FinTech Global FS Regulatory Round-up - w/e 8 August 2025

ICYMI

• High Court permits documents obtained via Norwich Pharmacal Order to be used against disclosing bank in related APP fraud claim

• Cyber security: A month in retrospect (Australia) - July 2025

UK

FCA: Feedback statement on new standard setting body for open banking

The FCA has published Feedback Statement 25/4 – Design of the Future Entity for UK Open Banking (FS25/4) which responds to the feedback received to the Joint Regulatory Oversight Committee's (JROC's) consultation in this area. FS25/4 sets out the FCA’s expectations for the role of the Future Entity, how it will sit within the open banking ecosystem, and the next steps for establishing the Future Entity.

Subject to future legislation, the FCA expects the Future Entity to be the primary standard setting body for open banking Application Programming Interfaces (APIs) in the UK. Its responsibilities will include:

• setting common standards that will provide a minimum level of service and interoperability across open banking services;
• monitoring API performance;
• ensuring adherence to relevant standards (including providing information to the FCA);
• providing directory and certification services; and
• working with multilateral agreement owners and operators to develop standards that enable commercial schemes.

Separately, the FCA expects there will be a competitive layer of open banking schemes that will  operate commercially. These schemes will develop the rules that govern how firms interact and put things right when they go wrong. 

The regulator expects to say more about how the Future Entity will be established by the end of 2025.  [8 Aug 2025]  #OpenBanking #FutureEntity #API

FCA reports findings of multi-firm work on off-channel communications

The FCA has reported the findings of its review of firms' approaches to off-channel communications, by which the FCA means communications that 'take place outside of monitored, recorded channels a firm has permitted'. The reported findings are relevant for wholesale banks and other firms in scope of the recordkeeping rules set out in Chapter 10A of the Senior Management Arrangements, Systems and Controls Sourcebook (SYSC).

In terms of those findings, the FCA noted that all the firms in its sample had improved their processes over the past two years. Actions taken included updating policies to include new technologies (eg smart watches), facilitating employees' self-disclosure off-channel messages, prohibiting personal numbers in out-of-office replies and directories, and providing dedicated help to guide staff on off-channel communications. Firms have also updated their surveillance approaches, and there was an observable increase in third-party providers facilitating the monitoring and recording of different channels.

On breach data, the FCA found that, while breaches occurred at all staff grade levels, 41% involved personnel at director level or above.

Based on its findings, the FCA has set out eight questions for firms to consider. The regulator says it will continue to engage with firms on this issue. [7 Aug 2025]  #Off-Channel #RegTech

FCA: Changes to the safeguarding regime for payments and e-money firms

The FCA has published Policy Statement 25/12: Changes to the safeguarding regime for payments and e-money firms (PS25/12), which sets out the FCA's feedback to Consultation Paper 24/20: Changes to the safeguarding regime for payments and e-money firms (CP24/20) as well as new interim rules (the  Supplementary Regime) to improve safeguarding practices within payment firms. The Supplementary Regime represents the first stage of a two-part wave of changes on which the FCA consulted in CP24/20.

These rules are intended to better protect consumers and encompass:

• annual audits by qualified auditors;
• monthly reporting for payment firms;
• firms to conduct daily checks to make sure the right amount of money is being safeguarded to protect customers; and
• better planning if firms fail so customers receive their money back sooner.

Alongside PS25/12, the FCA has published its intended amendments to the document Payment Services and Electronic Money – Our Approach, which sets out the FCA’s role under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, and an amended Handbook instrument.

The Supplementary Regime, and related amendments to the Approach Document, will come into force on 7 May 2026. [7 Aug 2025]  #Payments

Europe

EBA/EIOPA: Q&As – DORA

The EBA has published the following questions and answers (Q&As) relating to the Digital Operational Resilience Act (DORA):

• identification of ICT service providers (DORA)
• how to fill the refPeriod field of the parameters.csv file for the DORA register of information; and
• obligation to maintain a register of information for financial entities exempt under article 16 of DORA.

The European Insurance and Occupational Pensions Authority (EIOPA) has also published the following Q&As on DORA:

• What are the standards Article 28(5) is referring to?; and
• ICT third-party service providers.  [8 Aug 2025]    [8 Aug 2025]  #DORA #OpRes

EIOPA: Opinion on AI governance and risk management

EIOPA has published an opinion addressed to national supervisors to clarify the key principles and requirements in insurance-sector legislation for the use and supervision of AI systems. The opinion follows a risk-based and proportionate approach intended to reach a balance between the benefits and risks of AI systems.

Since the AI Act entered into force in the EU in Summer 2024, it has governed the use of AI systems across all sectors of the economy including insurance. AI systems used in insurance are already subject to existing sectoral legislation which establishes broad, technologically neutral principles and responsibilities for governance and risk-management. This opinion provides further clarity to supervisors on how to interpret these provisions in insurance-sector legislation – such as the Insurance Distribution Directive and the Solvency II Directive – in the context of AI.

AI systems categorised as high-risk or prohibited under the AI Act are excluded from the scope of the opinion to avoid regulatory complexities. The opinion does not set new requirements and does not alter the scope of either the AI Act or existing sectoral legislation.

