ATM Outsourcing IBA Report June 2005

www.ibspublishing.com

ATM Outsourcing - State of the Indian market

Special ReportJune 2005

IBS Publishing Pvt LtdTelephone: +91 20 56030453

Fax: +91 20 56023653Web site: www.ibsintelligence.com

Contents

KEY DRIVERS FOR ATM OUTSOURCING 1

HISTORY 2

ATM OUTSOURCING IN INDIA 3

ATM OUTSOURCING MODELS 8

WHITE LABEL ATMs 11

INTEGRATION OF ATMs WITH OTHER DELIVERY CHANNELS 12

VALUE ADDED SERVICES 13

SECURITY ISSUES 14

ASSESSMENT OF BENEFITS BY BANKS 16

THE FUTURE ROADMAP 16

Research Sponsor:

For information related to subscriptions, please email [email protected] write to IBS Publishing Pvt Ltd, Daya Prabha House, Gulmohar Park, ITI Road, Aundh, Pune 411007, India.

©2005 IBS Publishing Pvt Ltd - All Rights Reserved.


IBS-IBA Special Report June 2005

Key Drivers for ATM Outsourcing

ATMs are expensive to own and operate, especially for banks with a limited branchnetwork and human capital already stretched to capacity. Banks have been struggling to balance the demands of increasing customer care touch points while reducing the cost to serve. In particular, ATMs continue to be an extremely important customer touch point to banks, but also represent a significant cost. This cost includes ongoing expenses due to servicing, monitoring, rent, and other operational costs, as well as capital investment inthe ATMs themselves.

The need for external services providers who help reduce expenses and eliminate unnecessary capital cost while assuming the burden of ATM operations is therefore becoming paramount. Managing ATMs is becoming an increasingly complex task witheach passing day with advanced services being offered. Banks have realised that the value of the ATM is not in its ownership, but in its ability to provide customers withconvenient access to their bank accounts. This has been one of the reasons for bankersto let external vendors handle the ATM channel.

Banks generally do not consider ATM management a part of their core business. Theywould rather focus on customers than on managing the ATM network. That is why theyprefer to outsource ATM related services. ‘Logistics of some of the services like security,cash replenishment, network and switch maintenance require skills that banks do not wantto invest in,’ says A K Upadhyaya, assistant general manager, information technology,Bank of Baroda.

There are other factors also that drive banks to ATM outsourcing. One such factor is transaction volume. For instance, the rise in the number of ATMs installed in the US has resulted in reduction of transaction volume per ATM. Even in India, the rate at whichATMs are being deployed ispresently greater than the rate of growth of ATM transactions.This reducing margin per ATMis one of the key drivers ofATM outsourcing. ‘Operational efficiency and cost efficiencyare the two major factors thatare driving banks to outsource ATM related services,’ saysLoney Antony, managing director, Euronet Services India.

Operational complexityrelating to network monitoring and maintenance, monitoring of performance both for on-site and off-site ATMs, cash replenishment and forecasting;places significant demands onthe valuable management resources in banks. Also, management of the call centre, first and second level support functions, and vendor relationship management are some of the areas that banks increasingly find better to outsource to third parties that have a credibleand reliable service offering. ‘Outsourcing helps banks to manage technologyobsolescence, security and uptime more efficiently,’ says Deepak Chandnani, managing

Table 1: Key Drivers for ATM Outsourcing

Availability of expertise

Optimal use of resources

Proactive maintenance

Single point of contact

Committed uptime

Quicker implementation of technology upgrades

Systematic reporting and MIS

Trained staff

Enables the bank to concentrate on its core business

©2005 IBS Publishing Pvt Ltd - All Rights Reserved. 1



director, NCR India. While selecting such third parties, banks assess the infrastructure available with them and their ability to manage multiple aspects of the ATM network.

Many financial institutions today dedicate significant financial and management resources to the ongoing operation and support of ATM networks. As financial institutions increasingly come under pressure to cut costs and boost margins, they are discovering that outsourcing their ATM network can bring improved performance and a reduction in operational costs. The key to making the ATM outsourcing relationship successful and profitable is knowing what to look for in the outsourcing relationship, choosing the right service provider, measuring the outsourcing ROI and maximising value of the outsourcing relationship.

History

Very few inventions of this magnitude and complexity are successful in their first iteration. In 1939, a serial inventor by the name of Luther George Simjian created the Bankmatic automatic teller machine. Simjian filed 20 separate patents related to the device and persuaded what is now Citicorp, to give it a trial. After six months, the bank reported of insignificant demand.

Don Wetzel was the co-patentee and chief conceptualist of the modern automated teller machine, an idea he said he thought of while waiting in line at a Dallas bank. At the time (1968) Wetzel was the vice president of product planning at Docutel, the company that developed automated baggage-handling equipment. The other two inventors listed on the patent were Tom Barnes, the chief mechanical engineer and George Chastain, theelectrical engineer. It took five million dollars to develop the ATM. The concept of the modern ATM first began in 1968, a working prototype came about in 1969 and Docutel was issued a patent in 1973. The first working ATM was installed in New York basedChemical Bank.

The first ATMs were off-line machines, which meant that money was not automaticallywithdrawn from an account. Bank accounts were not connected by a computer network to the ATM. Therefore, banks were at first very exclusive about who they gave ATMprivileges to, giving them only to credit card holders with good banking records (historyrepeated itself in India during the last decade of the century that has gone by). Wetzel,Barnes and Chastain developed the first real ATM cards, cards with a magnetic strip and a personal ID number to get cash. ATM cards had to be different from credit cards so that account information could be included.

In the UK, John Shepherd-Barron is credited with the invention of the ATM. His vision for a 24 x 7 cash dispenser was conceived back in the mid-1960s. At the time, he wasmanaging director of De La Rue Instruments in London. The invention of the ATM brought together different ideas, experiences and technologies. For example, Shepherd-Barron'sarmoured trucking division was then responsible for moving most of the cash in the UK. He had earlier brought over the idea of armoured trucking from the US.

Shepherd-Barron was involved with printing money and then moving it as a part of his job. Inevitably, the next step that seemed to follow was dispensing money automatically. Hegot his first break after he convinced a general manager at Barclays Bank to build a cash dispensing device. The first machines followed soon after a deal was signed with the bankto develop six ATMs (then called DACS for De La Rue Automatic Cash System) on a trial basis, followed by 50 more machines. It took one year to develop the machine and make it work.




