Digital Banking, Payments and FinTech Regulation

Introduction and Context

Banking is increasingly delivered through software, telecommunications networks, cloud infrastructure and data-sharing arrangements rather than through branches alone. Customers may open accounts remotely, authenticate with biometrics, make instant payments, obtain credit through a mobile application, or use a non-bank platform that embeds financial services into commerce. These developments can reduce cost and increase access, but they also create new forms of operational, conduct, cyber, data, liquidity and financial-stability risk.

Digital finance therefore does not eliminate the need for banking regulation; it changes the objects and techniques of regulation. Supervisors must regulate not only banks and payment institutions, but also technology providers, platform firms, agents, cloud-service providers, application-programming interfaces (APIs), data intermediaries and crypto-asset businesses. The central policy challenge is to preserve safety, integrity and consumer protection without preventing useful innovation or excluding underserved populations.

This chapter examines the regulatory architecture for digital banks, payment systems, electronic money, open banking, embedded finance, peer-to-peer models, digital identity, central bank digital currencies (CBDCs) and crypto-asset exposures.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish digital banks, payment institutions, electronic-money issuers and technology firms.
2. Explain the regulatory principles governing payment systems and settlement.
3. Evaluate open banking, APIs and embedded-finance arrangements.
4. Assess the risk and regulatory treatment of peer-to-peer lending and crowdfunding.
5. Analyse digital identity, cybersecurity, outsourcing and data-governance requirements.
6. Compare the principal design choices for CBDCs.
7. Identify prudential, conduct and financial-crime risks associated with crypto-asset exposures.
8. Apply a proportionate, risk-based framework to a digital-finance business model.

1. The Regulatory Perimeter in Digital Finance

A useful starting point is the distinction between the function performed and the institution performing it. Traditional regulation often attached obligations to banks. Digital finance requires supervisors to ask what economic function is being performed, what risks arise, and which entity controls the relevant activity.

The principal regulatory functions include:

• Deposit-taking: accepting repayable funds from the public and transforming them into assets.
• Payment execution: transferring funds between payer and payee.
• Issuing electronic money: creating a monetary claim on an issuer that is stored electronically and accepted by persons other than the issuer.
• Credit intermediation: connecting lenders and borrowers or underwriting credit.
• Investment and custody: holding assets or executing transactions for customers.
• Data intermediation: obtaining, analysing or sharing financial data.
• Technology provision: supplying cloud, identity, fraud-detection, ledger or interface services.

The same mobile application may combine several functions. For example, a platform may provide a wallet, facilitate payments, distribute insurance, offer credit and use transaction data to determine eligibility. Each function may attract different licensing, safeguarding, consumer-protection, anti-money-laundering (AML), prudential and reporting requirements.

1.1 Digital banks and neobanks

A digital bank is a licensed deposit-taking institution whose customer acquisition, service delivery and operational infrastructure are predominantly digital. A neobank may be a fully licensed bank or a technology brand operating through a partner bank. The distinction is legally important. A technology company that markets a bank account may not itself hold deposits; the regulated bank may remain responsible for the account, safeguarding, liquidity and prudential obligations.

Digital banks face the same fundamental risks as other banks, including credit, market, liquidity and operational risk. They may also face intensified risks because of rapid customer acquisition, automated underwriting, concentrated cloud dependencies, weak human escalation, algorithmic bias and limited experience in stress conditions. A digital interface does not justify lighter standards for capital, governance, liquidity, resolution planning or consumer protection.

A sound licensing assessment should examine:

1. ownership, controllers and sources of capital;
2. governance, board competence and risk appetite;
3. business-model viability and funding assumptions;
4. technology architecture and resilience;
5. outsourcing and cloud arrangements;
6. customer identification and transaction monitoring;
7. complaints, redress and vulnerable-customer treatment;
8. recovery, resolution and exit arrangements.

1.2 Proportionality and technology neutrality

Proportionality means that regulatory requirements reflect the nature, scale and complexity of risk. A small payment institution need not have the same organisational structure as a systemically important bank, but it must control the risks generated by its activities. Technology neutrality means that equivalent services should generally be subject to equivalent risk-based outcomes even when delivered through different technologies.

