On Oct. 17, 2012, the U.S. Patent and Trademark Office formally received a provisional application for The patent numbered 61/715,142. It was accompanied by the required $250 (U.S.) filing fee and was submitted quietly by intellectual property lawyer Matthew J. Marquardt, who was then working at the Toronto offices of the law firm Norton Rose Canada.
The filing listed Edison Ortiz and Terry Lee as co-inventors. The application was the result of months of inspired work they’d done for their employer, the Royal Bank of Canada, and it marked a bold foray into the increasingly hyped future of mobile payments—the digital wallet. But RBC didn’t issue any news releases heralding its arrival, and only a handful of people within the bank knew any details about the project.
The application, which sported a bland title—“Secure Processing and Storage of Payment Data”—outlined a clever system that connects smartphones to the cloud to approve and process payments. The system doesn’t require the bank to share vital and valuable customer data with retailers, phone manufacturers or wireless service providers. RBC considers it to be a world-beating new technology, one that will make the bank a global player in the processing of mobile payments.
Or, it may not. To say that the business around digital wallets is fluid is a vast understatement. Credit card companies, banks and trust companies, tech companies, Apple, Google, Amazon, wireless providers, coffee chains, and on and on, are all vying to build—and trumpet—their own digital wallets. What’s at stake? Mobile payments are forecast to swell to $721 billion (U.S.) by 2017. RBC actually rolled out its cloud-based digital wallet to clients last year. To put things succinctly: It has yet to catch fire.
Yet, even among all that competition, RBC is pounding the drums for its cloud-based solution, and its enthusiasm is justified for several reasons. The bank isn’t Apple or Google, or a Silicon Valley upstart, yet it built a product that is far more advanced and nimble than many of those introduced so far by U.S. tech leaders. It also managed to do this with a measly budget of $10 million and all within the confines of a stodgy Canadian bank. And yet more surprising, it was built by what tech snobs might consider a B team of developers.
A system that would allow consumers to pay for retail purchases by waving their mobile phones over a merchant terminal has been a holy grail for financial institutions, retailers, phone makers and wireless providers since the 1990s. In Canada, the Big Three wireless companies—Bell, Rogers and Telus—formed a joint venture in 2005 to develop a common platform for mobile payments (the firm is now named EnStream). Canadian consumers, for their part, have a history of being early adopters of new technology, such as ATMs and debit cards.
Ottawa was also eager to see improvements in digital payments. Cash was becoming a growing competitive drag on the economy. One international study by MasterCard estimated that cash costs countries up to 1.5% of GDP. In March, 2012, the Task Force for the Payments System Review—appointed two years earlier by Finance Minister Jim Flaherty—released its final report. It slammed, in particular, the banks for dragging their feet on mobile payments: “Their interests are best served by keeping at bay new entrants to the system‚ the very entrants who would bring the innovations that Canadians need.”
That criticism irked the banks, and lit a fire under them. In May, the Canadian Bankers Association released a detailed “reference model” for mobile payments. As for the actual technology, pretty well all of the major Canadian players were working on the same basic idea: a system that would put the kind of information stored on a debit or credit card onto the SIM card or another secure component in a smartphone.
By then, the banks could also see new competitors—hordes of them—looming in all directions. Some had already made it to market in the United States. In January, 2011, Starbucks had introduced a mobile payments app for iPhones and BlackBerrys. That September, Google and MasterCard launched Google Wallet, an app for Android phones that allowed users to pay by credit card through MasterCard’s PayPass merchant terminals (Google Wallet is still only available in the U.S.). In Canada, Rogers caused a stir when media reports disclosed that it had applied for a Schedule 1 banking licence (which it received in 2013).
The big fear at RBC and the other large banks was that they could be disintermediated by tech companies, telcos or just about anyone else involved in a mobile payments transaction. “You never want someone between you and your customer,” says David McKay, 51, who was head of RBC’s Canadian banking operations until 2012, before succeeding Gord Nixon as CEO last year. “We saw new competitors like Apple and Google starting at the front end of the value chain and forward-integrating. We saw a collision coming, and we needed to change our overall role in the ecosystem.”
