Visa/MasterCard: Structural Weakness in the US Business Model
SEE LAST PAGE OF THIS REPORT Howard Mason
FOR IMPORTANT DISCLOSURES 203.901.1635
October 15, 2013
Visa/MasterCard: Structural Weakness in the US Business Model
- Catalyzed by the information-processing promise of chip-enabled cards and mobile phones, payments is moving from a back-office utility to integration with front-office functions around customer acquisition and relationship management; the goal is to leverage payments data for e-couponing and other promotional activities. Front-office engagement and ownership of in-store transaction data increase merchant leverage and will lead to a shift in the US payments industry from interchange-based to least-cost routing (LCR).
- The resulting increased pressure on network fees and migration of debit volumes from Visa-branded signature-authenticated transactions to lower–cost alternatives (direct BIN routing by large issuers, EFT networks by small issuers, and ACH-enabled debit by MCX and large stores such as Target), will prevent Visa from sustaining guidance for revenue growth in the “low double digits” beyond 2014.
- PIN debit has lower fraud and authentication costs than signature debit and, now that Durbin has eliminated the interchange differential, issuers prefer it as well as merchants. Visa/MasterCard face more intense competition for PIN debit than signature debit because of the electronic funds transfer (EFT) networks including STAR owned by First Data and Pulse owned by Discover; and because PIN-authentication makes it easier for large issuers to work with processors on direct bank identification number (BIN) routing.
- The threat from ACH-enabled products is illustrated by the rapid ramp of Target “RED” cards which accounted for 19% of Target sales in August 2013 up from 10% in October 2011; debit penetration was 9% up from 3%.
- Banks are preparing to deliver LCR through a tokenization project (run by The Clearing House, TCH) which, aside from system-wide security benefits, wraps Visa/MasterCard in a bank-controlled routing architecture. TCH tokens will allow banks to shift volume among the two networks, direct BIN routing, and EFT/ACH networks without the cost of reissuing cards; with lower switching costs, banks have more leverage over network fees.
- Unlike primary account numbers (PANs), tokens can be issued for limited so that they are valid, for example, for e-commerce use but not at point-of-sale; this has implications for the extension to point-of-sale of the online payment franchises of firms such as PayPal and AMZN.
- Visa faces less immediate threat from lower-cost alternatives in US credit in part because, unregulated by Durbin, credit generates premium interchange. However, we expect banks with large issuing and acquiring businesses (such as BAC, WFC, and USB) to follow Chase’s move towards private processing, and other banks (such as COF and Barclays) to partner with MCX in offering credit products that dis-intermediate Visa/MasterCard.
- In both cases, a key motivation is to facilitate the pooling of in-store transaction data accessible to merchants with out-of-store payments activity accessible to issuers so as to drive e-couponing and other merchant promotions, and to carry this non-financial information along payments “rails” without exposing it to Visa/MasterCard.
- Visa is looking to defend its franchise through strengthening credit with its own NFC-enabled e-coupon infrastructure, and betting that mass-market consumers will be motivated to shift spend from debit to credit by these merchant-based promotions just as affluent consumers have been so motivated by miles and other issuer-based rewards.
- We believe this strategy explains Visa’s push for EMV adoption (in contactless rather than contact-only form) despite issuer ambivalence and merchant resistance.
- Visa is structurally challenged in leveraging payments for merchant promotions because it owns neither the consumer nor merchant relationship. Despite the consumer-facing wallet, V.me, large issuers are not going to expose the crucial map between PAN and personally identifying data (PII), including the names of account-holders; on the merchant side, the April 2010 acquisition of Cybersource provides Visa with some direct merchant relationships in e-commerce.
- In addition, Visa is competing to win merchant routing in debit by enabling its core “VisaNet” infrastructure for PIN-authenticated Visa debit (PAVD) and by introducing the Fixed Acquirer Network Fee (FANF) to lower per-transaction costs and fund the revenue deficit with a new license fee for the Visa acceptance brand. However, at best, these measures only partially mitigate pressure on network fees:
- FANF: The DoJ is investigating FANF and may find it represents questionable tying of credit and debit; even if FANF stands, it will tend to decouple revenue growth from transaction growth and increase the incentive for MCX to offer credit-enabled products.
