ANZ and CBA push for consolidation of EFTPOS, BPAY and NPP

The days of using EFTPOS, BPAY and the humble BSB number to make transactions could soon be numbered.

After around 50 years providing the core infrastructure that still powers direct bank debit account transactions, along with ATMs, a once in a generation consolidation of payments platforms has inched closer, after two of the big four banks indicated support for collapsing Australia’s biggest mainframe stack.

Both the Commonwealth Bank of Australia and the ANZ Banking Group have lodged submissions with the Reserve Bank of Australia’s review of payments regulation saying the current menagerie of payments schemes and infrastructure needs to be reviewed with a view to an industry-wide platform.

That’s one industry-wide platform – not the current siloes of BPAY, EFTPOS, cheques and in some banks even passbooks.

While most Australians see EFTPOS and BPAY as brands in their own right, in reality they operate as mutually-owned low-cost payments infrastructure providers for banks, what were credit unions and building societies and big merchants.   

Any final decision to consolidate – which is still a couple years away – would have massive ramifications for literally tens of billions of dollars of bank-owned systems initially rolled out in the 1980s, predominantly on IBM’s zSeries (or earlier) running COBOL and dozens of bespoke and proprietary legacy applications that linger to this day.

Known as the ‘direct entry’ system (as in you don’t have to go through intermediaries) the complex web of interbank facilities lets Australians deposit money straight from their bank accounts to another person, biller or merchant.

“In the long term, the direct entry system should be retired as part of a broader rationalisation of payment systems over the period of 2025 to 2030,” the CBA said in its submission to the RBA.

“CBA supports AusPayNet’s industry consultation on ‘A Future State for Australian Payments Systems’ to co-ordinate industry activity to reach this target.

"For the NPP to be a viable alternative to direct entry, particularly for bulk corporate payments, the costs of processing and settlement will need to become comparable to direct entry costs.”

The ANZ, though more restrained, was also supportive of an infrastructure roll-up.

“The present structure for industry governance and provision of domestic payment systems has been an important foundation for the positive performance of the Australian payments system,” ANZ said.

“ANZ believes that it is now timely to consider options for governance and provision of industry-based infrastructure and programs given the extent and complexity of the work to be done and the dynamic environment.”

Going the distance

The systems in question weave complex, maze-like network of bilateral bank-to-bank pipes run under a series of standards known as the Direct Entry System that is overseen by the Reserve Bank of Australia and industry self-regulatory body AusPayNet.

It’s a system that has been technologically superseded by the New Payments Platform in the same way Qantas’ once ubiquitous wide body workhorse, the Boeing 767 has been surpassed by the 787 Dreamliner.

The networking phenomenon of the direct entry (DE) system that millions of Australians now take for granted today was established, like the 767, in the 1980s, alongside the then world-leading EFTPOS (electronic funds transfer at point of sale) and the equally modernist ATM networks.

In terms of wiring, it’s not all that pretty today, but it worked a treat until the early noughties when banks were seriously considering dumping their own payments infrastructure for that of the credit card schemes (Visa, Mastercard and Amex) that doled out handsome interchange fees extracted from merchants.

Having watched Australia's domestic credit card, Bankcard, rise and fall, the RBA decided Australia might want its own infrastructure rather than outsourcing it to global schemes.

Because that could be very costly in the long term.

The 1980’s never died

Although reworked and enhanced many times over (like a 767), the Direct Entry system still essentially runs on the same, pre-internet network architecture probably best recognised for its BSB numbers (bank, state, branch) and referred to in the payments industry as ‘proprietary rails’ because they were not US owned.

(As an aside, former CBA chief and reformed Assembler coder Sir Ralph Norris helped write the trans-tasman EFTPOS and enjoyed ribbing his Australian colleagues by reminding them it went live in New Zealand first.)

However the pre-internet limitations (data size limitation in messaging being the biggest) of the direct entry system have gradually become more encumbering as time and technology marches on, especially now the real-time New Payments Platform (NPP) is up and running.

