money rebel platform Building a future-proof hybrid financial service and banking platform for the age of crypto.

Transcription

1 money rebel platform Building a future-proof hybrid financial service and banking platform for the age of crypto. Receive, transfer, grow and manage your fiat and crypto money with a single REBELlious app. TECHNICAL DESIGN OVERVIEW 1

2 Preamble the global FinTech opportunity The FinTech world has found itself in a position where the adoption of the revised EU Payment Services Directive (PSD2), the storm of cryptocurrencies, blockchain and welldesigned digital financial services, and the awareness of the consumers, turning away from the old brick and mortar banks everything is pointing toward a new financial system reality. These are great times for developing new products, as the consumers have embraced financial digital services. This is where Money Rebel (MR) steps into the game. As a FinTech start-up with a team of wealth management, financial coaching, and banking professionals, we partnered with a group of highly skilled tech individuals and crypto specialist to make managing money tasks completely trivial. Questions like How much is my net worth?, What is my portfolio value?, or How can I buy stocks with bitcoins quickly? are becoming a things of the past. The MR Platform will help them get a quick and high-quality answer for all financial investments in one place. And they will also have access to top financial advisers, banking and, payment services with crypto or fiat money, whatever they need for a specific occasion! Such a platform needs to be built on deep and widely spread databases, it needs intelligent filtering and individualization options for the end users, and, in the end, it must enable them to invest with a high level of technical safety and security, enriched with financial advice from well-seasoned financial asset managers, supporting the customers through their investment cycle. Note: The whole business description of the project can be found in the separate document: MR Platform Whitepaper, accessible at the Note: This document is the MR Platform Technical Whitepaper it describes in overview the technical foundation for the MR Platform, security efforts, standards to follow, and it outlines the core Robo Systems algorithm, front end application functionalities and the basic payment/transactional functionalities. 2

3 Table of contents 1. Abstract 5 2. Project set-up The best technology Expert team Insight Milestones Intelligent core build Advanced operating model An eye on the market 8 3. Platform introduction 8 4. The MR Platform operating model Data Center (DC) Hypermedia support Blockchain Languages, frameworks and algorithms MR Platform / Robo System Decision-making process Risk level prediction Investor portfolio calibration Sales and marketing Process automation MR Platform application front ends Application data layer Communication layer 14 Applications for user interaction Mobile applications for clients Back office application Front office application API Fiat/crypto transaction processing MasterCard payment cards Hosted Card Emulation 17 Settlement currency choice In-app crypto purchase In-app crypto payment/p2p crypto/money transfer 17 In-store payment with plastic/mobile debit card 18 (funding from crypto or fiat wallet)

4 6. Security Key security goal MR Platform security architecture Adaptive security platform Core risks Unique integration of security solutions MR Platform unique security proposition PCI security Regulatory standards PSD2 23 PISP - Payment Initiating Service Provider license 23 AISP - Account information service provider license SEPA Instant Payments SEPA Instant Payments overview Cross-border transfers with Ripple Cash in / Cash Out MR Platform Implementation Roadmap Modular approach Future-proof hybrid infrastructure Conclusion and Summary 29

5 1. Abstract In the end, the MR Mobile Bank will emerge, offering a full suite of services for the modern money rebel! The goal of this project is to build the MR Platform a set of integrated data, advisory and financial services and tools, catering to the ever-expanding needs of the financially aware customers. Product such as the MR Portfolio and the MR Adviser will be at the core of the services based on a powerful data center and real professional advisers, accompanied by automated and self-catering services, such as advisory tools and payment cards with on-the fly fiat/crypto currency exchange. We have already developed the fully operational and well-proven arbitrage algorithm MR Kriptel.de, which is helping us attain consistent financial gain. First, we will build a powerful global crypto and fiat investment oriented hypermedia data-crunching data center. Next we will add easy and automated on-boarding processes, mobile end user applications and front/back-office applications. They will be optimized for quick and high-quality service, providing the users, the advisers and business administrators the best user experience possible. Card payments with fiat or crypto currencies will be ensured by way of physical or mobile hosted card emulation MasterCard cards. Finally, based on the harvested user and adviser decisions, we will develop our automated recommendation system with advanced machine learning capabilities, and we will constantly benchmark its performance. 5

6 2. Project set-up 2.1. The best technology For building the system we will be using best-of-breed technology components and services, and where needed, we will develop our own Expert team Best of all we already have the systems well thought-out, as our core team has vast experience and top expert knowledge in the fields of banking and financial IT, investment advisory and in the field of taxes and regulation, as well as banking software development, big data analysis, mobile application and business intelligence. Last, but not least the team is already using the applications MR Portfolio and MR Adviser in their work. As we implement these solutions in the new platform, we will provide scalability and integration with other services, as well as improve them even further, and ready them for the challenges of the international business environment Insight Our data, system, and business insights architecture will be built off the big data management system, data analytical tools, agile business intelligence tools, and a team of talents. Machine and talents will be our insights delivery engine, and they will provide a pluggable fabric for insight discovery, collaboration, and governance tools Milestones Our development effort is planned with five milestones ahead, depending on the ICO result. Milestone 1 will be reached when we Implement to the MR Platform the upgraded building blocks (MR Portfolio and MR Adviser), and secure the state of the art design and UX experience. Milestone 2 will see the finishing of the smart functions of the MR Platform, as well as MR Adviser Tools, intended for use by expert advisers in dealings with the customers. Milestone 3 is when we reach a new level of the MR Platform the MR Mobile Bank. That will enable payments, customizable debit cards, real-time transfers, automated budgeting and categorization, detailed reports, and 24/7 accessibility. 6

