CBPC Roadshow: Trust Is More Than a Handshake – Paulo Barbosa [Episode #4]

Shaun Ferrari 00:00:42 Hello everybody. Thank you for joining us on this next episode of The P.I.T. Exchange, where we talk about the latest in payments innovation and technology. I’m your host this week, Sean Ferrari with Currency Research. And we’re excited this week to bring you another episode of our road to the central Bank Payments Conference. Our road to CBPC. Episode series where we have another one of our great partners for the event, Banfico, joining us. And we have Paulo Barbosa, who’s the COO at Banfico.

Shaun Ferrari 00:01:15 Paulo, nice to. Nice to see you.

Paulo Barbosa 00:01:18 Hi, Shaun. Thanks for having me. Happy to be here.

Shaun Ferrari 00:01:20 It’s a pleasure. And we’re we’re thrilled to welcome you also to Istanbul in a few weeks. Looking to be a great program and can’t wait to to talk to you in person there. But in the meantime, great to talk. Virtually. maybe. But before we jump into, trust and trust frameworks and payments, which we’re going to spend some time on today. and also when you’re there in Istanbul, we can learn a little bit more about yourselves, about, Fico. so I’ll, I’ll turn it over to you for a little bit to tell us, you know what? What is it that that excites you in this space? What are you working on? tell us a little bit about about being Fico. take it away.

Paulo Barbosa 00:02:01 Sure. So it’s, Red stag company. So we have been building a technology for banks, central banks and other, you know, payment service providers.

Paulo Barbosa 00:02:11 It’s the word in Europe to this umbrella term that includes human institutions, payment institutions. So every entity which is impacted by, regulations and they need to build something technical to be combined with it. So we have been doing that since 2017. We are a London based company with subsidiaries in, Brazil, Saudi Arabia, Germany and India. and we have clients pretty much all over the globe. and it’s been a very interesting journey. So I joined a few years ago. but my background personally has nothing to do with technology or or even payments. I studied, international politics. But, you know, life takes you away. It takes you. But it’s it’s been very interesting and challenging. And I became the chief operating officer of the group. I’ve been driving the international growth of the company, and I’ve been following a lot of these regulatory, changes. And I’ve been recently appointed, to join the Payment systems market expert group from the European Commission. So it will also give me an opportunity to bring a lot of these lessons learned from different parts of the world.

Paulo Barbosa 00:03:27 and hopefully, you know, make it that Europe will be able to, in a way, catch up with other initiatives that were, very, very successful, in, in different parts of the globe.

Shaun Ferrari 00:03:41 Awesome. No, thanks for that. I was going to I was going to see I was going through your your LinkedIn information and I was going to mention your, your appointment to the, the European Commission’s, payment system Market expert group. congratulations on that. It sounds exciting and, can’t wait to talk to you again in a, in a little bit after you’ve had some time on that to to hear what’s being discussed and, see where that goes.

Paulo Barbosa 00:04:04 But sure. Have you.

Shaun Ferrari 00:04:06 Do those. Great. it is funny. I mean, you mentioned your your background in international international politics. Clearly there’s a lot going on in that space now. myself too. I was a government and economics major coming out of school, and, here we are talking all about payments and, all the latest.

Shaun Ferrari 00:04:26 It’s a it’s fascinating for sure. but maybe, you know, today, I think where we want to spend most of our time is really talking about about trust, trust protocols and instilling trust in payments. And there’s so much moving in this space. in terms of, agenda payments and in terms of different technologies that are allowing payments to happen, faster. And, and if we look back through, through time. Right. I think everybody was relying on, Over the past few years, APIs was the big thing. It was like, oh, well, we have we have APIs. Surely that’ll take take care of this. That’ll help the communication which which obviously it does. But, tell us a bit about why, you know, why aren’t APIs enough in this, in this world as we build these digital ecosystems?

Paulo Barbosa 00:05:20 Yeah. So a lot of the new payment schemes are based on APIs because it’s a very flexible technology. It’s quite easy to implement. so that’s the backbone of, for example, the open banking implementations, which was at least in Europe, and going back to the politics side of things, because in the end, if everything is linked, there was, the intention to push for a token payments and instant payments.

