for the purpose of lending”.

According to RBI Act,(Section 5), Banking is defined as

 “banking” means the accepting, for the purpose of lending or investment, of deposits of money from the public, repayable on demand or otherwise, and withdrawal by cheque, draft, order or otherwise;)

The P2P lending IT Start Ups are proposing to set up a platform which will register “Borrowers” and “Lenders” and try to match the borrowers and lenders in to a personal loan contract. In between the service provider takes the “Commission” or “Brokerage” or “Service Charges”.

Unlike a Bank, the P2P platform does not borrow and pay interest to the depositor and also does not lend and collect interest from the borrower. It therefore remains outside the transaction and acts only as a match maker.

There is no doubt that this so called “Innovation” does overlap with the function of “Banking” and requires RBI to take a policy view.

Currently, any entity that tries to take public money is either working  as a “Bank” or “NBFC” or a “Payment Bank” under the regulations of RBI or as an entity that is regulated under the issue of securities by SEBI. Individual Money lenders are not permitted to release public advertisements and collect deposits from the public. It is however possible for individuals to borrow money from other individuals directly on one to one basis by private negotiation.

Apart from these regulations on who can take deposits from the public and how, there are regulations on the maximum interest that can be charged as well as Tax Deduction at Source. There are State level laws on “Chit Funds” that also may affect loans within a common group.

One of the main risks that RBI has to worry about is “If a large number of public are lured into investing in the P2P platform based on the brand name of the platform and if they are unable to recover their money and the platform goes bust, then will the RBI have served a public cause.

The Sharda scam and various other Chitfund scams which we have seen through out our lives indicate that when money is collected from the public at rates of interest that are higher than what is offered in the Banks, public will not be able to identify it under a “Risk-Reward” equation. They will move money from Banks and hope to earn more without understanding the difference in Risks associated with the lending. The failure of CRB Capital Markets around 1996 introduced the “Credit Rating Scheme” for Deposits of NBFCs. This accelerated a huge shake up in the then thriving NBFC industry and hurt even major players. Only a handful of them like Sundaram Finance and Shriram survived.

The risk of such scams re-surfacing in the form of P2P lending cannot be ruled out. Hence “Regulation of P2P platforms” is extremely critical for a healthy development of the Financial Services activity.

Innovation cannot be Destructive in the guise of being Disruptive:

In the last month there have been a buzz in the industry that RBI is about to come up with a guideline for P2P lending.

In particular I draw the attention of the public to the following articles:

‘RBI guidelines on P2P lending platform likely by June-July’-Economic Times

RBI proposes P2P lending regulations-Livemint.com

RBI Finalises Norms For P2P Lending Platforms; Final Guidelines To Be Out In 2-3 Weeks-inc42.com

RBI guidelines to act as a growth catalyst for P2P business-Yourstory.com

RBI guidelines to act as a growth catalyst for P2P business Investors eye RBI move

Investors to eye RBI Move to regulate P2P lending-Luthra &Luthra

In April 2016, RBI had released a consultative paper for public comments on the proposed P2P lending platforms. Afterwards like many consultative papers, this had also gone into hiding and it appears to have suddenly re-surfaced in the last week. This obviously indicates a Public Relations Exercise undertaken by some vested interests which wanted to create a favourable mood in the market before RBI comes out with its announcement.

Looks very similar to the behind the scene machinations seen in the Bitcoin regulation push. Like in the Bitcoin push, here also there seems to the Finance Ministry which is involved in the policy making. According to one of the sources, the comment “The guidelines should be out soon. The norms will be out before July-end.” was attributed to a Finance Ministry official and not RBI.

Finance ministry also seems to have given a micro instruction that  it proposes “to register these institutions as Non-Banking Financial Companies (NBFC)” completely taking over the decision making from RBI to itself.