7 Milestone 4 means the creation of the Smart MR Mobile Bank, with integrated AI-based features, accessible directly from the mobile app. The MR Robo Adviser, the MR Virtual Assistant with real expert knowledge, applied into a virtual assistant, and conversational bots for customer self-service. Milestone 5, the final stage, will boost the MR Kriptel.de PRO fund our operating algorithm, to give it a performance boost and new features, such as AI-supported additional trading strategies, and enhanced interest rates with no risk for all our clients, which will provide liquidity in fiat and/or crypto Intelligent core build The magic of the whole technological constellation lies in how the systems are set up and intertwined, which will all happen in stages project milestones. The data center will harvest data from public sources, but also feed on personal data sources for customers individual insights. It will provide safe and secure access to data sources and data output, and it will be set up according to the relevant standards in the financial industries. The robotic assistant system will learn from users and live advisers interactions on the application front-ends, and it will always keep an eye on the data center as well, to catch the latest trends and changes. It will follow and analyse trends, help the users set operational parameters, and watch how the expert advisers act just to embed the newly acquired knowledge into its DNA, and then repeat the cycle. This interactive three-compound system will enable users to harvest real-time fiat and crypto financial investment advice, and in the long run, investment cycles can become fully automated and tailored according to the opportunity-seeking preferences of the users Advanced operating model In business development terms, the essence of the MR Platform is represented by a digital operating model, which is fuelled by data and shaped by real-time human decisions (made by platform users), supported by real-time robotic (AI) or live financial expert advice, with the purpose of engaging customers into their portfolio value raising activities by following simple and clear advice, based on firm insight into financial evidence and historic and current data. Moulding data into a meaningful context and making decisions will be our daily routine, executed through clearly defined process roles and by tracking our MR Platform staff efficiency daily. By interacting with clients, our digital listeners, built into the front office applications, the platform and its steering personnel will analyse and profile clients behaviour this will enable our product/service delivery department to respond properly and to adapt to the environment and operational parameters. 7

8 2.7. An eye on the market We have outlined a roadmap to include the first wave of functionalities but during the project we will be planning and adapting for the next steps, analysing the situation as it develops, to keep a leading position in the market. 3. Platform introduction The MR Platform will at first help customers gain a centralized overview of their accounts. This way, the insight into personal finances will be enabled through one single application. Because there will be expert advisers available to consult about financial investment (fiat money or cryptocurrency), the consumers will be less stressed regarding money and investment efforts. Later in the development, the MR Platform merges the financial investment opportunities from the emerging world of cryptocurrencies and traditional fiat currencies (money and other financial assets) in a lively, data and information rich environment for investing and asset management, with the purpose of enabling consumers to build wealth according to their own strategic parameters and with the help of custom tailored human or algorithmic advice. This modern technological and business platform needs to provide highly secure, scalable financial data and advisory services to customers and advisers in the financial sector. It aggregates relevant data from data sources such as banks (personal accounts), trading platforms, exchanges, business analyses, and news portals, etc., and it offers this information to the user, shaped by their own parameters, filtered and sorted, and so presents them with the maximum useful value possible. In this way, the platform enables the users to maximise their profit by using comprehensive reports, preformatted for their needs, news, automatic robotised advisory services, and individual expert advice from real live advisers operating through the platform service. Users can set their own financial operating parameters, set their own goals and shape their financial future according to their selected strategy. Advisers live and/or robotic can help them attain that goal with less stress and with greater confidence. 8

9 4. The MR Platform operating model The financial business is all about data and how you react to it! The MR Platform will collect data in real-time from the two worlds of the traditional fiat money and the new cryptocurrencies, and from individual accounts, held currently by financial institutions and put the power of the data into the hands of the consumers, under training and supervision of live expert advisers and the newly developed robotic advisers. Because, you see the secret lies in knowledge! Easy Valuable External Apps Personal Where I Want It When Desired Customer Expectations Transparency Finance Regulator Demands Analyze & Discover Leverage Insights & Engage Robo Act & Automate Store & Forward DC MR Platform API s endpoints Cards APIs 3 rd parties APIs Ripple APIs SWIFT APIs Stocks API PSD2 APIs External APIs Data sets Fast Adoption Optimize, Test & Learn MR Platform API Orchestration Internal Apps Intuitive Automate Internal Smooth Learning Curve Client Needs The vast ocean of data gathered from various sources must always be quickly accessible, anywhere, up-to-date at all times, possibly rich with contextual metadata, and hyper-contextualised, to make sense to the trained eye. Only then can a system for providing useful insight for consumers, with optional automated advice and transaction schemes, serve its purpose to the full extent to enable and engage in value growth of the customers portfolio. At the core of the MR Platform lies a comprehensive live database, always fetching, syncing and aggregating financial data and contextual content from multiple channels, private information in the financial services sector, financial news and financial asset management sector. The MR Platform consists of three key sub-systems: Data Center - Data acquisition, data exchange Robo System - Decision making, insight, process automation Application front ends - End user interaction (for consumers and for advisers, back office, front office) 9

