I would say the most effective component of the legislation is the fact that it frames the responsibilities of each sector as equivalent but different. What I mean by this is that it acknowledges that each sector, because of the technological way they operate, the business model, etc., inevitably has different capabilities and different responsibilities. Some of that goes to the data issues that David was talking about.
The overarching idea that there is a responsibility to work to prevent, detect and respond to scams—those three labels—becomes really important. Working in the banks, I can look at the obligations of the telcos and the platforms and can ask what they are doing to prevent scams and what we are doing. Is it roughly the same? Are we trying to do the same sorts of things? What are we doing to detect scams? Particularly in the data-sharing space, that's very important. Is the data we're providing helpful, and what is the response?
It's about having an overarching framework that cuts across regulatory silos, because historically, each of those sectors has been regulated in its own silo. The sector has its own regulator, and they don't always work together outside of those vertical boundaries. Forcing discussion not only at the industry level but also at the regulator level—across the silos—is probably the foundational thing that is of greatest benefit in the scam prevention framework.