Paulo Barbosa 00:05:50 so basically to try to decrease the dependencies on the card schemes, especially the foreign card schemes. And that discussion is going. It’s coming back again more and more. When you talk about, you know, payments, sovereignty and how, at least in Europea, we’re trying to build new initiatives to, to not being dependent on, on foreign, payment systems. APIs have been greatly used to push for the implementations of of those schemes. But if you think about APIs, it’s it gives you the instructions to the technical instructions for the two systems to talk. Yeah. So if I build an an API, I will be able to, to connect with other, yeah. With a counterpart in a programmatically way. and it works pretty, pretty well. It’s it’s been it’s a proof model. It works fine. But then if we move into more of an ecosystem, approach where it will no longer be 1 to 1 interactions, it’s many to many, that the scalability can be a bit, a bit complicated.

Paulo Barbosa 00:06:58 So that’s why we talked about, yeah. Other things to bring the, the rules and regulations and, and the, the, the validations for you to be be so you can talk to the ones that you’re supposed to to be talking. And so API itself gives you the plumbing, but not yeah. The, the, the rest of the, of the trust. So you can make sure you’re trying to talk with the person you’re, you’re supposed to to be talking with.

Shaun Ferrari 00:07:32 Right. So it’s a they’re, they’re tools to facilitate or to accomplish the, the communication. But it doesn’t, it doesn’t tell you. Yes. You, you should be talking to this person or, or this is a even a valid maybe transaction or what’s going on behind the scenes. Yeah. Okay. So if I think about how particularly in the open banking world where you all spend a lot of your time, there’s so many banks, fintech companies, regulators, talking to each other. that in a world where we used to kind of work on one on one trust, like I verify you, you verify me.

Shaun Ferrari 00:08:14 Okay, now we can make a transaction. does that scale in a in an ecosystem like we’re in currently?

Paulo Barbosa 00:08:22 It doesn’t. And if you look at Europe, that’s been one of the biggest issues, with the success and the speed of the rollout that we had with, with open banking implementations in Europe, where there is no trust framework, enabling for the dynamic, connection between all these parties. So basically the fintechs need to do one on one onboarding. And it’s, it’s a model that, you know, it’s really, really hard to to scale in and maintain. and that requires, you know, manual due diligence. Bilateral contracts, certificate exchanges. And we saw in some other parts of the world, including UK, where there’s, an open, open banking directory allowing for this, dynamic bank registration, for example, which speeds up the onboarding, but also on the real time operations, you see that having this, trust framework allows for the for the interactions to, to happen in a more secured way and more, automated way.

Paulo Barbosa 00:09:28 So it sort of fixes the real world friction, avoiding onboarding delays, or inconsistencies on how the security framework has been interpreted and implemented by, by the different parties. so we do see it that. Yeah, it’s it’s a direct it has direct implications on the, the outcome of the success of this open banking implementations, but also any other API, implementation. If you leave it to the market to to come up with, with solutions, without having, yeah, something sitting on top that it’s coordinating all these interactions. It’s possible, but it’s I would say it’s less secure to some extent. And it’s, for sure more difficult.

Shaun Ferrari 00:10:17 Gotcha. Okay. So really we’re talking about like this federated trust framework then that is that’s needed to to help a market, this ecosystem kind of accomplish what it needs to do in terms of verify payments and, and let the community, interact with each other. So maybe just I know we talked about it just a little bit, but stepping back, just for everybody to, to understand and listen to, in, in a, in a high level kind of put simply, how would you describe this federated trust Framework.

Paulo Barbosa 00:10:58 So in the end, it’s it’s some sort of a shared system. so it can have the form of a directory, a root of trust, which enforces the, the rules that everyone has to, to, to play by. so instead of every so if you, if you talk on, on the bank side for example. Again using the open banking example where they need to, you know, trust that the fintech that is trying to connect to their APIs for initiation or to get access to the to the payment account data, they need to do some some checks, some KYC on on that entity. So having, a central directory or a central registry listing all these verified participants, that already helps the banks, quite a lot, so they can go and check. Well, this this entity is actually, Authorised by the central Bank of Portugal or Spain or whatever. and that that they have, you know, the certificate, the trust, the security certificate that they are supposed to to, to be doing.

Paulo Barbosa 00:12:10 they have the, yeah. The, the authorization to act in a specific country. If in Europe, you know, within the single market, they need to go through what is called the best sporting process. So all of that can be, centralized in a trust, directory, which will automatically update that information once the authorisation is revoked by the central bank, for example. So you you can you can be certain that as a bank, you’re only giving access to the entities that are supposed to have access. And now if if we move from an open banking logic where we are talking about payment accounts to an open finance, where we are talking about other types of participants like insurance. Insurance companies or even, you know, open everything where, you know you can give access to, anyone that has data on on you. Then it gets a bit more complex because the certificates, the security certificates used today for this fintech to bank interactions or bank to bank interactions will not be will not be working in this new with this new type of of participants.

Paulo Barbosa 00:13:23 So having this directory or trust framework is really important. So everyone can, can trust on the other participants. Because if that trust chain is broken, either from me as a consumer of my bank client or using a fintech service, if the trust is broken on, is broken on my side, that will just create, a, you know, a chain of events that will, you know, create implications for everyone. So the same thing with a fintech interaction with with a bank if they have. If they are accessing things that they did not get the consent to get access to, there are some liability consequences that they are exposing themselves to. So having a directory, it’s you know, it will fix a lot of of these issues.

Shaun Ferrari 00:14:13 Okay. So with this directory, how does this actually like what technology does this or what is it running on. Like how does this actually function? I feel like I can’t get through a discussion without, you know, at least saying the word blockchain is just a blockchain type thing.

Shaun Ferrari 00:14:30 Is it is it not? but, well, how does this can be?

Paulo Barbosa 00:14:35 It can be so, you know, more more than the technology itself. I think it’s it’s important to explain what, what they do then the, the building blocks that you do it to, to implement it. So it can of course be, blockchain technology, in some aspects, it can be, of course, some cryptographic building blocks for the certificate validation and issuance and the entire lifecycle management of of security certificates. But in the end, the trust framework is doing different things. So they are verifying that you are legally the entity that you are claiming to be. And they do that through different means. in Europe, it includes validating the qualified certificate that you have on your power, which is equivalent to a to a passport. Yeah. So the the trust provider that gives you that certificate, you will make you go through a process that it’s it’s giving you it’s giving certainty to the entire market that indeed if you have that certificate, you you are the person that you’re claiming to to to be then then the trust framework, they are validating that that certificate is, is valid, that it was, given to you by a company that has the authority as a qualified, certificate issuer to give you that identification.

Paulo Barbosa 00:16:04 And then, you know, once this sort of trust is established, there are different things that this trust framework can enable. It can verify that the messages that you’re you’re sending, the information that you are changing is aligned with certain, with certain technical specifications that it follows. You know, everyone is following the same rules and, and, yeah, rulebooks of that scheme if we’re talking about a scheme. So it enforces that everyone. Yeah. Is is playing by the same rules. and then the players that are playing this, this game are entities that they are supposed to. and having this, this, this sort of technology in the middle, enables all of that and the way the technology itself is, as I said, is is given. So typically the interactions with this platform are through, APIs, which again is a very flexible and it’s an mostly over the, the internet connectivity. So it’s it’s very accessible. But then it builds all the, the trust layers around it to, to make it secure and trustworthy.

Shaun Ferrari 00:17:20 Yeah. No for sure. And I think the it always comes back to to as you say, if a chain breaks somewhere and you lose trust, then the kind of the cascading effect of that, is, is problematic for sure. And it sounds like these types of technologies help maintain that validity all the way, all the way through which through the transaction, which is which is critical. and to that point, you mentioned a bit about what’s going on in the EU currently and a bit about why this is urgent. But why? Why? You know, why do you think in the next few years, everybody should be moving to, to something like, like this federated trust framework? or why is it essential given everything that’s going on right now?

