


































Economics, Law and Policy 
ISSN 2576-2060 (Print) ISSN 2576-2052 (Online) 

Vol. 5, No. 2, 2022 

www.scholink.org/ojs/index.php/elp 

28 
 

Original Paper 

Crisis Preparedness in the Digital World  

Demet Canakci
1
* & Geof Mortlock

2
 

1
 Program Director, Toronto Centre, Toronto, Canada 

2
 Program Leader, Toronto Centre, Wellington, New Zealand 

*
 Demet Canakci, E-mail: dcanakci@torontocentre.org 

 

Received: November 12, 2022   Accepted: November 22, 2022   Online Published: December 5, 2022 

doi:10.22158/elp.v5n2p28                   URL: http://dx.doi.org/10.22158/elp.v5n2p28 

 

Abstract 

This paper discusses the importance of crisis preparedness and the role of financial supervision in 

mitigating the risks posed by technological innovations in the financial ecosystem. The paper will focus 

on the important role that financial supervisors and regulators can play in promoting effective risk 

management, supervision and crisis preparedness in relation to fintech developments, and the need for 

coordination and collaboration with policymakers, government, and the financial sector to address 

potential threats to financial stability. It elaborates on the challenges associated with fintech 

developments in banking and the potential implications for financial supervision and considers the 

nature of crisis preparedness in the context of banking in the digital era. The paper also provides 

thoughts on the tools available to supervisory authorities and central banks in dealing with financial 

crises while enabling new technologies to enhance financial services provisions. 

Keywords 

financial crises, fintech, cyber risk, financial supervision, regulation 

 

1. Introduction  

Recent years have seen an increase in the development and uptake of financial technology (fintech 

(Note 1)) by financial institutions globally. This has been especially the case by banks and other 

financial intermediaries but also applies to many other types of financial institutions, including insurers 

(general, long-term and health insurers), wealth management providers, securities firms, and 

investment advisory firms.  

The Covid-19 crisis has also promoted the digitization of the financial services industry. It has 

accelerated the shift towards technology-enabled, contactless, and customer-centric production and 

consumption of goods and services and working practices. The business model of financial institutions 

will become more digital-based as they accelerate the adoption of technology. There will be a further 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

29 
Published by SCHOLINK INC. 

shift away from the use of cash to digital retail payment systems (Note 2).  

The uptake of new IT by financial institutions has the potential to bring many benefits, including to 

strengthen the contestability and competitiveness of financial services, to lower the costs of some 

financial services, to enhance aspects of risk management, and to better meet the needs of consumers 

and the real economy. However, it also comes with risks, including the development of “non-bank 

financial intermediation” in relatively under-regulated sectors and associated disintermediation, the 

increase in some financial sector risks (especially operational risks), and the potential to increase the 

risk of financial institution stress and financial instability. In particular, there is a danger that digital 

platforms, if not well structured and managed, could exacerbate operational risks in banks and 

non-bank financial institutions, including the risks of cyber-attacks, fraud and money laundering. These 

risks pose a potential threat to the soundness of individual financial institutions and can exacerbate 

intra-group contagion in financial conglomerates. Fintech-related risks, together with the emergence of 

financial services in relatively under-regulated sectors of financial systems, pose a somewhat 

heightened threat to financial stability. They reinforce the importance of financial sector regulation 

keeping pace with fintech developments and for supervisory and resolution authorities to be equipped 

to deal with financial stress in a rapidly evolving fintech environment. 

Drawing from Toronto Centre‟s extensive worldwide supervisory capacity building, and other relevant 

sources, this paper looks at the risks associated with fintech, with a particular focus on banking and 

bank-like functions, the implications for financial stability and supervision, and the nature of the crisis 

preparedness needed by the regulatory and supervisory authorities to ensure that risk events are 

managed in ways that minimise impacts on financial stability.  

 

2. Fintech Developments 

2.1 Fintech in Banking 

Financial technology is increasingly making its presence felt in the banking sector. Fintech is being 

adopted by existing mainstream banks to reduce operating expenses, make more efficient use of data in 

the assessment of risks, and expand market penetration. 

Key areas where fintech is being adopted by mainstream banks include: 

1) The increasing use of online and mobile banking to progressively reduce the need for physical 

customer interface via branch networks, and thereby reduce operating expenses, and facilitating 

enhanced efficiency for customer interface 

2) The use of IT functionality to process large volumes of data to better identify and respond to 

risks, and to enhance the capacity to target particular market segments with products tailored to 

consumer needs 

3) The use of IT functionality to process applications for credit and reduce the operational 

expenditure associated with such processes 

4) Robo-advisory services to assist in customer queries and advice 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

30 
Published by SCHOLINK INC. 

Fintech is also being utilized by newly established digital banks and by non-bank financial entities. 

The adoption of digital banking platforms takes many forms, and include the following key examples 

(Note 3): 

Digital Payments and E-Money 

Fintech innovations are being increasingly applied to wholesale payments, but most of the major 

developments have been in retail payments. This is particularly the case in developing countries, where 

cash accounts for the bulk of retail payments and where payment (debit and credit) cards are not widely 

used. In such cases, fintech firms offer options for peer-to-peer transfers, bill payments, and electronic 

purchases. In many cases, these services are attached to an e-money product—i.e., a digital wallet 

where customers can hold monetary value for an undetermined period of time. A pioneer was Kenya‟s 

M-PESA, offered by Safaricom, a mobile network operator, but there are numerous other examples. 

These products can also be tied to savings accounts or insurance products.  

International Remittances 

A substantial degree of fintech innovation has been focused on large international remittances corridors. 

Fintech has been used to simplify procedures and cut the costs of transfers, including to serve the 

undocumented diaspora in a variety of countries. The services may be based on e-money products, 

traditional bank accounts, cryptocurrencies, or combinations of these. 

Personal and Business Loans 

Fintech credit is a burgeoning market and can take many forms and target various customer segments, 

including low-income borrowers and micro, small and medium enterprises. Most often, fintech credit 

utilizes relatively novel credit-scoring methods based on a wide range of data, including data that are 

collected outside of the financial sector (e.g., Big Data, bill payments history, mobile phone usage). 

Many products are based on automated credit decisions, whereby a customer applies for credit and, if 

successful, has her loan disbursed in only a few minutes via her mobile phone. 

Peer-to-Peer (P2P) Lending Platforms 

Within fintech credit, an important development is P2P platforms, which are mostly internet-based 

services provided by a fintech firm where lenders and borrowers interact in a virtual intermediation 

framework. Platforms vary widely in format and operating rules. Typical characteristics of P2P lending 

are: (i) no necessary common bond or prior relationship between lenders and borrowers; (ii) 

intermediation by a P2P lending company; (iii) transactions take place online; (iv) lenders may often 

choose which borrowers to lend to or invest in, if the P2P platform offers that facility; (v) the loans can 

be unsecured or secured; (vi) loans are securities that can be transferred to others, either for debt 

collection or profit. 

Crowdfunding Platforms 

Crowdfunding platforms are mostly Internet-based services provided by fintech firms to facilitate 

funding/investment opportunities, including equity investment and donations. Like P2P lending 

platforms, these vary widely in shape and operating rules. 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

31 
Published by SCHOLINK INC. 

Robo-Advisors 

Robo-advisors (also called “automated” or “digital investment” advisors) are online platforms that 

provide services such as financial advice and, most often, portfolio management with minimum or no 

human intervention. 

The digital revolution has changed the demand for financial services and led the sector to become more 

customer centric. On the supply side, it has left some incumbents with ageing and increasingly 

inefficient technologies, such as an overreliance on rigid mainframes, and an overextended branch 

network. On the demand side, younger population cohorts increasingly want to bank with their mobile 

phones and online apps, rather than through the more conventional mainstream banking channels. The 

banking sector has overcapacity and, in some cases, the wrong kind of capacity. The industry is facing 

significant restructuring and IT investment costs, which is placing a strain on some banks‟ profitability, 

particularly given the low net interest margins on which many banks are currently operating (in 

particular in the Eurozone and Japan). 