DACS was installed outside a north London branch of Barclays Bank in 1967. Shepherd-Barron's invention had become a reality. Shepherd-Barron took the concept to both, the US and Japan, poised to become two of the world's largest ATM markets. Soon Shepherd-Barron got his first US order from First Pennsylvania Bank for six machines to be installed in Philadelphia. The idea was later taken to Japan and installed by banks that paid royalties for seven years.

Unimaginable as it may seem, the ATM was never patented, allowing rival machines toenter the market and, in turn, setting pace for a rapid growth rate. However, there was a reason behind not wanting to patent the ATM technology. Shepherd-Barron’s legal team believed that applying for a patent would have involved disclosing the coding system,which in turn would have enabled criminals to decipher the code and make it vulnerable In December 2004, 79 year old Shepherd-Barron was appointed an Officer of the Order of the British Empire in honour of his contribution to the banking industry.

ATM Outsourcing in India

Setting up an ATM network involves finding premises to install, creating the infrastructure in terms of surveillance system, air-conditioning equipment, uninterrupted power supply,and acquiring and installing the ATM itself. Then comes the connectivity that could be through landline or VSATs. A transaction switch needs to be installed centrally to which all the ATMs of the bank and the branch systems (in case of distributed database implementation) or the core banking system are connected.

Operating the ATM network involves cash replenishment and management, monitoring, incident management, call centre management, vendor relationship management, securityand reconciliation. It also involves running and maintaining the transaction switch and network. All these activities can be outsourced. ‘Presently in India ATM outsourcing is done partly, i.e. ATM's and sites are owned by the bank and these are being maintained by various vendors for network, cash replenishment, switch operations, call centre etc.,’ says a banker from the co-operative sector.

‘While banks in the US only own cards, banks in India own networks,’ observes V. K. Ramani, president – information technology, UTI Bank, which ownsthe third largest ATM network in India, with State Bank of India and ICICI Bank owning the largest two networks. UTI Bank has over 1,650 ATMs across the country. The bank outsources ATMinstallation and switching. ‘Once the bank identifies a site to setup an ATM, other things like setting up the VSAT network, air conditioning, processing services, cash management and replenishment and hiring of security agencies is outsourced,’ saysRamani. UTI Bank has installed a Base24 ATM switch from ACIWorldwide, which is managed by Chennai-based Financial Software& Systems (FSS).

V.K. Ramani, UTI Bank

Between doing everything themselves, like Shamrao Vithal Co-operative Bank which has35 onsite ATMs, to Bank of India which has adopted a totally outsourced approach, various types of partial outsourcing exists among different Indian banks. In some cases a part of the infrastructure is outsourced, while in others only services is outsourced, while inyet others only switching and networking is outsourced.

In India, ATM machine suppliers and switch suppliers presently dominate the ATM out-sourcing market. For instance, Diebold Systems, a wholly owned subsidiary of NYSE-




listed Diebold provides managed services for Bank of Punjab's network of over 220 ATMs.Diebold uses its Event Management Software, which interfaces with the bank's ATMswitch provider to monitor the status of the network and electronically receive ATM status messages at a dedicated 24 x 7 monitoring centre at the bank.

NCR, another major ATM supplier, provides managed services involving 24 x 7 monitoring and incident management to banks such as SBI, HDFC Bank and Corporation Bank whichhave large ATM networks. ‘We use a fully automated system for ATM monitoring, whichuses our proprietary diagnostic tool to generate a ticket which gets routed to the relevant vendor for fixing the problem,’ says Chandnani. ‘We have an escalation matrix in place to automatically escalate the observed incident within the related vendor’s organisation till it gets resolved’.

Other service providers, which have sufficient experience insystems integration, facilities management and who enjoyhealthy relationships with the financial industry in India are likelyto join the fray. For instance, Anand Sankaran, vice president - total outsourcing, Wipro Infotech, says ‘We are already in the business of system integration. Quite a substantial part of ATMrelated infrastructure and services falls within the IT domain, so ATM outsourcing would be a logical extension of our businesslines. So far, only ATM vendors or switch suppliers have beendominating the outsourced ATM service market in India. Thereis no system integrator in the field’. Such service providers are planning to leverage their existing relationship with the banksand the confidence that the banks have in them. ‘Many banks that are our existing customers would like us to provide these services, especially when the ATMs move torural markets where service level agreements would be a key concern,’ says Sankaran.

Anand Sankaran Wipro Infotech

‘Prior to 2001, proprietary ATM networks were set up by the banks in India to create brand differentiation and for customer acquisition,’ says Antony. New private banks like ICICI Bank, UTI Bank, IDBI Bank and HDFC Bank and multinationals like Citibank and StandardChartered Bank spearheaded this movement. When India’s first shared ATM network,Swadhan, was launched in 1997 in Mumbai under the leadership of Indian Banks’Association (IBA), these banks were initially reluctant to share their ATM networks.Swadhan was an idea whose time had not yet come. Swadhan was being managed byIndia Switch Company (ISC), a joint venture between ACI, Tandem, HMA Starware and

Financial Software& Systems (FSS)using the Base24 transaction switch.It eventually closeddown in December 2003.

FiguFigure 1: Growth of ATMS in India. Source: Venture Infotek Research

But during these years, a handful of other banks, like State Bank of India (SBI), Andhra BankFederal Bank, andPunjab National Bank (PNB) had setup their own ATM




switches. Wider deployment of ATMs had established it as a channel for customer convenience, which made sharing of ATM networks a commercially viable proposition. Banks that owned a large number of ATMs saw an opportunity in the transaction-acquiring business that could contribute to more revenues per ATM deployed. The closure of Swadhan kick-started bi-lateral ATM network sharing arrangements between various banks, which continues even now. Very recently, State Bank of India entered into such an arrangement with PNB and Corporation Bank. The growth of ATMs in India is depicted inFigure 1, which is based on ATMs connected to Visa / MasterCard networks.