In short, the bank had to step up its game. Jeremy Bornstein, 36, a former consultant who joined RBC in 2010 as managing director of enterprise strategy, says that “we decided not to be a fast follower, but to be the best in the space.” But until the summer of 2012, RBC was focused on the same chip-based solution as Canada’s other big banks: storing client information on a SIM card, and forging alliances with wireless providers, retailers and other partners.
At RBC that summer, however, there was a key shift in leadership—and fundamental thinking. The bank’s CFO, Janice Fukakusa, spearheaded the promotion of Linda Mantia to executive vice-president in charge of cards and payment solutions. Fukakusa wanted an innovator in the job.
Mantia, 46, is not a stereotypical banker. She worked as a corporate lawyer and a consultant at McKinsey in the 1990s, and joined RBC as a senior vice-president in 2003. She was posted to London, as chief operating officer of global private banking, but returned to Toronto in 2007, after the birth of her youngest daughter. Mantia was no expert in mobile technology—her previous position was in procurement—but she came in with a fresh perspective. She started asking software developers basic questions about chip-based systems. They told her that the system would require banks to store the so-called client credential—name, account number and other confidential information—on each phone’s SIM card and provide access to it through merchant terminals. But what if the phone or the system got hacked?
Despite those doubts, time was running short. McKay told reporters that summer that RBC would introduce a digital wallet by fall. In early October, Mantia and Bornstein, who had been promoted to head of emerging payments a few days earlier, met to sign an agreement to launch a wallet on Bell Mobility’s wireless network. “The pen was in our hands to sign when we realized, ‘Oh my God! This is scary,’” says Bornstein. “The model the telcos wanted would allow them to access that credential,” says Mantia. “That’s when we said, ‘No, there’s got to be a better way.’” They didn’t sign. A few weeks later, McKay told a reporter that the launch had been delayed due to unspecified “partner difficulties.”
RBC, however, wasn’t giving up. Mantia and Bornstein had what they figured was an ace up their sleeve: two sharp software developers who had a better idea.
Edison (Eddy) Ortiz was born in Ecuador, and he didn’t go to an established engineering school like MIT or Stanford. He started at DeVry University in Toronto, earning a diploma in electronic engineering technology, and then took computer science courses at York University. In the early 1990s, he landed a job at the school board of Peel Region, just outside Toronto. On one project, he programmed a system to automatically phone the homes of absent students. A mentor at the board saw potential in Ortiz and encouraged him to apply at a bank.
Ortiz joined RBC in 1997 as a technical systems analyst. He then rose through several management jobs in IT before being appointed as the bank’s director of digital strategy in 2009.
Along the way, Ortiz became close friends with Terry Lee, one of the fathers of Internet banking at RBC. Lee joined RBC in 1994, as a junior programmer, after studying computer engineering technology at Toronto’s Seneca College. He led the development of RBC’s online and mobile banking services and in January, 2013, he was appointed director of research and development for emerging payments. In recent years, Ortiz and Lee have become inseparable at work, so much so that many colleagues refer to them simply as “Teddy.”
Ortiz often did some of his clearest thinking on summer motorcycle rides between his home in Milton, west of Toronto, and the office. He also spent a lot of time at night and on weekends taking apart and studying smartphones and merchant terminals in his tech-laden suburban basement.
Instead of storing client information on SIM cards, Ortiz and Lee had an idea for a system based on so-called tokenization. Importantly, RBC’s client credentials would remain stored on its secure data servers. As with the chip-based model, a client would need a smartphone and a SIM card that were both enabled with near-field communications (NFC) capability. When the client activated the digital wallet, it would connect to the cloud. There, the bank would verify the client’s credential and issue an electronic token that would authorize any purchase of up to, say, $50 or $100.
