How do payments work?: A primer on payment systems
Note: This was first published on Linkedin 1st July, 2021
My current working goal is to develop a mental model of the payments stack to make better sense of the innovation happening in the space. To that end, I wanted to first abstract out the different steps in a payment and how major payment systems realize those steps.
Very simply, a payment is a transfer of value from one entity to another. The entity transferring value is the payer and the entity receiving value is the payee. The payment is complete when the payee is reasonably confident that the transferred value is now under his/her control and the payer cannot use it in another payment.
Steps in a Payment
There are four steps in a valid payment and the specific order of the steps and how trivial or complex each step is depends on the underlying payment system (payment rails). The payment system defines how value is transferred and provides a rule-making framework for participants to implement payment steps securely and to manage exception scenarios such as reversals and disputes.
1. Authentication / Payer Authorization: The payer initiates the payment and confirms that he/she is authorized to transfer the funds being sent. Payment systems (and regulators) often have rules on how payers are authenticated and require participants to create and maintain documentation of payer authentication in the event a payment is disputed.
Exhibit #1: Authentication / Payer Authorization in Apple Pay using payer fingerprint / biometric
Source: https://www.shopify.com/blog/118721221-apple-pay-is-coming-to-all-shopify-stores-this-fall
2. Authorization: The payer’s financial institution (custodian of the payer’s funds, typically a bank or credit card institution) also needs to authorize the transaction and confirm that the payer has sufficient funds for the payment. While payer authentication confirms the identity of the payer and his/her intent to pay, authorization confirms ability to pay.
Exhibit #2: Card payment authorized by issuer
Source: https://depositphotos.com/227981728/stock-illustration-vector-realistic-silver-3d-payment.html
3. Messaging (also called Switching): To effect a payment, a “payment message” containing the details of the payment such as amount of payment, payer and payee information, authentication method etc. needs to be securely exchanged between the financial institutions of the payer and payee. This need for secure data exchange helps highlight the value of a payment network operator such as VISA or Mastercard. Without a network operator, every financial institution would need to build individual connections to every other financial institution to exchange payment messages. The network operator provides a central platform that all financial institutions can connect to and thereby avoid individual connections to each other.
The payment message can originate either at the payer’s institution or the payee’s institution. For example, when you deposit a check, your bank sends the payment message to the payer’s bank. This is an example of a “pull” payment. In a “pull” payment, the payment message originates at the payee’s institution while in a “push” payment, the payment message originates at the payer’s institution. An easy way to remember this is to keep in mind that “push” and “pull” are always defined from the perspective of the payer. If the payment message originates at the payee’s institution, funds are being “pulled” from the payer and it is a “pull” payment. If the payment message originates at the payer’s institution, the payer is “pushing” funds to the payee and it is a “push” payment.
This messaging step is often also called “Switching” because the network “switches” the payment details from one institution to the other. There are standards which describe how financial institutions send these messages to each other. The below example shows messaging in a card payment system which majorly used a standard called ISO 8583. Another example of messaging standards that may sound familiar is SWIFT (think SWIFT codes in international payments).
Exhibit #3: Payment messaging in a card transaction
4. Settlement (also called Clearing and Settlement): This is always the final step in a payment. In this step, control of funds is transferred from the payer’s financial institution to the payee’s financial institution and thereby from the payer to the payee. For instance, in a payment involving two different banks, the banks could transfer ownership of central bank reserves to settle a payment. In a card transaction, the issuer of the card transfers funds (on behalf of the payer) to the network operator who in turn transfers funds to the acquirer (payee’s institution in a card network). Each payment system typically defines how settlement occurs within the system.
When both the payer and the payee have accounts at the same institution, there is no need to go through a network operator as the institution has access to the accounts of both the payer and the payee. These payments are called “on-us” transactions and typically saves the institution from paying fees to the network.