Whatever might be the commercial considerations for these numerous bi-lateral ATMsharing arrangements, these are not as convenient for customers as multi-lateral and branded networks. The largest among these multi-lateral networks is Cashnet whichbegan with just three member banks, viz. Citibank, UTI Bank and IDBI Bank and is managed by Euronet India. The details of various multi-lateral shared ATM networks are in Table 2 below:

Table 2: Multi-lateral shared ATM networks in India

Network Managedby

#ATMS

SettlementBank

Other Member Banks

Cashnet Euronet 5000 IDBI Bank UTI Bank, Bank of Punjab, Centurion Bank, Dena Bank, Citibank, Corporation Bank, Dhanlakshmi Bank, Development Credit Bank, HDFC Bank

Cashtree ISC 1800 Bank ofIndia

Union Bank of India, Syndicate Bank, Dena Bank, Indian Bank, United Bank of India

NFS Euronet 4100 ClearingCorporationof India

Andhra Bank, Bank of Baroda, Corporation Bank, Punjab National Bank, ICICI Bank, IDBI Bank, United Western Bank, South Indian Bank, Dhanlakshmi Bank

Mitr FSS 2800 PunjabNationalBank

Oriental Bank of Commerce, UTI Bank, Indian Bank, Karur Vysya Bank

Bancs ISC 3000 Bank ofIndia

UTI Bank, Bank of Maharashtra, Bank of Bahrain & Kuwait, Greater Bombay Co-operative Bank, Centurion Bank, Central Bank of India, Punjab & Sind Bank, IDBI Bank, Ratnakar Bank, SBI Commercial & International Bank, Cosmos Bank, Air Corporation Employees Co-operative Bank, Saraswat Co-operative Bank




In addition to the above, there is CashOnline, for which Canara Bank is the settlementbank and other members are Central Bank of India, Indian Overseas Bank, UCO Bank and Union Bank of India. Most of these networks came into existence during the year2003.

The functionality of an ATM depends on the instructions which the ATM gets from the switch. An ATM obeys commands from the switch and is only an execution and dispensing machine. The switch on the other hand represents the heart of the ATMnetwork. Many banks have their own switch and those that do not ride on the networks of other banks. However, that is a business decision every bank management has to make.

Euronet India was selected by the Institute for Development and Research in Banking Technology (IDRBT), the technology arm of Reserve Bank of India (RBI), to implement aNational Financial Switch (NFS) in the country. NFS consists of both an integrated inter-ATM switch provided by Euronet India and an Internet and e-commerce payment gateway from Opus Software, which willact as an e-commerce facilitator to authenticate and route payment details between banks and various parties. Theswitch became operational in August 2004. This two-partsolution is the first of its kind at the national level. ‘NFS will act as the mother of all ATM switches, and all other ATM switchesin the country are expected to join it eventually,’ says Antony.The settlement on NFS takes place through the RTGSsystem. It is expected to be a major step in building the financial infrastructure to allow connectivity for participatingbanks' ATMs. In many countries, national switches are developed and run by the country's central bank to ensure that all local banks can participate in electronic payments.

Loney AntonyEuronet

The SBI group has acquired the numero uno status in terms of ATM deployment in India. Starting out in 1992, the SBI group had progressed to 250 offline ATMs until 2000. In 2000, the bank floated a global request for proposal (RFP) for the installation of a transaction switch and selected the Base24 switch from ACI worldwide to be implemented on HP Non-Stop (Tandem) hardware, which was installed in March 2001. In the next four years it installed 5000 ATMs. Today, It owns a network of 5300 ATMs, which is more than double of its closest competitor, ICICI Bank.

SBI is implementing Bancs core banking solution from FNS with TCS as the systemsintegrator for its domestic branches and Finacle from Infosys for its overseas branches. The Base24 switch and both the core banking systems are based at its data centre in Belapur, Mumbai. The switch has a disaster recover site in Chennai. For connectivity, a combination of VSAT, landlines and ISDN are being used. The ATM machines are from both NCR as well as Diebold. The Indian distributor of ACI Worldwide for the Base24 switch, FSS, has been providing technology services to the bank in its ATM initiatives likeissuance of Maestro debit cards and VISA and MasterCard acquiring business. Initially,SBI had decided not to share its ATM network, but later when it entered into agreements for ATMs sharing with other banks in India, it decided to use inter-bank transaction switching and settlement using ASP hosted service FSSNET from the vendor. The bank uses Prognosis software from Integrated Research, Australia for monitoring the ATMnetwork, and DCMS card management system from FSS. ‘The SBI group uses ourProConcile ATM solution for reconciling ATM transactions,’ says Suresh Kamath, chairman and managing director, Laser Soft Solutions.




The ATM transactions for SBI group have grown five-fold in the last two years. The bank has issued more than eleven million ATM/debit cards that generate close to one million ATM transactions involving INR 700 million per day. ‘SBI has a vision of making world class banking services available to the people of the country, whollynetworked, with multiple delivery channels,’ says A. K. Purwar,chairman, SBI, and chairman, IBA.

A.K. PurwarChairman, SBI / IBA

Both, SBI and ICICI Bank, have been following the policy of avoiding multi-lateral shared ATM networks and opting for bilateral arrangements. While SBI has reciprocal ATM sharingarrangements with UTI Bank, HDFC Bank, Andhra Bank, Indian Bank, PNB and Corporation Bank, it is not a member of anymulti-lateral network, not even NFS. ICICI Bank has reciprocalarrangements with Andhra Bank and Federal Bank, but it wasthe first bank to join NFS.

HDFC Bank, which recently joined Cashnet, has also been avoiding multi-lateral ATMnetworks so far and relying more on reciprocal arrangements. 'Bilateral sharing of ATMnetworks is more popular among banks in India and is likely to co-exist with various multi-lateral sharing arrangements,' says Rahul Bhagat, vice president, direct banking channels, HDFC Bank. Antony holds the opposite view, saying ‘Multi-lateral shared networks will join NFS as a consortium and co-exist with it, but bi-lateral arrangements will disappear over time.’

The field is clearly unequal, as can be seen in Table 3 below. The top six banks ownalmost two-thirds of the total ATMs deployed in India. In fact, the top three account for almost half of the market share. Multi-lateral sharing is seen to be more useful for banks having fewer ATMs.