10 4.1. Data Center (DC) This is the central data acquisition and exchange system for sending and receiving data from/to the external entities like Bitcoin, Ethereum, Ripple, SWIFT, MasterCard, Visa, and personal client data (banks, exchanges, funds, etc.), and for storing data about users and their activity. The data center will be pre-processing data with the following methods: Data cleaning - Removing noise and correction of data inconsistencies Data integration - Storing coherent datasets by merging data from multiple sources for storing and forwarding Data reduction - Aggregation, redundant data/features elimination or clustering Data transformation Hypermedia support The data center supports hypermedia (graphics, audio, video, plain text, hyperlinks, etc.), and it provides actions for each defined endpoint by using methods native to its protocol. The resource clearly defines its media type for all endpoints so the client knows how to parse the content. Endpoints have an embedded machine-readable description of how to parse the media type. Python, Scala/Java and R programming languages will be used for developing pre-processing and processing routines as they provide safe refactoring, out-of-the-box machine learning and statistics package, interactive exploratory analysis, and they provide built-in visualization tools Blockchain In addition to databases, the MR Platform will utilize blockchain, the underlying disruptive technology behind cryptocurrencies that could spell huge changes for financial services in the future. Saving information as hash, rather than in its original format, blockchain ensures each data element is unique, time-stamped and tamper-resistant. The semi-public nature of some types of blockchain paves the way for an enhanced level of security and privacy for sensitive data a new kind of database where the information header is public, but the data inside is private. As such, the blockchain has several potential applications in financial markets think of trade finance, stock exchanges, central securities depositories, trade repositories or settlements systems. Data analytics using blockchain, distributed ledger transactions and smart contracts will become critical in future, creating new challenges and opportunities in the world of data science. 10

11 Languages, frameworks and algorithms The MR Platform Data Center and Robo Segments will be developed with the following languages/packages: Python / Scikit-learn - Machine learning, data mining and data analysis. NLTK - Building Python programs to work with human language data. Keras - High-level neural networks API. TensorFlow - Numerical computation using data flow graphs. PyMC3 - Bayesian statistical modelling and probabilistic machine learning focused on advanced Markov chain Monte Carlo and variation fitting algorithms. Statsmodels - Classes and functions for the estimation of many different statistical models, as well as for conducting statistical tests, and statistical data exploration. Scala/Java with H2O - In-memory, distributed, fast, and scalable machine learning and predictive analytics. Spark's MLib - A machine learning library consisting of common learning algorithms and utilities, including classification, regression, clustering, collaborative filtering, dimensionality reduction, as well as underlying optimization primitives. Weka - Data mining tasks, algorithms can either be applied directly to a dataset or called from Java code. Weka contains tools for data pre-processing, classification, regression, clustering, association rules, and visualization. R Glmnet - A generalized linear model via penalized maximum likelihood and e1071 SVM for Support Vector Machine algorithm. Camunda.com solutions - A business process, case and decision model, and workflow automation MR Platform / Robo System On top of the data center, the Robo System will be built to analyse data and discover significant information to gather insights and act upon them. This actionable information will then be used by real-live advisers through different channels, provided by the MR Platform. All the gathered and pre-processed data will be stored in DC and then used for: learning, discovering, engaging, and automation Decision-making process The Robo System will use Data Center feeds for its decision-making process. Using data warehouse technologies, together with artificial intelligence and machine learning algorithms, we will extract insights that will help us shape intelligent investment advice, forecasting and predictive analyses of profitability, assess risk, detect fraudulent activity, track trends of active currencies, and recognize trends before currencies gain substantial value, discover patterns and behaviours useful for personal financial tips to users, and generate 11