2.2 Bigtechs 

Large technology companies (Bigtechs) are increasingly getting attention from policymakers due to the 

expansion of Bigtech firms (e.g., Google (Alphabet), Apple, Facebook, Amazon, and Microsoft) in 

financial services. This has generally been more rapid and broad-based in Emerging Market and 

Developing Economies (EMDEs) than that in advanced economies. The expansion of Bigtech firms in 

EMDEs has brought benefits, but can also give rise to risks and vulnerabilities, including risks relating 

to data privacy and cyber-attacks. Risks concerning consumer protection may also be larger in the case 

of EMDEs, particularly where customers have a lower financial literacy and to the extent that Bigtech 

firms make greater use of personal data (including that acquired from their non-financial business) 

without appropriate statutory protections of privacy being in place. Where Bigtech firms are the 

principal or even sole providers of financial services to some EMDE populations, there is a risk of 

excessive market concentration and attendant issues related to excessive market power and inadequate 

consumer protection. They may also be subject to heightened operational risks, particularly in 

environments with weaker communications and financial infrastructure. Competition from Bigtech 

firms may, in places, also reduce the profitability and resilience of incumbent financial institutions and 

lead to greater risk-taking. 

Bigtechs also handle payment services as part of e-commerce, with some offering them as independent 

business units. Their business models leverage on their data analytics, network externalities, and 

interwoven activities, coupled with distinct platforms that process and settle payments, including: (i) 

overlay systems (using third-party infrastructures such as credit card or retail payment systems); and/or 

(ii) proprietary systems (using firm-owned infrastructures) (Note 4). Some common business 

applications include digital wallets, online banking, and domestic and cross-border funds transfers.  

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

32 
Published by SCHOLINK INC. 

The experience of some jurisdictions demonstrates the positive role that well-targeted and designed 

regulation, supervision and other official-sector policy can play in supporting innovation in financial 

services while also mitigating risks. Governments in some jurisdictions have also played a key role in 

promoting the development of financial infrastructures. In doing so, they have facilitated the growth of 

financial technology, including that employed by Bigtech firms (Note 5). However, there are also 

examples where regulation has not kept pace with fintech developments, leaving consumers and the 

wider financial system exposed to significant risks, as discussed later in this paper. 

2.3 Non-Bank Payment System Providers 

Fintech is also enabling the evolution of “new” forms of banking, such as the development of purely 

digital/online banks which have no physical presence (e.g., UBank, RaboDirect and ME Bank in 

Australia; and Wise, Revolut and Starling in the UK, etc.) and non-bank payment system providers. 

Non-bank Payment System Providers (PSPs) include Prepaid Payment Instrument (PPI) issuers, such 

as mobile wallets, card networks and “white label” ATM operators. These developments are an 

important aspect of fintech and have grown rapidly in many countries via a range of operators, such as 

Adyen, Braintree, PayPal and Stripe. For example, the Reserve Bank of India has recently announced 

that it has allowed non-banks to participate in its Centralised Payment Systems (CPS) through Real 

Time Gross Settlement (RTGS) and National Electronic Fund Transfer (NEFT) systems, in a phased 

manner. 

PSPs are facilitating financial inclusion in EMDEs by providing electronic payments services to large 

numbers of people who are not currently serviced by banks—i.e., those without a bank account, as, for 

example, in much of Africa. Hence PSPs can help to promote greater financial inclusion goals by 

enabling unbanked individuals to use non-bank services as an alternative to payment instruments 

offered by banks (mainly due to the reason that they do not have a banking account or cannot open 

one). 

Non-bank payment service provider can improve the efficiency of the retail payments system by 

increasing competition, providing new or improved payment options, and reaching sectors of the 

population that did not previously have access to payment services. In other situations, non-banks can 

contribute expertise that the incumbents lack and cooperate with banks to provide innovative services, 

such as mobile payments. At the same time, the growing involvement of non-banks could also impact 

risks in the system. The implications will vary by the type of non-bank and the services that they 

provide. For example, non-banks may specialize in certain services, thus generating large economies of 

scale or network effects. The nature of these effects could mean that the provision of such services may 

converge towards a small number of large providers, or in the extreme, a monopoly over the provision 

of a certain payment service. If a service is localized in a particular non-bank, the operational risk may 

also be concentrated. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

33 
Published by SCHOLINK INC. 

An important feature of non-bank involvement in payments services is outsourcing, where payment 

service firms place considerable reliance on a wide range of outsourced IT and other functionality 

providers. Outsourcing offers a range of benefits, including enhanced efficiency, strengthened capacity 

for innovation and reduced operating costs. If managed well, outsourcing may also offer the potential to 

reduce operational risks. However, outsourcing also carries a number of risks do not present or not as 

prevalent with an insourced approach to functionality provision. These include risks of more 

complicated coordination between the financial service provider and the various outsourced providers 

of functionality, discontinuity of supply and inadequate contingency arrangements.  This requires 

supervisory authorities to be particularly attentive to outsourcing risks, including the need for robust 

contractual documentation, testing requirements, backup arrangements and financial institutions 

maintaining contingency plans to deal with situations where outsource providers fail. 

2.4 Digital Currencies 

Another area of innovation by technological advancements has been the development of potential new 

mediums of exchange and store of value, and other means of payment such as central bank digital 

currency, cryptocurrencies including bitcoin or other digital coins, or claims such as payment services 

issued by banks or other intermediaries (Alipay, WeChat Pay, M-Pesa, or blockchain-based monies 

such as Paxos or USD Coin) (Note 6). These developments characterise a “dual” monetary system 

involving privately issued money (by banks, telecom companies, or specialised payment providers) 

built upon a foundation of publicly issued money (by central banks).  

Claim-based monies can, in turn, be categorised according to whether their redemption is at a fixed 

value (e.g., bank money or e-money) or at a variable value in the case of Libra, for example, which 

may have exchange rate risk when converted into domestic currency. Another important distinction is 

whether the settlement is centralised (e.g., cash, bank money, e-money) or decentralised (e.g., 

crypto-assets).  

Stablecoins are a specific category of cryptoassets that have the potential to enhance the efficiency of 

the provision of financial services but may also generate risks to financial stability, particularly if they 

are adopted at a significant scale. Stablecoins are an attempt to address the high volatility of 

“traditional” crypt-assets by tying the stablecoin‟s value to one or more other assets, such as sovereign 

currencies. They have the potential to bring efficiencies to payments systems and to promote financial 

inclusion. However, a widely adopted stablecoin with a potential reach and use across multiple 

jurisdictions (global stablecoin or GSC) could become systemically important in and across one or 

many jurisdictions, including as a means of making payments. The emergence of GSCs may challenge 

the comprehensiveness and effectiveness of existing regulatory and supervisory oversight. The FSB has 

agreed on ten high-level recommendations that promote coordinated and effective regulation, 

supervision and oversight of GSC arrangements to address the financial stability risks posed by GSCs, 

both at the domestic and international level (Note 7).  

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

34 
Published by SCHOLINK INC. 

Another development in this area is central bank digital currencies which are becoming an important 

agenda item for many central banks: The Eastern Caribbean has created its own form of digital currency 

(DCash), which is designed to facilitate faster transactions and serve people without bank accounts. 

DCash was created by Barbados-based fintech company Bitt in partnership with the central bank. Unlike 

cryptocurrencies, it is issued by an official central bank and has a fixed value, tied to the existing Eastern 

Caribbean dollar used across much of the region.  