Proportionality must not become regulatory arbitrage. A firm should not avoid bank-like obligations merely by describing a deposit as a wallet balance, a loan as a marketplace product, or a financial service as a technology feature.

2. Payment Systems and Electronic Money

Payment systems are arrangements that enable the transfer, clearing and settlement of funds. They include retail payment schemes, card networks, instant-payment systems, automated clearing houses, high-value payment systems and settlement arrangements linked to central-bank accounts.

2.1 The payment chain

A card or account-based payment commonly involves the payer, payer’s payment-service provider, payment scheme, acquiring institution, payee and payee’s provider. Regulation addresses authorization, authentication, transparency, execution time, allocation of liability, refunds, fraud and settlement finality.

Important regulatory principles include:

• Access and interoperability: qualified participants should have fair access to essential payment infrastructure.
• Settlement finality: rules should establish when a payment becomes irrevocable, subject to applicable law.
• Operational resilience: critical systems should withstand disruption and recover within defined tolerances.
• Transparency: fees, exchange rates, execution times and liability rules should be understandable.
• Customer authentication: authentication should appropriately address fraud without excluding legitimate users.
• Protection of client funds: customer money held by non-bank providers should be segregated or otherwise protected.

2.2 Electronic money and safeguarding

Electronic money is generally a prepaid monetary value represented by a claim on the issuer. It is not automatically a bank deposit. An electronic-money issuer typically cannot use customer funds as unrestricted lending resources. Safeguarding may require segregation in a protected account, investment in eligible low-risk assets, insurance or another legally recognised mechanism.

The regulatory purpose of safeguarding is to reduce loss if the issuer fails. It does not necessarily eliminate every risk: safeguarding accounts may be exposed to bank failure, reconciliation errors, fraud, legal uncertainty or delays in insolvency administration. Firms should perform frequent reconciliations, maintain clear records of beneficial owners, control access to safeguarding accounts and test insolvency-return procedures.

2.3 Payment-system risk

Payment systems generate several forms of risk:

• Credit risk: a participant may fail to meet an obligation.
• Liquidity risk: a participant may be solvent but unable to pay at the required time.
• Principal risk: one party may deliver value without receiving the counter-value.
• Operational risk: systems, processes or staff may fail.
• Settlement risk: a payment may be reversed or delayed after a participant has acted on it.
• Cyber risk: malicious activity may compromise availability, integrity or confidentiality.
• Concentration risk: many institutions may depend on one processor, cloud provider or network.

Central banks and payment-system overseers commonly require governance arrangements, risk controls, participant standards, incident reporting, business-continuity planning and testing. Systemically important systems may also require liquidity resources, collateral arrangements and legally robust settlement rules.

3. Open Banking, APIs and Data Governance

Open banking allows customers, with appropriate consent, to authorise regulated third parties to access account information or initiate payments. It is commonly implemented through APIs, which are controlled technical interfaces enabling systems to communicate.

Open banking can increase competition, support account aggregation, improve financial management and enable new credit assessments. It can also create risks involving excessive data collection, fraudulent consent, screen scraping, unauthorised payment initiation, weak third-party security and unclear liability.

3.1 Regulatory architecture

A credible open-banking framework should define:

1. who may access data;
2. which data categories are available;
3. how consent is obtained, recorded, renewed and withdrawn;
4. authentication and authorisation requirements;
5. API performance and availability standards;
6. liability for unauthorised access or payment;
7. data minimisation, retention and deletion rules;
8. dispute-resolution and compensation mechanisms;
9. supervisory reporting and audit rights.

Consent should be specific, informed, revocable and limited to a defined purpose. A customer’s acceptance of a lengthy digital notice is not necessarily meaningful consent. Firms should present the identity of the third party, the data requested, the purpose, duration and consequences of approval in clear language.

3.2 Data as an asset and a source of power

Financial data can improve risk assessment, reduce information asymmetry and support tailored products. However, data access can reinforce the market power of large platforms. A firm that controls a dominant customer interface may use data to cross-subsidise services, discriminate against rivals or exploit behavioural information.