EIOPA plans to develop more detailed analyses of specific AI systems or emerging issues related to their use in insurance, and to provide further guidance where appropriate. [6 Aug 2025]  #AI #AIAct

EBA: Draft RTS on prudential treatment of cryptoasset exposures – CRR

The EBA has published its final draft RTS which specify the technical elements necessary for institutions to calculate and aggregate cryptoasset exposures in relation to the prudential treatment of such exposures under the CRR.

The draft RTS further develop the relevant capital treatment for credit risk, counterparty credit risk (CCR), market risk, and credit valuation adjustment risk for asset reference tokens (ARTs) that reference one or more traditional asset(s) and ‘other’ cryptoasset exposures.

The RTS also include the relevant technical elements on the use of netting, aggregating of long and short positions, criteria to allow hedge recognition for other cryptoassets, and the underlying formulas relevant for calculating the exposure value of cryptoassets for the CCR and market risk treatment. [5 Aug 2025]  #Crypto #DigitalAsset #ART

Malaysia

BNM: MyFintech Week 2025

Bank Negara Malaysia (BNM) has published a report on MyFintech Week 2025, an event which brought together regulators, financial institutions, digital banks, fintech innovators, technology providers, policymakers, investors and academia for fintech conversations, practical insights and regional alignment.

The event was structured around three thematic tracks:

• 'finance for the future' – focusing on building a digitally enabled and forward-looking financial system;
• 'finance for change’ – supporting sustainability and social impact; and
• 'finance for a resilient ecosystem’ – strengthening financial system resilience.

In his opening remarks at the event, BNM Governor Abdul Rasheed Ghaffour outlined the importance of collaboration in shaping the future of finance and highlighted some of the BNM's key fintech-related initiatives.  [5 Aug 2025]  #Fintech

BNM: Discussion paper on AI in Malaysian financial sector

BNM has published a discussion paper setting out its proposed approach and views on the development and adoption of AI in the Malaysian financial sector. The paper outlines:

• BNM’s position on responsible AI innovation in the financial sector;
• the proposed regulatory approach for AI, as well as industry guidelines on responsible use; and
• the general development approach, including priority areas for greater innovation and industry-led collaboration.

Feedback is requested by 17 October 2025.  [5 Aug 2025]  #AI

Philippines

BSP launches pilot to accelerate open finance and PERA retirement programme

The BSP has announced the launch of a project aimed to make it easier for citizens to access Personal Equity and Retirement Account (PERA). The initiative leverages the BSP’s open finance framework, which allows secure, consent-based sharing of customers financial data across institutions. The pilot will soon allow users to open accounts directly via participating apps.  [3 Aug 2025] #OpenFinance

US

SEC staff statement on certain liquid staking activities – crypto

The SEC Division of Corporation Finance has issued a statement which aims to clarify the application of federal securities laws to crypto, specifically addressing a type of protocol staking known as "liquid staking."

Liquid staking refers to the process of staking crypto through a software protocol or service provider and receiving a “liquid staking receipt token” to evidence the staker’s ownership of the staked crypto assets and any rewards that accrue to them. The statement clarifies the division’s view that, depending on the facts and circumstances, the liquid staking activities covered in the statement do not involve the offer and sale of securities within the meaning of Section 2(a)(1) of the Securities Act of 1933 or Section 3(a)(10) of the Securities Exchange Act of 1934.  [5 Aug 2025]  #Crypto #DigitalAsset #LiquidStaking

CFTC: Launch of listed spot crypto trading initiative

Commodity Futures Trading Commission (CFTC) Acting Chair Caroline D. Pham has announced the launch of an initiative for trading spot crypto contracts that are listed on a CFTC-registered futures exchange (designated contract market or DCM). This is the first initiative in the CFTC’s crypto sprint to start implementation of the recommendations in the President’s Working Group on Digital Asset Markets report.

The CFTC is inviting feedback and suggestions on listing spot crypto asset contracts on a DCM, including section 2(c)(2)(D) of the Commodity Exchange Act, Part 40 of CFTC regulations, and whether there are any implications under the securities laws or regulations with respect to an SEC framework for trading of non-security assets that are part of an investment contract.

Written input is requested by August 18, 2025. 

This initiative follows on from Acting Chair Pham's announcement of the CFTC Crypto Sprint to start implementations of recommendations set out in the President’s Working Group on Digital Asset Markets report.  [4 Aug 2025]  #Crypto #DigitalAsset

SEC creates AI Task Force to deliver enhanced innovation and efficiency

The SEC has announced the launch of a task force on AI to lead the agency’s efforts to enhance innovation and efficiency in its operations through the responsible use of AI. The task force is led by Valerie Szczepanik, the SEC’s Chief AI Officer.  [1 Aug 2025]  #AI

SEC Crypto Task Force to host series of roundtables around the U.S.

The SEC Crypto Task Force is hosting a series of roundtables around the country to provide opportunities for stakeholders to meet with the task force leader, Commissioner Hester Peirce. This series follows on from five roundtables held in Washington, D.C. The SEC has released a tentative schedule and invites representatives of crypto-related projects to engage in the exercise.  [1 Aug 2025]  #Crypto #DigitalAsset