e-Transactions: the impact of the internet on the financial sector. (Cover Story).

It's hardly great news that there has been tremendous growth in the use of the Internet and other electronic facilities to process financial transactions.

According to the Federal Deposit Insurance Corp., transactional Web sites have more than doubled each year for the past six years, growing from one in 1995 to nearly 2,500 in 2000.

This growth is a reflection of the fact that over the past few years, financial leaders have been considering various ways in which to allow their customers to transact business using the Internet. This objective is now reaching beyond the financial services industry into non-electronic business segments, such as the building supply industry. Furthermore, this growth is likely to continue to climb as the number of Internet users, Internet connection speed, and the number of transactional Web sites continue to increase.

Despite these numbers, larger banks are still reporting that the overwhelming majority of their transactions are still manual. A high percentage of manual transactions may be attributed to the fact that most business transactions, such as check cashing and deposits, are still originated by commercial and small businesses. Even so, there are many changes in process that will facilitate and encourage increases in electronic transactions.

The number of adults using PC banking is also growing. With this growth, there is an increased awareness of the benefits of using online transaction processing, thereby fueling the thought that all business should be electronically facilitated.

Gartner predicts that worldwide business-to-business (B2B) e-commerce will total $3.6 trillion by 2003 and $8.5 trillion in 2005. Online financial activity had a slower start, but has had steady growth, from 6 million users in 1998 to 27.5 million users in 2000. During 2000, only 30 percent of the Internet-capable households were using some form of Internet banking, indicating that there is tremendous room for increased use.

The most common types of online transactions have been investment management and trading, insurance transactions, online mortgage services, credit cards applications and payments, and loan applications.

Cash management functionality, such as automated clearinghouse (ACH) and financial electronic data interchange (FEDI), is fueling growth -- banks have developed these systems and are now piggybacking development of other banking services. This is providing substantial potential for growth because currently only five percent to 10 percent of all U.S. businesses use ACH for their disbursements. This is primarily due to high set-up costs. Increased ACH use will come with reduced cost and increased business partner acceptance and demands. Electronic commercial payment and presentment will require a degree of customization due to the customer's need to attach invoices as well as interface payments with accounting systems.

[GRAPHIC OMITTED]

The e-Commerce Value Chain

Consider that the consumer and the merchant are on either ends of the electronic commerce value chain, with the authentication network and transaction processor (bank) in the middle. Banks have traditionally been the trusted agents, have the largest customer base, and have received the initial benefits from electronic commerce. Value has begun a steady migration to the ends of the value chain. Customers can receive and pay bills from one point using products from multiple issuers. Merchants can influence and enhance the consumer experience by providing innovative and time-saving means of doing business. Merchants can add value to the payment process, for example, by offering discounted prices for electronic payment.

Merchants can-also reduce their costs by receiving electronic payments, which results in reducing and sometimes eliminating the need for data entry, as well as reducing the error rate and the time to investigate and correct the data. By increasing and effectively managing cash flow, merchants may also be able to reduce costs associated with lines of credit.

Trends in the Use of Electronic Transactions

Financial institutions are developing new means of processing their current transaction base. Two traditional areas of service have been check processing and lockbox services. These areas are also undergoing transformation to electronic processing functionality.

Check Truncation

Almost every individual and business has used, and possibly still uses, checks to initiate payment for goods or services. A trend currently in development is called check truncation. In this payment processing method, a payment starts as a check and ends up as an electronic payment transaction. These transaction services operate as follows:

* At the point of sale (POS), the merchant's clerk rings the sale and swipes the customer's check in a magnetic ink code reader (MICR).

* The MICR information and the related transaction (sale) information are transmitted to a site where the MICR information is converted into electronic transaction format.

* A request is sent to the paying bank for verification, and an approval transaction is returned from the bank to the store POS system.

* The customer signs the authorization documentation, and the clerk voids and returns the customer's check.

Lockbox Truncation

Many businesses contract with banks and other financial institutions to provide lockbox services. These services provide a central collection point and faster processing for payments. Lockbox truncation works as follows:

* The billing merchant or service provider notifies the customer of the truncation service and obtains authorization for use.

* The customer mails the check payment to the biller.

* The biller captures the check and other information from the MICR line on the check.

* Biller truncates the check (using the service described with POS systems) and transmits payment as an automated clearinghouse (ACH) debit transaction.

* The entry flows through the ACH network and is posted to the customer account.

These types of services enable the financial institutions to electronically process traditionally generated transactions, thus speeding up payment.

The payments system facilitates a strong economy. For example, if a merchant or manufacturer has a high confidence that they will receive payment for goods sold, they are more likely to order or produce more goods on a shorter term basis. Accordingly, workers are paid on time and more likely to spend, thereby fueling the cycle.

Advances in communications and information technology offer opportunities to improve the efficiency of retail payments. Efficiency comes in the form of reduced time to deposit funds. Also, since the payment is an electronic transfer, the possibility of bad checks is reduced or even eliminated. Of course, with reward comes risk. Unauthorized use of credit card or bank account information can put consumers at great risk of financial loss. Businesses are at risk in that the funds may be transferred long before goods or services are delivered, thus reducing cash flow for the purchasing organization.

The ability to manage these new risks while promoting innovation will be foremost in the minds of public policy makers as they begin to consider the elements of an appropriate legal and regulatory framework. The goal is to assure that the payments system protects the consumer and promotes the efficient flow of commerce.