12 alerts and notifications. This will present high-quality support to the advisers and users in their decision-making process. We will also capture real-time data as well as historical data to improve the relationship with the stakeholder and mitigate potential risks Risk level prediction We will classify objects by categories, based on historical data, and we will predict the risk level of a certain investment by leveraging a range of different sources of information, such as company financials, transactions, real-time market information, business networks, news, and use it for the identifying, prioritizing, and monitoring of risks, potential frauds, money laundering, and investigations. We will compare transactions to precisely distinguish between legitimate and fraudulent transactions made by buyers and sellers. With unsupervised learning algorithms, we will enrich customer segmentation meta data Investor portfolio calibration We will build algorithms to calibrate financial portfolios to the goals and risk tolerances of the users. To propose these customized recommendations to the users, we will cluster the information that we have, based on specific features and industries. After the clusters will have been generated, we will match the user to the company. We will use the data from the past about users and/or various offerings from a bank (like card overdraft, investment strategies, funds, etc.) to recommend the most appropriate actions to the user based on their preferences and purchase history. The algorithms will be able to recommend a purchase based on users patterns the algorithm will analyse historical investment data and find user behaviour patterns. By identifying these patterns, we will create association rules for recommending investments to the investor based on their previous investment preference. We will use Naïve Bayes classifier, KNN k nearest neighbour, Decision tree, Random forest, Support Vector Machine, and Learning vector quantization to make a recommendation based on clients characteristics Sales and marketing The Robo System also supports Sales and Marketing functionalities for the development of targeted personalized marketing campaigns, based on an understanding of the users individual buying habits. The systems will also incorporate unstructured data from the users social media profiles, to create a fuller picture of the users needs through sentiment analysis, to measure effectiveness of marketing campaigns, and to monitor social media for consumer insight. 12

13 Process automation The Robo System will provide automation functionalities throughout the MR Platform. The list of possible automated functionalities is growing fast, but these are the ones to be automated first: Customer on-boarding Advisory - Automating customer data capture, market data changes and custodian, broker, transaction orders adherence to compliance. Straight-through processing - Automating customer data capture according to Payment compliance. Registration of sales leads - Automating the allocation of qualified leads into the customer service outbound call queue. Customer complaints - Automating the payment protection insurance remediation process. Claims processing - Automating the instructions of third party assessors. Policy updates - On renewal, automating the migration of third party fire and theft policies to comprehensive policies, or perhaps the inpersonalization for usage by thirdparty data and/or services. Direct debit - Automating debit orders and their cancellations MR Platform application front ends The MR Platform will provide services for the application front ends in three distinctive layers. ios Native apps Android Native apps Back office staff apps Front office staff apps Soft token app. ios UI SDK Android UI SDK Web UI Web UI Soft token UI Soft token SDK MR Platform authentication << interface >> MR Adviser << interface >> Payments << interface >> Transactions << interface >> Accounts << interface >> Card details << interface >> Templates << interface >> MR Portfolio << interface >> JWS MR Portfolio, MR Adviser (Engagment system) Market Insight Portfolio Management Transaction Processing API Adapter Engagment system API Adapter Market Insight API Adapter Advisory Business Logic Business Logic Business Logic Business Logic External APIs Management Cards MC / Visa Engagment sys Integrations Integration SWIFT Market Insight DATA Customer Insight DATA RIPPLE MR PLATFORM DATA WAREHOUSE 13

14 Application data layer The data layer will provide fast access to data used in mobile applications to provide the best possible user operation. We will integrate optimized data container use for different user activities Communication layer The Communication layer represents everything that connects users with the data they need from the system, while at the same time preparing the data and packing it into action-ready and usable information, which will be presented through one of the applications. The Communication layer contains several elements, responsible for data handling and either exposing it towards users, or collecting it from internal or external data services. In addition to the data layer, the Communication layer will interact with different external services exposed through APIs to gather information or execute actions. Applications for user interaction Applications for user interaction The applications for user interaction are targeted at three user groups: mobile applications for clients, back office staff applications, and front office staff applications Mobile applications for clients End-users of the MR Platform (consumers) are going to fully interact with the platform through mobile applications. There will be no branches, web-based access, or any other way of interaction with the bank except through mobile devices. By walking this mobile only path, the mobile applications for end users are going to leverage the full potential of the smartphone to deliver the best possible experience. We will make sure that users are completely comfortable handling all interactions with the banking world through mobile phones. ios and Android The mobile applications are going to be available for both ios (versions 9 and later) and Android (versions 4.4. and later) operating systems, offering the same user experience in both platforms, except for standard user interface components which are natively different to ios and Android. The platforms will be supported on phones and tablets, they will offer a rich experience, and we will utilize the most of the screen real-estate that fits into the supported devices category. 14

15 Major functionalities and available products in the mobile applications are explained in the separate MR Platform overview whitepaper. These functionalities will include: MR Portfolio MR Adviser News feed Mr Advisory Tools MR Kriptel.de MR Smart Debit card MR Mobile Bank Back office application These applications represent the system interface for the back-office employees. We will use Xmarin cross-platform development software to enable fast development and changes of this application which will be used on PC, laptops, tablets, and smartphones. The application will be used for: System administration and maintenance Administrative tasks Market data supply Business intelligence Big data management Auditing Process management Procurement Facility management IT management Reporting Front office application This application will be used by advisory personnel in direct communication with clients of the MR Platform. The front office application is going to be used for: By Sales staff For Face 2 Face advisory activities 15