Other countries are developing central bank digital currencies. For example, China launched the e-yuan 

in 2020; the ECB aims to launch its own digital currency in 2025, while the Bank of England and the Fed 

are actively exploring the issue. A January 2021 survey (Note 8) by the Bank for International 

Settlements reported that most central banks are considering digital currencies. The survey found that 

central banks representing a combined 20 per cent of the world‟s population are likely to launch their own 

digital currencies within three years.  

Aside from central bank digital currencies, private-based digital currencies, while offering potential 

benefits in payments capability, also present significant risks. A key concern is the extreme volatility in 

the value of these digital currencies, with market prices moving by very large amounts intra-day and 

over a short trading horizon. They also represent a potential avenue for money laundering and other 

financial crimes unless subject to robust AML/CFT requirements. Moreover, private digital currencies 

also fail to have the liquidity needed to serve as efficient media of exchange, at least for the time being.  

2.5 Regtech and Suptech 

Regtech and Suptech are part of the fintech evolution. These tools could have important benefits for 

financial stability. 

Regtech focuses on technology-based solutions to attenuate or solve regulatory and supervisory 

challenges, including the challenges posed by the expansion of fintech. It leverages digital data and 

analytical networks to supplement conventional processes to strengthen the capacity to manage risks 

and improve the decision-making process. For regulated institutions, the use of Regtech could improve 

compliance outcomes, enhance risk management capabilities, and generate new insights into the 

business for improved decision-making. For both authorities and regulated institutions, the efficiency 

and effectiveness gains, and possible improvement in quality arising from automation of previously 

manual processes offers potentially significant benefits. 

Most of Regtech centres around solutions for regulated financial institutions, helping them to comply 

more efficiently and with greater certainty with regulations and improve risk management, while 

cutting costs (e.g., compliance costs).  

Regtech developments are mainly in the following areas:  

(i) regulatory compliance—e.g., systems to enable banks and other regulated entities to 

identify breaches of regulatory requirements and to facilitate quick remediation, and to 

maintain compliance with regulations;  



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

35 
Published by SCHOLINK INC. 

(ii) identity management and control—e.g., anti-money laundering controls and fraud 

detection; 

(iii) risk management-advanced data analytics supported by machine learning  or other AI 

applications and regulatory reporting, transaction monitoring such as by using DLT, 

end-to-end integrity validation, anti-fraud and market abuse identification systems, 

back-office automation and risk alerts; 

(iv) trading in financial markets-the automation of the procedures related to transacting in 

financial markets, such as calculating margins, choosing central counterparties and 

trading venues, assessing exposures, complying with good conduct-of-business principles, 

etc. 

In some cases (regulatory reporting, KYC), Regtech solutions are developed and implemented jointly 

or use a third-party solution to achieve efficiency gains, while others are developed and implemented 

separately by individual financial institutions in bilateral partnerships with fintech firms. 

Supervisory technology (Suptech) is being adopted by regulatory authorities to use fintech to assess 

trends more efficiently in market data to identify potential risk areas, to facilitate peer group analysis of 

banks and other institutions, and to assess early warning indicators of emergent stress. Suptech is 

mainly conducted in two types of application: (i) Data collection; and (ii) Data analytics: 

(i) Data collection applications are used for supervisory reporting, data management and virtual 

assistance. Examples include the ability to pull data directly from IT systems of banks and 

other financial institutions; automated data validation and consolidation; chatbots to answer 

consumer complaints while collecting information that could signal potential areas of concern. 

(ii) Data analytics applications are used for market surveillance, misconduct analysis as well as 

microprudential and macroprudential supervision. Examples include detecting insider trading 

activities, money laundering identification, monitoring supervised entities‟ liquidity risks and 

forecasting housing market conditions.  

Suptech is a strategic priority for an increasing number of regulatory authorities. It is still at a relatively 

early stage of development but could evolve into the greater use of „real time‟ access to and 

interrogation of data on financial institutions, and greater analysis of the “big data” contained in 

regulatory reporting by financial institutions and more widely in other information sets and social 

media. For authorities, the use of Suptech could improve oversight, surveillance and analytical 

capabilities, and generate real-time indicators of risk to support forward-looking, judgement based 

supervision and policymaking. However, such developments depend on supervisory authorities having 

the necessary resources and skills to take them forward. 

 

 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

36 
Published by SCHOLINK INC. 

3. Risks Associated with Fintech: Implications for Financial Stability 

Fintech brings wide-ranging benefits, particularly for low-income countries, due to its potentially 

far-reaching economic and social impact. Those benefits include increasing access to financial services 

and financial inclusion; deepening financial markets; strengthening competitiveness in the financial 

markets; lowering the costs of some financial services; and improving cross-border payments and 

remittance transfer systems. 

However, fintech also creates a number of significant risks in the financial system, and not least in the 

banking sector. In this paper, the focus is mainly on the risks and the regulatory and supervisory issues 

that arise from these risks. Supervisors should monitor the evolution of those risks closely and take 

necessary actions to mitigate them. Although most of the risks are not new, the nature of fintech 

increases the probability and potential impact of some key risks. Those risks include: 

o Operational risks-such as cyber risks, IT malfunction fraud, money laundering/financing of 

crime, misselling of financial products and services, privacy breaches, and breaches of 

regulatory compliance 

o Credit risk inadequately managed arising from P2P platforms 

o Reputation risk for banks/insurers as a result of the above risks, with potential for 

intra-group contagion 

o Payment system disruption—e.g., arising from operational dysfunction in non-bank 

payment providers 

o Business model risk-as new technology, new entrants and greater competition threaten the 

viability of existing business models. 

Unless these risks are subject to robust governance and risk management frameworks overseen by 

appropriate prudential and market conduct supervision, they have the potential to cause instability in 

individual financial institutions, payments networks and potentially the financial system as a whole. 

Moreover, the entry of new firms into the financial system, such as bigtechs and non-bank payment 

providers, have the potential to reduce the market share and profitability of the incumbents, with the 

potential that the established financial firms could come under financial stress, especially in a low net 

interest income environment.  

Some of these risks pose a potential threat to the stability of financial systems via several channels 

(Note 9): 

o Contagion: examples of contagion arising via fintech include: (i) significant and unexpected 

losses incurred on a single fintech lending platform could be interpreted as indicating 

potential losses across the sector, with flow-on effects to investor and creditor confidence in 

that sector. (ii) the technical failure of a fintech function in a financial conglomerate could 

trigger intra-group contagion through the transmission of losses, confidence effects and 

cross-defaults, and (iii) misconduct or misselling in new fintech sectors could erode market 

confidence in the wider financial system. 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

37 
Published by SCHOLINK INC. 

o Procyclicality: procyclicality can arise when market participants act in a way that 

exacerbates the degree and impact of fluctuations in economic growth and market prices over 

the short and/or longer-term, such as excess provision of credit in economic upswings and 

excessive deleveraging in a downturn. Examples of procyclicality that could potentially be 

generated by fintech include: (i) interaction between investors and borrowers on fintech 

lending platforms could potentially exhibit larger swings in sentiment than traditional 

intermediation of funds, as a sudden unexpected rise in non-performing loans could trigger a 

drying up of new funds; (ii) small investors involved in crowdfunding might be more prone 

to contributing to asset price bubbles (and subsequent bursting of bubbles) due to lower 

understanding of the risks involved in lending/investing.  

o Excessive volatility: Excess volatility in financial markets is a key source of instability and 

can manifest through over-reaction to financial events, potentially creating solvency or 

liquidity problems that can spiral through the financial system, impairing the functioning of 

asset and credit markets. Fintech can contribute to this in various ways, including (i) 

algorithmic traders may tend to be more active during periods of low volatility but rapidly 

withdraw from the market during periods of market stress when liquidity demands are high, 

and thereby increase asset price volatility; (ii) crowdfunding investors and person-to-person 

lenders might be susceptible to exuberant investment in periods of buoyancy, but rapidly 

withdraw in periods of emerging stress, with adverse impacts on asset prices and flow-on 

effects to solvency. 

o Systemic importance—e.g., large market dominance: The systemic importance of 

financial institutions is a key factor in posing a threat to financial instability. Although fintech 

does not currently pose a major risk in this regard, it does increase the risk of intra-group 

contagion as a result of reputation risk. Moreover, the non-bank financial intermediation 

sector poses a potential risk to instability to the extent that it experiences severe risk events, 

and these are not detected or responded to quickly and effectively by supervisors. 

o Financial risks being inadequately managed: the inadequate management of risks 

associated with fintech pose a threat to financial stability—especially in non-bank financial 

intermediation and other under-regulated parts of the financial system. 