- PAVD: PAVD allows Visa to compete for PIN debit on Visa-branded cards which carry EFT bugs other than the Visa-owned Interlink. However, post-Durbin, there is dual-routing for PIN debit increasing pressure on network fees; furthermore, we expect this pricing pressure to extend to signature debit in H2 2014 with Court-mandated dual-routing of signature debit.
“There are lots of people that we compete with and people who want to compete with us that have strategies around working with merchants at point of sale and if we don’t figure out how to evolve our model to encourage issuers and acquirers to do that then we’ll be leaving great opportunity on the table” Byron Pollitt, Visa CFO, May 2013
As the US card payments industry undergoes a transformational change from interchange-based to least-cost routing (LCR), investors are underestimating the business-model risks to Visa and MasterCard. For example, following Judge Leon’s July ruling (now under appeal) calling for dual-routing of signature as well as PIN debit transactions, Visa lost its premium multiple to MasterCard (see Exhibit 1) on the basis that Visa’s distribution advantage with issuers would be less important and it would lose share of signature-debit transactions to MasterCard. This is likely true but misses the broader point that, in a dual-routing environment, merchants will opt for least-cost routing putting pressure on network pricing (and hence likely valuation multiples) for both Visa and MasterCard.
Exhibit 1: NTM Forward PE for Visa/MasterCard relative to S&P500
The thesis of this note is that the US card payments industry is undergoing broader industry changes in anticipation of mobile/chip-card payments, and that these will lead to a least-cost routing environment for debit regardless of the eventual outcome of the Fed appeal on Judge Leon’s ruling. We acknowledge that mobile payments are presently insignificant ($500 million in 2012 almost entirely at Starbucks versus card payment volume of over $4 trillion) and will likely remain below $100 billion even through 2019. However, the prospect of mobile/chip-cards is driving industry structure now including, most obviously:
- MCX: the organization of the MCX payments consortium of merchants which we expect to launch a pilot program for processing debit payments over the ACH network, rather than Visa/MasterCard, in the first half of next year;
- Private Processing: the announcement in February that Chase would develop a private processing service for card transactions and license the Visa acceptance brand in a 10-year deal.
- Tokenization: the announcement in the last few months of bank and card-network tokenization initiatives which, among other things, can play a role in blunting the threat posed by online payment companies such as PayPal, Google, Amazon, and Apple leveraging mobile payments to extend their franchises to physical point-of-sale.
These projects are ultimately about gaining control over payment data and routing, and hence negotiating leverage over Visa and MasterCard. The projects involving alternative processing solutions, such as MCX and private processing, will also siphon volume; to give a sense of the possible volume impact from MCX, we note that the Target debit card now accounts for 9% of Target sales up from 3% less than two years ago.
There is already evidence that expanded routing choices are creating pressure on Visa/MasterCard network fees which presently average approximately 5-10 basis points charged to the issuer and 10+ basis points plus 2-3 cents/transaction charged to the acquirer. In April 2012, for example, Visa introduced the fixed acquirer network fee (FANF) based, for card-present business at physical point-of-sale, on the number of retailer locations; Visa commented in its 2012 annual report that these changes were: “intended to increase our competitiveness and incent merchants to route transactions over the Visa network”.
Over time, we expect further action from Visa/MasterCard to adjust US pricing by lowering per-transaction costs to win merchant-routing and making up some of the resulting revenue loss through license fees for the acceptance brands. Nonetheless, with interchange now equalized by Durbin, there will be a volume-shift from signature-authenticated debit to PIN-authenticated debit which is economically-advantaged by lower fraud and authorization costs. This shift is important because Visa faces competition in PIN debit from electronic funds transfer (EFT) networks including STAR owned by First Data and PULSE owned by Discover, and because PIN debit requires less sophisticated risk-scoring and fraud management and so is easier for banks to in-source by making arrangements with processors for direct bank identification number (BIN) routing. In addition, we expect a share shift from Visa debit, whether signature- or PIN-authenticated, to ACH-enabled debit products issued by large stores such as Target and by the merchant consortium, MCX.