Regulators must therefore coordinate banking, payment, competition, privacy and consumer-protection rules. Important governance controls include data inventories, access logs, role-based permissions, model documentation, data-quality testing and independent audits. Automated decisions should be explainable to a degree appropriate to their impact, and customers should have routes to challenge errors.

4. Embedded Finance and Platform Regulation

Embedded finance occurs when financial products are integrated into a non-financial customer journey, such as payments within an online marketplace, insurance at checkout or working-capital credit within accounting software. It can improve convenience but may obscure who is providing the financial service.

The regulated institution, platform and technology provider should allocate responsibilities expressly. A supervisory assessment should ask:

• Who is the licensed provider?
• Who owns the customer relationship?
• Who performs identification and sanctions screening?
• Who makes and explains credit decisions?
• Who handles complaints and refunds?
• Who bears fraud and operational losses?
• What happens if the platform terminates the relationship?

A bank cannot outsource accountability merely by outsourcing performance. Contracts should provide audit access, service-level requirements, incident notification, data-use limits, subcontracting controls, exit assistance and business-continuity obligations. Supervisors increasingly apply a “third-party risk” lens to major cloud and platform providers because the failure of a non-bank service provider may affect many regulated institutions simultaneously.

5. Peer-to-Peer Lending and Crowdfunding

Peer-to-peer (P2P) lending platforms connect lenders and borrowers, sometimes using automated credit scoring and servicing. Crowdfunding platforms may facilitate loans, equity investments or donations. The platform may not take deposits, but it can still generate significant conduct and systemic concerns.

Key regulatory questions include whether the platform:

• assumes credit risk or merely intermediates;
• promises repayment or markets investments as protected;
• conducts suitability or affordability assessments;
• holds client money or securities;
• manages conflicts of interest;
• services loans after platform failure;
• provides accurate default and performance data;
• uses fair and valid algorithms.

Investors should receive clear information about default risk, liquidity, fees, ranking of claims and the absence or limits of deposit insurance. Borrowers should receive responsible-lending protections, including affordability assessment and fair treatment of distressed customers. Platforms should maintain wind-down arrangements so that loan records and servicing can continue if the platform becomes insolvent.

6. Digital Identity, AML and Cybersecurity

Digital identity is the process by which a person or organisation is identified and authenticated electronically. It may involve government credentials, trusted private providers, biometrics, cryptographic credentials, device signals and behavioural analytics.

A robust identity framework distinguishes:

• Identity proofing: establishing that an identity exists and belongs to the applicant.
• Authentication: verifying that the current user controls the identity credential.
• Authorisation: determining what the authenticated user may do.
• Attribution: creating evidence linking an action to a person or entity.

Remote onboarding should use risk-sensitive controls. Possible measures include document verification, liveness detection, database checks, device intelligence, sanctions screening, transaction limits and enhanced due diligence. No single biometric or automated check is infallible. Firms must manage false positives, identity theft, deepfakes, exclusion of persons without standard documents and misuse of biometric data.

Cybersecurity regulation should address confidentiality, integrity and availability. Minimum controls commonly include secure software development, encryption, privileged-access management, multi-factor authentication, network segmentation, vulnerability management, backup testing, incident response and independent penetration testing. Firms should report material incidents promptly and conduct post-incident analysis rather than treating cybersecurity as a purely technical issue.

AML controls must be adapted to digital channels. Rapid account opening and instant payments can increase the speed of fraud, mule-account activity and illicit transfers. Transaction-monitoring systems should be calibrated and subject to quality assurance. Excessive reliance on artificial intelligence can generate opaque alerts, discriminatory outcomes or systematic failure when criminal behaviour changes. Human oversight remains necessary for escalation and suspicious-transaction decisions.

7. Central Bank Digital Currencies

A CBDC is a digital form of central-bank money available under a legal and institutional design determined by the issuing central bank. It may be intended for retail users, wholesale financial-market participants, or both.

7.1 Principal design choices

A retail CBDC could make central-bank money directly accessible to households, improve payment competition and support resilience. Conversely, in times of stress, customers might rapidly convert commercial-bank deposits into CBDC. This could intensify bank runs and alter bank funding. Holding limits, remuneration design and conversion controls are possible safeguards, but each creates trade-offs.

