Citigroup acted. Now, two new ideas on how banks can limit gun sales.

Five weeks earlier, a gunman’s attack at a high school in Parkland, Florida, had left 17 dead. Soon afterward, I wrote a column challenging the business world to “effectively set new rules for the sales of guns in America,” given Washington’s intransigence.

Other companies soon acted — BlackRock and Dick’s Sporting Goods, among them — but Citi’s decision has the potential to serve as a template for others in the finance industry. Citi said it would require retailers to place restrictions on the sale of guns to anyone younger than 21, to stop selling bump stocks and high-capacity magazines and to perform background checks. Otherwise, it would not do business with them.

Corbat, a gun owner who said the decision had not been made lightly, found the response to the bank’s move instructive.

“I would say from our employees, it has been overwhelmingly to virtually unanimously positive,” he told me. “I would say lots of positives from customers and clients. And then, as you know, the gun lobby is a strong lobby. I’ve gotten my share of people who staunchly disagree with us interfering in what they believe to be a constitutional right. And that wasn’t unexpected, and we certainly respect that opinion.”

He added that he had expected to hear from customers who planned to “take their Citi card and put it in a drawer or cut it up” — and that Citi had received such responses.

But ultimately “the positives have significantly outweighed the negatives,” he said. For every negative note, he said, he has gotten many more “saying that ‘I’m moving everything I have to Citi as a response to this.'”

Investors applauded, too. The board of the California State Teachers’ Retirement System, a huge pension fund, issued a statement saying Citigroup was “modeling best practices and demonstrating actionable steps that others can take.”

In the weeks since the Parkland shootings, I’ve had conversations with dozens of chief executives and other leaders from a variety of industries, many reaching out directly about the internal debates they have had. Virtually all the major banks, JPMorgan Chase and Bank of America among them, have created formal or informal working groups to consider the issue, as have the big credit card companies, including Visa, Mastercard and American Express.

(Perhaps the bank that’s least receptive to addressing the issue of guns is Wells Fargo, which has said it should be approached through the “political and legislative process.” Wells Fargo is the largest financier in the nation of the gun industry and is the main bank for the National Rifle Association, according to Bloomberg.)

With the exception of Citi, most financial institutions are still grappling with how to properly carry out a plan that is both enforceable and does not encroach on the rights of its customers.

While Citi’s decision is significant, Corbat acknowledged that it was intended to be balanced — and he purposely didn’t want it to be too broad. “This isn’t an easy thing to simply take a stance on,” he said, because of various privacy laws and rights.

“There is an important nuance here,” he said. “We didn’t tell our hundred and sixty million card holders in the world how they can use their cards. It’s their money. But what we did say — in terms of the people that Citi is going to do business with, the ones that we’re going to finance and that we’re going to, in essence, put our brands together on — that there needs to be something that makes sense for us and for both sides.”

He said the bank had purposely left some of its policy ambiguous so it could accommodate potential exceptions — for example, to the 21-year-old age limit.

“My inbox lit up with people saying: ‘Dear Sir, I’ve served in the military. Our country gave me a firearm when I was 18, and it was fine for me to go use that in the defense of our country,'” Corbat said.

“We didn’t use the word prohibit,” he added. “We used the word restriction. And we think that part of this should evolve.”

So if a person “had military training or you’ve had hunter safety training,” Corbat said, he could see an allowance for those individuals, though how that would be administered remains unclear.

The focus on raising the age of gun buyers to 21 is not random: Individuals ages 18 to 20 commit homicides using guns at a rate four times higher than the rate for those over 21, according to Everytown for Gun Safety, using FBI and census data.

While other institutions seem to be waiting to find the perfect solution, Corbat said, he decided he needed to act. “There’s things you can do today, and there are those things that maybe we have the ability around technology or other things to do in the future,” he said.

Here are two new ideas that the financial community might want to consider. I’ve shared these ideas with many of the biggest financial institutions, and the feedback, with some exceptions, has been quite positive.

One of the biggest complaints that banks and credit card processors have is that it is very difficult for them to know what products a merchant is selling. Banks do not get access to the specifics of each purchase. The only information they get is a Merchant Category Code, known as an MCC. Oddly enough, a gun dealer and Modell’s share the same MCC: “sporting goods.” So a bank or processor has no idea if you’re buying a gun or sneakers.

If the credit card companies and banks agreed, they could come up with a series of subcodes that would identify retailers that sold guns under a “best practices” policy — like the policy Citigroup proposed or the one Walmart and Dick’s follow — and the ones that don’t. It would add transparency to the process, and it would give banks that issue credit cards the opportunity to decide which retailers they wanted to associate with.

This solution is hardly a panacea. Retailers could try to game it, and it would require some enforcement. But much of that could be accomplished through crowdsourced feedback from customers. The addition of a new level of detail to the MCC might add pressure on gun retailers to voluntarily follow the “best practices” route.

The second technological solution is deceptively simple, but it could change the way guns are sold at gun shows, where in some states background checks are not required. Many of the sales at gun shows are done through services like Venmo and Square — both of which refuse to knowingly process the firearm sales under their terms of service.

Given that gun shows are public events with specific addresses and times, payment services could use GPS coordinates to electronically geo-fence the event — so their services limit transactions to users over 21 or require additional information for sales to be processed from that location.

In the world of banking, there is an abbreviation that is considered sacrosanct: KYC, or Know Your Customer. It seems only reasonable for the financial industry, especially when it comes to guns, to do more to know its customer.

This article originally appeared in The New York Times.