As a result, growth in US revenues will slow and increasingly lag growth in transaction volumes reversing the recent trend where revenue growth has exceeded transaction growth (see Exhibit 2 and Appendix). As investors attune to this risk, and particularly as MCX establishes credibility with pilots later this year or early next year, we expect them to re-visit long-run growth assumptions, and hence valuation multiples, for Visa and MasterCard. The remainder of this note reviews the structural risk to Visa’s business model in the US from MCX, private processing, and tokenization before looking at a number of possible scenarios for industry standards and evolution.
Exhibit 2: Revenue and Transaction Growth at Visa
MCX and the Structural Risk to Visa from Mobile Payments/Chip Cards
“Pressure on client pricing also poses indirect risks. If we continue to increase incentives to our clients, we will need to find ways to offset the financial impact by increasing payments volume, the amount of fee-based services we provide or both”. Visa 2012 Annual Report
The Visa/MasterCard acceptance brands are valuable, and represent a significant barrier to entry for new entrants, such as PayPal (even partnered with Discover), attempting to leverage online franchises into physical point-of-sale and new entrants, such as Dwolla, attempting to leverage the internet for payments (in a world where devices are increasingly IP-connected and there are emerging protocols for the secure transfer of value, as opposed to merely information, between IP-connections). In short, the larger risk is not so much to disintermediation of the Visa/MasterCard acceptance brands as to the ability of Visa/MasterCard to generate economic rent from these brands at the same rate as in the past through their pivotal position in the US card industry as rule-makers and as operators of processing networks.
Chip-enabled payment devices (whether card or mobile phone) are a catalyst for this challenge not because of current or even near-run transaction volumes but because it is clear that the shift from mag-stripe to chip will bind payments to marketing in terms both of capturing customer information around in-store spend and of delivering relevant, real-time consumer offers through e-coupons. Industry participants are positioning now for this future environment with two important and immediate consequences for Visa/MasterCard:
- First: The payment stakes for merchants are raised with issues not only around high card acceptance costs but also advertising efficiency. Merchants who are able to leverage payments information into more effective mobile advertising and e-couponing will set in motion a virtuous circle: advantaged advertising efficiency => increased share of trade-spend (i.e. promotional funding from manufacturers and consumer packaged goods companies) => more customers => greater information scale => advantaged advertising efficiency. In short, payments will become a critical component of retailer front-end operations not merely an interchange headache for finance staff. The move of the payments function from back- to front-office at merchants has created in MCX the first new entrant in decades capable of competing at point-of-sale with the Visa/MasterCard acceptance brands.
- Second: Strategic advantage in payments will be increasingly information-based flowing, in particular, to players who can aggregate in-store item-level information with broader customer profiling including, in particular, “hard” out-of-store payments behavior and “soft” intentional data from, for example, online search and social activity. Visa/MasterCard are weakly positioned for this shift to an information-based payments industry because they typically own neither the customer relationship (in the hands of the issuer) nor the merchant relationship (in the hands of the acquirer); this is in contrast to Amex which owns both relationships and is explicitly leveraging the information advantage (including, for example, through the purchase of the European-based Loyalty Partners for $660 million in October 2010).
“We also run the risk of disintermediation by virtue of increasing bilateral agreements between entities that would rather not use a payment network for processing payments. For example, merchants could process transactions directly with issuers, or processors could process transactions directly between issuers and acquirers” Visa 2012 Annual Report
The importance of integrating customer and merchant data has already led to disintermediation of Visa with the announcement in February of Chase’s private processing service through white-labeling Visa’s core “VisaNet” processing infrastructure and licensing the Visa acceptance brand. Allowing Visa-branded transactions in the US on a processing infrastructure that is not controlled by Visa is a meaningful strategic shift; as recently as 2006, Visa paid First Data an estimated $50 million to shut down its own private processing operation.
Aside from the siphoning off of transaction volume (albeit not more than 5% of total Visa transactions given Chase has approximately a 15% national share on both issuing and acquiring sides but some regional concentrations in, for example, New York), the deal has implications for rule-setting. As Jamie Dimon put it when announcing the deal: “if you go to merchants, what they always complained about was Visa’s got all these operating rules … it [private processing] allows us to go to merchants and strike our own deals”.
Furthermore, private processing weakens Visa’s information scale which is based on a centralized architecture and is important to the ability to add value through fraud management; the 2012 annual report notes: “VisaNet is built on a centralized architecture, enabling us to view and analyze each authorization transaction we process in real time and to provide value-added information, including information products, such as risk scoring and loyalty applications, while the transaction data is being routed through our system”.