It is worth highlighting two key risks to financial stability arising from fintech: the emergence of 

non-bank financial intermediation; and the growing threat of cyber risk.  

Non-bank financial intermediation 

Non-bank financial intermediation refers to the emergence of bank-like functions, such as payment 

services and intermediation functions, provided by non-bank entities. Examples of these services are 

mobile banking, e-wallets and P2P intermediation functions. These are increasingly providing an 

alternative to mainstream banking. Although this is a positive development in terms of strengthening 

competition for financial services, lowering costs, and increasing financial inclusion, it also poses a risk 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

38 
Published by SCHOLINK INC. 

to financial stability. This is particularly the case if non-bank fintech providers of financial services 

become systemically important and where a failure could cause significant disruption to the financial 

system and economy.  

Payment networks using digital wallets provide a direct connection between consumers and merchant 

processors, operating via software-based systems that store users‟ payment information. Solutions 

within a consumer digital wallet can include merchant payments, P2P payments, international money 

transfers, bank accounts, lending, and cryptocurrency trading. Digital wallets allow a party to make 

electronic transactions and bypass traditional banks. According to market data provider Statista, digital 

wallets accounted for 44.5% of all global e-commerce transactions in 2020 (Note 10). In the case of 

P2P services, growth in these financial services has been relatively strong in some jurisdictions but has 

not yet reached the point where it poses a significant risk to the financial system. 

The challenge in non-bank financial intermediation is when these non-bank providers of financial 

services grow to a size that could pose a threat to financial stability in the event of a failure event. This 

has the potential to cause disruption to the financial system through dislocation to the payment and 

settlement systems and through impacts on credit markets and the real economy. In the P2P area, there 

is also a risk of adverse confidence effects on depositors with funds at risk in the event of an upswing 

in credit losses and a risk of a rapid withdrawal of credit and associated asset price volatility. 

All of these considerations suggest the need for the regulatory authorities to monitor developments in 

non-bank financial intermediation by obtaining data from market participants to better understand the 

nature and scale of their activities, the risks involved, and the adequacy of participants‟ risk mitigation 

capacity. This will assist the authorities to monitor the types of business being undertaken and the 

growth in volume and in market share in particular niches of the market. It will also provide a basis for 

regulators to assess the nature of the risks involved to affected users of financial services and to the 

providers of the services and the potential impact on the financial system. Ultimately, as discussed later 

in this paper, regulatory authorities should be moving to a form of regulation that regulates financial 

services in a competitively neutral and even-handed manner, regardless of the legal form or licensing 

status of the provider of financial services—i.e., a “form over substance” approach. The objective 

should be to regulate financial services on a risk-based basis, anchored to well-defined regulatory 

objectives based on maintaining financial system stability while also seeking to enable financial system 

innovation and fostering competition. 

Cyber Risk 

Another key risk that is of increasing relevance to financial stability is cyber risk. This is already a very 

significant risk and is likely to grow considerably as online banking, and other forms of digital 

financial services become more prevalent. Cyber risks of various forms arise in online banking and 

payment services across the mainstream banks and in the new digital non-bank financial service 

providers, as well as for networks of small banks using common platforms. Major cyber risk events in 

banks and other financial institutions have the potential for system-wide disruption, data theft, privacy 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

39 
Published by SCHOLINK INC. 

breaches, financial crimes and financial losses for financial firms. All of these risk channels have the 

potential to threaten financial stability, either through disruption to payment and settlement processes or 

through adverse impacts on market confidence. 

In the securities trading area, greater reliance on automated transactions could potentially increase 

market volatility due to higher asset price correlations. The wider adoption of certain algorithms and 

technological solutions may increase vulnerabilities to cyberattacks. It may also increase concentration 

risk on key nodes within the global system as market structures adjust and network interconnections 

strengthen.  

The increase in cyber risk has been a clear trend over the past decade, and regulators and supervisors, 

as well as the industry, face major challenges in effectively managing these risks. Numbers can be 

misleading, and even though many financial firms see an increase in attempts, it is the more advanced 

attacks that matter most. Good data on cyber incidents are scarce, and this is partly due to a lack of 

incentives for firms to report incidents. One lesson from two recent cyberattacks—on SolarWind‟s 

Orion software and on Microsoft Exchange Servers—is the need for a more integrated approach to risk 

management to combat the threats of cyberattacks. This includes the need for strengthened IT 

protection software and associated processes; regular IT security audits; strengthened focus by financial 

institutions‟ CROs, senior management teams and boards; regular stress testing of cyber protection 

arrangements; and developing and testing the capacity to respond to and recover from an attack.  

The challenges in identifying and managing risks are considerable across areas such as cybersecurity, 

fraud, anti-money laundering, consumer protection, and cryptoassets. Addressing these risks require 

coordination among many authorities, nationally and internationally, not only to share information but 

also to identify events that may not cause losses to financial institutions but do harm consumers and 

investors. 

 

4. Effective Regulation and Supervision of Fintech   

Given the fast-evolving nature of fintech, it is essential that there is an effective regulatory response to 

fintech developments, particularly as it relates to areas that pose a potential threat to financial stability, 

such as banking, non-bank financial intermediation and payment systems. In most respects, existing 

regulatory and supervisory frameworks can be applied to fintech financial services and products, given 

that fintech risks are generally an extension or variant of existing financial risks rather than being 

completely new. However, some modifications to regulatory and supervisory frameworks are likely to 

be needed in the case of currently unregulated or under-regulated parts of the financial system and in 

respect of those risk factors which represent a significant shift from mainstream banking risks. In this 

section of the paper, we briefly identify the key areas in which enhanced monitoring and regulation 

might be needed and the types of regulatory responses that could be appropriate. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

40 
Published by SCHOLINK INC. 

The need for greater monitoring of fintech and an assessment of appropriate regulatory measures to 

ensure that fintech-related risks are managed in ways that maintain financial stability has been 

recognised by a number of international bodies. These include the Financial Stability Board (FSB) 

(Note 11), Basel Committee on Banking Supervision (BCBS), International Monetary Fund and World 

Bank. All of these bodies have undertaken considerable work on fintech-related matters and have 

published a range of papers on the issues. 

Bali Fintech Agenda 

In this context, in October 2018, the IMF and World Bank held a conference to promote a wider 

understanding of fintech and the implications for regulation. This was held in recognition that countries 

want to harness the benefits that fintech can offer to financial systems, economies, consumers, 

depositors and investors, but also want to ensure that the risks associated with fintech are well 

understood and managed. The “Bali Fintech Agenda” (Note 12) resulted from the IMF-World Bank 

conference and outlined high-level issues for consideration by members of the IMF and World Bank as 

they seek to develop their policy responses to fintech. The agenda is focused on the implications of 

fintech for the financial sector and provides a high-level set of principles to guide regulatory oversight 

of fintech. 

The Bali Fintech Agenda brings together key considerations for policymakers and the international 

community into twelve (12) elements arising from the experience of member countries. It is useful to 

briefly recap these elements: 

 Element 1: Embrace the promise of fintech. 