As per the proposed guidelines which is no longer a secret and already fixed for RBI to sign on the dotted line, the regulatory framework would majorly encompass the following regulations:

• Permitted Activity: The platform could be registered only as an intermediary and will be prohibited from giving any assured return either directly or indirectly. It will be allowed to opine on the suitability of a lender and creditworthiness of a borrower and will prohibit the platforms being used for any cross-border transaction.
• Prudential Requirements: Prudential requirements will include a minimum capital of INR 2 Cr, with a prescribed leverage ratio and prudential limits on maximum contribution by a lender to a borrower/segment of activity.
• Governance Requirements: This includes a set criterion for promoters, directors, and the CEO, with preference to a financial sector background. Also, the guidelines may also require the P2P lender to have a brick and mortar place of business in India.
• Business Continuity Plan (BCP): The platforms need to put in place adequate risk management systems for smooth operations. A BCP and backup for the data needs to be put in place since the platform also acts as a custodian of the agreements/cheques etc.
• Customer Interface: Confidentiality of customer data and data security would be the responsibility of the platform. P2P lending platforms may be prohibited from promising or suggesting a promise of extraordinary returns. Also, the current regulations applicable to other NBFCs will be made applicable to the P2P platforms in regard to recovery practice.
• Reporting Requirements: Platforms will need to submit regular reports on their financial position, loans arranged each quarter, complaints etc. to the Reserve Bank. The bank may come out with a detailed reporting requirement.

The indications are therefore clear that some influential entity has ensured that the Finance Ministry will take the decision and push it down the throat of RBI as in the case of the Bitcoin regulation.

In the light of this development we saw a news report today in Times of India stating that a new venture “billionloans.com” has raised $1 million funding from Reliance owned Reliance Capital Trust

Fine. We now know why there is so much interest in the guidelines being issued to regulate P2P lending. Now we can wait for the actual guidelines to come out.

While I donot cast any aspersions on the new venture referred to above, when I made a cursory glance at the website, it was clear that the project is in a shoddy state of compliance and if this is an indication of the “Due Diligence” that Reliance Capital has done, it reflects poorly on their expertise.

At the same time, unless there is a major change, it appears that Mr Bala’s reputation will be at stake in this venture. I would take this opportunity to alert him that associating with a finance activity with low level of compliance culture is a huge risk. There is no need to remind us of what is the problem Sahara Chairman is having. In the past even General Manek Shah and Sachin Tendulkar had difficult times due their association with some companies.

My first impression on billionloans.com website was that they have simply lifted the terms and conditions from a US company. It is otherwise funny to see that dispute resolution is by a binding arbitration under the laws of US by the US based Arbitration Council.

The first para of the dispute clause states

“This Agreement is governed by the laws of the State of California, USA, without regard to its choice of law or conflict of law provisions. If any dispute arises between you and billionloans, including, without limitation, any dispute arising from or relating to the Website or the Program, you agree that all such disputes will be determined exclusively by final and binding arbitration, in accordance with the then existing commercial rules of the American Arbitration Association in San Francisco.

The arbitration shall be heard and adjudicated by one arbitrator to be selected by you and billionloans…”

“Any award will be final, binding and conclusive upon the parties, subject only to judicial review provided by California statute, and a judgment rendered on the arbitration award can be entered in any court having jurisdiction thereof…

Notwithstanding the foregoing, either you or billionloans may seek any injunctive relief in a state or federal court in San Francisco, California, as may be necessary to preserve rights pending the completion of arbitration and billionloans may seek any injunctive relief in a state or federal court in San Francisco, California, or another court of competent jurisdiction, at any time against any violations of Section 2 (Proprietary Rights) or Section 3 (Acceptable Use) of this Agreement.”

The Company should know that India has an Arbitration Act and if they want to sell their services in India they need to abide by the Indian regulations.

