Regulatory Compliance Failures And The Importance Of The Risk-based Approach
FinTech, for some just a buzzword, for others it is a promise to make finances more seamless and robust via the help of technology. Over the past decade, ambitious disruptors have championed the cause, vowing to redefine the way consumers engage with financial institutions—be it taking on the high fees of traditional remittance firms or democratizing investment opportunities. Companies like Wise have revolutionized currency exchange and international transfers, Klarna has enabled seamless transactions without incurring debt, and superapps like Revolut have made daily financial management more accessible. But as we stand closer to the end of 2023, it’s time to scrutinize the cost of these innovations.
Venture capitalists, enamoured with rapid growth and sky-high valuations of their portfolio firms, have frequently neglected the long-term sustainability of these business models. But financial viability isn’t the only area that’s been overlooked. Amid a laser focus on technology and market disruption, one crucial element has often been missing: regulatory compliance underpinned by a sound risk-based approach. Given that the financial sector is bound by complex rules encompassing risk management, prudential requirements, and financial crime prevention, this oversight is especially glaring.
So what has fuelled the FinTech engine so far? Typically, successful startups in this space have been characterized by:
- Visionary founders willing to challenge the status quo.
- Ample financial backing to bring revolutionary promises to life.
- Creative solutions to address pressing financial issues.
- A responsive market hungry for these solutions.
But notice what’s conspicuously absent? Regulatory compliance has been more of an afterthought than an essential pillar.
Wake-up call: regulatory compliance failures followed by interventions
As we had forecasted in our previous article back in 2021 – regulators started to wake up to this reality and take action. The FinTech industry is now under increasing scrutiny, and we can only expect this regulatory intervention to intensify. This is true for such firms as Railsr, which got their Lithuanian subsidiary’s authorisation revoked, Modulr, which got a restriction on onboarding any new partner clients by the FCA, Dzing, which was forced to sign an undertaking with the FCA to not onboard any new retail customers or allow new incoming funds, and dozens of other lesser-known FinTechs who faced VREQs, OIREQs, section 166 reviews, which don’t go to so much publicity.
As the regulatory landscape evolved, FinTech firms will need to adapt swiftly or face escalating penalties and potential existential threats. A non-compliant FinTech is as good as a dead FinTech and that becomes true more and more every day. The cost of non-compliance is very high, 10 years ago average cost for the firm to undertake the section 166 review and rectify the issues was £2.9 million, today’s costs are probably double that. The market shifted from growth ambitions to a more tranquil and compliant landscape where there will remain only those few who understand the importance of regulatory compliance when the music stops.
Regulatory compliance lesson #1 what do regulators want?
Regulatory compliance is oftentimes seen as something that is contrary to the growth of the business since it adds friction and hampers progression. It is recognised as a stopping force behind the product rollout and the pain which you need to suffer in order to provide services. Although, is it? Oftentimes people in the sector forget that it is there for a reason and prescribed rules are needed to create a safety net for risky situations of materialising and bad actors exploiting those who are more vulnerable.
Regulatory compliance is fundamentally designed to mitigate risk (pay attention to the last word – risk). By adhering to established rules and guidelines, businesses can better prevent the very incidents—like fraud, financial crime, data breaches or consumer harm —that could prove devastating both financially and reputationally. A robust compliance framework allows FinTech firms to build safeguards against volatile situations and unscrupulous actors who might otherwise exploit vulnerable customers. This isn’t merely about avoiding legal trouble; it’s about establishing a business model that is inherently safer and more secure for all stakeholders involved, including the firm itself. Think here of recent developments and emphasis on consumer protection which went sweeping through the UK financial services sector via the introduction of Consumer Duty. If you wish to dive deeper into this topic we have prepared a summary accompanied by a guide for payment and e-money firms that you can read here.
Why you should care about regulatory compliance
Regulatory compliance can actually be a competitive advantage. With governments strengthening laws by adding proliferation financing prevention in the MLRs, sanctions being in the purview as a hot topic, and cybercrime on the rise thanks to AI and deepfakes it is as important as ever to have strong systems and controls.