Paulo Barbosa 00:18:12 Yeah. So in we tend to do a lot of things in Europe, because a lot of these regulations are then exported to different parts of the world and adopted and adopted, in different parts of the world. That’s what we see with, data protection regulations, with, open banking, with ST2, even with, instant payments and verification of be.

Paulo Barbosa 00:18:35 So it’s a very interesting, yeah. Place to be because of the nature of the region as well. So when we talk about Europe, it’s we’re talking about very a combination of very different countries in terms of technology, culture, language, everything. so for the, directives that require national, transposition. So taking that piece of law and adopting it in their national regulation, then the implications are quite interesting. So it it shows the need to have this shared infrastructure to make sure that these, cross-border, interactions are, are secure and working and are happening in, in, in the way they were designed to. So back to your question. In Europe, there are a few regulations coming. So ST3, the third payment Service directive, is coming to fix a lot of the issues that were there with the open banking implementation. that was done with PSC two, including all the issues that we had with, you know, interoperability and, where the lack of, a central directory was, was quoted as one of the reasons to, to look into into this PSC three.

Paulo Barbosa 00:19:59 Then there are other API based schemes like verification of payee or this fraud sharing arrangements that are coming with with a payment service regulation that require, the trust framework. and then in the bigger scheme of things, a lot of these obligations are being implemented at global, on the global aspect. Yeah. So if you if you look at the G20 agenda for the implementation of the fast payment systems, and we were in South Africa presenting this to, to the G20, where they are discussing, implementing overlay services like account, account verification services. you need to have some sort of, trust framework to make it work properly. and that’s, you know, we are working a lot of, of these aspects in how to make this new upcoming, regulatory obligations work better with our trust framework, but also in other parts of the world. How can you know the, a fast payment, system between two countries in Africa, for example, can you bring this verification of pay in a in a good way so that you don’t you’re not opening, a high way of fraud.

Paulo Barbosa 00:21:19 and you can establish this, verification of pay model so people are 100% assured that they are sending money to the person they are intending to send money to. So time is critical in Europe. But I would say it’s it’s a bit of a global, trend as well. and I know in Istanbul the audience will be very international. So we are happy to, to show how this is relevant for pretty much every country and every region, of the globe working on, you know, fast payment Implementations, or any API based scheme that requires having this trust framework sitting on top to to govern these interactions.

Shaun Ferrari 00:22:01 Yeah, no, for sure. I think you’re right. It is a global issue that everybody should be thinking about, particularly as you consider cross-border and other things for for sure, no doubt. So we’ve talked a lot about kind of the compliance aspects of of the the Federated Trust framework. But there’s more to it than that, right. There’s there’s also real benefit, real, efficiencies and benefits that folks can realize by implementing this type of framework.

Shaun Ferrari 00:22:31 So maybe if you could just put a finer point on it and talk a little bit about what are those real world, advantages of implementing a framework like this.

Paulo Barbosa 00:22:42 Yeah. So the, the key point, even outside regulation is how fast and easy can this implementation happen. And now successfully these implementations are. So we see every time that having this, umbrella sitting on top of a scheme rollout, this trust framework will, will just make sure that everything happens, much, much faster and in a better way. and then it’s not only, on the technical aspects, it’s if you don’t have this, there are some liability exposures that, the SPS can be exposing themselves to. So if this if we, as we mentioned before, if this trust is broken, someone needs to, you know, be liable for it. So not having this will for sure expose everyone for this, to to these, risks. so I think it’s, it’s not really a choice now, and also the way the world is moving, with AI and everything.

Paulo Barbosa 00:23:50 I don’t want to be that annoying guy bringing AI to the discussion, but it has real, real world implementation impacts. and it’s, it’s making access to, you know, fraudulent behavior much, much easier. So you need to bring all the, all the safeguards that that you can. And this, this one for sure. It’s, I would say it’s it’s a must even outside any regulatory, obligation.

Shaun Ferrari 00:24:18 No. That’s helpful. And we we had a conversation a few weeks ago with a different podcast guest, talking all about kind of, AI payments and how how that’s really changing the game in terms of, both of the elements you just talked about not only trust in terms of, you know, making sure my agent has the ability and the authorization to talk to your agent. but also on the liability side, where that then opens up a whole can of worms. about who actually authorized it. Who? Who was, Was it the the agent? Was it the company that runs the agent? Was it the person that.