Table 3: ATMs Deployed by Major Banks in India

Bank # ATMs % Share

State Bank of India and its Associate Banks 5300 30

ICICI Bank 1900 11

UTI Bank 1650 9

HDFC Bank 1070 6

Corporation Bank 800 4

Punjab National Bank 560 3

All Other Banks 6720 37

Total 18000 100




ATM Outsourcing Models

According to estimates by Celent, financial institutions worldwide spent US$4.9 billion on outsourcing services for ATM operations in 2002. The market still has considerable room for growth, and ATM outsourcing is expected to grow at a steady pace to US$6.5 billion bythe 2007.

Industry experts believe that although banks have outsourced basic functions for years,outsourcing of managed services still comprises only a tenth of total ATM operating costs. Banks are constantly on the look out for alternatives to own and operate their ATMs as the cost of offering convenience to customers is proving to be prohibitive. Banks have beendedicating significant financial and management resources to the ongoing operation and support of their ATMs. But in recent years they have been taking a closer look at alternative ways of managing their ATM networks.

ATM outsourcing in India can be broadly classified under three broad models. One, where the bank sets up its own ATMs network and manages it, but outsources specific services like security, cash replenishment, network and switch management to third partyservice providers and suppliers. In this model, vendor relationship management and uptime of the ATM network remains the responsibility of the bank. SBI, which has a general manager specifically to handle ATMs, claims to follow this model. According to a bank spokesperson, ‘We outsource only the facilities management’. The bank claims to handle cash replenishment itself and says that it does not hire security guards. ‘Thesecurity guards have to go at some point of time, especially when offsite ATMs take off in a big way,’ says Antony. For a bank with an ATM network which is bigger than any multi-lateral shared network, the economy of scale is on its side.

The second model stops just short of relinquishing the ownership. The bank owns the entire ATM infrastructure butoutsources all the services including installation, creating the infrastructure, monitoring, call centre, maintaining the networkas per pre-defined service level agreements, cash management and security. This model has many variants witheach bank customising the model to suit its requirements. Forinstance, HDFC Bank uses this model for outsourcing ‘managed services’ while owning the assets. 'Withinmanaged services, incident management is crucial formaintaining the desired service levels,' says Bhagat. Itinvolves co-ordination with a host of suppliers with whom the bank may have maintenance contracts. 'We are one of the few banks that haveoutsourced incident management with pre-defined service level agreements,' he adds.

Rahul Bhagat HDFC Bank

UTI Bank, too, has opted for this model where the banks network centre resides within its premises and external vendors supplement the management activity, both onsite and offsite, for a fee. ‘We have set up ATMs at 14 railway stations in Mumbai and 24 per cent of the transactions at these ATMs are generated from non-UTI customers,’ says Ramani. In a situation like this, UTI Bank acts as a service provider to other banks using its infrastructure and network.

Another instance of ATM outsourcing could be through a common shared network wherethe ownership of the network remains with the consortium of banks. Elaborates Ramani, ‘If a bank decides against setting up its own network, it can very well exercise the option to




join an existing network. Kotak Mahindra Bank and ABN Amro Bank have chosen this model of ATM outsourcing. Such banks absorb the transaction costs themselves instead of passing them to the customer while they rely on another banks network and infrastructure at almost zero cost’.

Several independent payment systems providers such as Euronet, FSS, and India SwitchCompany (ISC), now owned by eFunds, are tapping this outsourcing opportunity. Euronet provides ATM management services to Development Credit Bank, apart from IDBI Bank,Standard Chartered and Citibank who have outsourced the complete management of their ATM programs to the vendor. Unlike these banks, UTI and Corporation Bank have outsourced only their shared ATM services to Euronet India under its Cashnet network. It has recently signed a multi-year ATM outsourcing and deployment agreement withCenturion Bank. Under the agreement, Centurion Bank will outsource its entire network of 152 ATMs to Euronet India. The vendor has taken over the operation of the bank's ATMsand provides end-to-end ATM outsourcing services from its operations centre in Mumbai.

Banks that have already been in the business for a while now prefer a hybrid network to start off with and later graduate to a common network. Not very long ago the choice of network was dependent on the amount of fees MasterCard of Visa would charge from banks. But now that banks have entered the market themselves, it is the domestic shared network where pricing is shared. It is no secret that banks with a large number of ATMs

are acquirers of large transactions. Those that have invested in physical infrastructure will eventually gainbut those without a network rely solely on the existing networks of other banks and external service providers. ‘Banks owning large ATM networks aremore inclined to outsource only managed services,while banks with smaller networks prefer tooutsource the assets as well,’ comments Chandnani.

eFunds provides managed services for ATMnetworks of banks. These include transaction processing, ATM health monitoring, cash flow

management, switching and connections. With the US$20 million buy-out of ISC’sbusiness and assets, eFunds will gain access to 12 installations in India. According to Atul Kunwar, senior vice president - global outsourcing and managing director for India, eFunds, ‘Banks can either undertake ATM outsourcing functions internally or outsource some or all of them to vendors like us. Transaction processing can be outsourced at three levels. In the first stage money moves within Reserve Bank of India’s (RBI) branches through a Cash Flow Management System (CFMS). When it comes to the RTGS system,wholesale transaction processing takes place, with money travelling between banks, whilein the case of retail transactions customers are connected through Visa, electron or POSsystems’. Banks can either own their ATM networks or outsource them depending on howproactive the management is. In the former case, a bank may either build a paymentgateway of its own and pay the outsourced services provider based on service levelagreements or pay per transaction per day. According to Kunwar, the ATM concept is proven, but its roll out is critical and that is where outsourcing comes in.

Deepak ChandnaniNCR

The setting up of ATMs by UK major retailer Tesco, is an apt example of how the large retail outlets are entering a territory that, until recently, was considered the exclusive domain of banks. Payments for services through such ATMs are settled based on transactions with one bank, for eg. the Royal Bank of Scotland (RBS). If a mall, petrol pump or drug store wishes to put up an ATM they would need a cash dispenser that will




permit multiple interfaces and support an open architecture. Between 75 to 80 per cent of London’s financial transactions run on eFunds’ platform.

Wal-Mart Financial Services has started offering cheque cashing, wire transfers and money orders. ATM services are offered in 1,200 Wal-Mart stores across the US. Wal-Mart is America’s largest employer and maintains a well developed, CRM-based, back-end operation. Another example is Vcom, a financial kiosk in 7-Eleven stores that merges 24-hour ATM capabilities with other services. With the kiosk operating in more than a thousand 7-Eleven stores, and with the company operating a total of about 5,800 stores in the United States and Canada, this Dallas-based convenience store chain is positioned toleverage the market. Banks and financial institutions should align with national andregional retailers and create a trusted and established household brand.