Wholesale CBDCs may improve settlement in securities or cross-border transactions, particularly where programmable delivery-versus-payment arrangements are legally enforceable. Yet programmability must not allow unauthorised restrictions on legitimate use or transfer of money. Governance should establish who may update software, reverse transactions, access data and resolve disputes.

8. Crypto-Assets and Banking Exposures

Crypto-assets include diverse instruments: payment tokens, stablecoins, utility tokens, investment tokens and decentralised-finance (DeFi) positions. Their legal classification varies. Regulation should focus on economic substance, rights and risks rather than labels.

Banks may face crypto-related exposure through direct holdings, lending to crypto firms, custody, brokerage, payment services, stablecoin reserves, derivatives, venture investments or indirect exposure to common technology providers. Principal risks include:

• extreme price volatility;
• market and liquidity risk;
• counterparty and settlement risk;
• fraud, theft and private-key loss;
• governance failures;
• run risk in stablecoin arrangements;
• sanctions evasion and money laundering;
• legal uncertainty and enforceability;
• operational dependence on unregulated entities.

A prudent bank should establish board-approved limits, customer and counterparty due diligence, segregation of client assets, valuation controls, independent reconciliation, wallet and key-management standards, stress testing and contingency plans. Capital and liquidity treatment should reflect the actual risk and applicable prudential rules. A bank should not treat a crypto-asset as safe merely because it is widely traded or supported by a prominent platform.

Stablecoins require particular attention. A stablecoin’s reliability depends on the quality, liquidity, custody and legal enforceability of its reserve assets, as well as redemption arrangements and governance. A token that promises one-to-one redemption may still experience a run if holders doubt the reserves or the issuer’s ability to process redemptions.

9. A Supervisory Framework for Digital-Finance Business Models

A practical assessment can be organised through six questions:

1. Function: What financial function is performed?
2. Legal claim: What does the customer own or have a right to receive?
3. Control: Who controls funds, data, algorithms and customer communication?
4. Risk: What could fail, and who bears the loss?
5. Dependency: Which third parties or infrastructures are essential?
6. Exit: Can customers access funds and records if the provider fails?

Supervisors should combine entity-based supervision with activity-based and ecosystem-based analysis. They should map dependencies, test severe but plausible scenarios and assess whether the customer can understand the product. Regulatory sandboxes may facilitate experimentation, but participation in a sandbox is not a guarantee of safety or regulatory approval.

Useful supervisory metrics may include fraud losses per transaction, system availability, reconciliation breaks, complaint-resolution time, unauthorised-payment rates, concentration of critical outsourcing, API failure rates, suspicious-transaction alert quality and recovery time after incidents. Metrics should be interpreted in context; a low complaint rate may indicate satisfaction, but it may also indicate barriers to complaining.

10. Illustrative Case: The RapidPay Platform

Background

RapidPay is an illustrative fictional platform offering a mobile wallet, instant payments, salary advances and a marketplace for small-business loans. It is not a bank. Customer funds are held in safeguarded accounts at two commercial banks. RapidPay uses a cloud provider, a third-party identity service and an external credit-scoring model. It also plans to connect to customers’ bank accounts through open-banking APIs.

Problem

RapidPay grows rapidly. A cloud outage prevents payments for six hours. Reconciliation reveals a mismatch between wallet balances and safeguarded funds. The credit model rejects applicants from a particular geographic area at a significantly higher rate, although the firm cannot explain the result. Fraudsters exploit weak account-recovery procedures and redirect salary payments.

Analysis

The platform has at least four regulatory functions: payment execution, electronic-money issuance or wallet operation, credit intermediation and data access. Its risks are not confined to technology. The safeguarding mismatch creates direct customer-asset risk; the outage creates operational and conduct risk; the unexplained model outcome creates discrimination and governance risk; and account takeover creates authentication and fraud risk.

Approach and solution

The regulator requires RapidPay to:

• reconcile safeguarded funds daily and investigate breaks immediately;
• document the legal status of wallet balances and customer claims;
• establish an incident-response and customer-compensation process;
• strengthen recovery authentication using risk-based step-up controls;
• validate the credit model for accuracy, bias and stability;
• provide adverse-action explanations and human review;
• map cloud and identity-provider dependencies;
• conduct operational-resilience testing;
• obtain explicit, granular consent for open-banking access;
• maintain a tested wind-down plan.