Payment Systems in the US¹
There are 5 major payment systems in the US: Cash, Checks, ACH (Automated Clearing House), Cards and Wires. These systems differ in their operating rules such as technical standards, membership requirements, fees, payment acceptance requirements and most importantly exception processing and dispute resolution.
Cash
Cash is a payment system we all understand intuitively. Cash is produced by the US Treasury and the US Mint. It is brought into circulation when a member bank of the Federal Reserve orders cash to be delivered to it. The Fed then reduces the balance in the bank’s account at the Fed and gives it cash. The member bank basically does an “ATM cash withdrawal” from the Fed!
Possession of cash implies ownership. Therefore, in a cash payment, the payer presenting a currency note to the payee serves as both authentication and authorization. Messaging and settlement are instantaneous as the currency transferred itself has value.
The recipient of the cash payment bears the risk of the cash being counterfeit. Cash payments also have no recourse. Once cash has been transferred, there is no way for the payer to reverse the transaction unless the payee voluntarily agrees to return the money. Cash transactions also typically have no transaction costs but handling cash typically comes with a lot of overhead costs such as counterfeit detection, protection from theft etc.
Exhibit #4: Cash Stack
Decisions on monetary policy are made in the Government layer which impacts the amount of cash available for depository institutions to withdraw. The depository institutions make rational decisions on how much cash to hold taking into account demand from end users and their individual economics of handling cash. End users interface with the depository institutions through bank branches, ATMs etc and make their demand for or supply of cash known.
Checks
Checks are one of the oldest payment systems in the US. Checks instruct a bank to take funds out of the payer’s deposit account and provide those funds to the payee named on the check. When a check is filled out, the payer needs to sign and notate the check properly for it be valid. This is the authentication step.
Checks often can be issued through one bank and then deposited at another. This calls for a mechanism for different banks to be able to exchange checks they have received for deposit. The Clearing House serves as this mechanism and is a central hub for checks heading in different directions. There are multiple Clearing Houses in the US, some owned by a syndicate of banks and some owned by independent third parties. The Clearing House sets rules for its participants (in addition to the Federal Reserve’s rules that govern payments). Up till the early 2000s, checks had to be physically presented to the check writer’s bank before they could be settled. When 9/11 hit, all planes in the US were grounded for three days and the entire check ecosystem came to a halt because checks could no longer be physically presented. This provided fresh impetus for check digitization advocates and eventually led to the passing of the Check 21 Act which said that the image of a check is legally equivalent to the physical check².
The Clearing House network is therefore what enables payment messaging in the check payment system. Checks are “pull” payments and the payment message always originates at the payee’s financial institution. The payer’s bank upon receiving this check message, surveys the payer’s account and provides authorization. Finally, the banks settle to finalize the payment. A Clearing House may run the final settlement process itself or may contract it out to the Federal Reserve Bank. Typically payments are batched periodically and funds are transferred between participating banks.
Exhibit #5: Check Payment
In step 1, the payer writes and signs the check and gives it to the payee. The payee deposits the check at his bank (step 2). This bank is called the Bank of First Deposit (BOFD). Steps 3 and 4 are the messaging steps where the BOFD sends the check to a Clearing House which in turn presents the check to the bank that issued the check. The issuing bank inspects the validity of the check (signature etc), looks up the payer’s account to verify if the check can be covered and if yes, authorizes the payment. The check payment is finally settled in steps 5 and 6. The BOFD finally credits the payee’s account (Step 7) completing the payment. The designation of BOFD is important as the check could go through multiple banks before it reaches the Clearing House.
The bank at which the check is presented for deposit may or may not make funds available to the payee until settlement. This decision is a trade-off between customer experience and risk management. It is a great experience for a payee to have immediate access to the funds once a check has been deposited. However, this does open up the payee’s bank to NSF Risk (Non-Sufficient Funds risk) if the payer’s bank eventually does not authorize the transaction and the payee has already moved the funds made available.