In practice, the likely motivation for the deal was Chase’s desire to combine in-store transaction information available to merchants with broader payments activity available to Chase through the primary account number (PAN) with customer profiling from Personally Identifiable Information (PII) such as name and e-mail address. Given competitive and privacy concerns, Chase will not have wanted to share information with third-parties in general and, in particular, Visa (which has the PAN but not PII) hence the private processing deal; put another way, Chase will likely be running non-payments, reward-related information over the payments infrastructure and will have wanted to keep this private from Visa.
We believe the private processing arrangement will generate meaningful competitive advantage and share gains for Chase in both its issuing and acquiring businesses since improved advertising efficiency will be attractive to prospective clients of the acquiring business (particularly given trade-spend dynamics) and, by supporting premium economics, will also create advantage on the issuer side. If so, competitors with both issuing and acquiring businesses (such as BAC, WFC, and USB) will likely follow suit with their own private processing networks which will further fragment VisaNet and siphon volume from Visa; finally, we expect vertical integration of acquiring and issuing businesses to be an M&A driver particularly on the acquiring side.
To underscore the importance of the fusion of the payments and advertising functions at the merchant-clients of acquiring businesses Ed Labry, Vice Chairman of First Data, points out that the revenue pool for the US acquiring industry is $30 billion versus merchant advertising-spend of ~$550 billion; it follows that a small shift of ad-spend to acquirers leveraging payments data to improve advertising effectiveness can make a meaningful difference to acquirer economics.
Tokenization I: The Security Case
In an information-based payments and merchant-advertising model, access to payments-related information is strategically important. Indeed, a founding principle of MCX is that payments data belongs exclusively to each individual merchant, not to the consortium collectively and certainly not to outsiders. Dunkin Donuts, a founding member, noted that the merchants “wanted to protect and control our own data … we want to be certain that what our customers were doing was not shared with our competitors”.
Merchants can control and protect their data by interposing a “staged” card or wallet between the cash register and a general-purpose card, with the Starbucks card and associated mobile application being the canonical example; we use the term “staged” to refer to a card or wallet which captures item-level data but remits only aggregate data in batches to the ultimate funding source. In an attempt to penetrate the data wall erected by staged wallets, MasterCard has imposed a “staged digital wallet operator fee” (of an estimated 35 basis points of dollar value over a $50 million threshold) over and above usual interchange unless the wallet provider agrees to unmask the transaction data; this means PayPal either faces either data-sharing or a lower take-rate (the difference between the rate charged to merchants by a wallet provider and the rate paid to issuers).
Issuers are looking to control and protect their data, consisting crucially of the ability to link the primary account number (PAN) to personally identifying information (PII), through tokenization. Tokenization is simply the replacement of something convenient for something less convenient so that a subway “token”, for example, is more convenient than cash. In the context of the card payment industry, tokenization refers to the replacement of the PAN with a proxy set of identifying information. Examples of tokens include the use of your e-mail address and PIN in place of the PAN on PayPal, use of your location and face in place of the PAN for certain Square transactions, and use of your location and device fingerprint in place of the PAN by Braintree.
The three largest card networks (Visa, MasterCard, and American Express) are also involved in tokenization announcing on October 1st plans for a global standard to replace account numbers in parts of the card payment system with digital tokens; this followed a July 1st announcement from The Clearing House (TCH), which runs the bank-owned ACH payments network, of a project called “Secure Cloud” (see Exhibit 3) to replace card and other account information in mobile wallets with randomly-generated, temporary tokens.
We note that the announcements are different in character: the card networks are developing standards (so a common format for digital tokens and their communication, for example) while the ACH is developing a solution (so actual tokens) with a pilot for next quarter. In practice, the networks will likely evolve to a solution quickly at least for e-commerce so that, for example, tokenization replaces Verified by Visa (VBV); the customer will enter a digital token (versus a PIN in the case of VBV) and the merchant will get card-present terms: a lower interchange rate and issuer assumption of fraud liability.
