Virtual banks in Hong Kong are looking to meet growing consumer demands to improve the digital banking experience by disrupting the traditional bank landscape.

While banks and financial services organisations are no strangers to technological disruption, the introduction of virtual banks has also put the spotlight on risk management. Regulators, investors, and market watchers are now asking whether the virtual banking model, which promises faster, more convenient, and accessible financial services, elevates the role of risk management.

To examine this question and others, I had the privilege of hosting an expert webinar in July 2021 with some industry leaders in virtual banking, including Rockson Hsu, Chief Executive Officer at ZA Bank, and Wendy Ennis, Head of FCC at Mox. Both ZA Bank and Mox are among the pioneers in the Hong Kong virtual banks.

The webinar, jointly organised with the Hong Kong British Chamber of Commerce, explored the outlook for Hong Kong virtual banks and how they address risk management.

Virtual Banks accelerate banking innovation

The virtual bank initiative was first introduced in 2017 under HKMA’s (Hong Kong Monetary authority) Smart Banking Initiative. ZA Bank received its license in 2019 and was the first to launch in Hong Kong 16 months ago.

Virtual banks launched with three objectives: promoting adoption of Fintech innovation, furthering financial inclusion and offering a new seamless customer experience. Essentially, the goal was an easy, frictionless and fun banking experience for the masses.

In Hong Kong, the biggest challenge for virtual banks was entering a mature saturated banking landscape. With already 162 licensed banks and around 1,200 physical bank branches – these are considerable numbers compared to the Hong Kong population.

However, the speakers noted that there are always areas of improvement, especially for a frictionless experience. The virtual banks focused on mobile banking, which was largely underdeveloped in Hong Kong at the time. Due to licensing restrictions the virtual banks were unable to set-up physical branches. They fast turned this into an advantage launching mobile banking, making everybody’s mobile phone into a virtual branch. So, at launch, each virtual bank had the potential to grow into over seven million potential hand-held, in pocket branches.

The frictionless experience helped virtual banks raise the bar on digital banking experience and attract new customers. Opening an account in traditional bank may take hours while it takes as short as two minutes to open an account in virtual bank with your fingertips. During the webinar, the speakers shared their performance figures. ZA Bank attracted more than 300,000 registered users as of March 2021. Mox went live in September 2020 and, after nine months, had 150,000 customers. A vast majority of registered customers are under the age of 40.

The launch of virtual banks also shifted banking habits, for example, customers previously limited by the branch network opening hours were now doing banking after hours and over weekends, through the virtual banking apps. They were also supported by 24/7 customer service in the apps.

Understanding customer stickiness and pain points

Account opening is the first step when engaging a bank and is often the most onerous. Virtual banks dramatically streamlined it. While the required processes and procedures remained intact, most of these are automated and have easy-to-follow guides. With virtual banks, setting up an account just needs a quick selfie with a copy of your Hong Kong ID card. This flexibility shortened account opening times from days or hours to just 5 minutes, end to end.

Virtual banks also added fun by gamifying banking. For example, the ZA Quest got customers engaged in the app, meeting the virtual bank’s aim to make it part of their daily lives. The virtual bank focused on spending and payment services for gamification since they are the most used services, unlike a loan or a time deposit.

The role of RegTech and data sharing

Virtual banks are expanding their security and compliance by collaborating closely with the growing RegTech community. They are testing out different approaches, further accelerating the fintech industry forward.

Specifically, the speakers noted that virtual banks found considerable advantages in using RegTech for managing transaction monitoring. Their experience of working with RegTechs was also regularly shared between peers in industry knowledge sharing meetings. The joint belief was that expertise sharing would make the overall virtual banking industry stronger. Meanwhile, the speakers noted that internal training was essential to enabling an innovative and agile mindset without compromising security.

When it comes to data sharing, the speakers pointed to the HKMA initiative for commercial data interchange. The initiative looks to build a consortium to gather external and internal information so that the industry can collectively assess risk better across all data — not just credit risk — by leveraging the database. A virtual bank committee was also the Hong Kong Association of Banks to promote data sharing.

Fintech innovation: the road ahead

Looking ahead, the speakers discussed was the Open API Framework, one of the seven initiatives announced by the HKMA in September 2017 to prepare Hong Kong to move into a new era of Smart Banking. The Framework takes a risk-based principle and a four-phase approach to implement various Open API functions. It also recommends prevailing international technical and security standards to ensure fast and safe adoption. The speakers noted that the framework would serve as an essential guide for the banking industry in Hong Kong to adopt APIs effectively and strike a good balance between innovation and risks.

HKMA announced a new “Fintech 2025” strategy to give further impetus to fintech development in Hong Kong. Hong Kong is also driving the central bank digital currency project for cross-border payments together with the Bank of Thailand to facilitate real-time cross-border foreign exchange payment-versus-payment transactions in a multi-jurisdictional context and on a 24/7 basis. These new initiatives will further foster the industry Fintech innovations and drive more customer-centric services.

Price of seamless customer experience

While seamless customer experience has increased the interest in virtual banks, the ease of opening has also attracted fraudsters. After all, they don’t operate in the confines of a regulatory environment and are constantly exploring new scams and schemes every day.

The speakers noted that virtual banks still adhere to the strict AML and cybersecurity rules that govern the traditional banking environment. However, the ease of account openings and ease of using the application have meant that the virtual banks had to double down on improving the security of their entire ecosystem, from the front end to the back end. A priority for the virtual banks is a prudent risk framework, this priority is very much seen as critical for their growth.

The virtual banks deploy a multi-layered, risk-based authentication that adapts to each of the bank’s customer. LexisNexis® Risk Solutions recommends organisations to consider the following framework:

  • 1st line of defence: Risk Assessment. Know the risk before you know the person. Establish risk for a sign-in attempt or other user activity based on factors such as location, network reputation and device footprint. The higher the risk, the more additional layers of authentication may be required, such as a one-time password to grant user access.
  • 2nd line of defence: Identity Verification. Know the claimed identity. Identity verification will verify collected identity evidence against public records and data from multiple credit bureaus to ensure an identity exists. Also, verify the supplied bank account details are associated with the identity.
  • 3rd line of defence: Fraud Assessment. Know the risks associated with the identity. Establish any fraud risks posed by the individual’s digital or physical identity and behaviour to determine suitability to do business with them.
  • 4th line of defence. Identity Authentication. Know the person is who they say they are. Protect your organisation and maintain a seamless digital experience for your customers by dynamically assigning additional identity authentication checks to higher risk identity scenarios.

To learn more, visit our Fraud and Identity page.