16 4.4. API APIs (Application Programming Interfaces) are the communication layer between web/ mobile applications and the rest of the system. Web/mobile applications contain very little data, logic and calculations on their own, resting almost entirely on the already processed data retrieved through APIs. APIs are going to be grouped based on their purpose in web or mobile applications, offering a collection of related interfaces for data retrieval. Some of the API groups are: Public offers access to static public content (for example call center information, contact address, working hours, etc.) Authentication offers a set of API methods responsible for user authentication Authorization offers the means to authorize sensitive actions. Profile offers access and manipulation of user profile data. Interaction offers the communication channel between personnel and users. Accounts a set of APIs for account data management. Payments a set of APIs for payment execution; Transactions a set of APIs for handling transactions data (retrieval, filtering, ) Cards a card management API; PFM offers a offering set of APIs responsible for the retrieval and management of personal finance data; Exchange a set of APIs for buying and selling different currencies, tracking rates. Crypto a set of APIs responsible for the integration with crypto wallets; Location based services retrieval of locations data (ATMs, partner branches, etc.) Content management of files and other content. Only a minor subset of the API methods will be publicly available, serving static open content, while all user-related data will be protected, requiring authentication on each request towards the API. 5. Fiat/crypto transaction processing No bank today can expect any market share without a significant footprint in the retail sector. The MR Platform (from within which the MR Mobile Bank operates) as a market disruptor will also offer standard payment tools to its customers, but with a disruptive ecosystem in the background MasterCard payment cards The main retail products will include MasterCard payment cards, both in physical (plastic EMV Chip & PIN card) and mobile-only Hosted Card Emulation (Cloud based payments) based EMV payment card. 16

17 5.2. Hosted Card Emulation The MR Mobile Bank/ MR Platform issued payment products will provide the ability to use both fiat money and cryptocurrency for payment settlement. The HCE card is going to use a certified MasterCard MCBP solution, based on the MCBP 1.0+ specification. The end user will have the convenience of a standard plastic contactless payment card, while using only a mobile phone (smartphone). This way, the entire user experience of the MR Platform will remain mobile first. Settlement currency choice While the front-end acquiring will use standard interoperable rails for card payments today, the background ecosystem will provide the end user with a choice to use crypto or fiat currency settlement upfront or in real time, based on the predefined parameters (value of the transaction, time of the month, etc.). The basic principle will be for the MR Mobile Bank to use a corporate account with a certain liquidity amount at the leading crypto exchanges (i.e. Bitstamp, and others), with subaccounts for the MR Mobile Bank clients. This unique feature will enable the provision of the following services through the mobile application and by using a plastic/mobile payment card: In-app crypto purchase In-app crypto payment P2P money/crypto transfer In-store payment with plastic/mobile debit card with funding from a crypto or fiat wallet 5.3. In-app crypto purchase The MR Mobile Bank app will enable clients to easily transfer funds between fiat and crypto wallets, whether to exchange fiat for crypto (buy crypto), or to exchange crypto for fiat (sell crypto). Whenever the client wishes to buy or sell crypto, they will simply execute a few simple steps to confirm the transaction everything will happen in-app. During the process, they will be informed about the best exchange rate available, and funds will be transferred instantly. The client will have the option to set various limits in the app: max fiat spent for crypto purchase, max crypto sale, etc In-app crypto payment/p2p crypto/money transfer MR Mobile Bank clients will be able to easily transfer crypto or fiat funds within the MR Mobile Bank system, or to/from external wallets and accounts. The process will be trivial and standard, and the client will have the option to directly send their crypto funds, or purchase crypto funds for sending with fiat money. 17

18 If the client chooses to buy crypto and transfer it, the amount of crypto currency will be directly sent from the MR Mobile Bank corporate account at the exchange, and the client will be charged from the fiat wallet according to the best exchange rate. If the client chooses to send crypto currency directly from his account/wallet, the amount of crypto currency will be sent to the deposit address. If both the sender and recipient are using the MR Mobile Bank, the sender can simply choose the recipient from their contact list, or enter other predefined ID data, such as an or a phone number. The app will also enable QR code scanning for the deposit address. To send fiat money the MR Mobile Bank client can choose to send fiat money directly to the other MR Mobile Bank user through the app, or they can send crypto currency, which can then be exchanged to fiat and sent to the other MR Mobile Bank user s fiat wallet (account). The recipient of a fiat money transaction can be a user of another bank in this case the recipient s bank account number must be specified) In-store payment with plastic/mobile debit card (funding from the crypto or fiat wallet) Another innovative feature of the MR Mobile Bank will be the ability to use the standard MR Mobile Bank issued MasterCard debit card worldwide and choose to pay in fiat or crypto. Clients will be able to predefine limits, fiat to crypto spending ratio, etc. The basic principle is similar to the classic money transfer, but the crypto/fiat exchange will occur almost in real time, as the speed of transaction at the point of sale cannot be put at risk. A basic example of a transaction: 1. The customer is buying goods (in a physical or online store) worth 200, and they are paying with their MR Mobile Bank debit card. 2. In their fiat wallet, they have 100 EUR, and in their crypto wallet 0.5 BTC. 3. When the transaction authorisation request from the card processor enters the system, the MR Mobile Bank will charge the customer for the 100 EUR from the fiat wallet (if they predefined such a hybrid scenario), and for the remaining 100 EUR, the MR Mobile Bank will charge them for the fiat equivalent amount of BTC, according to the best exchange rate available at the time. The MR Mobile Bank will then confirm the fund availability (EUR) to the processor, so the transaction will be authorized). 4. Meanwhile, the previously charged BTC amount will be exchanged at the exchange and funds will be deposited to the MR Mobile Bank account. 5. Various configuration options for this service will be available to the client (limits, volumes, ratio etc.). Both products the mobile and physical cards will be monitored and configured through the MR Platform mobile banking application. MR Mobile Bank user Acquiring Bank Crypto exchange MR Mobile Bank interaction Crypto/Fiat exchange A basic overview of the MR Mobile Bank / MR Platform transaction flow MR Mobile Bank Fiat account Crypto account 18

