How to launch quick payment innovations in the cloud

Zil Bareisis, CELENT: My name is Zil Bareisis, Head of Retail Banking at Celent. Allow me to introduce my two esteemed panelists who will answer most of your questions: Dmitry Yatskaer,  Chief Technology Officer at OpenWay, and Rik De Deyn, Senior Director of Financial Services Industry Strategy at Oracle.

Dmitry Yatskaer, OpenWay: Hello, everyone!

Rik De Deyn, Oracle: Good afternoon, Zil, and everyone who joined us!

Zil Bareisis, CELENT: Delighted to be in such company!

Zil Bareisis, CELENT: It is clear that the cloud is becoming an increasingly important component of banks’ technology infrastructure. Everyone is really thinking about the cloud. I think it’s fair to say that attitudes have changed quite a bit in the last few years.

Rather than stealing the thunder of Dmitry and Rick, I won’t be talking here about HSM as a Service, but I think the industry has been addressing that. It’s something that we’ve been following and writing about, trying to help people understand how you can deliver things like HSM that used to be sitting in-house but now can be offered as a service.

Zil Bareisis, CELENT: So I talked a little bit about the benefits of migrating to the cloud, but what sort of things do you see from your experience with your clients when it comes to payments? Specifically, what sort of benefits can your clients expect?

Dmitry Yatskaer, OpenWay: I would say that the number one benefit that we hear about is speed-to-market, because when you have the cloud in place, you can start onboarding clients quite quickly, particularly for payment processors.

If you want to scale, it becomes much more straightforward to add new capacity. Again, you don’t need to think about how much floor space you need or the logistics of the servers, which is usually the case when you deal with on-prem infrastructure in data centers. Potentially it is easier to be resilient and secure in the cloud because you already have the infrastructure there, the network, backup facilities, physical security, you don’t have to build it from scratch. This means that your initial investment to become a payment player is much lower compared to what it used to be just five years ago.

Zil Bareisis, CELENT: You mentioned the investment needed to become a payments player. This is not just investment by fintechs and startups, who are maybe the first adopters of cloud technologies, but for all other players. What other types of players are interested in moving to the cloud? Are there reasons for someone to NOT move to the cloud right now? 

Dmitry Yatskaer, OpenWay: We see the same thing in the RFIs for payment platforms coming in with questions about the cloud. Some are just curious, others are clearly requesting information, but all kinds of players are considering the cloud. Usually there are early adopters in fintechs or payment processors who consider the cloud a necessity, you then have different bank players who might be more careful in moving there. First, you need to look at matters from your own infrastructure. If it is on-prem, it is perfectly up and running, and you are not going to replace it over the next few years, then you can take your time, and eventually when you do want to move, there will be better options, better hardware. On the other hand, if your current infrastructure is nearing the end of its depreciation cycle, it is better to look into replacing it now. You might look into what cloud data centers are nearby. Although Way4 is a cloud-agnostic platform, Oracle Cloud has its clear advantages. It is growing quite rapidly andis available in many regions. In Europe we are literally surrounded by Oracle Cloud Data Centers. In Asia Pacific and Latin America there are growing as well, they are coming to Africa. So that is good news, and eventually you can look into whether you have the necessary expertise in your company, because there are some specifics of being PCI-DSS certified in the cloud as opposed to doing it on prem.  

So these are some factors to take into consideration when deciding whether it is the right time to move, but I think the likelihood is quite high that the majority of customers will move to the cloud, except for those for whom data centers are old and really far away, then obviously it is better that you are hosted in your country. But even then it’s possible to have a cloud running on prem. 

Rik De Deyn, Oracle: The pandemic is very much driving the move to digital, and the move to digital is being well supported by the move to the cloud. That is going really fast. Just this morning, I was talking to our product owners for the Oracle Banking application called FLEXCUBE, and literally every question that comes in is: “Can we run this core banking application in the cloud?” Every RFI. Imagine that, this was even before the pandemic, replacing a core banking application in the cloud, before, that was unheard of. But now, that is the way to go. Having said that, the pandemic has driven the customer experience first. Everyone was working from home and wanted to do as many things as possible from their phone. And if you think about it, the next level of customer experience is payments, using your phone for online delivery and payments. That was a big driver, but now we are even going in the direction of core banking. Now, the last data point is financial services in general, which is probably one of the most technology-intensive industries. On average corporate spend on IT is 3-4% , but in financial services it’s hitting 7-8%. Innovation and technology improvement — these are factors driving banking into the cloud.  

Zil Bareisis, CELENT: In terms of types players, fintechs versus banks, do you see a difference in terms of who might be moving faster on the issuing side or the acquirer side? You are in a position where you offer solutions to both sides of the value chain. Can you talk about practical experiences with these?

Dmitry Yatskaer, OpenWay: I would say that both on the issuer side and the acquirer side there are niches that are easier to migrate to the cloud. When you want to move a payment facilitator’s billing system, it is more straightforward than moving a system that is driving physical POS terminals with Chip&PIN. In the first case, you might not even need to be PCI-DSS certified because you might not have to store card numbers in the system. But if you are moving your Chip&PIN infrastructure, if you have to keep in mind that you must certify your infrastructure with PCI PIN which is going beyond the PCI DSS. Similarly, if you want to move the processing of 3DS, it has to be PCI 3DS in the cloud. A similar story is on the issuing side. If, on the issuing side, what you move is the card processing system, it has to be PCI DSS because it has to contain card numbers in a certain form, then you have to be careful if you have to look at the card production cycle. Achieving PCI CP standard in the cloud for card production is quite interesting. I would say in both verticals, you can find both niches and case studies that are pretty straightforward and simple. Adding digital wallets to that is really straightforward. It’s a no-brainer because you don’t need a payment scheme access points, which are sometimes pain points because currently you don’t have Visa or Mastercard access points in the cloud. They are coming, but not quite yet, so you have to place them somewhere in the data center next to the cloud. I would say that in every niche, you can find a nice use case. For some players, they can do it entirely in the cloud, while other players might have to put little pieces more in the hybrid mode.

Rik De Deyn, Oracle: Maybe just a word on the size and the majority of companies that move to the cloud, what we definitely see is that there is no real affinity. You don’t have to be a certain size to move to the cloud — we see a lot of big banks, also startups. The way that you use the cloud can be different. A mature builder like OpenWay or a large bank has a heritage of running their applications on an Oracle Database, on Java, on WebLogic, technologies they use to be really reliable. They have a lot of reasons to go into the cloud and make sure that the cloud technology supports them so they are not taking a step back in reliability. Whereas cloud-native payment processors and cloud-native application providers use different technologies to obtain the same thing, but they have a longer way to go in terms of architecting their way around. So there are different uses, but it is not a limitation on who you need to be to move into the cloud.

Dmitry Yatskaer, OpenWay: From OpenWay’s standpoint, it is taken for granted that a good payment application has to be able to run quite well in the cloud. The first thing you need to check is whether your payment applications are actually able to run in the cloud. If they don’t, why not consider replacing them with something more up-to-date? We found that our architecture really fits the multi-cloud model, we didn’t really have to change it. We just had to continuously work with new features of the cloud to improve them, but from day 1 we found that it runs really well. We did a benchmark and reached 1000 authorizations per second in the cloud. We are talking now with huge customers who are aiming to run big proof-of-concepts, we are talking of tens of millions of cards. So it’s important when you consider moving to the cloud the question of whether your payment applications are really able to run well there.

Zil Bareisis, CELENT: You mentioned the pandemic and how that accelerated the migration to digital in different shapes and sizes in terms of digital onboarding, digital self-service, especially with physical premises being shut down. Maybe you can talk about contactless, that is another growth area. Also, Rik, you mentioned about working remotely, including how it has benefited many technology projects as well. Maybe you can tell us something about that.

Dmitry Yatskaer, OpenWay: I would say that with the pandemic, it’s a blessing that the industry has digital cards. Imagine if the pandemic happened in times of plastic, I’m not even sure how many people would get their cards delivered. With digital cards, it became much more straightforward. You just enroll and get your Apple Pay, or Google Pay, or other application instantly available, you are not dependent on going into a bank branch and choose your PIN code. That is something we have embraced quite early with our Way4 solutions, so we see a surge in digital products.

One of our clients, just during the pandemic they had something like close to 1 million digital cards, which is probably one of the largest digital card portfolios. At the same time, we made sure that we also offer options for those customers who are based in countries with no Samsung Pay and no Google Pay. We offer solutions where you can use contactless, integrate directly into your wallet, and we are the only vendor compared to other cloud payment platform vendors who has this kind of SDK certified with Visa and Mastercard. So contactless is something that you can run in the cloud as well. You just need to make sure that you have the HSM boxes available, that you have PCI certificates, payment scheme links.

Now talking about the user experience, obviously, in order to run payments in the cloud, your platform has to enable a proper web-based GUI. It has to consume low bandwidth, and there we were in time for the pandemic as well. As far as OpenWay is concerned, we managed to complete really large-scale projects for some of the largest European acquirers you have seen, on time and on schedule despite the pandemic. We all worked remotely. Our client was based in Milano, which is as you know one of the areas that were hardest hit by the pandemic. But nevertheless, we managed to complete everything on time thanks to the new remote way of working. Obviously, the architecture allows for that as well, otherwise it would be impossible.

Rik De Deyn, Oracle: That is definitely something we have seen as well. We are not in the cards business, but the whole customer experience that sped up during the pandemic is important for us. One of the things that we started is a massive push to bring Oracle to the cloud. Oracle is the biggest cloud customer. We are serious about ensuring that what we bring to our customers does not fall over. Oracle has launched a project called Redwood, which is about rebranding our website, the usability of that, and also our applications. So what you will see is that over the next year or so is that all of our applications will be coming out with new user experience, not only about easy to use and configurable, but empathic. We are building AI into the customer experience, into the user interface. And what we are starting to see is that some of our bank customers adopting that idea of using our artificial intelligence to make their user experience empathic. So that based on what they know about their customers, the user experience just changes itself, instead of you having to go into all sorts of preferences and configurations. So that’s a big move.

Zil Bareisis, CELENT: Nice that Oracle is using its own medicine. So good to know that Oracle was the first customer of Oracle.

Rik De Deyn, Oracle: I am a big tester of Oracle Cloud. Every day, when I do my expenses, for example!

Zil Bareisis, CELENT: An interesting aside on AI, where does AI play the largest role in financial services? Is it fraud, or user experience? Why do you think it will really catch on?

Dmitry Yatskaer, OpenWay: Good point, if you look at everything going on with AI in payments, it started in risk management in different shapes, first starting with payment risk management for payment transactions, then extending into RBA, risk-based authentication for issuing and acquiring. At the same time you can find many uses for credit scoring, and there are more and more applications in chargeback processing. There are companies who are finding out whether to dispute a transaction, they can calculate that something is not worth disputing because the cost of disputing would potentially exceed the amount you would win when it comes to something small like subscription fees. So it is a big creative space, and there, the good thing about the cloud, particularly for machine learning and AI, is that you can scale your environment when you need it. So this is helpful.

Rik De Deyn, Oracle: One of the things we at Oracle have done is that we have built AI into the database, so the database maintains itself, patches itself. Now, that sounds nice, but the real effect you have is that once you start using that autonomous database, the risk of having human-related failures and hacks drastically reduces by 80 percent. And if anything is important in payment processing it is making sure that you have an absolute handle on fraud and against the possibility of getting hacked. So artificial intelligence is definitely in payment processing and in the underlying technology.

Zil Bareisis, CELENT: By the way, I am keeping an eye on the questions that are coming in from the audience. Not surprisingly, we have quite a few around payment HSMs. How do we resolve this conundrum of payment HSMs in the cloud, and maybe just for the audience, just to highlight the difference between general-purpose HSM versus payment HSM specifically, and what the nuances are? How do Oracle and OpenWay address this issue?

