Regulation and Standard

in Financial Technology
Saravanan Kulanthaivelu

Regulation and Standard in Financial Technology 0

Biography

• Currently employed as Cyber Forensic Senior Specialist for Standard Chartered Global Business
Service
• more than 18 years of experience in the IT industry, with experience in forensics, incident response,
network security, malware analysis and threat intelligence.
• Worked as consultant with Mandiant (FireEye) and was stationed in one of the largest bank in
Malaysia as resident incident response and forensic consultant, providing global threats advisory
services.
• Worked in the law enforcement sector, Malaysian Communication and Multimedia Commission
(MCMC) which monitors threats towards Malaysian network and advise the relevant bodies on
mitigation strategies.
• Master in Science, Universiti Sains Malaysia.
• Bachelor in Computer Science with Honors, Universiti Sains Malaysia.
• Member of
• HTCIA
• GIAC Advisory Board
• UKM Fellow
• Certifications

Regulation and Standard in Financial Technology 1

What is FinTech?

• “Fintech” is a line of business based on using technology to provide financial services. Financial
technology companies are generally start-ups founded with the purpose of disrupting
incumbent financial systems and corporations that rely less on technology.
https://www.imoney.my/articles/introduction-fintech-malaysia

Regulation and Standard in Financial Technology 2

What is FinTech?

Regulation and Standard in Financial Technology 3

History of FinTech

• FinTech 1.0 (1866-1967): from the laying of the first transatlantic cable to invention of the ATM,
finance and technology combined to produce the first period of financial globalization. Technologies
such as the telegraph underpinned financial interlinkages across borders, allowing rapid transmission
of financial information, transactions and payments.
• FinTech 2.0 (1967-2008): when FinTech remained internal to the sector and: was dominated primarily
by the traditional regulated financial services industry that used technology to provide financial
products and services. This era witnessed the introduction of electronic payments and clearing
systems, ATM machines and online banking. In the mid-1990s, the financial services industry became
the single largest purchaser of IT – a position it retains to this day.
• FinTech 3.0 (2008-present): since the global financial crisis, disruptive new start-ups and established
technology companies have begun to deliver financial products and services directly to businesses
and the general public. And where new entrants tend to: focus on a single-purpose solution, designed
to offer an improved experience in just one product or service.

https://www.consumersinternational.org/media/154710/banking-on-the-future-full-report.pdf

Regulation and Standard in Financial Technology 4

What problems does FinTech Solve?

• To qualify as FinTech, a company must be able to do the following for

the financial industry:
•Faster
•More accurate
•Safer (such as cryptography and security)
•Cheaper (lesser administrative chores)
•Provide greater convenience (such as mobility)
•More transparent
•Consolidate and aggregate across many different platforms

Regulation and Standard in Financial Technology 5

Growth in Fintech investment

Regulation and Standard in Financial Technology 6

Financial Technology - Malaysia

Regulation and Standard in Financial Technology 7

Payments Statistics - Malaysia

Regulation and Standard in Financial Technology 8

Overview of Fintech Players in Malaysia

Regulation and Standard in Financial Technology 9

FinTech MAP 2018 - Malaysia

Regulation and Standard in Financial Technology 10

What is RegTech?

• The Financial Conduct Authority (FCA), a regulatory body in the United

Kingdom, describes RegTech as the “adoption of new technologies to facilitate the delivery of
regulatory requirements.”
• “Like FinTech, PayTech, and many other combinations of XXXTech, RegTech is another example
of an industry that is being changed rapidly by software. There has been technology used at
various levels in the Regulatory space for over 20 years. However, what the new RegTech label
recognises is that the gap between software and non-software enabled services has widened
significantly.” –Delloite
• “harnessing the capabilities enabled by new technologies such as cloud computing, big data,
and blockchain, are devising solutions to help companies across all sectors of activity ensure
that they comply with regulatory requirements. In the financial sector, regtech is deemed a
subarea of what is generically known as fintech.”=BBVA

Regulation and Standard in Financial Technology 11

The need of RegTech

• Regulatory requirements have increased since the 2008 financial crisis and with that regulatory
costs
• Issue of how to maintain compliance and uphold risk management within the growing FinTech
sector continues
• Financial institutions continue to utilize legacy systems not equipped to handle the now
automated and digitized financial requirements
• As costs increase to meet regulatory requirements, financial institutions begin to shift to
RegTech solutions to meet regulatory obligations while continuing to meet client demands