19 In the initial phase, the MR Mobile Bank will utilize existing third-party crypto exchange services. Later on, the MR Mobile Bank will enable users to directly exchange fiat to crypto and vice-versa in-house, within the MR Mobile Bank / MR Platform system. In addition to standard payment functionality of the card(s), the MR Platform / MR Mobile Bank will offer additional benefits to its clients: Instalment payments (Adhering to the MasterCard instalment mandate) Loyalty Purchasing services with MRP tokens 6. Security Security, when it comes to personal financial information and transactional data, is of the highest importance Key security goal We will strive to provide the safe enablement of MR Platform applications through the abovementioned basic security elements and prevention of all known/unknown cyber threats for all users on any devices/any network MR Platform security architecture Of course, the entire MR Platform system will be separated into three main zones: publicly available services, DMZ (demilitarized zone), and MZ. 19

20 Internet APPS 1,2,...,n API EXPLORER 1,2,...,n API Metrics Threat / DDOS Protection / Firewall / Web Application Firewall Load BALANCER 1 Load BALANCER 2 DMZ s Web Servers Farm 1 SSL termination, Serve static content Web Servers Farm 2 SSL termination, Serve static content App Servers Farm 1 App Servers Farm 2 Firewall Firewall Message Queues, Store & Forward Storage Search, Log, Aggregation API MZ s MR Platform Engagement System MR Platform MR Portfolio Management MR Platform Transaction Processing Elastic Search Data Warehouse Postgres Extarnal Data 6.3. Adaptive security platform Platform security is organized with an adaptive security platform (ASP) at its core for both hardware and virtual servers, in the whole environment, comprised of the enterprise data center, Amazon Web Services, Google Compute Engine, Microsoft Azure, OpenStack, etc. Platform security will be provided without any dependency on the underlying network. The ASP solution provides real time micro segmentation, data encryption and policy enforcement, regardless of the underlying infrastructure. The protection of data traffic which is invisible to perimeter firewalls, enables the efficient detection of and response to such unauthorized activity Core risks The bore security risks are managed using an integrated risk management solution, tied with a GRC tool and cyber/security relevant escalation procedures and different scenarios, based on BCM priorities and risk management analytics. Cyber-risk management is based on the NIST cybersecurity framework, focused to find and secure hidden risks. 20

21 6.5. Unique integration of security solutions We use ASP (adaptive security platforms) and recognized the SIEM solution for correlation and analysis, to provide better real-time threats detection, more relevant risk assessment and an integrated GRC solution. This is important for data center/services and cloud traffic missed by the perimeter MR Platform unique security proposition At the top of the MR Platform security proposition sits a strategic and electronic channel-centric approach to cybersecurity. Security foundation elements are designed using the COBIT 5 governance and IT management framework as the basic governance, risk, and compliance (GRC) tool. The compliance and operational requirements are provided on the security foundation element level (security controls) to provide native industry standard convergence and include: European digital bank regulations, payment networks regulations (PSD/SEPA, SWIFT CSP), payment card standards (PCI DSS) and data privacy (EU GDPR), and country specific regulations. Governance and Market Leadership Security and operations Risk management Resilience and change Cyber/Security govermance by the Board and driven on executive level GRC vision aligned by proven cyber frameworks End-to-end security integraton for all business processes, specially change and development Dedicated cyber securiry operations center (SOC) Inovation/ new technology driven Cyber risk aware culture Link between businesss requirements and process design Focus on business relevant risk and proven mitigation technics Automation and analitics dash boards/reporting with internal/external risk transparency Functional commitment Business continuity BCM Escalation timers and defined response scenarios Incident management IM according to EU frameworks Build-in efficent communication process All business procedures have: high level business, functional, technical, security requirements; foundational elements / security foundational elements / compliance convergence and alignment goals; implemented cybersecurity relevant escalation procedures and different scenarios based on BCM priorities and risk management analytics. 21