RapidPay’s partner banks remain responsible for the functions assigned to them, but contractual allocation does not remove the platform’s own duties. The supervisor also requires board reporting on reconciliation, fraud, outages, complaints and model performance.

Outcome and learning points

After remediation, RapidPay reduces its growth targets, improves reconciliation and introduces a manual review pathway. Fraud losses decline, but the cost of compliance increases. The case demonstrates that digital-finance supervision must assess the complete service chain. Licensing, safeguarding, outsourcing, model governance, customer protection and operational resilience are interdependent.

11. Ethical and Governance Issues

Digital finance raises questions that cannot be solved by technical compliance alone. Automated pricing may reproduce historical discrimination. Personalisation may manipulate vulnerable customers. Instant credit may encourage over-indebtedness. Biometric identity may create irreversible privacy harm. Large platforms may use financial data to entrench market dominance.

Boards should treat fairness, privacy and inclusion as governance matters. Effective governance includes clear accountability for algorithms, independent risk challenge, documented data purposes, impact assessments, accessible redress and testing with vulnerable users. Inclusion should be measured by actual successful use, not merely by the number of accounts opened. Alternative channels may remain necessary for persons with disabilities, limited connectivity, low digital literacy or distrust of digital systems.

12. Contemporary Regulatory Direction and Best Practice

The regulatory direction internationally is toward:

• licensing based on activities and risk;
• stronger operational-resilience expectations;
• oversight of critical third-party providers;
• interoperable and secure payment infrastructure;
• expanded data-rights frameworks;
• more explicit algorithm and model governance;
• enhanced crypto-asset and stablecoin controls;
• cross-border cooperation;
• testing of CBDC and instant-payment designs;
• increased use of supervisory technology (suptech).

For management, best practice is to maintain a regulatory inventory, map data and funds, identify critical services, test failure scenarios, monitor customer outcomes and ensure that senior executives understand technology risk. Innovation should proceed through controlled experimentation, documented risk acceptance and a credible path to compliance—not through ambiguity about responsibility.

Chapter Summary

Digital banking regulation must follow economic function, customer risk and control over funds and data rather than relying solely on institutional labels. Digital banks remain subject to core prudential expectations, while payment and electronic-money providers require strong safeguarding, settlement, operational and conduct controls. Open banking can improve competition but requires secure APIs, meaningful consent, clear liability and sound data governance. Embedded finance and P2P models require explicit allocation of responsibility, fair disclosure, responsible lending and continuity arrangements.

Digital identity supports remote access but must address proofing, authentication, privacy, exclusion and cyber risk. CBDC design involves trade-offs concerning privacy, resilience, bank disintermediation, monetary transmission and cross-border use. Crypto-asset exposures require risk-sensitive treatment of volatility, custody, liquidity, governance and financial-crime risk. Across all models, effective regulation combines proportionality, technology neutrality, operational resilience, consumer protection, accountability and credible exit planning.

Key Terms

Digital bank: A licensed bank whose services are primarily delivered through digital channels.

Neobank: A digital banking brand, either independently licensed or operating through a partner bank.

Payment system: An arrangement for transferring, clearing and settling payments.

Electronic money: Digitally stored monetary value representing a claim on an issuer.

Safeguarding: Protecting customer funds held by a non-bank payment or e-money provider.

Settlement finality: The legal point at which a payment becomes final and generally irrevocable.

Open banking: Controlled third-party access to payment-account data or payment initiation.

API: A technical interface that enables authorised systems to exchange data or instructions.

Embedded finance: Financial services integrated into a non-financial customer journey.

Peer-to-peer lending: Lending arranged through a platform connecting borrowers and lenders.

Digital identity: Electronic representation and verification of a person or organisation.

Authentication: Verification that a user controls a claimed identity or credential.

Operational resilience: The ability to continue important services during disruption.

CBDC: Digital central-bank money issued under a central-bank framework.

Crypto-asset: A digitally represented asset or claim using cryptographic or distributed-ledger technology.

