Flexible Credentials

© Starpoint LLP, 2024. No part of this site, blog.starpointllp.com, may be reproduced or retransmitted, in whole or in part, in any manner without the permission of the copyright owner.

Background

Visa’s network is the largest commercial network in the world, moving over $15T in volume over 4.3B cards in over 200 countries. Visa’s core is called VisaNet, a real-time messaging network between banks. They don’t move money but send instructions to and from banks, merchants, consumers and other approved third parties. The banks move the money, primarily through net settlement on ACH.  The beauty behind Visa’s network is its operating model, which allows thousands of partners to invest billions of dollars. To defeat Visa, you not only have to create a better network, but you must also create a better economic model for EVERYONE to switch, AND overcome the combined investment of all current stakeholders. This is why SEPA failed (see Power of Bank Networks). 

Part 1 – US Payments Environment covered the complexity of the US payment environment and the challenges top banks face in modernizing their systems (where all systems live forever). There are many types of payments: bill payments, A2A, P2P, wires, RTP.  The intelligence of payment networks is distributed; this allows investment by different parties. For instance, eCommerce merchants (and their service providers) own much of the risk and fraud intelligence (see blog). Banks take ownership of all areas with a regulatory requirement or competitive advantage. Where there is no competitive advantage, they form consortiums (ex, Early Warning) or push to the network. 

Most of us would logically question “why” there are so many bank networks and how a bank chooses which one to use. As I outlined in US Payments Environment, part of the problem is that no system ever dies within a bank. For example, consumers use telephone banking to pay bills (I’m not joking). Banks are almost “crippled” in their ability to innovate because of this complexity, as these systems are all highly interconnected in a giant spaghetti mess (n2 problem). 

Consolidating consumer channels to Mobile has made this complexity unsustainable for banks. Historically, each product line could operate isolated from its customers in a defined channel. Credit card holders were issued a plastic card that could be used in a way banks controlled, high-net-worth customers could access bank wire facilities through specialized interfaces, ATM cards, …etc. Banks can’t create a different mobile app for each product type; they are challenged to keep the primary interface (ex Plaid, GPay, ApplePay, PayPal, …etc.). 

How can banks get products out the door faster and leverage existing investments? What network do you place your bets on? A: Visa, the payment network with the most consumer traction and the best ability to manage the mobile platform. 

Today, Visa’s GDV comes from credit and debit card transactions. How could Banks leverage Visa to perform an A2A transfer on RTP, an Authorized Push Payment (APP) in the UK, or an instant bill payment using FedNow? How could Banks create their own BNPL solution as a financing option?

Flex Credentials

These are the early days for VFC. And things may change. But this is what we know from the video interview of Mark Nelsen, Visa’s global head of consumer payments by Karen Webster and Visa’s product brief and Visa PR on seven new products from VPF2024.

Flex Credendials (VFC 2023 Product Brief).  Flexible Credentials are currently live in Asia and will launch with BNPL provider Affirm later this summer in the U.S.

My understanding

1. Change to transaction auth process. Merchant submits credential for auth
2. The consumer selects a card or funding method (Affirm)
3. Merchant messages returned, including Auth and Funding DPAN + data token
4. Merchant then processes/routes based upon BIN (has interchange rate) 
5. Focus is on BNPL and the result of innovation work with Affirm (see Debit+ blog)
6. Moves from a “One card, one funding source” model to a “flexible credentials map multiple funding sources to a single card — virtual or otherwise.”
7. “The product is subject to certain MCC restrictions and has its own interchange rate.”

There are still many things to work out and unknowns, such as whether this is pre-checkout or post-checkout (when the consumer selects funding) and whether it could be split among many instruments. This is clearly a better approach on many accounts vs. MA. As a refresh, Mastercard’s BNPL has a new rate tier with merchant opt-out (most NRF merchants have opted out). See the blog. 

Analysis. Expanding the Pipes

While the first use of Flex Credentials is squarely focused on BNPL, using a credential instead of a PAN creates a many-to-one relationship and acts much more as an “identity” than an instrument. Visa is at the center, and every bank is able to leverage its existing investment in card VAS beyond card transactions. 

The many-to-one relationship has LONG been a goal of the US banks. As I wrote in 2012, the 27 banks behind TCH’s mobile effort wanted to provide a single number for the mobile phone that could resolve itself into an instrument defined by the banks. This model would end up running all the networks. Charlie Sharff correctly came down with what I refer to as the Wrapping Rules (i.e., Staged Digital Wallet. See 2013 blog Wrapping Rules and Tokens). The summary is, “If you create a token that wraps a Visa card, it still must operate within the Visa rules set and be routed through our network”. 