To make a purchase, a client would select debit, credit or loyalty card on the phone and enter a pass code. Then, the client would wave the phone close to the terminal to send the token. After that, the phone would pull down a new token from the cloud.
Up until Mantia and Bornstein balked at signing the deal with Bell in October, however, RBC had been focused on the same model as its rivals. Other executives in the bank weren’t all that interested in alternatives. “No one listened because the whole industry was moving toward SIM,” says Mantia.
That situation changed after the Bell meeting. Mantia gave the green light to Lee and Ortiz. They assembled a small SWAT team of key software developers—including a hand-picked core group of six whiz kids who were eager to work free of the bank’s often cumbersome rules on process. Mantia also appointed a project manager, Jacquelina Calisto, who had a background in program management and digital payments.
The effort was top secret. The entire team—which occasionally swelled to 20 people—was herded into a 500-square-foot room at 320 Front St. West in Toronto, a generic-looking satellite office several blocks from RBC’s glittering gold headquarters on Bay Street. They named themselves Payments 2020, and dubbed their office the Shipyard, because they promised that big things would be built there.
The first two weeks were particularly intense. Ortiz and Lee went from talking about a dream to working 16-hour days, day after day, preparing detailed documents for the provisional U.S. patent application, including eight pages of highly complex charts and line drawings.
Only a handful of other people in RBC’s technology group knew what they were up to. Even McKay stayed mum about the cloud-based idea after the application was submitted on Oct. 17. Six days later, he told a Reuters reporter that RBC would miss its October target for launching its digital wallet—but not by much. “We’re almost there; it’s close. It’s going to be out in the next three or four weeks,” he said.
That delay allowed CIBC and Rogers to beat RBC to market by staging what they called the “first mobile credit card transaction in Canada” on Nov. 2, 2012. At a Toronto Tim Hortons, Simon Whitfield, gold medalist in the triathlon at the 2000 Olympics in Sydney, paid for a coffee by waving a BlackBerry over a payments terminal—no more need to search your wallet for a plastic card! “Our vision is to take the millions of cards Canadians carry today and to make them instantly accessible and secured on the SIM card of a smartphone,” said David Robinson, vice-president of emerging business at Rogers. Among the onlookers was Bornstein, who had slipped into the launch party with an RBC colleague.
The CIBC launch revealed some of the obstacles in the way of a complete digital wallet. The bank’s mobile payments app was only available for Visa and MasterCard credit cards issued by CIBC, and only on select BlackBerry phones sold by Rogers. (Since then, CIBC has added many Android phones, and partnered with Telus, Bell and Virgin Mobile.)
Meanwhile, back at the Shipyard, the Payments 2020 team was encountering some hurdles for its cloud-based solution.
In theory, Lee and Ortiz’s system was clever and elegant. But in practice, it had to conform to the reference model for mobile payments endorsed by the other Canadian banks and the big telcos. And though it didn’t require storing client credentials on SIM cards, there were fears that it could be compromised in other ways.
In November, Lee and Ortiz travelled to the headquarters of Bell Identification B.V. in Rotterdam. Bell ID is a privately owned software company that develops token-based systems and cryptographic keys for governments, banks and transit systems. The duo won’t divulge what they worked on for two weeks, but Mantia says that getting the sign-off for the trip from McKay, who has a mathematics degree from the University of Waterloo, was critical. “I was brand new and he could have easily said, ‘We don’t want to delay. Every other bank is doing it [the SIM card] way,’” she says. “But he didn’t. We gave [Lee and Ortiz] a chance to prove they could be right.”
Indeed, as 2012 drew to a close, other software developers at RBC were outright suspicious of what was going on in the Shipyard. Lee and Ortiz would sometimes don white lab coats as they toiled into the night. Their one indulgence: baskets of crispy fries at Fionn MacCool’s faux-Irish pub on the building’s ground floor. Other managers and developers were still hard at work on a SIM-based solution. “They didn’t understand why they weren’t being included,” says Mantia.