ACH
The ACH or Automated Clearing House is another important payment system in the US used for many different applications. The ACH was an attempt to do away with checks and focus on electronic transactions and is the only system to offer both push and pull transactions. The way ACH works is very similar to checks. A central network operator acts as a Clearing House to route transactions. No physical checks are required. Instead payment details are electronically transmitted through the network. The Reserve Bank and the Electronic Payment Network (EPN) are the two national ACH network operators in the US³. The non-profit association NACHA (National Automated Clearing House Association) is the primary regulatory and rule making body overseeing the ACH system.
An ACH “Pull” payment works exactly like a check. The payee’s bank originates the payment and is called the Originating Depository Financial Institution (ODFI). It is assumed (and it is indeed an obligation) that the ODFI has authenticated and obtained payer authorization to initiate the payment. The payment message is then sent through the ACH operator to the payer’s bank which is called the Receiving Depository Financial Institution (RDFI). The payer’s bank is provided a time-period to either authorize the payment or reject it. Authorized transactions are then batched together periodically and settled.
In an ACH “Push” payment, the payment originates at the payer’s financial institution. The ODFI is the payer’s bank and the RDFI is the payee’s bank. Messaging and settlement occur similar to a “Pull” payment. The payee’s bank can credit the payee’s account almost instantly in an ACH “Push” payment since the payer’s bank has already authenticated and authorized the transaction. Settlement risk is very low compared to an ACH “Pull” payment.
ACH participants typically manage multiple risks such as fraud and NSF. For example, in an ACH “pull” transaction, the payer might dispute the transaction and claim that it was never payer-authorized. There are also risks in a “push” transaction. For instance, the payer might claim that their account was taken over and the payment was never initiated by them. The NACHA rules provide a framework to assign liabilities in such risk events.
Wires
The Wire Transfer system is a real-time payment system. Messaging and Settlement happen in real-time and once a wire transfer is completed, there is no reversal. There are two major wire network operators in the US — CHIPS and Fedwire. Wires are typically used for time critical and guaranteed payments, and payments amounts through wires are much larger than those through other payment systems. Majority of B2B payments occur via the wire system. Consumers rarely use wires. Since wires cannot be reversed and often carry very high value payments, financial institutions build strong risk management measures leading to higher end-user costs to use wire even though transaction fees charged by the major wire operators are low.
Cards
The Cards payment system (debit and credit) are the major consumer payment systems in the US. The card networks are operated by the various card associations — Visa, Mastercard, American Express, Discover. These network associations create and set rules for participants, often in close consultation with the participants themselves. The institution providing the payer with a card is called the “Issuer”. The institution providing card acceptance capabilities to the payee is called the “Acquirer” and the network operator who facilitates switching and settlement is simply called the “Network”.
Cards are “pull” payment systems. When a payer swipes a card at the payee’s point-of-sale terminal, the payment message is sent from the payee’s acquirer to the issuer via the network. Typically multiple messages are exchanged through the network in real-time to authenticate the payer and receive payment authorization from the issuer. In card based payment systems, authentication, authorization and messaging occur in real-time and these payments are finally batched together periodically and settled.
Exhibit 6: Steps in a single-message card payment
In step 1, the payer initiates the payment at the merchant. This can be done at a merchant Point-of-Sales terminal (Swipe, Tap etc) or on the merchant’s website (Type details, Apple Pay etc). The payment message is sent to the merchant’s acquiring bank (Step 2). Steps 3,4,5 and 6 are the messaging steps in the payment. The payment details are sent from the acquiring bank to the issuer via the network. The issuer authenticates and authorizes the payment and sends this information back to the merchant (Step 5,6 and 7). Authorized payments are batched together and settled when the network debits the issuer and credits the acquirer. The acquirer then pays the merchant (Step 11). The payment is posted on the card holder’s statement and he/she pays the issuer by the statement due-date (Step 12).
The shift to more online payments has created additional fraud in card payments. 3DS (3 Domain Security) is an enhancement in card payments that includes an additional authentication layer to tackle online fraud. I have chosen this to illustrate an example of innovation in card payments.
