How Banks are Adapting to Digital Disruption and Data Privacy Regulations

Digital disruption, changing consumer demographics and preferences on how they engage with their banks, along with burgeoning regulatory requirements are having far-reaching repercussions on banking. And banking executives are feeling the pressure!

Digital Disruption

Banks that resist digital transformation will be punished by their customers, experiencing a marked erosion in profit margins. In contrast, banks embracing digital disruption—those creating new product and service offerings and empowering their customers with digital technologies—are headed towards profitability growth. According to a 2023 study by BDO Alliance USA, an accounting and professional service association firm, many banking executives plan to lean further into AI over the next two years, and 25% of them believe it to be “the most effective technology” to help improve the customer's experience.

Most banking leaders recognize the value of digital and have embraced technologies such as Internet banking and online lending applications. But this is just the start, and the next several years are going to be pivotal. For example, Emergen Research predicts that Digital Banking Platforms (DBP) market size will be worth a staggering $27.02B in 2032 – up from $9.14B in 2022! This growth will account for virtually every aspect of banking operations and services—payments, account management, insurance, wealth management, pensions, savings and term deposits, and lending.

Demographic Changes: Customer Preferences

While changes in customer preferences—both B2C and B2B—are represented across every demographic group, the new digital natives (e.g., millennials) are at the forefront in bringing about a transformational shift in how banks interact with their customers. Their mindset is "digital first", and they prefer self-service options in the majority of instances. And with millennials forecasted to comprise over 75 percent of the workforce by 2025, banks must cater to their expectations and behaviors.

According to Forbes, citing the World Retail Banking Report from 2021, more than half of consumers (57%) say they prefer online banking to traditional branch banking. However, there is still a big generation gap in terms of adoption according to Gitnux's research released in December 2023 – with millennials having a higher usage rate (80%) vs. baby boomers (48.5%)!

One of the factors driving this change is the fact that the digital banking customer expects their banks to protect their personal data and are not currently confident about how well their bank or financial institutions (FIs) can do that – and, not surprisingly, PYMNTS' research in early 2023 found that 50% of consumers feel that their FI should provide additional online security and managing their personal and financial data. And, when consumer trust is violated, the repercussions can be dramatic—from brand degradation and customer exit–to lower revenues.

Regulatory Compliance: Complex Landscape

The post-Dodd-Frank banking regulatory landscape is increasingly complex. Regulatory supervision has moved beyond planning phases to implementation and ongoing management. Ethics, culture, and related accountabilities touch every aspect of banking operations, including the handling of customer data. There are a number of banking regulations that touch on data security and privacy—Safe Harbor (U.S. and EU), European Union Data Protective Directive (EU), the Payment Card Industry (PCI) Data Security Standard (PCI-DSS), and the Electronic Communications Privacy Act. See how the upcoming rollout of PCI DSS 4.0 can impact your bank.

Non-compliance with these data protection regulations can incur substantial fines and penalties. For example, failure to comply with directives in the European Union’s General Data Protection Regulation (GDPR) can result in fines based on two to five percent of global turnover (or up to €100 million)!

Mapping Out the Digitalization Data Privacy and Data Protection Risks

In order to leverage the opportunities and tackle the challenges of the new digital and customer landscape, banks must concurrently address the electronic risks and implications of protecting client data and privacy. Data Privacy risks fall into two basic buckets—external movement and disclosure of client data, and internal movement and disclosure of customer data. There are at least four different digitalization risks that banks need to heed when crafting their data privacy and protection strategies:

1. Personal information. Online banking services and products capture personal information on customers such as names, addresses, account numbers, contact information, user names and passwords, among other data elements. This may also include birth dates, payment card information (PANs), social security and national identify security numbers, and driver’s license numbers.

2. Information usage and impact data. Digital data collection goes beyond personal information, encompassing online activities such as the use of online services. For example, banks collect customer or prospect IP addresses of the device used to connect to the online service, the type of operating system, and browser used. It also includes sites visited before and after coming to the bank’s online service, pages visited and the time spent on each, and the use of other online services.

3. Omnichannel and mobile banking. The majority of banking customers expect their banks to provide omnichannel transactional and service options. Customers also want to move seamlessly between different banking channels—in branch, web, phone, email, and live web chat – and the movement of personal and financial data between these channels requires monitoring and management typically not accounted for in traditional banking models. This includes the need for customer consent.

4. Additional sources of information. Digitization normally expands the collection and exchange of data with external third parties such as co-branded partner sites or other sources such as credit reporting agencies, insurance companies, among others.

Data privacy and protection is not something that banks can ignore. Their very survival depends on their ability not only to adapt to evolving technological, demographic, and regulatory changes, but also how they address the associated risks. As Charles Darwin famously wrote over 150 years ago, “It is not the strongest of the species that survives, nor the most intelligent that survives. It is the one that is the most adaptable to change.”