22 The following table defines four information security roles pillars in the MR Platform: Board level roles Management level roles Operational level roles External roles Information security programme to enhance bank security, cyber resilience and trust Information security steering committee Communicate management aims and directons Enterprise risk management (ERM) provide guidance on ICT and security risks Security provisioning, documentation, SLA / change management oversight and control Security incident management, Postcompromise investigations SOC, Security dashboards implementation, automation and report Operational Security support, IDS/IPS, next generation firewall (NGFW) Enablement of security goals in early development initiatives/ change process Security Information and Event management (SIEM) and Security dashborard control Regulatory, ICT, Security and compliance audit Outsourcing and SLA oversight, compliance and control Vulnerability scanning and penetration testing process Security vulnerability disclosure program Data Protection Officer (DPO) roles and GDPR compliance Security administration and SLA metrics recording/ reporting The security roles and responsibilities in the MR Platform are based on RACI charts and best practices. RACI charts (Responsible, Accountable, Consulted, and Informed) connect processes/activities with internal and external stakeholders PCI security The Payment Card Industry (PCI) Data Security Standard (DSS) framework version 3.2 implementation and certification will be adopted for future MR Platform business development. All 6 areas/12 requirements are subject to security implementation in the Bank. 22

23 7. Regulatory standards 7.1. PSD2 The MR Platform will adhere to the PSD2 rules under the following segments: Financial institution licensing: PISP (Payment Initiation Service Provider), AISP (Account Information Service Providers), and ASPSP (Account Servicing Payment Service Provider), which is already covered by the Money Rebel future FI license, based on the country of residence; Customer authentication (adhering to the final RTS technical standard); API based connection. According to the Access to account (XS2A) policy in the PSD2, all EU financial institutions will be obliged to expose their basic services via API to any financial institution, licensed under PSD2 rules. This obligation is defined as access to basic information of the user account info and transaction history and the ability to transfer funds from one account to another. Based on the defined business model, third parties can license as one of or both. A set of rules, such as customer authentication (subject to various rules based on the fraud rates, amount of transactions, etc.), type of information available, frequency of access to the information, and others are subject to the Regulatory Technical Standards document by the EBA, which is yet to be finalized. The current version is considered final, but it is still subject to final approval. The MR Platform will obtain PISP and AISP licenses. PISP - Payment Initiating Service Provider license It enables the MR Platform to connect to any customer account in any EU Bank (subject to customer approval) and perform payments/fund transfers to any other participating member. Authentication e.g. via token Money Customer's Bank e.g. via token 23

24 AISP - Account information service provider license It enables the MR Platform to aggregate information from any customer account in any EU bank (subject to customer approval), provide various analytics based on the information provided, and provide MR Mobile Bank customers with a single information point for multiple accounts. Bank 1 AISP MR Platform Bank 2 Bank 3 Bank 1 Bank 2 Authentication e.g. via token Money Bank SEPA Instant Payments The MR Platform will obtain license for the upcoming optional SEPA instant payments scheme. The scheme itself is based on the existing SEPA scheme, whereas instead of batch processing, real-time settlement (in less than 10 seconds time) will be used. The size of a transaction is limited to 15,000 EUR, and the limit shall be revised on an annual basis. From the technical point of view, the ISO (the universal financial industry message scheme) is used for the API SEPA Instant Payments overview The SEPA (Single Euro Payments Area) is a self-regulatory initiative by the European banking sector, represented in the European Payments Council, which defines the harmonization of payment products, infrastructures and technical standards. The PSD and PSD2 provide the legal framework within which all payment service providers must operate. The PSD2 is a step towards a digital single market. The demand for payment services using an SCT Inst arises from an Originator, who wishes to transfer funds Instantly for whatever reason to a Beneficiary. Whilst the payment service is provided by a PSP, the underlying demand and its reason are outside the control and responsibility of the PSP industry or any individual PSP. For the requirement to transfer Funds Instantly to be satisfied, the PSP holding the Payment Account of the Originator (the Originator Bank), must have the means necessary to remit the Funds Instantly to the PSP holding the Payment Account of the Beneficiary 24