Unlike independent payment service providers, ATM vendors like NCR and Dieboldservices are centred around the hardware box and installations. Their agenda is clearly to maximize ATM transactions, while third party service providers like eFunds, Euronet and FSS work on the principle of maximizing services and transactions. Independent paymentservices providers and ATM vendors are two ends of the same spectrum. The formereither get paid on a per transaction basis or a fixed payment basis.

The third outsourcing model involves leasing of assets. Nagaraj Mylandla, managing director FSS defines it as, ‘A service provider offers banks outsourced ATM services whereby the service provider will deploy ATMs for banks and operate those ATMs for afixed monthly fee or a combination of a fixed monthly fee and transaction fees. Thelocation of the ATMs and the deployment pattern will be as per the requirement of the bank’. This is the model currently being used by Bank of India. ‘We have opted for a totally outsourced model for our ATMs,’ says V. Babu, deputy general manager, Bank of India, which has signed up for total retail infrastructure management services (TRIMS)from ISC. The bank has leased ATMs from ISC for a seven year period with a clause inthe service level agreement mentioning that in case of unsatisfactory service, the bank can take over the ATMs. According to Babu, the payment is on a per day per ATM basis.

According to Mylandla, ‘When it comes to cost management and optimisation, the service provider manages vendor relationships for all activities in the service life cycle of ATMmanagement. This optimises resources and costs for the bank. The cost savings

associated with aggregating vendor management and resource optimisation is in consonance with the bank’s objective of better resource utilisation’.

'Banks with capital constraints are likely to favour this model,'says Bhagat of HDFC Bank, which currently owns the complete ATM infrastructure and outsources only the services.

‘There are costing issues that need to be sorted out, beforegoing in for this model,’ asserts Upadhyaya of Bank of

Baroda, which is planning to increase its ATM network to 1000 ATMs within the next six to eight months. The bank uses the infrastructure and facilities management service fromDiebold Systems and the Narada switch from Yalamanchili. Wipro is also planning to either partner with, or use ASP services from Yalamanchili. ‘As a part of ATMoutsourcing, we would provision the ATMs, manage and maintain the ATMs and thenetwork, and provide ATM operation services,’ says Sankaran. ‘We have expertise in managing IT infrastructure remotely. We can leverage on this expertise for monitoring unmanned ATMs. We provide managed ATM services along with end-to-end outsourcing with leased assets.’

Nagaraj Mylandla, FSS




‘We are not allowed to put up offsite ATMs or to offer value added services under the present regulations,’ says Ravikiran Mankikar, IT head, Shamrao Vithal Co-operativeBank, which has 35 onsite ATMs. While agreeing that the costs are higher if a bank tries to deploy and manage its ATMs, his bank presently does not outsource ATM services. ‘Since all our ATMs are onsite, we do not see it commercially viable to outsource the entire ATM operations,’ echoes another banker from the co-operative sector.

Using the right outsourcing business model ensures that all parties involved can benefit from more concerted collaboration; banks, because they can get a point of presence in the field at an optimum cost, and retailers because they can recycle their cash stocks on-site,reduce the cost of cash and earn additional revenue. Banks are extremely skeptical to outsource their entire operations in the first instance, and usually begin by outsourcing a small portion of the overall ATM program such as vendor management, cash management or processing. This allows sufficient time for mutual evaluation of the processes outsourced and helps provide an economic benefit through reduction in price and excess management supervision to the bank.

White Label ATMs

The concept of white label ATMs is widely prevalent in developed countries. North American markets have been more receptive to ATM outsourcing than European markets. In European markets, a larger percentage of ATMs are located at bank branches (onsite ATMs), as compared to North American markets where the share of offsite ATMs is much higher. Hence, the scope for ATM outsourcing is higher in North American markets than in European markets. In India, as in the European markets, the proportion of onsite ATMs is higher. However, it is believed that opportunities are available in Europe and India to provide ATM access in places where customers use ATMs more frequently.

The US has over 3,00,000 ATMs and Americans carry out than 1.1 billion ATMtransactions a month, which is about 26,000 transactions a minute. At last count, 394,500 ATMs were currently deployed within the United States, of which approximately 194,000 or 49 per cent are operated by Independent Sales Organisations (ISO). ISOs are the engines that drive ATM placements in off-premise locations. They enter into sales, deal with merchants and distribute the proceeds.

'White label ATMs are only at the conceptual level in India as of now,' says Bhagat citing regulatory hurdles in India to this mode of ATM outsourcing. Upadhyaya also points out that there are regulatory issues, particularly the ownership of cash dispensed by serviceprovider ATMs, which need to be addressed before this concept takes off in India. ‘We are not averse to the concept of white label ATMs,’ says P. Vijaya Bhaskar, chief generalmanager, department of banking operations and development, RBI. ‘As technologyadvances, new products, services and ways of providing these services will change,’ he says, adding that ‘due care has to be taken that various risks are taken proper care of’. Detailed guidelines on outsourcing by banks are being formulated in accordance with the guidelines from Bank of International Settlements. ‘White label ATM deployers operate on a different business model than that of the banks owning ATM networks,’ says Chandnani, adding that ‘the key factors governing this model are the number of ATM cards in a geography, convenient locations like retail chains, airports and railway stations, and the affordable charges to the customer’.

Ramani of UTI Bank sums it up, ‘Public and private sector banks in India are still in the ATM building/acquisition mode and it would still take some time before they begin limiting the number of ATMs in their network or treat them as a non-core business. However, with




the rise in both, the quantum of transactions per ATM and the number of external service providers, banks may be able to decide on whether to own ATMsor totally outsource the ATM management business only after a couple of years from now’. Mankikar feels that smaller banks willderive considerable benefits from white label ATMs but their current mindset has to change.

Ravikiran MankikarSVC Bank

There are around 18,000 ATMs in India at present, but the bulk ofthem are located in major cities and towns. ‘Customers in other areas are demanding the ATM channel,’ says Babu, holding that further growth for ATMs in India will come from smaller towns and rural areas.