Exhibit 3: Schematic for ACH Tokenization – “Secure Cloud”
There is a security case for tokenization in that PANs never enter merchant business systems; rather, merchants are able to securely schedule and process payments against tokens without the cost and risk of storing PANs and with less onerous payment card industry (PCI) compliance requirements. Merchant systems are less attractive to cyber-criminals because the tokens, by themselves, are not valuable; only if they are sent by the merchant through the card payment system to a token vault and paired with the PAN can they be used to effect payment. Furthermore, tokens improve system integrity since if a token is compromised (e.g. lost or stolen wallet), it can be revoked and another issued if and when the wallet is recovered. Furthermore, tokens can be limited life (and so require regular renewal) and even one-time and they can be context-limited (so that, for example, if a token is provisioned for a digital wallet but shows up on-line the authorization can be refused).
Tokenization II: Control and Routing Issues
“We also engage with merchants and merchant acquirers and processors to provide funding to promote routing and acceptance growth. As these and other relationships take on a greater importance for both merchants and us, our success will increasingly depend on our ability to sustain and grow these relationships” 2012 Visa Annual Report
Digital tokenization confers increased control over payments routing to the token-owner (i.e. the party which issues the tokens and owns the directory or “vault” mapping tokens to PANs). Presently, routing is built into the number embossed on to a bank card (which itself is a token rather than the PAN) so that card numbers with a leading ‘4’ are routed through Visa while those with a leading ‘5’ are routed through MasterCard. Changing the routing is expensive since it involves re-issuing the card and persuading the cardholder to change the acceptance brand on the front of the card; in short, there are switching costs for a bank looking to shift payments volume from Visa to MasterCard or vice-versa. In digital tokenization, however, the routing instruction is encoded in the token, and a bank can change the token (and hence the routing) without re-issuing the card; the cardholder is none the wiser.
Visa can argue that transactions acquired on a Visa-branded card must be processed over the Visa network since only a “genuine” Visa transaction can support the brand promise but, in practice, it has already conceded the principle by licensing the Visa brand to Chase’s private processing service. With bank costs for switching networks near zero, we can expect least-cost routing and consequent increased pressure on issuer-side network fees. Indeed, as issuers seek to build direct relationships with merchants around information-based marketing, merchants can prevail on issuers to implement least-cost routing on merchant-side network fees as well.
Tokenization could be used to block the online payments companies from expanding their franchises through mobile payments to physical point of sale. For example, if a bank receives an authorization request from, say, PayPal for a debit transaction, the bank can issue a token for the relevant demand-deposit account (DDA) that is valid only for online use and not at point-of-sale. Such use of tokenization could be reviewed by the Department of Justice (DoJ) and found anti-competitive but, at the least, the banks would have bought some time to establish their own mobile wallets in the hands of customers.
Furthermore, the banks could prevail: PayPal is, after all, generating revenue from ACH-enabled access to DDAs while banks bear the cost and risk of the infrastructure. Chris McWilton, MasterCard President of US markets, has expressed bank frustration particularly as PayPal looks to extend its payments franchise to physical point-of-sale: “PayPal rides for free on the back of other business models. I think they’ve got to be cautious that they don’t get too big and start making people wake up and say wait a minute, I’m actually losing business [debit interchange] here because of your moving into the physical space”
Industry Standards and Scenarios
The anticipated migration to chip-cards/mobile payments is creating structural change in the payments industry because of the possibility of richer, and two-way, communication between payment device and point-of-sale terminals; this will likely allow payments to be a driver of customer-relationship management through the in-store capture of payments data and integration of loyalty rewards-redemption into the payments transaction (through e-coupons, for example). In addition, phone-based payments will allow other information conduits to interact in the payments experience including the internet for IP-connected devices (as in the TCH tokenization plans) and Bluetooth connectivity (as in the case of PayPal’s Beacon technology).
This enriched information environment for payments devices gives rise to a need for new technology standards and business rules. Examples of technology standards include the EMV (establishing the protocol under which payment-device chips will communicate with point-of-sale terminals in both contact form and NFC-enabled contactless form) and the tokenization protocols being promulgated by TCH and the card networks (establishing, for example, the data format and communication standards for tokens). Examples of business rules include when a transaction is deemed card-present and whether a “device-present” standard might be more useful, and whether there is an “honor-all-tokens” rule or retailers can pick and choose which tokens to accept.