The second para of the clause does mention Indian laws by stating

“This Agreement shall be construed and interpreted in accordance with the laws of India and the courts and tribunals in Bangalore shall alone have the jurisdiction thereof. . If any dispute arises between you and billionloans, including, without limitation, any dispute arising from or relating to the Website or the Program, you agree that all such disputes will be determined exclusively by final and binding arbitration, in accordance with the laws of India and the courts and tribunals in Bangalore shall alone have the jurisdiction thereof.”

In the light of the first para, I donot know what is the force of the second para and whether it will stand. What it could mean is that after the arbitration by the US arbitration tribunal, if there is an appeal it can be taken up in the Bangalore Court and we all know that it will be thrown out in the first sitting itself.

I want RBI to be aware that this is the attitude of the P2P Platforms that they may register and permit raising money from the Indian public. If tomorrow a scam surfaces, RBI cannot say they were not forewarned.

As regards the risk of loss for the lenders, the platform engages the services of “Field Partners” who will be the local agents who will have direct contact with the borrower or the lender. They will be like the branch managers of the finance companies who will be there today and vanish tomorrow and not liable for the repayments. They will be mules who will take the blame while the Platform owners may say they are not liable.  These mules will be helpless and take the blame if the investor loses his money. The “Field Partner” may also be the local muscle man who is using your money for funding his lending activity and will be untouchable if there is a dispute.

The repayment terms include the following wordings

“If, for any reason, the Field Partner(s) are unable to collect Loan repayments directly from the Borrowers or if billionloans, for any reason, is unable to collect Loan repayments directly from the Field Partner(s), repayment of your Loan could be at risk of partial or total delay or non-repayment and a loss of some or all of your principal could occur.

You hereby acknowledge and agree that billionloans is obligated to repay only such Loan principal to the extent actually received by billionloans from a Field Partner with respect to a Borrower. None of billionloans, its Field Partner(s) or any Borrower will have any obligation to pay interest on the Loan or other fees or amounts (other that as expressly set forth above) to you or any other Lender in connection with any Loan you make. billionloans and Field Partners charge fees and interest on loans posted on the Website to Borrowers, for example, cover their operational expenses……If for any reason less than 100% of your Loan is repaid, you agree that billionloans and its Field Partners shall have no liability therefor, and you hereby release and forever hold harmless billionloans and its Field Partners for any loss you may incur. You should consult with your accountant and/or tax advisors to determine the appropriate tax treatment of such a loss..”

This essentially protects the platform and its agents and places the entire credit risk on the lenders who have no control on the recovery process and have to blindly trust the “Field Agents” that the P2P platform engages.

The aggregate liability that the P2P platform owner is accepting is indicated here

“Notwithstanding anything contained in these terms of use, billionloans’s aggregate liablilty to the Lenders, Field Partners and/or Borrowers for any damages shall not exceed the amount of total introducers fees received by billionloans from the user and end user..”

What this means is that in the unlikely event of a liability arising, Billionloans will payback the 2% or 3% commission that it has collected on the transaction. (P.S: There is an exception however in case of Date Protection related loss).

Another issue which most of the P2P service providers need to check now is the impact of GST on the transaction. Both the lender and the borrower needs to pay GST since they avail service from the platform and the Field agents. The net return of the lender gets adjusted for the tax effect which will be 18% either way on the service charges. Since both parties are likely to be unregistered but the intermediary is registered, there could be “Reverse Charge” for the platform owner and he may have to jack up the fees to cover this loss ultimately recovering it from the service users.

While billionloans collects sensitive personal information, there is no recognition that the Company is either liable under Section 43A or under 79 indicating how unprepared they are in running a business of this nature.

I am not sure if other P2P lenders who are also in the market as are as bad as billionloans.com in designing their terms but it is unlikely that they will be much better.

It is such entities that the RBI is now required to register and for the sake of being considered progressive, have to cannibalize Bank’s deposits and simultaneously endanger the community’s interests.

Bank interests are likely to remain low and come down further in the coming months and at that time if the P2P lenders enter the market with funds from Venture capitals to advertise, it would not be difficult for them to divert not only Bank deposits into their coffers but also poach into the profitable consumer loan portfolio of Banks.

Unless the P2P platform is owned, managed along with liability ownership, by a licensed banking institution that maintains Capital as per the Basel II/III norms, the P2P lending is a high risk venture from the point of view of the public interest.

I suppose RBI will be strong enough to resist the pressure from the Finance Ministry and uphold what is correct from the principal of prudent lending.

I wish RBI as well as the Finance Ministry under Mr Arun Jaitely responds to this post with its views. In the meantime, members of the public who happen to view this may kindly share this with other prudent Bankers and send in their comments.

I have sent an e-mail to billionloans.com in the morning itself seeking their comments and if they provide any rejoinder, I will be happy to publish it here.

I suppose that some corrective action will be taken by billionloans though there is a major change required in their business model if this business has to come anywhere near acceptance in India.

The ball is however in the Court of RBI and I look forward to a good decision from them. It would not be sufficient if they simply publish a guideline and expect the technology companies to comply. What can be guaranteed is that the technology companies will completely ignore the regulation and do what they want and RBI will keep the responsibility for allowing such businesses to loot public money.

Naavi.org will be closely watching the identity of the particular officer who will eventually pass the regulation and mark him for responsibility if things sour some time in the future.

Naavi

On June 8, 2017, RBI issued an important document containing guidelines for Information Technology Framework for NBFC sector. The Master Direction sets detailed guidelines for managing the IT infrastructure by  NBFCs in order to enhance the safety, security and efficiency of IT operations. The guidelines are on the lines of the Gopala Krishna Working Group (GGWG) recommendations for Banks and cover

1. IT Governance
2. IT Policy
3. Information and Cyber Security
4. IT Operations
5. IS Audit
6. Business Continuity Planning and
7. IT Services Outsourcing.

Subsequently in 2016, a Cyber Security Framework for Banks was also mandated.

While the directions proceed on expected general principles of Good IT Governance, it is interesting to note that the Information Security has been defined to include “Authenticity” as one of the basic tenets apart from the well known CIA principle (Confidentiality, Integrity and Availability). The Total Information Assurance model which the undersigned recommends is on the similar thought process and infact extends it to the fifth tenet which is “Non Repudiation”. “Non Repudiation” is an extension of “Authenticity” and hence we can equate the new RBI quartet of CIAA as not different from Naavi’s adoption of CIAA and Non Repudiation.

The IS policy is recommended to be built on

1. Identification and Classification of Information Assets. NBFCs shall maintain detailed inventory of Information Asset with distinct and clear identification of the asset.
2. Segregation of functions: There should be segregation of the duties of the Security Officer/Group (both physical security as well as cyber security) dealing exclusively with information systems security and the Information Technology division which actually implements the computer systems. The information security function should be adequately resourced in terms of the number of staff, level of skill and tools or techniques like risk assessment, security architecture, vulnerability assessment, forensic assessment, etc. Further, there should be a clear segregation of responsibilities relating to system administration, database administration and transaction processing.
3. Role based Access Control – Access to information should be based on well-defined user roles (system administrator, user manager, application owner etc.), NBFCs shall avoid dependence on one or few persons for a particular job. There should be clear delegation of authority for right to upgrade/change user profiles and permissions and also key business parameters (eg. interest rates) which should be documented.
4. Personnel Security – A few authorized application owners/users may have intimate knowledge of financial institution processes and they pose potential threat to systems and data. NBFC should have a process of appropriate check and balance in this regard. Personnel with privileged access like system administrator, cyber security personnel, etc should be subject to rigorous background check and screening.
5. Physical Security – The confidentiality, integrity, and availability of information can be impaired through physical access and damage or destruction to physical components. NBFCs need to create a secured environment for physical security of IS Assets such as secure location of critical data, restricted access to sensitive areas like data center etc.
6. Maker-checker is one of the important principles of authorization in the information systems of financial entities. For each transaction, there must be at least two individuals necessary for its completion as this will reduce the risk of error and will ensure reliability of information.
7. Incident Management – The IS Policy should define what constitutes an incident. NBFCs shall develop and implement processes for preventing, detecting, analysing and responding to information security incidents.
8. Trails- NBFCs shall ensure that audit trails exist for IT assets satisfying its business requirements including regulatory and legal requirements, facilitating audit, serving as forensic evidence when required and assisting in dispute resolution. If an employee, for instance, attempts to access an unauthorized section, this improper activity should be recorded in the audit trail.
9. Public Key Infrastructure (PKI) – NBFCs may increase the usage of PKI to ensure confidentiality of data, access control, data integrity, authentication and nonrepudiation.

It is interesting to note that RBI stops at making a suggestion that NBFCs may increase the usage of PKI and does not go for a mandate though any prudent NBFC would like its operations to be fully compliant with the law of the land though the regulatory authority has given them a certain cushion.

A separate mention has been made of a “Cyber Security Policy” though experts would consider both Information Security and Cyber Security as inter dependent.

As indicated in the Cyber Security Framework (CSF) for Banks, the directions require that “The adequacy of and adherence to cyber resilience framework should be assessed and measured through development of indicators to assess the level of risk/preparedness. These indicators should be used for comprehensive testing through independent compliance checks and audits carried out by qualified and competent professionals. The awareness among the stakeholders including employees may also form a part of this assessment.”

Similarly, a “Cyber Crisis Management Plan” has also been suggested which includes DEtection< Response, Recovery and Containment principles. As in the CSF, it has been stated that NBFCs are “Expected” to  be well prepared to face emerging cyber-threats such as ‘zero-day’ attacks, remote access threats, and targeted attacks.

A specific mention has also been made of the necessity to take necessary preventive and corrective measures in addressing various types of cyber threats including, but not limited to, denial of service, distributed denial of services (DDoS), ransom-ware / crypto ware, destructive malware, business email frauds including spam, email phishing, spear phishing, whaling, vishing frauds, drive-by downloads, browser gateway fraud, ghost administrator exploits, identity frauds, memory update frauds, password related frauds, etc.

Additionally, a Cyber Incident Reporting mechanism has also been suggested on the format similar to that meant for the Banks and the reporting has to be done within 24 hours. (Format)

On the mobile, “End to End Encryption” has been mandated to maintain information security. A warning has also been sounded on the risks of using Social Media for marketing and the possibility of malware distribution through this channel.

For smaller NBFCs with an asset size of less than Rs 500 crores, it has been suggested that the appropriate Information Technology policy is put in place by September 30, 2018.

In summary one can observe that RBI like its earlier guidelines, is washing its hands off by sending out a circular. It has been observed that RBI does not normally care to follow up on implementation of any of its Information Security related circulars at least as we have seen in the Banking sector. Hopefully they will be more pro active in implementation since NBFCs are not as powerful as Banks and cannot arm twist the RBI.

Naavi

On the historical “GST day” when a One Nation- One Tax system went on stream, a day long conference was held in Chennai about “Cash Less Economy”. Organized by InternetTechies Solutions Private Limited, the program in ITC Chola Grand  discussed several interesting aspects of the emerging Cashless society in India.

One of the topics of discussion was the evolution of Cyber Laws in India and how it impacts the new digital system where “Cash” is being digitized in various forms of digital instruments.

Speaking in the subject, Naavi underscored the different perspectives of principal stakeholders of the Cashless Economy such as the Technologists, The Businessmen and the Regulators a part of which is captured below.

Disruption Without Destruction

While Technologists with their passion for innovation take pride in “Causing Disruption” in the society with their innovative transformation ideas, Businessmen look for profits at every corner, including cutting the corner for an additional rupee of profit. Regulators on the other hand work with less than complete understanding of technology and are often honey trapped by technologists and business entities into taking decisions which are sub-optimal.

In this context it is a challenge to find a balanced path of growth where Innovation towards a disruptive solution that shakes up the society into progress is brought in without causing destruction of those who use very system which we want to take in the path of progress.

A typical example is the push for acceptance of Crypto Coins such as Bitcoin as a “Legally Recognized Digital Currency” which may be a disruptive  innovation that can transform the way we look at currency but in the process make our Banking system redundant and thereby destroy the edifice of the economy.

Hence at every step towards implementation of the concept of Cashless economy, there is a need to watch if the risks are properly covered. The objective is not to reject technical progress but ensure that the security of the users is always at the center of adoption of any innovation.

With the trend in the Digital Cash system in India converging on the NPCI platfom as a common gateway for different  Bank and Card Accounts  and convergence of authentication on the Aadhar  platform, and now convergence of all trade transactions in the GST platform, there is more convenience in the cash less society.

However along with this convenience, comes an “Unification of Risks”. If there is a single vulnerability some where in the system, that can have a highly disruptive effect causing wide spread destruction.

It maybe recalled that the Petya Ransomware spread across Ukraine like wild fire through a widely used tax related software and similar happening in India cannot be ruled out.

In the context of the Risks that can be exploited by criminals, it is necessary to look at how the Indian Cyber Laws address the responsibility of protecting the consumers.

It must also be realized that law may identify two types of Digital Cash namely “Digitization of the current currency/money holdings which a citizen may deposit and hold in the form of balances in the Bank” and the creation of new “Digital Currency” of the BitCoin type.

The two namely the “Digitization of Existing Currency” and “Creating Digital Currency” are not same either for regulatory purpose or for the impact they may leave on the economy. While the Digitization of money in the banking system is achieved through E-Banking and M-Banking where digital modes are used as “Channels of Communication with the Banks”. The extensions such as the ATM or the Cards, or Mobile Wallets are also normal Banking transactions executed with different digital tools. From the legal perspective this “Digitized Banking” is governed by the legacy laws of Banking super imposed with the law such as the Information Technology Act (ITA 2000) which builds a bridge between the existing laws and the electronic way of using money.

On the other hand the Bitcoin type of Digital Currency is a system which may be outside the purview of the definition of Currency under the RBI Act and does not come under the provisions of the existing legal framework.

What may not be within the framework of law may also be outside the purview of law. Some times, such things may be neither within the law nor outside but may fall in the grey area in between. In such a situation, some people start exploiting the opportunities until one day the matter is pushed either inside or outside the legal framework by clarity dawing on the community.

But when the legal framework is unclear, which side to err on is a matter of “Risk Perception and Risk Management Attitude” of a subject. People with n unethical mind (as also the criminals) will jump at the opportunity and try to make hay while the sun shines while conservative people stick to ethics and avoid doing what is not clearly legal.

Some of the people who make gains today may lose it out if the law changes and regret their decision in future. Alternatively, if they are smart, (and also lucky) they may get out in time with profits but not without trapping others. It is for this reason that our MP Mr Kirit Somaiah called Bitcoin a “Ponzi Scheme” and he was not off the mark.

Under existing law in India, Bitcoin is not a “Currency” under RBI Act but may be considered as an “Electronic Piece of Paper recognized by ITA 2000” and interpreted for the meaning contained in the electronic document.

While the principal Cyber Law that we need to look at in this context is the Information Technology Act as introduced in 2000 and amended in 2008, it is also necessary to look at the Payment and Settlement Act 2007 which may undergo further modifications now as suggested by the Watal Committee, the amendments to ITA 2008 itself which is under consideration as well as the newly proposed Data Security Act.

In the back of these laws, one cannot forget the “Negotiable Instruments Act 1881” as amended from time to time and more recently in 2015 and the different regulations of RBI.

The ITA 2000 brought the legal recognition of electronic document with a paper document and the NI amendment Act of 2002 introduced the concept of Cheque in Electronic Form. This concept of Cheque in Electronic form went through a major transformation in the NI amendment Act 2015 which brought Cheque in Electronic Form into the provisions of the NI Act 1881 as amended upto date since Cheque in Electronic Form is part of Section 6 of NI Act.

With this, it may be possible to invoke several aspects of NI Act such as the responsibilities of the Paying Banker and Collecting Banker as well as Payment in Due Course and Collecting Bank’s responsibilities etc which need to be interpreted in the context of electronic instructions that go behind the UPI or Wallet transactions where the customer of one Bank is deemed to have issued an electronic instruction to his Bank to make payment of a certain sum of money to a certain person and the same is collected by another Bank on behalf of the intended payee of the instruction.

To most technologists and even the non Banking regulators, this concept of a “Wallet Transaction” being spoken in the same breath with a “Cheque” may come as a shock.

When the full implication of this comparison dawns on the society, we will know that there are clear interpretation of how a “Forgery” of an electronic instruction  will be a nullity in law and the paying banker will be liable for the payment of such forged instruments.

A more detailed debate may be required on the impact of NI Act on the new instruments of cashless economy including the UPI and USSD, the role of the Banks under Sections 85 and 131 of NI Act, role of the NPCI which is similar to an intermediary in a physical society who carries the cheque from the drawer to the Payee determining whether it was properly “Delivered”.

I am sure that this line of thinking opens up thoughts on how the digital signature or E Sign needs to be used in digital payment instruments in substitution of physical signatures on paper based instruments and how the absence of a legally recognized authentication on “deemed electronic cheques” may affect the liabilities of the intermediaries.

The “Intermediaries” will then also be exposed to the liabilities that arise out of “Non Compliance of ITA 2008” and the impact of Section 85 and Section 79 on vicarious liabilities.

Amidst all these discussions looms the risk of the ignorant regulators trying to fall for the pressure of vested interests and trying to legalize Bitcoins. If done, a flood of around Rs 6.5 lakh crore rupees of digital currency will flow into the Indian floating currency system causing a 50% jump in the floating currency and causing disruption that will actually be destructive.

There are may in the technology industry who are pushing Block Chain technology as an “Authentication Technology” and building a relevance for Bitcoins through this mis-represented logic. “Block Chain Technology” is a “Ledger Keeping technology and cannot be used in replacement of what the law today recognizes as “Authentication” which is “Non Repudiable” under law.

In the light of these developments, the “Risk of Wrong Regulation” also becomes necessary to be taken into account. It is often found that the consultative process of the Government is inadequate and the Consumers are never part of this consultation. We the Citizens therefore are hoisted with law that we were never part of making despite calling ourselves a “Democratic Society”. Laws are made at the instance of business which has an agenda to exploit the innocent public and this trend needs to be changed.

It is therefore essential that more seminars like the Cash Less Economy needs to be held particularly in Mumbai and Delhi to attract the attention of RBI and the Finance Ministry. We need to debate on the theme of “Disruption Without Destruction”. The Government may also pro actively consider Co-opting consumer representatives who are “Techno Legal Economic Experts” so that a proper perspective is considered before key decisions are taken.

Even if all normal business risks cannot be eliminated through better legislative clarity, Government may still consider reduction of the risks substantially through the encouragement to be given to the Cyber Insurance Industry which needs to shoulder some of the liabilities that the consumers need to bear out of the systemic risks that arise as the nation move towards cash less economy.

Naavi

For the last few days, I am having a problem with the Word Press. It appears that a post above a particular size is not getting published or updated.

If I post a screenshot image this post also cannot be uploaded.

The error message says

Quote

Not Acceptable

An appropriate representation of the requested resource /wp/wp-admin/post.php could not be found on this server. Additionally, a 406 Not Acceptable error was encountered while trying to use an ErrorDocument to handle the request.

Unquote

Can anybody suggest how this can be rectified?

Help will be highly appreciated.

Naavi

P.S: The problem was identified as a Mod Security on the server. Has been set right now.