Exhibit 7: Steps in a card payment with 3DS
Note: In the above diagram, I have considered the merchant and the acquirer to be one unit when labeling payment messages. Therefore, messages between the merchant and the acquirer may have the same number as the message into or out of the merchant-acquirer unit.
The payer initiates an online payment on the merchant’s website (step 1). In steps 2 and 3, card details are sent to the issuer via the network to evaluate participation of the card in 3DS. If yes, this affirmative message is sent back through the network to the merchant (steps 4 and 5) and the payer is presented with a re-direct link to begin the 3DS process (step 6). The link directs the payer to the network server (step 7) which contacts the issuer (Step 8) to begin 3DS verification. The payer enters a password or OTP which is verified (Step 9). Eventually, the payer is authenticated and the payer is directed back to the merchant (Steps 10, 11 and 12). Once the payer has been authenticated, the authorization flow begins and steps 13–21 represent the same card transaction message flow we saw in exhibit 6, though the message contents may be a little different given authentication is already complete.
Exhibit 8: Example password / OTP screen in 3DS flow step 9 (Verified by Visa and American Express Safekey)
Source: https://www.cardfellow.com/blog/american-express-safekey/
The economics of the card payment system involve two components of fees — assessment fees and interchange. Assessments are fees charged by the network operator to both the issuer and acquirer for use of the network. Interchange is a fee the acquirer pays the issuer.
The rationale for the introduction of interchange was that the merchants (and acquirers that enabled card acceptance) primarily benefited from the card network while issuers largely bore the costs of card acceptance. The card networks make it extremely easy for consumers to pay merchants (no need to enter bank account information, access to credit etc) and increase sales for merchants. Issuers, while enabling this increase in sales largely take the hit if consumers do not pay them back. Therefore, an incentive needed to be provided to issuers to participate in the card network.
It is extremely complex for every acquirer to individually negotiate with every issuer and arrive at interchange rates. The easiest solution is for the interchange rate to be set by the network. The network needs to balance issuers and acquirers — too high the interchange and you lose card acceptance, too low the interchange and you lose card issuers.
Interchange is a hotly debated topic. The Durbin Amendment was passed in 2010 as part of the Dodd-Franks Act and limited interchange on debit card transactions⁴ where the issuers have minimal credit risk and the argument of issuers bearing disproportionate costs of card payments breaks down.
Cross-Border Payments
All the payment systems we have seen above rely on a central network operator that manage switching and settlement. These central networks typically operate under supervision of a country’s financial regulator posing an interesting challenge from a cross-border payment perspective. To facilitate cross-border payments, Governments do pool together and create central networks. For eg: SEPA (Single Euro Payment Area) is a pan-European payment initiative targeted at simplifying cross-border euro denominated payments in Europe. As of 2020, SEPA has 36 members⁵. However, the most common method of cross border payments is through correspondent banking. In this system, relationships between banks helps move money.
When ICICI Bank in India wants to offer money movement to the US, ICICI approaches a US bank, say Bank of America to be its correspondent bank. ICICI then opens a dollar denominated account in Bank of America which is called its “Nostro” account (Italian for “your account of my money”)⁶. When a payer in India approaches ICICI to pay a US recipient, the “money” does not actually cross borders. Instead, ICICI uses its Nostro account to complete the payment (See exhibit 9).
Exhibit 9: Cross-border payment where payer and payee banks have a correspondent banking relationship
Source: https://www.bis.org/cpmi/publ/d147.pdf
In step 1, the payer initiates the payment. The bank debits the payer’s account after appropriate authentication and authorization (Step 2). The payer’s bank then sends a secure message (usually via SWIFT) to it’s correspondent bank advising it to credit the payee’s account. Once complete (step 3), the funds are available for the payee to use (Step 4). The payer’s bank then reduces the balance of its Nostro mirror account to account for its position in its actual Nostro account (Step 5). This mirror account is not an real account but is purely an accounting trick used to track positions in its Nostro account. This mirror account is tracked in the bank’s local currency.