25 (the Beneficiary Bank) and in the process, be provided with the necessary information to accomplish the transfer. The credit transfer can be initiated directly (by the Originator) or indirectly (by a payment initiation service provider at the request of the Originator), in compliance with the Payment Services Directive. Provided that the Originator has sufficient Funds or sufficient credit with which to execute the SCT Inst, provided that the Originator is acting within its authority, and provided that the SCT Inst does not break any applicable legal, regulatory, or other requirements, including requirements established by the Originator Bank, the Originator Bank will process the payment and advise the Originator accordingly. The means for making the SCT Inst will exist, if the Beneficiary Bank has agreed on both the method and the rules for receiving the payment information, as well as the method and the rules for receiving the payment value. Based on these means of transfer, the Beneficiary Bank will use the information received, to immediately making funds available to the Beneficiary for its use. Originator 1. Notification of funds made available Beneficiary Bank 5. Beneficiary SCT Inst Instruction 7. SCT Inst Transaction 6. Clearing function of CSM SCT Inst Transaction 4. Makes funds instantly available Confirmaton message if SCT Inst transaction successful or not Confirmation message if SCT Inst transaction successful or not Confirmation message if SCT Inst transaction successful or not III I II Notification of funds made available Notification of confirmation message recevied Notification of funds made available Areas out of scope of the SCT Inst scheme Settlement function of CSM Source: SCT Inst Overview 7.4. Cross-border transfers with Ripple Cross-border transfers of funds today still make up the biggest part of the payment transaction costs for the banks, and are considered to be the slowest part of the process. Traditional banking uses the international SWIFT service as the cornerstone for this process, but the MR Platform will be using a disruptive blockchain based service provided by the Ripple Protocol. Ripple is a real-time gross settlement system (RTGS), currency exchange, and remittance network by Ripple. Also called the Ripple Transaction Protocol (RTXP) or Ripple protocol, it is built on a distributed open source Internet protocol, consensus ledger, and native currency called XRP (ripples). Released in 2012, Ripple purports to enable "secure, instant and nearly free global financial transactions of any size with no chargebacks." It supports tokens representing fiat currency, cryptocurrency, commodity or any other unit of value 25

26 such as frequent flier miles or mobile minutes. At its core, Ripple is based around a shared, public database or ledger, which uses a consensus process that allows for payments, exchanges and remittance in a distributed process. By engaging the Ripple service, the MR Mobile Bank customers will have the benefits of almost instant cross-border transfers with the guarantee of the lowest possible fees, that are transparent and known upfront. Additional benefits, like the security of distributed ledger, corporate data transfer (since Ripple is using industry standard messaging) and the automated instant auction for liquidity provision, are providing the MR Platform customers the ability to perform cross-border transfers in accordance with the entire MR Mobile Bank user experience Cash in / Cash Out Being a mobile first bank, the MR Mobile Bank will enable digital funding only, meaning that the deposit on the account will be only enabled by bank transfer, card payment, or any other form of non-cash money, such as a crypto currency transfer to the client s debit account. Clients can perform cash out transactions on any ATM or POS (with cash-advance support) anywhere where MasterCard is accepted. 8. MR Platform Implementation Roadmap We will build the MR Platform incrementally. In phase 1 we will, on top of the existing functions, extend and create a customer master data repository, accounting and pricing repositories, and reuse that in the second phase. In phase 2, we will create a framework and all mandatory modules for the banking business functionality. In phase 3, we will connect the functionalities into the Smart MR Mobile Bank. That implies automation of all exposed processes and the creation of fully functional native applications with built-in MR Robo Adviser, transaction, money remittance (fiat to crypt) functionalities, and with online real-time virtual assistance. 26

27 Q MR Platform Q & Q Smart MR Platform & MR Mobile Bank Q Smart MR Mobile Bank MR Adviser Payment Service Ripple Information Messaging (SWIFT) Payments Transactions (SWIFT) MR Portfolio Accounting General Ledger / Accounting Integrated Regulatory Reporting Channels Management Advisory Mobile Portfolio Mobile Sales Agents Mobile Channel Profitability Call Center ATM / POS Mobile Banking Product Management Product development (incl. bundles) Product profitability Sales Strategic Planning Execution Controlling Contact & Complaint Management Markets and Trading All-in-one mobile application Customer Management Customer Master Data Customer Relationship Customer Profitability Fees & Commissions Management, Pricing Controlling Local Controlling Local Regulatory Reporting Accounting Market Risk AML Marketing Risk Fraud Mgmt Portfolio & Limit Mgmt Mkt. Indirect Current Accounts, Deposits & Cash Management Account Opening Account Servicing Cash Management Operational Risk Mkt. Direct 3 rd Party Products Insurance Extemal Mutual Funds External market places access Position keeping Midoffice functions Treasury Settlement Cards Services Issuing Acquiring Card Management Market data Securities Settlement & Custody Asset & Liability Management Order Routing (+ Ripple) Fund Administration Business Inelegance Compliance IT Management Accounts Sberbank Account Crypto wallet Bitstamp exchange Vanguard Account 8.1 Modular approach The platform will start out by combining existing application functions as described in the MR Platform Whitepaper (separate document). On top of these functions, we will introduce mandatory segments for the future MR Platform functionality. The basic functionalities of the MR Platform will be deeply integrated from the beginning, but they will still be constructed as independent modules. The modules will be developed within a framework and with the structure of proven branded financial service data models, BASEL - a ready data field structure, as well as a PSD2 ready engine Future-proof hybrid infrastructure The infrastructure for the MR Platform will be based on a combination of hardware servers and cloud services. This will provide a firm foundation for adaptive security, availability and scalability, and ease the development for a truly global business model. 27