7 Feb 2023

Head of National Payment Card System Vladimir Komlev: I can't say we're pleased with competitors leaving the market

The past year has been one of tectonic shifts for the Russian payment market. Following the departure of two of the largest players from the market, Visa and Mastercard, the Mir card operator has virtually become a monopoly. Vladimir Komlev, head of National Payment Card System (NPCS), told Interfax in an interview about what challenges NPCS has come up against, how the company is countering threats in the sphere of information security, what technologies are being developed on the market, and what awaits it in 2023.

        Q.: Is there approximate data on how many Mir cards were issued in 2022?

        A.: Mir issuance is fairly dynamic. That said, international payment systems have left, but their cards remain, they're active, people are continuing to pay with them, and this is also one of the functions of NPCS. But these cards are now gradually being replaced. More than 170 million Mir cards had been issued as of December 1. Approximately 6 million cards were issued per month on average in 2022. By way of comparison, there were 112 million cards on December 1, 2021. That is, banks issued almost 60 million cards over the year.

        Q.: What share do Mir cards have on the market at the moment?

        A.: We see that Mir is actively increasing market share based not much on issuance as volume. As of October 1, based on the results of the third quarter, the share of national payment cards in the overall volume of payments for goods and services using cards totaled 38.8%. That's even more than issuance, here we hold 38.6%. It can be said that Mir is becoming the largest payment system specifically by volume of transactions, and the dynamics aren't decreasing. We expect that 2023 will also be very dynamic, both for the Mir payment system and for the Faster Payments System (FPS).

        Q.: The Central Bank has set an objective to launch transfers between legal entities through FPS by April 2024. Are such transactions already being carried out in test mode?

        A.: Indeed, the Central Bank has set such a task, and for the part of NPCS, all technical preparations have already been completed, and a fully-fledged technological base is in place for such transactions to be carried out. A group of pilot banks and companies have already begun testing such payments.

        We as operational payment clearing center FPS are first of all testing such transactions in all situations, how they go through, how seamlessly and easily they go through our processing systems, so that any scenario may be fully used as soon as the very near future. B2B service speeds up the movement of money, these are instant deposits and withdrawals. All market players are interested in it, first of all merchants, and the sooner the better.

        Q.:  SBPay successfully tested payments using near field communication technology at the end of 2021, but it still hasn't become widespread. Is there any information on when payment through NFC will again be widely available, not just to Android users, but for iOS, as well? And what's hindering this now, what difficulties are arising?

        A.: The NFC tags that are used in FPS are so-called payment links, and a lot of complicated technical processes take place under the system's hood in order to complete a contactless payment convenient for the client. And, let's be honest, infrastructure is needed in order to implement such a payment method, which needs to be rolled out and fine-tuned, including cash register systems, so that they are able to receive and handle information from our systems. This is completely new uncharted territory for our country's payment infrastructure.

        In fact, we talked about NFC tags, it seems a fairly long time ago already, and it would be nice to see them everywhere today. But this, like introducing other new payment methods, takes time.

        Q.: Banking institutions faced a shortage of chips for bank cards last year. How is the market dealing with this problem now?

        A.: This problem doesn't just exist in the card industry. The issue for crystal and chip producers on the whole is a difficulty that arose the world over during the pandemic and couldn't help but affect the banking sector. In my view, Russian companies have been able to resolve it fairly effectively for now amid the restrictions. The problem with chips has largely been solved in our country now. We see what a serious volume of prepared cards Russian manufacturers were able to ship in 2022. The main problems that could arise now are with logistics and perhaps price hikes as foreign manufacturers are oriented primarily toward partners in Asian countries. The cost of cards and their cost to banks have increased considerably over the past year. And it also reflects on what bank card products are now economically profitable or unprofitable to make.

        Q.: New interchange fee changes entered into effect on Mir cards on January 1. Why did NPCS decide to change the interchange fees? And what categories of purchases do these changes affect?

        A.: Interchange rates affect all market players. First of all, issuers, for whom the interchange fee is the main income in the card business. Second of all, acquirers and merchants. And we needed to find a balance in these rates across a whole number of categories. Including those where the value of special reduced rates more favorable to the merchant and the bank acquirer were based on very subjective parameters that we on our side could not verify in any way. And I must confess, there were abuses, so-called miscoding when, for example, no matter what restaurant you go into, it turns out to be fast food by MCC [merchant category code], where the rate is completely different. We steered this system toward transparent computational parameters on our side, decoupling it from enterprise type and MCC. For example, a restaurant, cafe, fast food, no matter, if the check is more than 1,000 rubles, the full rate will be applied, and if the check is less than 1,000 rubles, then there can be a lower rate. All participants in the payment process benefit from this, because it levels conditions for them.

        The Bank of Russia has also given NPCS the authority to fulfill a number of functions to support the operations of cards of international payment systems, and MCC codes and interchange rates haven't changed here.

        Q.: The Central Bank noted problems with import substitution of hardware security modules even prior to the imposition of sanctions. The requirements of the regulatory documents included full substitution with domestic products by 2024, but recent events necessitate a significant acceleration. What stage is the process at now?