A FinTech company that can demonstrate a strong commitment to regulatory compliance is more likely to withstand market turbulence and build trust among customers, investors, and partners. In a crowded market, being recognized for operating transparently and ethically can set a business apart. This level of trust can translate to customer loyalty, better investment opportunities, and ultimately, sustainable growth. This is even more so when speaking about offering services to other regulated firms- think here about counterparty risk and how that should be mitigated.
Overall, firms that proactively invest in compliance are thus better prepared for this evolving landscape. They are less likely to face disruptive regulatory actions that could stall operations, levy fines, or even force a shutdown.
Risk-based approach: the key to effective and efficient regulatory compliance
A risk-based approach should be the beating heart of every firm’s operational and strategic decision-making. However, this is not just about identifying and addressing risks as they arise. Before delving into day-to-day activities, firms must first establish their risk tolerance levels. These benchmarks determine how much risk a company is willing to accept in pursuit of its objectives. Setting these levels is a strategic exercise, requiring a balance between entrepreneurial spirit and prudential caution.
Surprisingly, today this is oftentimes neglected, either on an institution-wide basis or solely when speaking about AML/CTF compliance. The latter point we covered quite in detail in our recent article where we touched upon this being an industry-wide issue as recognized by both the FCA and EBA.
How to implement the risk-based approach
To truly benefit from a risk-based approach, it must be holistic and grounded in a methodology that employs both qualitative and quantitative data sources. Qualitative assessments might involve expert opinions, industry insights, or scenario analysis. Meanwhile, quantitative data can include statistical analyses, trends, and metrics. Integrating these varied data sources offers a comprehensive view of potential risks, ensuring that businesses are neither overly cautious nor recklessly bold.
Furthermore, a robust risk-based approach goes beyond just identifying potential risks. It demands an understanding of the interconnectedness of these risks and their potential cumulative impact on the firm. For instance, a singular risk might be manageable within set tolerance levels, but in conjunction with other identified risks, it could pose a significant threat. Effective risk management, thus, requires an integrated and dynamic approach. Such an approach must be accompanied by actions taken to address the risks- either avoidance, mitigation or acceptance. Following that, if the risks at hand would be subject to mitigation measures they should be re-evaluated and the residual risk considered.
In essence, firms must ensure their risk-based approach is not static. It should be revisited regularly, and be agile enough to adjust to the ever-changing landscape of the industry. By consistently aligning the risk strategy with the business’s overall objectives and the industry’s current state, firms can navigate challenges more efficiently, ensuring sustainable growth without compromising compliance or ethics.
The value of fresh perspectives in the risk setting for the risk-based approach
Getting everything right the first time is almost impossible, especially in the ever-evolving landscape of the financial services sector where the screws are either tightening or, in some instances, coming loose (depending on one’s perspective). Every firm faces a plethora of risks, and these risks differ based on the operational model and business sector. At times, it’s essential to set aside preconceived notions and view the situation from a fresh perspective.
Frequently, I’ve come across situations where highly experienced individuals make surprisingly basic errors in judgment. What could be the cause of such oversights? Often, it boils down to overconfidence in their convictions and excessive dependence on past experiences, which can be somewhat myopic if one has remained within a single field of work. Whether it’s conventional banking, FX and payments, investments, crypto assets, or other areas, professionals need to be continuously challenged to grow and enhance their expertise. So, how does one overcome these pitfalls? Is it by hopping from one role to another? Not necessarily. Instead, seeking external advice or hiring a consultant with a vast reservoir of experience can be invaluable.
Consultants are quite handy as they can bring an unconstrained view of a case and assist in setting up a framework at your firm. Nevertheless, you may also get a consultant that is unencumbered by practical experience so that can be even worse than you making your own mistakes… Ultimately, building a diverse team that brings different viewpoints to the table is vital. The broader the range of perspectives considered when shaping a risk management framework – the more robust it will be. The consultant is just an option but not a must- the trick could be done whilst engaging your peers as well.
How PSP Lab can help
PSP Lab is a FinTech consultancy focused primarily on the payments and e-money services sector. We help companies to remain compliant with their regulatory obligations and streamline internal operations. We can help you to ensure that your firm is running in line with your regulatory obligations by either conducting an overall health check assessment or carrying out a throughout audit. In either case, our engagement can benefit you by creating a more compliant culture and reducing the chances of facing regulatory intervention.