Even with the backing of McKay and Mantia, the time pressure on “Teddy” got intense. Lee says he’s accustomed to projects that occasionally venture into the red on bank organizational charts—meaning they fall behind schedule or short of targets. The cloud-based initiative was in the red for its entire duration. Things came to a head at Mantia’s weekly review meeting with Payments 2020 in the Shipyard on Jan. 9, 2013. After a heated debate—Ortiz says they were sometimes “at each other’s throats”—the team decided that the bank should stop developing the SIM model altogether and instead pursue the cloud-based one wholeheartedly. Bornstein calls it “the best meeting of our lives.”
There were still obstacles ahead, however. By the spring, the team had built a cloud-based system so discreet that Visa, MasterCard and Interac wouldn’t immediately detect whether a transaction was conducted using a card or a smartphone. But what if hackers could enter RBC’s customer databases through the cloud? To bolster their case to RBC’s senior management, the team hired leading ethical hackers to try to breach the bank’s computer system firewalls. They couldn’t.
Keeping the telcos onside was also critical. In theory, they could develop their own payment systems, or only go with the SIM card model. Mantia says that RBC had regular meetings with Bell to discuss the technology and contracts. She says they were “very challenging discussions.”
But Bell executives remember no tension. Wade Oosterman, president of Bell Mobility and Residential Services, says he thought the cloud technology “was kind of cool.” He also disputes RBC’s worry about telcos getting access to the banks’ client credentials. Bell has mobile payments alliances with TD, CIBC and Desjardins, and even with the SIM-card model that those institutions use, the credential is stored in what Bell calls an “encrypted storage container” on the card. Only the client and the bank—not the wireless provider—have access to it.
On March 27, 2013, McKay journeyed not to a Timmy’s, but to a Toronto McDonald’s to stage the first contactless mobile-phone debit card transaction in Canada. With him paying for burgers and fries with their phones were Mark O’Connell, CEO of the Interac Association and Acxsys Corp., and executives from McDonald’s. Another nine months of trials and intensive testing followed the McDonald’s event. The bank formally launched RBC Wallet in January, 2014. The two big selling points: security and being the first bank digital wallet to offer clients the choice of debit as well as credit transactions. The next step, expected this year, is to add loyalty cards.
Has RBC’s cloud-based technology conquered the world, or even Canada? Not even close. But maybe that’s not the point. The mobile payments market is still in its chaotic early history. Other Canadian banks are sticking with chip-based systems. They don’t share RBC’s worries about storing a customer’s credential on a SIM card.
As for Google, it hasn’t tried to elbow aside the banks in Canada. RBC, TD, CIBC, Scotiabank and Desjardins sell their digital wallets through Google Play, the online supermarket for Android apps. And all have alliances with telcos.
Apple Pay hasn’t proved to be a category killer yet, either. Apple introduced its digital wallet in October, but only in the United States, and only on the latest iPhones and tablets. Apple is reportedly playing hardball with wireless providers and financial institutions, insisting that it wants a fee for every transaction, not just a so-called real estate fee for digital space on the SIM card. None of the big Canadian wireless providers or banks has lined up with Apple Pay yet. “Is Apple being aggressive?” Mantia asks, then pauses before answering. “They are ruthlessly focused on their unique and seamless customer experience on their devices,” she says. “We are ruthlessly focused on our customer experience.”
Energized by developing its cloud-based technology, RBC’s payments team is looking for new uses for it. In November, Bornstein announced that RBC would partner with MasterCard and Bionym, a Toronto-based start-up that makes smart wristbands, to test a payments system. In an interview last fall, however, McKay wasn’t quite as gung-ho as his payments team. He figured the bank had six months to meet its milestones for licensing its cloud solution. After that, it may have to scale back its expectations. Nonetheless, some high-fives are in order. Mantia and her team proved it’s possible for even a 150-year-old Canadian bank to somersault into the future. And the geeks with the smarts and panache to do it could very well be sitting in the bank’s office cubicles already.Report Typo/Error
Follow us on Twitter: