I confess guilt. As a lawyer seeking easy solutions to the often thorny questions of how to regulate branchless banking, I was seduced by the argument that if service providers are simply held strictly liable for the actions of their “agents”, then regulators should freely allow the use of such agents.  It was elegantly simple. Perhaps too simple.

As it becomes increasingly clear that the largest obstacle to the success of branchless banking is the lack of a viable business model that provides financial incentives to all parties in the value chain (including the agents), regulators need to pay increasing attention to how to allocate risks and liabilities in way that promotes viable business models. All too often, all the burden of liability is placed on service providers – the banks and the MNOs – perceived as powerful and bottomless pits of money when compared against the poor, unbanked target customer or the small retail agent.

But is it really reasonable to hold a financial service provider strictly liable for all the damages its third party agent could cause? And does such strict liability promote or hamper the growth of branchless banking models? Regulators would benefit from unpacking agent liability – breaking out the various risks posed by the use of agents and allocating risk and responsibility accordingly.

For example, there seem to be clear cases where strict liability for agent actions makes sense. These would include liability for the proper execution of KYC procedures (if such procedures are even permitted to be carried out by agents). The argument for strict liability here is that the risks of not adequately protecting against money laundering and terrorist financing are too great to leave with small agents not adequately positioned or sufficiently sophisticated to mitigate the risk.

Another area where strict liability may be appropriate (though even here I have some concerns) is agent fraud or misconduct resulting in direct quantifiable damages to the customer – for example, an agent who inappropriately charges customers, or otherwise steals from customers. The argument for strict liability in this case is that the principle service provider is best positioned to supervise the actions of its agents.

But there is another category of agent misconduct  – where damages are not easily quantified and agent behavior not easily monitored – resulting in an unknown risk that principle service providers are not well equipped to mitigate. For example, violations of data privacy – the agent who tells a customer’s wife that her husband has been sending money to another woman. Or another example, the agent who makes sexually harassing phone calls to a customer forced to give her phone number to make a transaction. In these cases, damages could be indirect and punitive – and therefore quite high. And yet, a principal service provider is ill equipped to stop such agent behavior.  Would a bank assume such liability? I’ve seen at least one case where they flat out refused and frankly, I don’t blame them.

Some argue that this problem is easily solved – keep the principal institution liable and it will take recourse against its own agent for any damages it is forced to pay as a result of such agent’s misconduct. That could work where agents are large well-capitalized retail chains. But to reach the very poor, agents are often the simple, modest corner shops – the ones whose independent behavior is most difficult to control and whose ability to “pay back” a principal for paid damages is most limited.  A principal is unlikely to take comfort that in the idea that it can sue the sole proprietor of a modest fruit stand to recover unknown liabilities.

Then again, maybe even I am being too conservative. After all, in the world’s most successful branchless banking model, Safaricom expressly disavows any liability for its agent’s activities. Hmmmm.

-Michael Tarazi