Dmitry Yatskaer, OpenWay: Indeed, there are HSMs and then there are HSMs. You have those general-purpose HSMs that you use for data encryption, this is something you find, of course, in the cloud, available off the shelf. Then you have payment HSMs, and there are two options available: either a cloud-based solution like MYHSM, integrated with your own cloud payment infrastructure, or your own HSM that you buy and place in your data center that has a good connectivity to the cloud. If you take Oracle Cloud, there is good connectivity to Equinix data centers globally. So you just enter your cabinet, place your own HSM there and link it to the cloud.

So as far as choosing, there are several factors. Do you actually have the expertise to manage the HSM in your company? Otherwise, do you want to grow that expertise, yes or no? So if you don’t have that expertise and you don’t have time to grow it, then MYHSM is a good way to go. But if your organization is huge and you already have the people within the company who can manage the HSM, then you might consider just finding a good cabinet and connecting it to the cloud, because it's still quite an isolated part of the whole infrastructure.

Also, importantly, of course, you need to ensure that you have the necessary PCI compliance. Again, is it just PCI DSS or is it PCI PIN, or PCI 3DS? Similarly, with general-purpose HSM, one thing is to use just for data encryption, but a different thing is to use it for PCI 3DS. This can be a driver to get an on-prem option or to consider cloud HSM providers. So those are the typical factors that you would consider.

Rik De Deyn, Oracle: Absolutely, it is the way Dmitry is describing. We realize that having a good answer to that HSM question is very, very important. The only thing I want to add is that if you visit our data centers, which are co-located with Equinix, you will see bank HSMs everywhere. Visa, Mastercard HSMs. There is also a very specific way that we have architected to get payments from Way4 through Oracle Cloud in those HSMs and that is called FastConnect.

Dmitry Yatskaer, OpenWay: The only cloud for the moment that offers any payment HSM directly in the cloud is MYHSM Cloud. You can be PCI compliant and so forth. Whether it is Thales 9000 or another HSM, before it only supported that but now it supports other HSMs, so you have a choice, choose where you have the most expertise. You also have different options in terms of cost, you have some HSMs which are quite cost-effective for a single tenant. You also have more expensive ones with more interesting options if you are multi-tenant with a lot of partitions. So nowadays there is a good selection available.

Zil Bareisis, CELENT: Interesting question, Rik, so what about actual cloud providers like Oracle getting into HSMs? What are the obstacles for Oracle offering its own HSM as opposed to working with partners?

Rik De Deyn, Oracle: We have gotten this question a lot, and this is one of the things we are looking at. Our sweet spot is large enterprises, those are for whom we have built the cloud. We still feel that dedicated hardware HSMs are the way to go. We have other priorities going on, as long as we can support our customer base, and of course as the HSM base continues to grow, you can expect this from us as well.

Zil Bareisis, CELENT: One of the other concerns we raised at the beginning of the webinar was the local data residence requirement. There is a question from the audience: how do you store customer client data in the cloud if you are prohibited from storing your data outside of your country?

Dmitry Yatskaer, OpenWay: Generally, if you have to store all the data in your country, if you absolutely cannot export any data, obviously, you have to remain on prem or you have to choose an option where you have an on-prem cloud. Basically, it is a machine that runs on prem but in terms of manageability, operating system patches, it is managed by the cloud provider, as well as provisioning. So that is an in-between version. If there is enough business case for a cloud to come to your country, the cloud eventually will come to your country.

Another thing you can do is study carefully all the data residency requirements in your country, because in some countries you are only required to keep a copy of certain data on prem. In other countries, the legislation says that you can’t export personal data where the variable is what personal data means, unless it is encrypted, for instance. So you really need to look carefully into what the law is saying, assess, of course, the possibility of the law changing. But typically, in our experience, it’s an open-loop payment infrastructure. So like it or not, if your card is accepted abroad, your card number is traveling abroad. It is never purely within the country. And we know that with major payment schemes, they require even your internal on-us transactions to be exported to them. So there isn’t much of pure in purely country-based. Often you can find a good solution where you can still benefit from the cloud. And in the worst-case scenario, you may consider just doing things that are less sensitive. Potentially, why not move your test QA systems, your performance optimization system? So that at least for that, you don't have to complicate your on-premise infrastructure.