        A.: Definitely, the market has become accustomed to living off foreign equipment. NPCS is taking part in work to transition to using domestic HSM modules. These are devices that should work flawlessly, a great deal of important functionality is built on them which affects the security, stability, and resilience of the entire payment market, and therefore, it must be treated with the utmost care and responsibility, which, in essence, is what's happening now. Systematic testing is underway of all necessary aspects in line with those deadlines that have been established in the project's roadmap.

        Q.: An agreement on introducing virtual Mir benefit cards in the accounts of Russian citizens on the Gosuslugi public services portal was signed at the St. Petersburg International Economic Forum (SPIEF). How is this work coming along?

        A.: The main objective of the project at this stage is to make it so that it is easy, convenient, and fast to enter reduced fares on public transport as prescribed for this person or another on your Mir card on the government services website. When we're talking about truly largescale projects that millions and millions of Russian citizens are going to use, here, of course, it's very important for the ideal client journey to be worked out and for cardholders not to have any difficulties receiving one service or another. Therefore, project organization and technical work is still underway and one of the pilot regions where there are plans for first launch has been chosen. We'll talk about the launch of the pilot later.

        Q.: The new PSI DSS 4.0 standard was published in the spring. How are companies transitioning to the new standard?

        A.: NPCS has been involved in the PSI council as an associated member practically from the first days of the existence of the Mir payment system, since 2016. This is a body that is truly important for the entire card industry that allows for the use of collective experience to ensure the security, storage, and processing of card data. We actively participate in two working groups, offer proposals for our part on these or other standards. That is, this is a two-way street, that's important.

        It took a fairly long time to reach the PSI DSS 4.0 standard. It will be mandatory starting in April 2024, and we're going to use it in our systems and in rules and standards. It will also be expanded here by rules regulated by the regulator, the Central Bank, and other organizations. That is, it's a synergistic effect from supplementing international standards with Russian rules and security requirements.

        Q.:  The Central Bank has mentioned that it is working through the possibility with the NPCS of banks providing services on the cards of international payment systems such as Visa and Mastercard, even if they were never their members. That is, it is expected that the NPCS will now verify the full profiles of banks containing a significant number of parameters that were earlier performed exclusively by the operators of international payment systems automatically. Is the NPCS ready to take on such functions? And is such work already underway?

        A.: We know that such a request has been voiced by a number of banks that when international payment systems left were preparing to receive licenses from them and begin servicing their cards. But after all, you can't accept payment from Mir in Russia and not accept Visa and Mastercards of Russian banks that are still being used in our country, because that wouldn't be full service on the part of banks and merchants. And here our objective is to guarantee so-called BAU [business as usual] processes, technical settings for acquiring, to do things so that we can support a bank that is, for example, in the process of migrating from one processing center to another. And this is purely a technical story and not the creation of new business entities in other payment systems. But we don't see any serious demand here for banks to be lining up.

        Q.:  International payment systems provided banks services to counter risks and decrease fraud prior to leaving Russia. Has the NPCS been able to close this niche by providing its members with similar instruments? Do similar instruments and services of the NPCS differ from those that were provided by international payment systems? How are these services developing as the NPCS develops?

        A.: More than. Our security systems and fraud prevention are at the very least no worse. We have always given and are continuing to give a great deal of attention to all possible risks of the payments market. At present, all systems connected to guarantees of operations we're conducting not only for Mir, but for all other payments systems that have left the country.

        We launched a fraud information system back in 2016 when the first Mir cards came out. It has been constantly developing since then both functionally and algorithmically. And even though the system was created for Mir, the ability to exchange information and analysis on the transactions of cards of international payment systems was embedded in it from the beginning. That's as concerns online monitoring and transaction activity. 

        We signed an agreement with Interfax at SPIEF in 2018, and the Business Inspection Service was created within the framework of this cooperation, which is very actively used by banks participating in the Mir payment system. They send practically all potential clients to us for inspection, merchants with whom they want to begin cooperation. And thanks to the Business Inspection Service, we can check many merchant parameters and assess the possible risks to banks in working with these or other counteragents.

        The efficiency of this service for banks is substantially higher than analogues. I don't want to name which ones specifically, but international payment systems had similar ones, of course. We receive a great number of reviews that our service in integration with SPARK is functionally very convenient for banks, as well as in terms of interface. This service is also forging ahead, we're constantly developing it, new reports are appearing there, and checks based on the Bank of Russia register, and integration through API [application programming interfaces], and other capabilities.

        When the project with Rostourism [Russian Federal Tourism Agency] was in place and we needed to verify all those tourism agencies and aggregators that wanted to participate in the tourist cashback for vacationing at Russian resorts, the Business Inspection Service was, of course, key in connecting these companies.