Integration of ATMs With Other Delivery Channels

Adoption of newer technologies, integration of hardware and installing software is easier in countries that have no legacy systems, unlike developed markets such as the US.Adoption in North America, experts feel, is likely to be relatively slower. In contrast to the United States, where ATMs communicate with hosts via proprietary NDC and DDC protocols, Europe has relied on the more basic ISO 8583 standard. Since ISO 8583 onlydefines transaction data rather than specifying how ATM applications should run, it has been easier for European deployers to move to browser-based technologies.

Banks can choose to take an incremental approach to integration or adopt a broader, enterprise-wide strategy. An incremental approach is more likely to yield immediate financial improvements, while the enterprise approach will result in larger reduction of cost over time. The enterprise approach also yields a better balance between IT and operational savings.

Both these methods use middleware to enable data flow between delivery channels as part of a central platform that connects all delivery channels with back-end systems. Such platforms provide transaction capabilities, business logic and customer data integration. Most middleware available today has evolved from serving just as a routing mechanism to providing greater intelligence and boosting CRM efforts.

Newer internet technology applications are comparatively easier to integrate as they can be added very quickly to the existing infrastructure. ATMs tend to be at the bottom rung of the priority list for most banks and financial institutions when it comes to channel integration as they have traditionally been part of a message-based system that has communicated with proprietary protocols. Besides, they are inherently more difficult to integrate with other channels as they have data warehouses and one needs powerfulmachines for this purpose.

However, it will not be long before ATMs become a critical part of the overall hardwareintegration strategy for banks. When this happens, natural synergies with other channels can be established. Cardholders could register online and be notified when their card has been used to withdraw more than a specified amount from an ATM, thus reducing fraud concerns.

Celent Communications estimates that financial institutions will spend between $5 millionand $70 million on integration projects that between one to five years. Developed markets are expected to lag behind developing markets when it comes to integrating the ATMnetwork.




The challenge however, lies with the outsourcing services provider whose agenda should be to provide a consistent experience for the user, regardless of the channel. This means that data should be updated in real time or near real time, with the same data available across channels. So, for instance, a customer withdrawing funds from an ATM or makinga deposit at a branch would see those transactions when he logs in to his online banking account later the same day.

The desire to better align their channels has grown in recent years as banks are attempting to differentiate themselves by building better distribution networks and offeringthe products and services that their customers want. To do this, they must develop asingle platform to manage customer data; one that can interact with all of their deliverychannels. Such a system would help fine-tune CRM efforts.

Banks and financial institutions are far more receptive to the idea of channel integration now as it would help them launch more products and services and improve customer service despite keeping costs under control.

Value Added Services

ATMs are no longer looked upon as mere cash dispensing machines but as avenues to provide a host of value added services. Banks are looking at accelerating the pay back period of ATMs by providing these value added services. Says a co-operative banker, ‘In the outsourcing model, value added services plays a vital role. As part of improvedservices, the outsourcing agency always looks forward to give new value added services to his customer. These value added services include coupon dispensing, gift vouchers, theatre ticketing, bill payment, loan request etc. By virtue of these facilities, the customer has the convenience to do even non-banking transactions at ATMs.’.

Packaged solutions are increasingly being preferred by big banks with multiple deliverychannels, while smaller banks perceive advantages in outsourcing since they are able to enjoy the advantages of superior technology at very affordable costs. With increased competition, the lines of differentiation in the retail banking space are becoming verynarrow. The answer lies in more offerings like various consumer payments and other utilitarian facilities through existing delivery channels. Value added services offered byservice providers are designed to do just that. Service provider partnerships with various mobile service operators and billers provide financial institutions an access to millions of potential subscribers in the Indian and overseas markets. Banks can offer prepaidproducts like mobile phone top up, long distance calling cards, internet packs etc. to their customers. The range of services offered on self-service terminals are growing and expected to go beyond deposits and withdrawals of cash.

Though in its infancy, provision of value added services is poised to grow significantly, in terms of both usage rates aswell as the breadth of functionality offered by machines. Theirrole, too, is set to change, moving further away from being rationalisation tools, towards being a promotional medium, a source of profit, and a proactive customer dialogue tool, all the way through to entry into binding contracts.

‘We provide value added services like bill payments andmobile top-up through our ATMs,’ says Babu. A Bank of India ATM card can be linked to six different accounts in different cities, and funds betweensuch accounts can be transferred through the ATM.

V. Babu Bank of India




Euronet is a specialist in pre-paid top-ups through ATMs. Antony cites value added services as one of the main advantages offered by service providers of multi-lateralnetworks.

For the ATM industry to sustain itself, an increase in the number of transactions would be necessary. This can be made possible by increasing the range of services available and expanding customer demographics. Maintaining profitability in the off-site market segments and increasing the cost-effectiveness in financial institution ATM networks has led to banks attracting more customers and generating more value added services, whilereducing the overhead cost of delivering the traditional bunch of services.

Security Issues

Security has and will always be a big issue with ATMs. ATM industry players are hard atwork making ATMs as secure as possible. Encrypted PIN Pad (EPP) is now a standard feature on all new ATMs manufactured by ATM vendors. ‘EPP is the first security feature that is likely to be introduced in the Indian market shortly, and EMV will be the next step,’ says Chandnani, whose company, NCR, is a frontrunner in ATM fraud management practices.

ATMs are one of the many devices that are highly vulnerable to frauds. Directions on howto make skimming and phishing devices is readily available on the Internet. Mostfraudsters know how to copy magnetic strip data, and a criminal can create a skimmingdevice for less than US$200. These devices can be easily disguised, especially to untrained eyes. At an off-premise location, a tampered-with ATM could eat cards for daysand have them phished out by a fraudster on several different occasions before the bank can spot the problem. One reason for the increase in theft devices is that criminals have more information readily available to them than before.

When one thinks security, guards come to mind, but ATM security is more than that, saysKunwar. ‘Security comprises tracking card usage trends based on analytics, installing data authentication features, since transaction data is constantly travelling on the link and installing fraud detection systems’. All these features only curtail fraud to an extent and not eliminate it completely. The physical handling of cash is a high-risk operation and that is why agencies with armoured vans like Group 4 Securitas and Brinks Arya are hired bybanks.

Ever since the shift to Windows has enabled ATM channel integration, greater networkconnectivity and more dynamic advertising campaigns, it also has increased concerns forsecurity breaches. With Windows has come the need to move from dial-up to TCP/IP.However, connections such as these are making banks and financial institutions vulnerable to hackers. Fears about the vulnerability of Windows-based ATMs to viruseshave not just started to make news headlines. Software developers and ATM technicians always knew that Windows has differed greatly from legacy platforms. It is difficult to discourage determined criminals, especially if they know that a large amount of money is at stake in ATMs. The onus is not only on users but also banks and independent paymentservice providers managing ATMs to take precautions.

While measures such as Triple DES and EPP address the problem of internal fraud at the ATM, the largest vulnerability remains: the ease in which external equipment can be used to compromise an ATM. The fundamental problem occurs when the magnetic strip is not secure. Also, EMV chip cards would improve the existing security level.




It is becoming a challenge for banks to address issues related to security, especially at a time when they are outsourcing a critical part of their business.

More systems at third party locations require new security strategies in order to counter growing attacks from criminal elements. Though security consciousness varies widelyfrom country to country, specifically in the ATM arena, the spotlight is increasingly going to be on more than just mechanical security, as demonstrated by the growing number of ATM attacks in certain countries. With growing instances of card-based fraud, identification of the user beyond doubt and secure encryption processes will start to play a key role.

Biometric procedures such as fingerprint recognition will be used in future; to introduce them on ATMs in the form of smartcard based fingerprint data complete with onsite checking, one will have to start by agreeing upon uniform international standards.

Cardholder security is of utmost concern and banks and ATM vendors feel that consumers need to be educated on how to prevent being a prey or unknowing party to fraud.

Anti-fraud products allow banks to search systems by account numbers for cards theythink have been skimmed. Such products keep a record so that banks can monitor a cards activity.

Card information can be stolen in one country and used fraudulently all over the world. Toprevent this from occurring, banks are upgrading to DVRs from the erstwhile VCRs. DVRs have shown improvements in lenses, cameras and are regarded for their colour output in lieu of a black-and-white film. DVRs can incorporate multiple features in a single device, including motion detection, remote search of ATM transactions, built in switching or multiplexers that would require the addition of multiple devices with typical analogue recorders.

ATM crime and fraud is being fought by groups like ATM Integrity Task Force, TheElectronic Funds Transfer Association (EFTA), in affiliation with ATMIA. These groups are publishing recommendations on PIN security and working with the Secret Service and ATM product and service providers. Global ATM Security Alliance (GASA), an arm ofATMIA, is organising international efforts to combat cross-border crime rings. It is workingwith the Secret Service, Interpol, the Metropolitan Police Flying Squad for New Scotland Yard and major card issuers.

Major ATM manufacturers also are taking a more proactive approach to fraud prevention. Several have made modifications to their machines, adding features such as sensors in card readers to detect foreign devices. Vendors such as NCR and Diebold use a feature called ‘jitter’ on their motorised card readers, which changes the speed of the card as it enters the reader, making it difficult for thieves to get any usable card data. Once the card is detected over the internal read head, the ‘jittering’ feature is disabled and a constant read speed is applied so that the card data can be read.

Fujitsu has received orders from two Japanese banks for its biometric security systembased on vein pattern-recognition technology. The system works by shining a near-infrared light on a palm placed near a scanner, which takes a snapshot of the palm. Veins illuminated under the skin appear as dark patterns; this information becomes the basis forsecurity applications. The information can be loaded into a server or put into an integrated circuit embedded in a cash card and used at an ATM. Suruga Bank has already installed a version of the system in 65 of its branches for over-the-counter transactions. The Bank of Tokyo-Mitsubishi will install the ATM version of the system in 250 of its branches in




October. Fujitsu is beginning to promote the system overseas through its affiliates andalso plans to develop other similar applications.

Assessment of Benefits by Banks

Do banks make an assessment of benefits from outsourcing ATM services? ‘The modelsand matrices for quantitative assessment of benefits derived from ATM outsourcing are inthe process of being developed,’ says Upadhyaya, whose view is corroborated by other

public sector banks as well. While there is near consensus among banks that outsourcing of ATM services is needed to reduce costs and improve service levels, not every bank tries to assess the benefits.

A.K. UpadhyayaBank of Baroda

‘We at HDFC Bank have detailed matrices to monitor the qualitative and quantitative aspects of outsourced services and we do the monitoring quite extensively,’ says Bhagat. Otherbanks are expected to follow suit as their ATM networks growand the extent of outsourcing increases.

It all depends on how one look at this business. An institution, which is in the process of only acquiring, will definitely make lot of investment on ATM deployments and concentrate on value added systems. Smaller institutions may not look at it as a source of revenue generation, but will explore the possibility of customer services at an affordable cost and also to have virtual branches all over the country.

The shared payment business is expected to grow in India in the years to come. Such network collaborations save the high investment required in deploying a large number of ATMs. Shared payment becomes a low cost solution for bankers to make cash available to their customer as per their convenience. Shared payment and bilateral arrangement willhelp banks to achieve return on investment. Software suppliers will also look at the solutions to provide an ATM transactions reconciliation module, CRM on the customer behaviour and pattern, port services like demat on the ATM terminal, income tax, fund transfer between cross banking customers etc.

The Future Roadmap

According to FSS’s Mylandla, the number of ATMs in the country is around 20,000 today.This number is likely to grow to 45,000 by 2008. ‘Out of these ATMs we expect about 15,000 ATMs to be available in the outsourcing market,’ he says. Euronet’s Antonyestimates an addition of around 6,000 ATMs per year for the next five years and arrives at the same figure of 15,000 ATMs for the outsourcing market.

The US$14 billion ATM industry is facing the challenge of change. ATMs are nowequipped with capabilities for multiple functions enabling them to do much more than just deliver cash.

ATM profits have been narrowing. Banks already have the floor space, it only makes sense that they leverage it for more services. This is because ISOs managing ATMs are offering over and above what banks ATMs would normally offer just to stay competitive. Things like advanced functionality technology have been around for a long time, but banks were reluctant to use it due to customer unwillingness to perform anything beyond cash




withdrawals, transfers and balance inquiries at ATMs. About 60 per cent of ATMtransactions worldwide are cash withdrawals, while about 20 per cent are deposits, balance transfers and account inquiries. This demonstrates why banks have had so little to offer until recently.