When the payer and payee bank accounts are with banks that do not have a direct correspondent banking relationship, the payment is completed using a chain of banks that have individual correspondent banking relationships. This is often why cross-border payments are slow, expensive and opaque.
Exhibit 10: Cross-border payment where payment goes through chain of correspondent banks
Payments Ecosystem
The payment ecosystem is complex and has many different participants. Ultimately, these participants come together to help payers and payees easily implement the four steps of payments and enable commerce.
Exhibit 11: Participants in the Payment Ecosystem
− Payers and Payees: These are the end-users of payment services who want payments to be inexpensive, fast, secure and easy-to-use. They also want to be able to track payments, capture data associated with them for reconciliation, and also have easy access to value added services such as credit (to fund a payment) or accounting (to report payments accurately).
− Network: These operate the different payment rails (Eg: CHIPS, Fedwire, Visa, Mastercard etc). Each payment network operator is looking to increase volume through its network. To enable this, they innovate and provide value-added services to payment participants to incentivize use of their payment rails over competitors.
− Financial Institutions: These are typically banks where end users have deposit accounts. They own the relationship with network operators and ultimately are liable for following the operating rules of the network. Banks typically offer payments to deepen customer relationships, increase stickiness and create opportunities to cross-sell profitable products such as loans.
− Processors: These are vendors that provide payment services on behalf of banks. They enable banks to connect to different networks and help banks provide payment services such merchant accounts (be an acquirer) to businesses.
− Payment Service Providers (PSP): These are companies that help end users make or receive payments easily. Their main value proposition is to simplify payments, especially for businesses. Majority of the PSPs charge by number of transactions and/or through licensing fees. They focus on growing transaction volume by providing value added services on top of payments (eg: Buy Now Pay Later). Some types of PSPs are
- Payment Gateways: These are PSPs that enable businesses to accept payments online. They connect a merchant’s checkout experience to the merchant’s acquirer.
- Payment Facilitators: These are PSPs that allow small and medium-sized businesses to get around having a dedicated merchant account with a merchant acquirer. Getting an account setup with a merchant acquirer often takes months and a lot of paperwork. Payment Facilitators help small business get around this by onboarding them as sub-merchants under their own merchant account with a processor. Each business, though does receive its own ID and allows it to be treated as a distinct business.
- Payment Aggregators: These are a special subset of Payment Facilitators where businesses do not receive a separate merchant ID but instead operate directly with the merchant id of the aggregator⁷. However, the downside of not having a separate id for your business is that disputes or chargebacks at another business sharing the same merchant id could impact the payment fees and settlement terms offered to your business.
While the payment ecosystem is complex and vast, there are still a lot of opportunities to solve real customer needs. Examples of recent innovation include speedier payment experiences for peer-to-peer payments (eg: Venmo, Paypal) and use of the Bitcoin blockchain as an alternative payment rail. The hope is that base knowledge of how payments work will serve us well to better understand the ecosystem and the opportunities therein.
References
¹Large parts of this post are derived from the excellent book: Payments Systems in the U.S. — Third Edition: A Guide for the Payments Professional
²https://payment21.com/blog/paper-check%E2%80%99s-death-began-september-11-2001
³https://www.federalreserve.gov/paymentsystems/fedach_about.htm#:~:text=The%20Reserve%20Banks%20and%20Electronic,the%20two%20national%20ACH%20operators.
⁴https://en.wikipedia.org/wiki/Durbin_amendment
⁵https://en.wikipedia.org/wiki/Single_Euro_Payments_Area
⁶https://www.investopedia.com/terms/n/nostroaccount.asp
⁷https://www.bambora.com/en/au/news/whats-the-difference-between-a-payment-facilitator-payment-gateway--merchant-account/#:~:text=The%20only%20key%20difference%20between,directly%20under%20its%20own%20MID.