 Element 2: Enable new technologies to enhance financial service provision. 

 Element 3: Reinforce competition and commitment to open, free, and contestable markets. 

 Element 4: Foster fintech to promote financial inclusion and develop financial markets. 

 Element 5: Monitor developments closely to deepen understanding of evolving financial systems. 

 Element 6: Adapt regulatory framework and supervisory practices for orderly development and 

stability of the financial system. 

 Element 7: Safeguard the integrity of financial systems. 

 Element 8: Modernise legal frameworks to provide an enabling legal landscape. 

 Element 9: Ensure the stability of domestic monetary and financial systems. 

 Element 10: Develop robust financial and data infrastructure to sustain Fintech benefits. 

 Element 11: Encourage international cooperation and information-sharing. 

 Element 12: Enhance collective surveillance of the international monetary and financial system. 

These elements provide a broad context for assessing the appropriate regulatory and supervisory 

responses to fintech developments. 

 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

41 
Published by SCHOLINK INC. 

Regulatory Objectives 

It is clearly important that the authorities understand the risks associated with fintech and design 

regulatory responses to seek to ensure that the risks are appropriately managed. It is not about 

achieving “zero risk” outcomes. Innovations and economic activity of all kinds necessarily entail risks. 

Rather, it is about seeking to ensure that risks are identified, monitored and managed so as to maintain a 

stable but efficient financial system and to protect those least able to protect themselves—small 

depositors, policyholders and some categories of investors. National authorities have a delicate 

balancing act here. On the one hand, they need to ensure that fintech risks are appropriately managed. 

But on the other hand, they need to maintain their country‟s competitiveness in the global financial 

system and harness the consumer, investor and systemic benefits that fintech can provide. It involves 

seeking an appropriate balance between the promotion of a stable and resilient financial system, and the 

promotion of a contestable, competitive, innovative and efficient financial system. 

There is a need for well-defined regulatory objectives in designing a regulatory approach to fintech. 

In most respects, the main regulatory objectives for fintech are the same, in substance, as those that 

currently apply to conventional financial activities. In that regard, the main financial sector regulatory 

objectives are: 

 To promote and maintain a stable, resilient financial system (i.e., a financial system that is capable 

of performing all critical functions in the face of severe shocks). 

 To promote and maintain an efficient financial system (i.e., a financial system that is dynamically 

efficient, allocatively efficient and productively efficient). 

 To facilitate competitiveness and contestability in the financial sector. 

 To protect retail depositors and insurance policyholders within the scope of established protection 

schemes. 

 To promote and maintain the integrity of financial markets. 

 To seek to prevent financial crimes. 

These financial sector regulatory objectives are just as relevant to fintech activities as they are to 

conventional financial activities. Fintech presents similar risks and externalities as do conventional 

financial activities—i.e., risks relating to information asymmetries, disruption to systemically important 

functions, contagion risks, risk of excessive market volatility, market conduct risks, and risks of 

financial crimes. Regulation of fintech should therefore seek to ensure that these risks and externalities 

are properly identified, monitored and managed. However, there is a need to make sure that the risks 

presented by fintech are well understood before developing new regulatory responses and to ensure that 

regulation appropriately addresses those risks in a proportionate manner. These new risks (or existing 

risks made more complex and more damaging in impact) will require particular regulatory 

attention—either using existing regulatory tools or, in some cases, new ones. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

42 
Published by SCHOLINK INC. 

The main regulatory tools relevant to fintech are largely those that are already applied to providers of 

conventional financial services and products. The tools might need to be modified in some respect to 

suit the particular characteristics of fintech providers and products/services, and to ensure a 

proportionate regulatory response to the risks involved, but by and large, existing regulatory 

frameworks are likely to be applicable to most types of fintech providers. In this regard, the key 

elements are likely to include the following. 

Licensing of Financial Service Providers 

A key element of financial sector regulation is a framework to ensure that providers of defined 

categories of financial products and services are subject to a licensing process so that they meet 

minimum standards relevant to the risks involved. Licensing requirements will vary greatly depending 

on the type of entity and the financial products and services it provides. A consistent approach based on 

types of products and services, rather than legal form, is generally desirable, with a view to achieving a 

competitively neutral regulatory framework that treats similar products and services in much the same 

way. A licensing framework typically includes a focus on:  

 minimum standards of fit and proper for key officers of the entity; 

 the need for the entity in question to have a robust framework for the identification, measurement, 

monitoring and management of risks, including a well-articulated risk appetite statement, risk 

management systems and controls, and risk culture; 

 robust governance arrangements, including a board (with suitably qualified directors, including 

non-executive and independent directors) to oversee the strategic direction of the entity and its 

senior management team, and board committees dedicated to overseeing risk management, audit 

and remuneration; 

 policies for ensuring that conflicts of interest are appropriately managed; 

 minimum capital and liquidity requirements, depending on the nature of the risks involved and the 

parties affected by those risks; and  

 the capacity to comply with regulatory requirements. 

In the case of financial institutions that are already licensed but whose business and risk profile are 

changing significantly due to fintech adoption, there is a need for the regulators to ensure that new 

financial services and products, and the associated risks, are appropriately integrated into the entity‟s 

business strategy and risk management framework. For new entities that fall outside the existing 

regulatory net, such as non-bank financial intermediaries, there is a need for the authorities to design a 

licensing framework that requires entities to meet defined licensing requirements relevant to the types 

of financial service they propose to perform on the basis of achieving a „level playing field‟ in the 

financial sector and ensuring that similar products and services are regulated on a consistent basis, 

regardless of the legal form of the entity which provides them. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

43 
Published by SCHOLINK INC. 

Regulatory Requirements 

The nature of the regulatory requirements will vary greatly depending on the particular characteristics 

of the fintech provider and the services and products in question. As a general principle, regulations are 

designed to ensure that financial services are provided in a secure and reliable manner and in 

accordance with the prudent management of the risks involved to meet the defined objectives of the 

regulatory regime. Depending on the type of financial service/product, regulations might cover such 

matters as: 

 market conduct requirements (including product disclosure, provider disclosure, and requirements 

in relation to advising and selling procedures); 

 capital requirements, based on the risks borne by the financial institution and its risk mitigation 

capacity; 

 liquidity requirements, based on the funding and liquidity risk profile of the financial institution; 

 governance requirements, such as minimum number of directors on the board, composition of the 

board, board committees for risk management, audit and remuneration, and responsibilities of the 

board; 

 requirements in relation to risk appetite and the risk management framework applicable to all 

material risks;  

 limits on credit and funding exposure concentration; 

 requirements for contingency plans in relation to business continuity, capital and liquidity—and, 

increasingly, a requirement for a comprehensive recovery plan to address severe financial and 

operational stress events; 

 and fit and proper requirements applicable to key officers. 

In the case of existing financial institutions that have adopted or plan to adopt fintech, regulatory 

authorities will need to ensure that the regulations in place adequately address fintech-related risks. 

This will be especially important for operational risks, such as cyber risks, IT security, financial 

integrity and business continuity. It will also be important to ensure that risks associated with market 

conduct are appropriately regulated through targeted disclosure requirements and measures to combat 

mi-selling. Regulations relating to information privacy will also be particularly important in the case of 

fintech services, as will regulations for financial integrity. Regulators will also need to ensure that 

regulatory arrangements for fintech providers include robust contingency planning, stress testing and 

crisis simulation requirements tailored to the types of financial technology and associated risks they 

have. 