        It's important to make mention of the decision-making service that we created for banks beginning work with a new version of secure e-commerce technology, Mir Accept 2.0. It was created on the basis of 3-D Secure 2.0, and we had it as a baseline. For cards of Visa and Mastercard, we support at least version 1.0. But we are actively developing specifically version 2.0 now, which entails so-called seamless transactions, when there's no need to enter a code from a bank text message, but risk levels can be seen from a whole number of additional parameters. The decision-making service developed by us actually allows the bank to off the client the most convenient and quickest route while maintaining a high level of security. You just enter the card number or press one button in the mobile app, and you no longer need to wait for any texts, and the bank doesn't need to pay for these texts, after all, when you have millions of clients and tens of millions of transactions, that can be a rather sizeable budget.

        But you need to know how to work with big data for that, and not all banks have the resources and abilities for that. That's why we created the Decision-Making Service, which in addition to the instruments of the bank itself scores transactions, putting them into either green, yellow, or red zones. This rids banks of a great deal of work, because we have a transaction approval level without additionally reaching out to the client at somewhere around 40% today. We have enough data to thus color transactions green, putting them in the green, safe zone. But most importantly, the more transactions there are, the more the analytic base amasses and the faster the green zone grows. 

        It's important that these are our own domestic developments and solutions. Other services are functioning, for example, calculated risk oversight based on a fraud monitoring system. It allows banks to, for example, receive information on reaching the limit of the guarantee fee, work with them does not stop, and they're able to refill the accounts from which payments are made on time.

        Q.:  Has the NPCS experienced growth in the amount of cyberattacks since the end of February? What it ready for them?

        A.: I think that all companies experienced it in 2022. It was particularly rough at the beginning of the year, although the attacks haven't stopped now. Our specialists together with the Digital Development Ministry, the Bank of Russia, telecom operators, and companies specializing in protection from DDos organized a savvy defense allowing uninterrupted work to continue under an enormous onslaught of these attacks. The attacks have become more powerful this year, refined, hybrid. Very trying days were spent on this difficult, multi-vector area.

        Q.: Has the NPCS seen an outflow of highly qualified personnel and IT specialists since the spring of the past year? Is there a shortage of personnel right now?

        A.: To say that no one at all left would probably be incorrect, but what there definitely wasn't was a massive outflow. We're constantly searching for talented new developers, and we always have openings - services and projects are developing that need support, and the need for Java developers, for example, is always high on the market, and there's competition for these people. I will note also that all specialists key for the company here are continuing to work, some have come back to us from other companies in the past year.

        Q.: Is the NPCS planning new promotions and marketing campaigns in the near future?

        A.: We are hands down always developing great deals for cardholders. One of the key plans for 2023 is creating a single NPCS loyalty platform on which offers - cashback, discounts, promotions - will be available for both Mir cardholders and Faster Payments System users. We see that direct cashback always shows high efficacy and high demand from citizens. FPS primarily implements prize drawings for now, but we want to do different actions, including simple and clear cashback for purchases. So that if you make a payment using FPS or Mir at one or another partner of the program, the money comes right away.

        Q.: You mentioned during an Association of Russian Banks conference that the NPCS is thinking of creating solutions that cannot be suspended or frozen under sanctions. What technologies could this be?

        A.: If we talk about what cannot be suspended or frozen under sanctions, then all technological solutions should be done here and also located here infrastructure-wise. From the outset, when our processing centers and data centers were created, we did this as much as possible on neutral technologies. That is, if these are servers, then those that don't depend on a specific producer, you can get them practically anywhere. And in transactions, in the product solutions that we implement, we have from the start nevertheless relied on and rely on the principles that all key products should fully belong to us. And even I we cooperated in the production process with this or another company, there should absolutely further be a complete transition in the development, support, and maintenance of this product. These should be technological solutions that are fully independent by way of licensing.

        Everything that NPCS works on today, all programs, products, services, it's all made in Russia. All this is really done here in the company and implemented on a base located within the country. But, unfortunately, this is very difficult to do in terms of international projects.

        Q.: How would you characterize the year in short? And what goals does NPCS have for 2023?

        A.: The year wasn't easy. It worked out that we, more or less, became the beneficiaries of the departures that happened from the market. Nonetheless, I can't say that we're pleased about this, because some or other technological solutions left.

        But this state of benefit wouldn't have happened if not for the previous seven years of hard work to replicate technologies. All that has been done in the NPCS - integrated service that is truly able to guarantee all the needs of the market. More or less, yes, Visa and Mastercard already worked through us, and we processed all their transactions. But we didn't stop there in due course. Truly, the strategy was on the money - to make our own Russian payment system that following the departure of international players continued to develop to the utmost, as is now happening.

        And our technologies and the Faster Payments System of the Bank of Russia, this is truly a challenge, for the market and for us, too. To create the right product content and make it just as simple, easy, and clear to use in the client journey. To make a good network so that it's convenient for enterprises to work with FPS, as they're the main interested parties here, probably, so that the product takes off. But without a large number of users, people for whom this product is interesting and convenient, this won't work out, either. But this is probably me already talking about plans for 2023 and possibly further. We're planning to fully invest in the development of the Faster Payments System, as a product and as a service convenient and in-demand to the max on the part of Russian individuals and merchants.