With an estimated 1.3 million ATMs deployed worldwide and between 11 billion to 14 billion ATM transactions each year in the United States, the industry appears stable. Customers throughout the world spent an estimated US$1.8 billion on advanced functions, such as ticket sales, at ATMs last year. That works out to a shade more than US$1,000 inrevenue per machine. Assuming a machine costs between US$7,000 to $8,000 to upgrade, given the above situation it would take seven or eight years to be profitable.

Industry experts feel that the future of ATMs will experience two big areas of change. Less ATM deployment, since more banks will rent fee-free ATM access from other ATMdeployers, and the co-existence of different types of ATMs, a low-end cash-dispensing ATM and a high-end one. ATM deployers will continue to be very focused on cost mitigation, but one of the areas that is going to see significant increase is the growth of ATM servicing by independent providers for maintenance and cash replenishment.

The ATM has been used as a delivery vehicle for a number of new types of solutions. Cheque cashing, payroll distribution, ticketing, money orders, all have been deployedusing the open solution. ‘While the currency note deposit feature is dependent on thephysical quality of notes, cheque imaging at the ATM is more likely to take off in India as it moves towards image-based clearing,’ says Chandnani. ‘Existing NCR ATMs can be upgraded to offer this functionality’.

New standards and technologies are beginning to change the industry. These include Interactive Financial eXchange (IFX), Windows Open Services Architecture Extension for Financial Services (WOSA/XFS), and Active XFS are becoming widely accepted.Technologies such as Hypertext Transfer Protocol (HTTP), Transmission ControlProtocol/Internet Protocol (TCP/IP), Hypertext Markup Language (HTML), and more recently eXtensible Markup Language (XML) are starting to be used in the ATM channel.

The new standards, in conjunction with these technologies, are allowing ATM acquirers to deploy a different kind of ATM. This new type of ATM is loosely referred to as a ‘Web-ATM’. The term Web-ATM was coined because of the technologies that these new ATMsemploy and not due to the common misconception that Web-ATMs either use the Internet for communication or allow customers to browse the Web. On the contrary, for the foreseeable future, due to both security and performance concerns, Web-ATMs willprobably continue to be driven across dedicated communications networks, such as the acquirer’s intranet. Currently, banks tend to purchase ATMs from a single vendor. This is mainly for compatibility and maintenance issues. Those that do have machines from multiple vendors often have them because of price considerations, functionality or by wayof inheritance through a merger.

For banks, the proliferation of Web-ATMs has been driven by the need to generate additional ATM revenue through a variety of financial and non-financial services. ATMshave traditionally been proprietary, with each major vendor offering hardware and software that is incompatible with those offered by competitors. Large banks usually have a variety of ATM machines as a result of merger and acquisition activities. ATMprogramming changes and maintenance differs for each vendor, considerably increasing costs. With ATM vendors now moving toward open architectures that have common infrastructures, communication protocols and software, having machines that arecompatible can result in significant reduction of support cost.




Despite some of the obvious appeals of outsourcing, Celent estimates that just 14 per cent, which translates to US$2.2 billion, of the $15.3 billion in total North American ATMoperating costs in 2002 was allocated for outsourcing services. Currency management, transaction processing and maintenance together accounted for 75 per cent of all outsourcing. Many financial institutions have resisted turnkey programs in the past because of the fear of giving up too much control.

The ATM industry in the next five years is expected to be characterised by multiple machine types, multiple markets and multiple business models. So far it has helped create convenience but now it must adapt to become a transaction and information portal for value-added services at the high end of the market. The key driver for ATM evolution is going to be consumer behaviour and customer expectations. If the top end of the ATMrange does not become more customised, more personalized, with more wide-rangingfunctionalities, then it will be rejected sooner than banks can imagine.

In the coming years, security will continue to be a key issue, with global crime syndicatesand the mafia continuing to target card fraud, skimming, ATM scams and old-fashioned armed robbery. Electronic money will grow in importance, eventually eclipsing cash in a few atypical countries like Belgium and reinforcing the decline of cheques. The market for ATMs in convenience and off-premise locations will grow in size and the bank branchlocation for ATMs will decrease in importance.

China and India and other large emerging markets will see phenomenal growth in their installed ATM base, where cash dispensing will be the primary function for several yearsuntil Internet penetration in these countries reaches the critical mass.

New payment card technology is changing the way we use ATMs and how we will all transact and do business. ATMs are undergoing massive standardisation and technical improvement. For banks, the ATM is becoming the common link between the branch and the Internet, the best of all banking channels - advanced, yet universally accessible. Still, the adoption of the IFX standard for browser-based interfaces has had limited success in developing the ATM as the key customer touchpoint. Banks, however, must exploit this potential by choosing the right products for their ATM channel.

Many banks have outsourced their ATMs to third-party service providers. With some banks buying independent ATM networks, ATM ownership will become fragmented with a variety of public bodies, retail businesses, and non-financial services companies, joining banks in the ATM business.





About IBS Intelligence

Vendors

Banks Investors

OUR VISION

Our vision is to assist in theevolution of the banking

technology market

IBS Intelligence is the management consulting arm of IBS Publishing, building on overfourteen years of unparalleled knowledge of the users and suppliers of core banking solutions. Our clients include:

Banks undertaking system selection exercises; Research analysts and investors who seek to better understand the market and itsplayers; and Vendors who wish to re-align their corporate and product strategies to meet market expectations.

We have borne witness to the mistakes and the masterstrokes and bring with us the unrivalled advantage of witnessing and recording the strategies that work for our clients. Our commitment is to use this knowledge to help our clients create a significant impact on their performance.

For further information on IBS Intelligence, contact

Shirish Pathak DirectorTel: +91 20 56030453 Email: [email protected]: www.ibsintelligence.com

About Indian Banks’ Association

The Indian Banks’ Association, formed in 1946, is an advisory service organisation of banks in India. It serves as a co-ordinating agency and a forum for its 156 member banks to interact in matters concerning the banking industry.

For further information, contact

Rema K. Menon Vice President (Technology)Telephone: +91-22-2218-2196Email: [email protected]: www.iba.org.in

Disclaimer: The views expressed by individuals in this report are their own, and may not necessarily be endorsed by their respectiveorganisations.

Documents

ATM Outsourcing IBA Report June 2005