Stablecoin: A crypto-asset designed to maintain a relatively stable value, often through reserves or other mechanisms.

Suptech: Technology used by supervisory authorities for oversight and analysis.

Technology neutrality: Applying comparable risk-based outcomes to equivalent services regardless of technology.

Review Questions

Short Answer Questions

1. Why is activity-based regulation important in digital finance?
2. Distinguish electronic money from a bank deposit.
3. What are the principal purposes of safeguarding customer funds?
4. Identify three risks associated with open banking.
5. What is the difference between authentication and authorisation?

Long Answer Questions

1. Explain how a regulator should assess the licensing and governance of a digital bank.
2. Discuss the regulatory benefits and risks of open banking and API-based data sharing.
3. Analyse the responsibilities of banks, platforms and technology providers in embedded finance.
4. Compare the principal design choices and risks of a retail CBDC.
5. Explain how a bank should govern and control its crypto-asset exposures.

Analytical / Application Questions

1. A wallet provider experiences a safeguarding mismatch, a cloud outage and a sharp increase in account-takeover fraud. Construct a risk-prioritised supervisory response.
2. Evaluate whether a P2P lending platform should be subject to bank-like regulation when it does not take deposits but markets loans as “safe.”
3. Design a governance framework for an open-banking credit product that uses transaction data and an automated affordability model.

Multiple Choice Questions with Answers

Question 1

Which principle requires comparable risk-based outcomes for equivalent financial services delivered through different technologies?

A. Technology neutrality

B. Deposit insurance

C. Settlement finality

D. Monetary neutrality

Correct Answer: A. Technology neutrality

Question 2

What is the primary purpose of safeguarding customer funds held by an electronic-money issuer?

A. To permit unrestricted lending from customer balances

B. To reduce customer loss if the issuer fails

C. To guarantee investment returns

D. To eliminate all cyber risk

Correct Answer: B. To reduce customer loss if the issuer fails

Question 3

Which feature is most directly associated with open banking?

A. Central-bank lending to commercial banks

B. Authorised third-party access to account data or payment initiation

C. Mandatory branch banking

D. Physical cash settlement only

Correct Answer: B. Authorised third-party access to account data or payment initiation

Question 4

Which statement best describes authentication?

A. Determining what an authorised user may do

B. Verifying that a user controls a claimed identity or credential

C. Allocating capital to a bank

D. Settling a payment irrevocably

Correct Answer: B. Verifying that a user controls a claimed identity or credential

Question 5

Why can a major cloud-provider failure create systemic concern?

A. Cloud providers always issue deposits

B. Many regulated institutions may depend on the same provider

C. Cloud providers determine monetary policy

D. Cloud services eliminate operational risk

Correct Answer: B. Many regulated institutions may depend on the same provider

Question 6

Which issue is especially relevant to peer-to-peer lending platforms?

A. Whether investors understand default and liquidity risk

B. Whether all loans are central-bank liabilities

C. Whether cash must be printed

D. Whether payment cards require magnetic stripes

Correct Answer: A. Whether investors understand default and liquidity risk

Question 7

Which CBDC design choice may reduce the risk of rapid migration from bank deposits into CBDC during stress?

A. Unlimited anonymous holdings

B. Holding limits

C. Removal of all intermediaries

D. Guaranteed high remuneration

Correct Answer: B. Holding limits

Question 8

Which is a significant crypto-asset custody risk for a bank?

A. Loss or compromise of private keys

B. Excessive branch opening

C. Guaranteed settlement by cash

D. Absence of any price movement

Correct Answer: A. Loss or compromise of private keys

Question 9

In the RapidPay case, an unexplained geographic disparity in credit approvals primarily raises which governance concern?

A. Algorithmic fairness and model risk

B. Settlement finality only

C. Cash transportation risk

D. Interest-rate parity

Correct Answer: A. Algorithmic fairness and model risk

Question 10

Which supervisory question best addresses failure preparedness for a digital-finance firm?

A. Does the firm have a credible wind-down and customer-access plan?

B. Does the firm avoid all technology?

C. Does the firm guarantee every investment?

D. Does the firm operate only through branches?

Correct Answer: A. Does the firm have a credible wind-down and customer-access plan?