Addressing Privacy Issues

Most e-business facility users are concerned with privacy. "Will my information be sold or shared without my knowledge or consent?" " Will information on my purchase habits be used to load my e-mail account with junk advertisements?" " Are financial institutions bound by any ethical guidelines that should prevent me from investigating every one of my intended business partners?" These are all commonly voiced concerns.

There are currently more than 50 bills addressing privacy before the United States Congress. The Financial Modernization Act, passed in 1999, requires institutions to establish and annually disclose to their customers a privacy policy. The federal banking agencies have issued final regulations on this new requirement, and compliance was mandatory by July 1, 2001. Federal banking agency examinations are expected. They will likely include policy review to determine clarity, how well the policy addresses current procedures, and each institution's practice for handling financial information protection. Industry leadership wishes to avoid legislation that hinders passing information technology-based savings to the customer.

According to the American Bankers Association (ABA) Web site (www.aba.com), the "ABA continues to work with our state counterparts, as well as with the Financial Services Coordinating Council (FSCC), to oppose privacy bills in the states that would create requirements beyond those in place under Regulation P. The Association has also participated in over 50 programs at the national and state level to assist our members with the implementation challenges of the privacy regulations."

A related privacy issue known as identity theft also has received extensive attention at the federal and state levels. Congress is considering a number of bills that would affect the public's use of social security numbers or create statutory mandates for responding to identity theft (which is already a crime under federal and state law).

Certifications

Financial institutions may wish to provide some increased level of assurance that the information contained on their Web sites is protected from unauthorized use or loss due to unforeseen circumstances. An independent review of management's assertions related to these areas may provide customers with that desired level of assurance. Many organizations are obtaining these reviews from certified public accountants and other consulting organizations. The resulting certification is often evidenced by a seal that is placed on the financial institution or merchant Web site which, when accessed, indicates the assertions made, the process followed for the certification, and qualification information about the certification issuing firm.

Existing Privacy Laws

The need for legislation has not escaped the attention of lawmakers. Several privacy laws are already in place to regulate information sharing. Recordkeeping professionals should be familiar with these laws and investigate those that are particularly applicable to their organization. In-depth information about each of these acts is available at the American Bankers Association Web site (www.aba.com).

1. Gramm-Leach-Bliley Act of 1999 established a set of comprehensive privacy laws at the federal level applicable to any firm that provides financial services. The new law

* requires annual customer notification of privacy policies

* allows customers to elect not to have their information shared with third parties

* includes specific prohibitions regarding account information disclosure

* establishes standards to regulate security and confidentiality

2. The Fair Credit Reporting Act gives consumers the ability to stop the sharing of credit application information and to stop unwanted credit solicitations.

3. The Electronic Fund Transfer Act requires that financial institutions inform consumers of electronic transaction information-sharing practices. This includes virtually all deposit accounts.

4. The Right to Financial Privacy Act protects consumer records maintained by financial institutions from improper disclosure to federal government officials or agencies.

5. The Telephone Consumer Protection Act gives consumers the right under federal law to stop telemarketing calls from a particular company.

e-Transaction Authentication Issues

Transaction authentication has been a topic of discussion since early in the evolution of e-commerce. Use of digital signatures is becoming widely accepted and has attracted the attention of legislators.

Digital Signatures

On October 1, 2000, the Electronic Signatures in National and Global Commerce Act was signed. This act states that an agreement, contract, or transaction signed electronically is enforceable in a court of law. Accordingly, financial services institutions can now legally transact business using electronic signatures, allowing transactions such as mortgages, funds transfers, opening and closing of accounts, benefits enrollment, and beneficiary designations to occur in an electronic environment.

The law defines an electronic signature as "an electronic sound, symbol, or process attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record." Fortunately, the legislation does not attempt to define acceptable technologies except to indicate that the technologies must be mutually acceptable to the transacting parties. Since a valid signature can be as simple as a digital image of a signature (enabled through an electronic pen and pad) or as complex as today's public key infrastructure (PKI) and associated encryption methods, the technology decision maker must define relevant business objectives and understand the risks, such as cost and unauthorized use associated with alternative implementations.

There are possible additional benefits to the implementing organization. These include reduced transaction timelines, reduction in paper processing costs, facilitation of customer migration to the Internet as a business channel, and increased online transaction security.

When compared to physical signatures, e-signature technologies are, in general, a more secure authentication method. Many financial institutions are studying the possible implementation of a public key infrastructure (PKI) system that will allow them to exchange electronic information securely with unknown parties.

PKI is the delivery channel for public key cryptography, a method that allows the parties to a transaction to keep a communication private through the use of a two-part key made up of public and private components. To encrypt messages, the published public keys of the recipients are used. To decrypt the messages, the recipients use their unpublished private keys, known only to them. Quite simply, if the signer's private key is not compromised, which can happen by releasing the password or allowing access to the device containing the private key, a document cannot be falsely digitally signed.

Conclusion

When considering all of the facilitators of change in the e-business function of maintaining records, change is coming faster than can sometimes be imagined. Records managers should pay attention to legislation that will dictate how they maintain records. They should interact with peer organizations and business partners to build synergistic capabilities. They should also be proponents of effective information retention within their organizations by leading information-sharing opportunities with the decision makers. As a result, records managers can better manage the impact on their profession.

AT THE CORE

THIS ARTICLE EXAMINES:

* the growth of e-transactions in the financial sector

* privacy issues resulting from e-business

* legislation and regulation affecting e-business in the financial sector

ABOUT THE AUTHOR: Thomas D. Powell has more than 20 years' experience in consulting with firms regarding information protection and related assurance and currently lives in Charlotte, North Carolina, He may be reached at [e-mail].