For new financial institutions not yet covered by regulatory nets, the authorities will need to consider 

the extension of regulatory requirements to such entities on the basis of seeking to ensure that these 

entities are brought into the regulatory framework in a competitively neutral manner, such that entities 

and their services are regulated on the basis of „substance over form‟. 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

44 
Published by SCHOLINK INC. 

Supervision 

The supervision of fintech will typically draw on existing supervisory frameworks. For a 

well-developed regulatory authority, supervision of financial institutions will generally be on a 

risk-based basis, where the supervisory authority has a framework for assessing the risk profile of each 

entity using a scoring system that evaluates the risks its business involves and the effectiveness of its 

risk mitigation and loss-absorption buffers, and where it also assesses the systemic importance of the 

entity. The combination of its risk rating and systemic importance rating will determine the level of 

supervision to which the entity will be subject, as well as informing the calibration of some of the 

prudential requirements to which the entity is subject—e.g., capital and liquidity. 

Within the risk-based supervisory framework, a supervisory authority would generally conduct 

supervision using a combination of off-site monitoring based on regular data provided by the regulated 

entity in accordance with regulatory requirements and on-site assessments conducted by the 

supervision authority. 

As with conventional financial services, a regulatory framework for fintech providers will likely 

involve the need for the supervisory authority to establish and maintain robust frameworks to monitor 

key risk areas, including early warning indicators of emerging risks and compliance with regulatory 

requirements. Particular focus will be needed on those risks that are associated with fintech 

developments, such as cyber risks, financial integrity risks, market conduct risks, data integrity risks, 

and contagion risks. 

Supervisory arrangements for fintech providers could be expected to involve some form of on-site 

assessment by financial supervisors, designed to enable the supervisors to identify and evaluate the key 

risks of the entity in question and the effective management of those risks. A risk-based supervision 

framework is generally the appropriate model, whereby the calibration of on-site assessments is based 

on the assessed risk profile and risk mitigation capacity of the entity and its systemic importance. Those 

entities assessed as being relatively high risk and high systemic importance could be expected to 

receive greater supervisory attention than those assessed as being of lower risk and lesser systemic 

importance. 

In a fintech context, on-site assessments are likely to focus on the risk areas of greatest relevance to the 

particular fintech product or service being provided. In many examples of fintech—such as mobile 

payment system providers, e-wallets, online banking, and P2P frameworks—the key risk areas are 

likely to be operational in nature, such as cyber risks, information risks, financial crime and market 

conduct. On-site assessments would also appropriately involve supervisory assessment of a financial 

institution‟s governance arrangements in relation to fintech matters, especially the adequacy of the 

board‟s understanding of the risks associated with fintech and their oversight of the risk management 

framework applicable to fintech. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

45 
Published by SCHOLINK INC. 

Particular areas of focus for supervisors would also include the need to assess the stress testing capacity 

of financial institutions in relation to fintech risks, including testing the vulnerability to cyberattacks 

and financial integrity risk. Similarly, supervisors should ensure that fintech developments are fully 

integrated into a financial institution‟s “three lines of defence” risk management framework, such that 

front line staff are charged with responsibility for adhering to risk management requirements in the 

deployment of fintech, that a risk management unit (overseen by a CRO) has responsibility for 

overseeing the risk management framework for fintech (integrated into wider risks), and that internal 

audit has responsibility for regular assessments of adherence to fintech-related risk management 

requirements. Supervisors should also ensure that financial institutions that deploy or rely on fintech 

maintain robust contingency plans for dealing with risk impacts. These plans should include BCP 

arrangements modified to include fintech operational risk events, as well financial contingency plans 

designed to ensure that capital and liquidity impacts are addressed effectively and in a timely manner. 

There should be periodic testing of contingency plans, with the results of these being reviewed by the 

supervision authority. 

The table below provides an overview of the types of regulatory responses that can be considered in 

relation to particular categories of fintech risks. 

 

Table 1. Fintech Risks and Possible Regulatory Responses 

Fintech Risks Possible Regulatory Responses 

Market misconduct—e.g., 

misselling and inadequate 

disclosure of financial product 

risks 

Regulatory responses are likely to include: 

 Strengthened disclosure requirements in relation to financial 

products and services, with clear disclosure of the risk/reward 

trade-off, with appropriate penalties for breaches of 

requirements. 

 A licensing framework for providers of financial products and 

services to ensure that they meet minimum standards relevant 

to market conduct, including fit and proper requirements. 

 Supervisory requirements to ensure that market conduct 

regulations are complied with, that fit and proper requirements 

are applied on an ongoing basis, and that regulated entities 

comply with disclosure requirements. 

Financial products and services 

evolving faster than the 

Regulatory responses are likely to include: 

 Clear definition of the “problems” to be solved and regulatory 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

46 
Published by SCHOLINK INC. 

law—leaving legal uncertainty 

over the rules governing such 

products and services. 

objectives. 

 Ensuring that the regulatory framework is applied on a 

consistent and competitively neutral basis, such that similar 

financial products and services are regulated in much the same 

way. 

 Increased resourcing for authorities to develop laws that keep 

pace with new technological developments. 

 Robust frameworks for legal and regulatory development, 

including well-structured cost/benefit analysis, consultation 

with interested parties, and regulatory accountability. 

Disintermediation risk, resulting 

in Fintech providers operating 

outside regulatory nets. 

Regulatory initiatives might include: 

 Ensuring that regulatory nets are based on clearly defined 

financial product and service delivery to ensure a 

competitively neutral framework. 

 Transitioning where appropriate from a regulatory framework 

based on defined categories of financial institution to one that 

is based on types of financial services provided to ensure that 

the regulatory net applies in a consistent manner across 

categories of financial services. 

 Ensuring that non-bank financial intermediaries and other 

unregulated entities are, at a minimum, brought into a 

monitoring and evaluation framework to enable the authorities 

to assess the nature of the business being undertaken, the risks 

involved, the quality of risk management, and the systemic 

importance of the business. This will help to inform the 

development of appropriate regulatory and supervisory 

requirements. 

Cyber risks 

Regulatory measures might include: 

 Licensing requirements for providers of defined types of 

online financial services, particularly those in which cyber 

risks (such as cyber-based fraud, identity theft, privacy 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

47 
Published by SCHOLINK INC. 

information breaches, and operational dysfunction) are 

considered to be significant. 

 Supervisory requirements for cyber risks, including well 

defined “three lines of defence” risk management 

requirements, board responsibility for overseeing cyber risks, 

on-site assessment by supervisors, vulnerability stress testing, 

and targeted external audits. 

 A requirement for financial firms to have comprehensive 

contingency plans to enable them to recover quickly and 

effectively from a cyber risk event, including back-up 

arrangements, disaster recovery sites, firewalls to prevent IT 

risk events from impacting critical functions and services, and 

regular testing of contingency plans. 

 Possible extension of safety nets to incorporate losses due to 

cybercrime. 

Financial crimes—e.g., money 

laundering, financing of illegal 

activity. 

Regulatory requirements would likely include: 

 Extension of AML/CFT licensing and supervision to Fintech 

participants (if not already covered). 

 Enhanced surveillance of transaction activity—e.g., via 

Suptech and Regtech. 

Contagion risk—e.g., as a result 

of operational dysfunction in 

one part of the financial system 

impacting other parts. 

Regulatory requirements might include: 

 Ensuring that the risks of operational dysfunction (e.g., IT 

failures) are properly managed, and backup arrangements are 

regularly tested. 

 Seek to ensure that risk transmission buffers are in place to 

limit contagion, including robust capital requirements for 

financial market participants and IT firewalls to limit or 

prevent the transmission of operational shocks from one entity 

in a group to another. 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

48 
Published by SCHOLINK INC. 

 Ensure that, within financial conglomerates, robust firewalls 

are in place between different categories of financial services 

within the conglomerate to limit contagion (including in 

respect of information and IT protection between entities in 

the group), and that the head of the group maintains robust 

contingency plans for addressing risk events. 

Financial stability risks—e.g., 

due to potential asset price 

bubbles or excessive market 

concentration of systemically 

important functions. 