Visa Tokenization Services (VTS) replaced PANs entered by customers with DPANs provisioned by banks for a single device. VFC expands the mobile nature of a DPAN to a credential that can represent multiple cards (i.e., Affirm BNPL)  and, in the future, multiple networks or perhaps even a provisioned identity.

I believe VFC is the most significant “Pipe expansion” in the history of card networks.  VFC could enable APP, FedNow, RTP and other non-card schemes, simplifying “

• Consumer provisioning
• Handset credential management
• Selective Application of existing VAS, Fraud, Risk and tools
• Universal “Pay Name” with integration to every network 

Simply put, VFC could solve the consumer side of the bank spaghetti complexity and provide a consistent path for managing consumer privacy, provisioning, fraud and risk.

Top Unknowns

1. Merchant Buy-In. Merchants will always be up for improved conversions. BNPL costs much more than a card, yet it’s been a #1 priority for almost every merchant (see Three Flavors of BNPL). 
2. Processors. There is tremendous work for processors as their fraud solutions are tightly tied to device ID and funding instruments. The resolution of credential to funding instrument must be coordinated across risk/fraud controls, support, dispute, loyalty and their PAR systems (see 14 Acceptance Hurdles and Acceptance Part 1). 
3. Optionality. Each Issuer controls which credential they will allow their card to be part of. For example Affirm BNPL account with my Bank of America Debit Card.  Getting everyone to play is key to the initial start. 
4. Pricing. Each funding source will have the same pricing as it would if it were not part of a credential. Who is paying for the VFC service?
5. Mobile/OS support. Is there any difference between provisioning a credential and a DPAN? 
6. Network of Networks. Cross scheme. Banks own their BINs. They are not the property of V/MA but rather the Issuers. Could I resolve a Visa VFC to a Mastercard (which would be processed as a MasterCard by a merchant on MA’s network)? I don’t see a downside for MA here. 
7. Apple. Why wouldn’t Apple work to step into the Affirm model? A block is Issuers ability to decline resolution of a credential into a payment token. Would that survive scrutiny?
8. Rollout. Given the processor effort, it would make most sense for Affirm’s merchant customers to push this as a priority to their processor. This will drive action. However, merchants that do not take part in Affirm will not be able to process the credential until they complete changes. How can consumers know “who” will accept a credential (i.e., where the Affirm VFC will be accepted)? 

Example – APP

Rather than VFC wrapping an Affirm BNPL product, what if it wrapped another network like the UK’s APP? 

In the UK, Authorized Push Payment Fraud has now eclipsed cards. Assuming rollout of VFC and processor integration. A UK consumer “wallet” could provide for APP use, wrapped within a VFC. The merchant would accept both card and APP as payment options. The VFC could resolve into an APP token with the merchant’s processor screening the transaction with existing card fraud tools. The merchant and/or consumer could incur charges based on who incurred the benefit of the fraud screen. 

All would benefit from the existing card infrastructure investment. For example a single instrument provisioned into Google’s GPay. The same would go for other schemes. VFC is the consumer side of payment network interoperability. 

Case Study – Curve

The most successful FinTech operating in this one to many model is Curve. Curve is a Mastercard partner, and operates primarily in Europe as an evolution of the 2012 Google Plastic model. A single Curve card wraps all other payment cards and open banking interfaces providing both an integrated Mint-like interface for transaction reporting and intelligence, as well as a single “super” reward scheme that goes across all spend. Whereas Affirm Debit+ innovation (and economics) are on alternative lending, Affirm’s focus is in creating the best consumer experience. 

It should be noted that the Curve’s wallet operates on both Android and soon to iOS (in the EU) making them the only wallet capable of both POS and eCom on both platforms in a single credential model. 

I’m going to write a separate blog on Curve. In my opinion these guys would be a great accelerator to PayPal, X.com, Paze and others. Even more so with VFC coming out. 

Take Aways

• VFC provides long term opportunity for Visa to expand GDV and VAS as network of networks
• Initial focus will be on BNPL
• Strongly aligned to Issuer plans over the last 20 yrs and solves many bank issues
• Potential enabler of RTP and other schemes by allowing existing card fraud/risk infrastructure to operate on “non card” transactions
• Greatly simplifies the consumer front end of provisioning
• Unknown effort by merchants, but it does not appear to represent any new costs. Merchant will want to see conversion impact and transaction mix impact. If consumers want it … it will happen

Feedback appreciated.