Rik De Deyn, Oracle: So in theory, you will run into legislation or corporate preferences, that is going to force you to postpone the move to the cloud until there is a cloud data center in your country. Having said that, there are a number of solutions. Some Dmitry has mentioned. I totally agree that taking a close look at the regulation often holds a solution, because a lot of regulation, certainly in Europe, are not as strict as some people believe. But on the other hand, banks like to be on the safe side as well — be a bit more holy than the regulation. There are a number of technical solutions as well, those from the Oracle Cloud come in a product family called Cloud@Customer. In that series of products the clouds stack is exactly the same as a public cloud stack, which means that if something runs on the public cloud, you can drag and drop it. I mean, that's not really how it works. But you can drag and drop it into your own data center at a database-only level, and that is called Exadata Cloud@Customer. A lot of banks use it. Or for the complete processing so that your data stays within your data center. And that offering is called  Dedicated Region Cloud@Customer, and basically puts a complete cloud data center with exactly the same configurations, service levels, security, trust, the same manageability as our public cloud, in your data center behind your firewall.

Zil Bareisis, CELENT: When you think about a software partner or about a cloud partner, what are some of the things to look out for?

Dmitry Yatskaer, OpenWay: One thing is really to look at the payment application, and from different standpoints. Does it have proven references in the cloud? Does it have live references in card issuing and merchant acquiring up and running in the cloud? How successful is it? How big? Talk to their clients to try to make some reference calls. On the other hand, I would say you don’t need to jump into something which promises to embrace all the latest stuff right away. You may have the latest and greatest in terms of what you can find in the cloud, but at the same time, is it really proven to work properly with payment schemes? So there needs to be a right balance between the two. To find a platform which does both, which already embraces all the latest cloud technology, which supports proper containers, which is scalable, that is a great thing. All these are found in Way4.

Interestingly, 42% of the respondents said no, they are not running in the cloud yet. But they plan to within two years — 21% are there already. 100% in the cloud was the response of 7% of respondents, and 14% have at least part of their payment infrastructure in the cloud. Another 9% said, no, not yet, but they are now actively in the process of migrating to the cloud. 28% said that at the moment, they are not planning to use cloud for payment services in the long term.

OpenWay

OpenWay started in 1995 as a startup, and since then it has grown into a global leader in digital payments software. Its Way4 solutions cover the end-to-end payment spectrum: issuing of all kinds of cards, end-to-end channel acquiring, payment switching, and digital wallets. OpenWay is active in a number of verticals: banking, fleet and fuel, and telcos. It serves Tier-1 companies such as Nexi and equensWorldline, the largest acquirers in the EU, Comdata, a major corporate card issuer in the United States, Finnet, a leading payment switch in Indonesia, and others. Over the years, OpenWay has been ranked as #1 in CMS and digital wallet software. It jointly won the PayTech Award 2019 for Payment Systems in the Cloud with its partner Enfuce, an innovative cloud payments processor in the Nordics. At this time, it was not considered easy to run payments in the cloud, but they succeeded.

Oracle is proud that OpenWay’s customers have started to use Oracle Cloud infrastructure to run Way4 payments software. In payments processing, a number of qualities that only the Oracle Cloud can offer are very important – such as SLAs for availability, performance and manageability. Also, Oracle has the fastest growing global footprint for our cloud data centers with coverage in the Middle East, Latin America and other regions. Its performance numbers can be five times higher than other cloud infrastructure providers. Moreover, its running costs are 50% less expensive, or the largest range of enterprise cloud hardware options that are specifically a good fit for Way4.  But most important is how Oracle Cloud helps OpenWay deliver exceptional service to you as an OpenWay customer.

Celent

Celent is a leading research and advisory firm focused on technology for financial institutions globally.