Increased market surveillance, regulatory measures to promote 

improved management of risks that contribute to asset price 

bubbles, and regulation to limit the systemic dominance of Fintech 

providers. 

 

5. Early Intervention and Crisis Management   

Early Intervention 

An important element in the supervisory framework for banks and other financial institutions is early 

intervention. Under most prudential supervision regimes, the supervisory authority has comprehensive 

legal powers to intervene and take a range of supervisory actions if a financial institution breaches 

regulatory requirements or its risk profile is deteriorating. These powers are normally supported by 

policies and practices under a preventive and corrective action framework, in which the supervisory 

authority sets out a range of triggers for taking remedial supervisory actions. The triggers generally 

include breaches of regulatory requirements, as well as deterioration in capital requirements, liquidity 

requirements, asset quality and other financial and prudential risk metrics. The framework typically sets 

out an escalating range of supervisory actions in response to particular triggers. These often include 

measures such as: 

 intensification of off-site monitoring; 

 more frequent and focused on-site assessments; 

 a requirement for the financial institution to obtain an independent assessment of particular matters; 

 a requirement for the financial institution to undertake specific actions to remedy the situation, 

potentially include strengthening risk management arrangements, increasing capital, limiting further 

risk-taking activity, and curtailing or ceasing the payment of dividends and bonus payments to 

senior management. 

These early intervention frameworks are generally accompanied by contingency plans to enable a 

supervisory authority to deal with specific types of financial institution stress. Under best practice, the 

supervision authority undertakes regular testing of its early intervention framework and contingency 

plans for dealing with stress situations. 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

49 
Published by SCHOLINK INC. 

In the context of fintech, these arrangements for early intervention are particularly important. It is 

essential for supervisory authorities to integrate fintech-related risks into their early intervention 

frameworks and to develop contingency plans for dealing with stress events involving fintech matters. 

Examples of where early intervention arrangements are especially important are fintech risk events that 

threaten the financial or operational soundness of a financial institution or financial stability. Of 

particular relevance in this context are operational risks arising from fintech, such as cyberattacks that 

threaten a financial institution‟s operational soundness or pose a threat to payment system functionality, 

the emergence of high-risk lending and payment system activity in non-bank financial intermediation, 

and financial conduct that threatens the integrity of the financial system (such as money laundering and 

other financial crimes). 

In these examples, it is important for the supervisory authorities to identify the triggers for different 

stages of early intervention and the response strategies they would apply to breaches of triggers. They 

should also develop and regularly test contingency plans for dealing with such risk events. In some 

cases, the fintech-related risk events would be able to be addressed through existing early intervention 

frameworks. However, in some areas, such as cyberattacks, modifications to existing early intervention 

frameworks and contingency plans may be necessary so as to incorporate specific responses to deal 

with the impact of the events and to facilitate effective remediation. 

Part of the early intervention framework should include a requirement for a regulated entity to maintain 

and regularly test its own contingency plans for dealing with distress events. Typically, a bank, for 

example, would be required to have a liquidity contingency plan, a capital contingency plan and a 

business continuity plan. In addition, following the global financial crisis, banks in most countries have 

also been required to have recovery plans that set out comprehensive strategies for enabling a bank to 

restore itself to financial and operational soundness following (or in anticipation of) a severe financial 

or operational shock. Supervisory authorities should include in their early intervention frameworks a 

requirement for such plans to be activated and implemented upon defined triggers being breached. 

In a fintech context, there is a need to ensure that financial institution contingency plans, including 

recovery plans, adequately identify fintech-related risk events and set out the strategies for responding 

to them. In some cases, fintech risk events can be integrated into existing contingency and recovery 

plans with only minor modifications. However, in the case of some fintech, especially ones that expose 

an institution to cyber risks and payments system network risks, there is a need for significant new 

response strategies to deal with such threats. The responses will include the initiatives needed to 

maintain critical functions and services, undertake capital and liquidity restoration, address stakeholder 

concerns, remediate reputation risk, and ensure that the underlying causes and vulnerabilities have been 

remedied. Supervisory authorities need to oversee these arrangements and ensure that recovery plans 

and other contingency plans are subject to regular testing. 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

50 
Published by SCHOLINK INC. 

Crisis Preparedness 

When early intervention and recovery actions are insufficient to remedy a risk event, there is a need for 

the authorities to have the capacity to undertake some form of resolution. This might involve the 

appointment of a statutory manager or administrator to a financial institution in acute stress to 

implement remedial actions that the board and management are either unable or unwilling to undertake 

and to identify possible resolution options. It will also likely involve the authorities having the legal 

powers, policies and procedures to implement a specific resolution option if the financial institution is 

deemed non-viable. This could involve transferring critical functions and systems, associated assets and 

liabilities, to another (viable) entity or to a “bridge entity” established for the purpose by the resolution 

authority. It might involve some form of recapitalisation, such as the use of contractual or statutory 

bail-in of unsecured liabilities. Or it might involve an unwinding of the institution‟s business in an 

orderly and non-disruptive manner. 

Since the global financial crisis, financial authorities globally have implemented a wide range of 

initiatives to strengthen the capacity to resolve a non-viable financial institution. These initiatives have 

been guided by the international standard on resolution issued by the Financial Stability Board—the 

Key Attributes of Effective Resolution Regimes for Financial Institutions (Key Attributes). Under this 

standard (which is non-binding but is encouraged by the IMF and World Bank through the FSAP 

process), resolution authorities are expected to have: 

 a well-defined statutory mandate for the resolution of non-viable financial institutions, anchored to 

clearly stated objectives (generally anchored to financial stability); 

 a resolution framework that applies to regulated entities, relevant holding companies and 

subsidiaries to enable a group-based resolution to be implemented; 

 a broad suite of statutory powers with well-specified triggers to enable a range of resolution options 

to be implemented; 

 the capacity to require a financial institution to prepare and maintain a recovery plan; 

 the ability to undertake resolvability assessments and prepare a resolution plan for at least 

systemically important financial institutions; 

 the maintenance of the ability to implement a range of resolution strategies, based on generic 

resolution policies and practices, and institution-specific resolution plans; 

 safeguards to ensure that resolution actions are not used in an inappropriate manner, including a 

general requirement to ensure that no creditor is left worse off under a resolution than they would 

have been under a conventional winding up/liquidation under the relevant country‟s insolvency law. 

To varying degrees, resolution authorities in many countries have implemented or are in the process of 

implementing resolution policies and practices, including institution-specific resolution plans, in broad 

alignment with the Key Attributes. This has typically included a strengthening of resolution-related 

laws, the development of generic resolution strategies, the undertaking of resolvability assessments of 

systemic institutions, and the development of resolution plans for such institutions. Domestic and 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

51 
Published by SCHOLINK INC. 

cross-border cooperation and coordination arrangements have also been strengthened for resolution 

purposes in many countries. 

For the most part, these resolution frameworks have been designed to apply to mainstream banking 

(and to some extent, insurance and financial market infrastructure) without specific regard for fintech 

issues. What is likely to be needed in the next phase of implementation of resolution frameworks is the 

assessment of the extent to which fintech developments might change some aspects of resolution. In 

most respects, it is likely that the principles and practicalities of resolution will not be significantly 

altered by fintech. However, some aspects of fintech might require special attention in a resolution 

context. This is likely to be the case for non-bank financial intermediation to the extent that such 

institutions become systemically significant, either individually or collectively (e.g., due to network 

platform contagion risks). In this case, it will be necessary for the authorities in question to consider the 

need to develop effective resolution frameworks for application to non-bank financial institutions, such 

as mobile payment system providers and P2P platforms, so as to enable financial distress and failure 

events to be managed in a manner consistent with maintaining the stability of the financial system. 