Shaun Ferrari 00:25:01 Quote unquote, intended to make the purchase? So it’s a a fascinating area. And I think you’re absolutely right that you need this type of, trust framework to be able to, to implement all those. So to to that end, I mean, you mentioned AI and, but where where does this go next with all of the, the new payment, developments that are, that are happening in this space?

Paulo Barbosa 00:25:25 Yeah, obviously payments are changing and it’s very exciting time to be working in, in the industry. but you also have things like, digital identity wallets, you have, digital currencies, cross-border KYC, there are some AML obligations that require for some, you know, communication to happen between countries. of course, authentic payments are, a big thing. and all of these new initiatives have, you know, something in, in in common. so, you know, it requires parties to communicate with, with each other to exchange information. So bringing this trust layer for this, all of these communications bit in the scope of payments or anything else, it’s it’s very, relevant.

Paulo Barbosa 00:26:17 And then now I think, AI agents are a big thing. on no one knows exactly the impact that will have in the payments, what that will mean in terms of liability. but I think for sure that having, someone that is able to, validate this, programmatic payments between agents, and make sure that the agents are authorized to represent someone and, you know, making sure that this, this chain of trust that needs to be there for a payment for the funds to move from point A to point B, even if they are initiated by agents. It’s really important to have, this, this trust framework, making sure that that’s all of those interactions are happening in a compliant way, both technically, but also even legal to to some, to some extent.

Shaun Ferrari 00:27:14 Yeah, absolutely. It’s, it’s a brave new world out there, with with all of this and and all of it requires, all of it again, comes back to trust. So what I guess is the as we kind of run out of time, don’t want to give away everything you’re going to be be talking about in Istanbul.

Shaun Ferrari 00:27:31 That will leave people wanting a little bit more. but if you could give our listeners one thing to kind of take away, one thing to remember, what would that be?

Paulo Barbosa 00:27:45 Yeah. So it’s I would say, Trust doesn’t really scale. By shaking more hands, you know it should be scaling by building some infrastructure that makes handshakes unnecessary. And that’s exactly what we are building. and I think it’s just the start of the, of the conversation. So every country will have different needs. Every region will have, you know, different, pain points. so we are happy to sit with anyone that is interested to, to learn more about this and explaining how this, how can we do the combination of these different modules, to help the implementation and governance of these schemes in the different countries. So there’s one there’s no solution that will, you know, magically fit, every single need. And I think that’s where we, as Benfica have been very successful on it’s on building and and, and the deploying technology that are solving real, real world problems and really adapted to the needs of, of the of our clients and partners.

Paulo Barbosa 00:28:59 So I’m happy to continue this with discussions in Istanbul also with a very nice view. It’s an amazing city. So I think it’s it can be an interesting subject to have in. Yeah. On a face to face.

Shaun Ferrari 00:29:13 No. Awesome. And that’s what it’s all about, you know, continuing those discussions and as you say, with, particularly looking forward to it with so many countries that will be there in the room and, and getting everybody’s perspectives and talking about how to implement these, these types of technologies across the world. so, so thank you for, for taking the time to be here. And, and also, can’t wait to see you in Istanbul.

Paulo Barbosa 00:29:36 Awesome. Thank you.

Shaun Ferrari 00:29:38 You’re welcome. Well, thanks, everybody for listening. We hope you enjoyed this discussion with Paulo and, Banfico. it was a great, great, interesting half hour. I hope you found it interesting as well. And for those of you that haven’t already signed up to be in Istanbul, please consider doing so.

Shaun Ferrari 00:29:55 You can go to the Currency Research website at currencyresearch.com to get more information on that. And with that, thanks for listening. Please do tune in again for our next episode of The P.I.T. Exchange. And in the meantime, like subscribe, download, do whatever it is, wherever it is you do it with your podcasts. we’re happy to be with you. So until next time, thanks for joining us. Take care.