Strategic risk is associated with the financial institution's mission and future business plans. This risk category includes plans for entering new business lines, expanding existing services through mergers and acquisitions, and enhancing infrastructure (e.g., physical plant and equipment, IT, and networking). The variety of emerging technologies for retail payments demands integration of payment strategies into the financial institution's overall strategic planning processes. Financial institutions also compete increasingly with highly innovative nonbank entities to provide retail payment services. This competition benefits the consumer through enhanced product offerings at a lower cost. Conversely, competition places additional pressure on financial institutions to protect profitability through the development of new products and services while managing additional marketing, research, and development costs.
Strategic plans that include significant market expansion or the addition of new products and services may expose financial institutions to increased risks. For example, expanding Internet banking services to include electronic bill presentment and payment services, expanding existing bankcard issuing programs, or entering the merchant bankcard processing business significantly increase the potential risk to the financial institution given the inherent risks associated with these services. Business plans for specific products and services should demonstrate that management has assessed the risks and documented the institution's program to mitigate them. Such plans should address the institution's capability to provide the service. Innovative products and services are emerging quickly and early stages of market introduction may expose financial institutions to undefined and unanticipated risks the need for an enterprise wide view of retail payment activities due to cross channel risk including fraud, money laundering, and IT security breaches. Business models for emerging products that are gaining acceptance abroad, particularly in Asia, may not be introduced as easily in the U.S. because of the differences in infrastructure and applications.
To mitigate strategic risk, management should have a strategic planning processSee the IT Handbook Management Booklet that addresses its retail payment business goals and objectives, including supporting IT components. Because financial institutions are increasingly reliant upon third-party service providers for retail payment system products and services, the strategic plan should address comprehensive vendor management.
Payment System Risk (PSR) Policy