Similarly, it will be necessary for the authorities to assess the possible modifications needed to 

resolvability assessments and resolution plans to deal with cyber risk events where these cause a bank 

or other financial institution to become non-viable. In this case, consideration would need to be given 

to a number of factors, such as how cyber risk-impacted critical functions and services can be restored 

to a secure and viable state, either within the existing financial institution or by being transferred to 

another entity or via secured backup systems. Similarly, consideration will need to be given to how 

FMI resolution strategies would be implemented in a situation where one or more FMI providers has 

been severely impacted by a cyber risk event. These issues raise an important question as to the 

adequacy of operational risk firewalls between different entities in financial conglomerates and FMIs, 

and how critical functions and systems can best be protected from cyber risk events that originate in 

non-critical systems, but which could be transmitted to critical functions and systems. 

These are still relatively new and evolving issues. It will take time for the authorities to assess the 

implications of fintech for resolution strategies, resolvability assessments and resolution planning. 

However, it will be increasingly important for fintech issues to be factored into resolvability 

assessments and resolution planning, given the increasing threat posed by cyber risk and some other 

fintech developments. 

 

 

 

 

 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

52 
Published by SCHOLINK INC. 

6. Conclusion  

This paper has looked at the tools available to regulatory and supervisory authorities to strengthen the 

regulation and supervision of fintech in areas where fintech risks pose a potential threat to financial 

stability and to consumers of financial services. In doing so, four key themes have emerged. 

First, a carefully considered balance needs to be drawn to embrace the benefits of fintech while 

addressing the potential risks. An appropriate balance needs to be struck between the promotion of 

financial stability, on the one hand, and financial system efficiency and innovation, on the other. This 

suggests the need for financial supervisors and regulators to further deepen their understanding of the 

benefits and risks associated with fintech across the financial system, to have a clearly defined public 

policy rationale for regulatory intervention, to have well-specified regulatory objectives, and to ensure 

that a proportionate regulatory response is applied based on robust cost/benefit analysis. In this context, 

it is important that regulation of financial services is based on sound principles of competitive 

neutrality and consistency, such that similar types of financial services and entities are regulated on a 

consistent basis—i.e., “substance over form”.  

Second, the use of Regtech and Suptech could improve supervision and support forward-looking, 

judgement based, supervision and policymaking. However, in order to be able to achieve this, 

supervisory authorities need to strengthen the skill sets of supervisors, and to continue to enhance their 

approaches to risk-based supervision. Regtech and Suptech should not be seen as substitutes for 

conventional supervision. These new technologies need to be harnessed in ways that supplement and 

strengthen existing risk-based supervisory frameworks, and where supervisory judgement remains a 

key factor in achieving desired regulatory outcomes. 

Third, a key element in the effective regulation of fintech will be the promotion of robust governance 

and risk management frameworks in providers of financial services—whether they be mainstream 

financial institutions or newly established digital financial service entities. This will include the need 

for regulators to place emphasis on the quality of financial institution boards, risk management 

frameworks, internal audit, stress testing arrangements, and contingency plans.  

Fourth, further attention needs to be given to how financial authorities respond to emerging stress and 

institutional non-viability in a digital environment. This is especially relevant for non-bank financial 

intermediation, which could increasingly pose a risk to financial stability, and cyber risks, which are an 

increasing potential threat to financial institution viability and financial stability. In this context, 

financial authorities need to pay particular attention to their early intervention frameworks for dealing 

with emerging stress and resolution arrangements for addressing institutional non-viability, with 

particular focus on the strategies for dealing with risk events associated with fintech, such as severe 

cyber attack scenarios and stress events in under-regulated non-bank financial intermediation. 

 

 

 



www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

53 
Published by SCHOLINK INC. 

References  

Adrian, T., & Mancini-Griffoli, T. (February 2021). Public and Private Money Can Coexist in the 

Digital Age. 

Andolfatto, D. (2018). Assessing the Impact of Central Bank Digital Currency on Private Banks. 

Federal Reserve Bank of St. Louis Working Paper 2018-026C. 

https://doi.org/10.20955/wp.2018.026 

Auer, R. (2019). Beyond the Doomsday Economics of “proof-of-work” in Cryptocurrencies. In Bank 

for International Settlements, Working Paper no. 765. https://doi.org/10.24149/gwp355 

Bank for International Settlements. (April 2022). CBDCs in Emerging Market Economies. 

Bech, M. L., & Rodney, G. (2017). Central Bank Cryptocurrencies. Bank for International Settlements 

Quarterly Review.  

BigTech Firms in Finance in Emerging Market and Developing Economies: Market developments and 

potential financial stability implications. (October 2020b). 

Board, C., & Wehrli, A. (2021). Ready, steady, go?—Results of the third BIS survey on central bank 

digital currency. In Bank for International Settlements, Working Paper no. 114.  

Crisis Binder. (October 2019).  

Designing and Implementing a Systemic Financial Crisis Management Simulation. (March 2020).  

Financial Stability Board. (February 2022). Assessment of Risks to Financial Stability from 

Crypto-assets. 

Financial Stability Implications from FinTech Supervisory and Regulatory Issues that Merit 

Authorities’ Attention. (June 2017).  

FinTech and Market Structure in the COVID-19. (March 2022). 

Guide to Supervision in the COVID-19 World. (September 2020). 

International Monetary Fund and World Bank Group. (October 2018). The Bali Fintech Agenda: A 

Blueprint for Successfully Harnessing Fintech’s Opportunities. 

OECD. (February 2020). Digital Disruption in Banking and its Impact on Competition.  

Regulation, Supervision and Oversight of “Global Stablecoin” Arrangements Final Report and 

High-Level Recommendations. (October 2020c). 

Statista. (2020). Share of selected payment methods as percentage of total e-commerce transaction 

volume worldwide in 2020, by region.  

The future of monetary system BIS Annual Economic Report. (June 2022). III.  

The Use of Supervisory and Regulatory Technology by Authorities and Regulated Institutions Market 

developments and financial stability implications. (October 2020a). 

Toronto Centre. (August 2017). FinTech, RegTech and SupTech: What They Mean for Financial 

Supervision. 

 

 

https://doi.org/10.20955/wp.2018.026
https://www.bis.org/publ/work765.pdf
https://doi.org/10.24149/gwp355
https://www.bis.org/publ/qtrpdf/r_qt1709f.pdf
https://www.bis.org/publ/bppdf/bispap114.pdf
https://www.bis.org/publ/bppdf/bispap114.pdf
https://res.torontocentre.org/guidedocs/Designing%20and%20Implementing%20a%20Systemic%20Financial%20Crisis%20Management%20Simulation%20FINAL.pdf
https://www.fsb.org/wp-content/uploads/R270617.pdf
https://www.fsb.org/wp-content/uploads/R270617.pdf
http://www.oecd.org/daf/competition/digital-disruption-in-financial-markets.htm


www.scholink.org/ojs/index.php/elp                   Economics, Law and Policy                        Vol. 5, No. 2, 2022 

54 
Published by SCHOLINK INC. 

Notes 

Note 1. In this paper, we use the FSB definition of Fintech: “Technologically enabled innovation in 

financial services that could result in new business models, applications, processes or products with an 

associated material effect on financial markets and institutions and the provision of financial services.” 

Note 2. Toronto Centre (2020) 

Note 3. Toronto Centre (2017) 

Note 4. Auer (2019) 

Note 5. Financial Stability Board (2020b) 

Note 6. Adrian & Mancini-Griffoli (2021) 

Note 7. Financial Stability Board (2020c)  

Note 8. Condruta and Wehrli (2021) 

Note 9. Financial Stability Board (2017) 

Note 10. Statista (2020)  

Note 11. 1 Financial Stability Board (2020a & 2020b) 

Note 12. International Monetary Fund and World Bank Group (2018) 

 

 

 

 

 

 