Having taken more than a decade of regulatory biffo to come to life – a core skill of Australian banking oligopoly is its capacity to disagree on any common technological innovation unless it’s forced upon institutions – the gradual but relentless growth of the NPP ultimately creates some technological redundancies.

Both BPAY and EFTPOS, which the direct entry system underpins, are the two most obvious low-cost transaction behemoths affected by any consolidation that could potentially see their functions rolled across onto the underlying NPP architecture.

And like the NPP, EFTPOS and BPAY are essentially owned by the main banks and other institutions, hence the ultimate disinclination to keep running three sets of infrastructure.

Preserving sovereign infrastructure

Understanding how Australia arrived at the creation of the NPP and its implications requires a bit of historical context.

EFTPOS, which facilitates debit based electronic transactions for plastic cards – that is draws directly from peoples’ bank accounts including allowing cash withdrawals – has worked well for decades, but has been essentially confined to the Australian and New Zealand market.

EFTPOS has also had two big technological handicaps. The first is that because global schemes Mastercard and Visa initially dominated tap-and-go or contactless standards based on their own rails – with the blessing of banks – they essentially locked EFTPOS out of contactless functionality, which has only recently been extended to EFTPOS.

Even then, because most banks issue what’s known as ‘dual network’ debit cards, contactless debit tap transactions for the most part default to Mastercard and Visa’s payments rails, cutting EFTPOS out.

Banks and supermarkets loved EFTPOS when it first hit, with Woolworths and Coles essentially made shareholders because they would give out cash at the till. But as cash transactions waned, and payments tilted from credit cards to debit cards, tap transactions took over cutting EFTPOS out.

That’s why when you make tap transactions on a debit Mastercard over $100, you get offered the ‘credit’ option on a payments terminal rather than ‘savings’ or ‘cheque’. The $100 limit before a PIN is invoked, as an aside, stems from what the US card giants estimated would be the upper limit of a tank of petrol.

Coles recently gave Visa debit contactless the flick, reverting contactless back to EFTPOS now that it could.

That move followed a similar play by Woolworths a decade ago to rein back hefty interchange fees paid on ‘scheme debit’ payments.

Since then the shift towards debit payments, rather than credit cards has continued at pace.

And then came the internet …

The other massive hurdle EFTPOS has faced is online transactions.

Because the internet and online transactions grew up in the US, online transactional standards, for better and worse, have largely the credit card rails.

In simplistic terms, online card transactions from their genesis were inherently insecure, relying on card numbers being sent in the clear in the same way you’d write down your credit card number and CVV on a mail order form.

That’s why online card fraud is referred to as ‘card-not-present’ (CNP) fraud, because the mag stripe or chip never actually hits a terminal. In Australia CNP fraud is now more than $470 million a year, almost all of which is worn by merchants, not banks or card schemes.

Card fraud is so prolific even Reserve Bank Governor Philip Lowe has publicly outed himself as a victim, revealing he had to get his kids to spot him some cash for the weekend after his cards got pulled.

In blunt terms, the man who signs Australia’s banknotes was left cashless thanks to the deficient PCI-DSS standard that credit card companies claim is world class.

But as huge amounts of payments went online, banks and merchants who were big billers soon realised fees as high as 3 percent were just not going to cut it.

… and BPAY

To get around the steep percentage fees initially charged by credit card giants for online debit transactions, big merchants (utilities especially) joined forces with banks to create BPAY as a work-around to EFTPOS’ lack of online functionality.

The reason was simple. Big quarterly bills (rates, utilities, telecommunications etc)were simply costing merchants too much, so another bank-backed transactional hub linking to the direct entry system was created.

As we’ve reported, BPAY has been racing to redefine itself in the face of the advent of the NPP, including providing overlay services.

Both BPAY and EFTPOS have launched extensive submissions arguing why the will continue to be relevant as stand-alone entities.

Westpac and the NAB also lodged submissions to the RBA review that are understood to be confidential.

We may not know for some time what those banks have proposed.

What we do know is that the biggest push for bank infrastructure consolidation in fifty years is now off and running.