Inevitably, these standards and their implementation will create industry winners and losers, and the resulting conflicts have delayed adoption of mobile payments. The situation is complicated because MasterCard and Visa are not in as strong a position to impose standards as they were before their IPOs in 2006 and 2008 respectively. First, as public companies, they are accountable to shareholders creating the potential for conflicting interests with the banks (now organizing through The Clearing House) they previously represented; and, second, merchants are determined not to let banks and networks define industry structure in a mobile payments world and have organized through the MCX consortium to shape industry evolution. There are a number of important conflicts between these stakeholders with some examples described below.
Cardholder Verification Method (CVM)
Issuer banks prefer PIN authentication because it carries lower fraud and authorization costs than signature authentication which, being less reliable, demands more risk-scoring in the authorization process. Furthermore, large issuers can work with processors to implement direct bank identification number (BIN) routing for PIN authentication and so improve margins by circumventing network fees altogether; indeed, banks may attempt to combine direct BIN routing with interbank clearance to generate a bank-controlled PIN network in the US following the model of Interac in Canada.
Direct BIN routing is more difficult with signature authentication because the associated risk-scoring either leverages Visa/MasterCard infrastructure (DPS/IPS respectively) or relies on bank credit card systems which are tightly linked to Visa/MasterCard infrastructure. Unsurprisingly, Visa/MasterCard prefer signature authentication because these transactions typically flow through their infrastructure and require their risk-scoring and fraud management services.
We view signature debit as an aberration (arising only because Visa/MasterCard tied it to their credit franchises through the honor-all-cards rules and sustained since these were terminated in 2003 because of issuer preference for premium interchange). Now that Durbin has eliminated the premium interchange of signature over PIN debit, it is less profitable to issuers than PIN (because of higher fraud risk) and we expect it to lose substantial share to a combination of direct BIN routing of PIN transactions by large issuers, use by smaller issuers of the existing PIN debit networks (including STAR owned by First Data and Pulse owned by Discover), and promotion of ACH-enabled debit by merchants including the MCX consortium.
Visa and MasterCard can continue to win a share of the PIN debit market through their Interlink and Maestro brands respectively (and, more recently, PIN-authenticated Visa debit which flows over VisaNet) but will need to compete on network fees in an environment where merchants have multiple routing choices; in short, Visa/MasterCard will either adopt commodity pricing for debit or be dis-intermediated.
Visa does not face the same threat of disintermediation in credit as debit in part because credit is not Durbin-regulated and continues to attract premium interchange; issuer economics in credit, therefore, are more driven by interchange (1.5-2% of transaction value in credit versus 21 cents/transaction, possibly falling to 12 cents, in debit) than issuer economics in debit which are more driven by network fees. One approach to managing the potential erosion of its debit franchise is for Visa to encourage a shift in spending to credit even if that spending does not need to be credit-enabled. Influenced by rewards programs, affluent customers already use credit cards in this way but mass-market customers tend to prefer debit for everyday spend and use credit only for large purchases where they need financing.
Visa is betting that e-couponing on credit cards, leveraging contactless NFC-enabled devices and terminals, will change this and shift the spend of mass market customers to credit products just as issuer-based rewards (miles, cash-back etc.) has shifted the spend of affluent customers to credit products. We believe this agenda has contributed to Visa’s push for EMV compliance (in contactless rather than contact-only form) even though issuers are ambivalent and merchants resistant; Visa’s agenda of shifting the spend-mix towards high-interchange credit products is, of course, likely the reason for the resistance to NFC by Wal-Mart and the MCX consortium more generally. We note that NFC pilots to date have focused exclusively on credit products and, given Visa’s apparent agenda, we do not expect NFC-enabled debit cards.
Visa’s desire to promote EMV standards (to bolster its credit franchise through NFC-enabled e-couponing) and leverage its risk-scoring and fraud-management services in signature authenticated products gives rise to strange product decisions. In particular, Visa has said that it will support a range of CVM with EMV ship including signature; in other words, Visa is taking steps (and imposing card re-issuance costs on issuers and re-terminalization costs on merchants) to reduce fraud related to counterfeiting and skimming (which are more difficult with chip cards) but not taking the opportunity to reduce fraud related to lost or stolen cards (which is more difficult with PIN-authenticated products).
Appendix – Visa Revenues and Payments Volumes