Regulation and Standard in Financial Technology 12

RegTech characteristics

Regulation and Standard in Financial Technology 13

Benefits of RegTech

Regulation and Standard in Financial Technology 14

FinTech, RegTech, XXXTech and Cybersecurity

• Cybersecurity is critical in all industries and even more so in the financial world due to
regulatory development.
• With the digital transformation of finance due to FinTech and RegTech, the financial world is
more vulnerable to attack by hackers. Since digital data continues to evolve in the financial
world, cybercriminal activity will continue to increase the risk of attack from hackers.
• Consumer demand for advancing and convenient financial products and services will continue
to evolve the FinTech sector.
• Regulators must strive to actively maintain oversight equipped to protect consumers and the
economy against technological attacks.
• RegTech and cybersecurity continue to be at the forefront of tools implemented in maintaining
a safe and productive FinTech industry.
• To continue providing financial stability and consumer safety, RegTech and cybersecurity must
advance along with FinTech products and service

Regulation and Standard in Financial Technology 15

What is Standard?

• Document approved through consensus by a recognized (standardization) body, that provides, for repeated and
common use, rules, guidelines or characteristics for products or related processes and production methods, with
which compliance is not mandatory.
• It may also include or deal exclusively with terminology, symbols, and packaging, marking or labelling requirements
as they apply to a product, process or production method.
• describes features of a product, process, service, interface, or material. Standards are embodied in several forms,
such as definition of terms; specification of design and construction; detailing of procedures; or performance
criteria against which a product, process, etc., can be measured. Product and process standards can have several
specific functions. These functions include:
• Fostering commercial communication
• Diffusing or transferring technology
• Raising productive efficiency
• Ensuring physical and functional compatibility (product quality)
• Improving process management
• Enhancing public welfare
• Interchangeability and interoperability
• Safety, health and environmental protection
• Variety control
• Usability (fitness for purpose)

Regulation and Standard in Financial Technology 16

What is Regulation?

• A technical regulation is a Government document that lays down product characteristics or their
related processes and production methods, including the applicable administrative provisions,
with which compliance is mandatory.
• It may also include or deal exclusively with terminology, symbols, and packaging, marking or
labelling requirements as they apply to a product, process or production method.
• No consensus is necessary for establishment of the regulation.

Regulation and Standard in Financial Technology 17

Standards vs. Regulations

• Standardization provides a basis for technical/trade agreements and technical regulations

• The difference between a standard and a technical regulation lies in compliance. While
conformity with standards is voluntary, technical regulations are by nature mandatory.
• International standards should be used as a basis for preparing technic
• al regulations except when they are not appropriate to fulfil legitimate interests, for instance,
because of fundamental climatic or geographic factors or fundamental technological problems.
• Standards can be used to find a middle ground when two regulations collide, especially
between countries. For example. If an imported product does not fulfil the requirements of a
technical regulation, it will not be allowed to be put on sale. In case of standards, non-
complying imported products will be allowed on the market, but then their market share may
be affected if consumers' prefer products that meet local standards such as quality or colour
standards for textiles and clothing.

Regulation and Standard in Financial Technology 18

Standard vs Guidelines

Regulation and Standard in Financial Technology 19

ISO Standards – FinTech Related

Standard Description
ISO 31000 Risk management principles and guidance
ISO/IEC 27001 An information security management system
ISO 20022-1 Universal financial industry message scheme (UNIFI)
ISO 6166 Securities and related financial instruments. International
securities identification ((ISIN)
ISO 10002 Quality management -- Customer satisfaction -- Guidelines for
complaints handling in organizations
ISO 22301 Business continuity management systems -- Requirements
ISO 12812-1 Core banking -- Mobile financial services

ISO 21188 Public key infrastructure for financial services -- Practices and
policy framework

Regulation and Standard in Financial Technology 20

Country Standards

MALAYSIA
Standard Issuer
Risk Management in Technology (RMiT) (Draft) Bank Negara Malaysia (BNM)
SINGAPORE
Standard Issuer
Technology Risk Management Guidelines (TRMG) Monetary Authority of
Singapore (MAS)

Regulation and Standard in Financial Technology 21

Industry Standards

From Standard
PCI SSC (Payment Card Industry Security Payment Card Industry Data Security
Standards Council) Standard (PCI DSS)
ISACA COBIT 5 for Information Security
Common Global Implementation (CGI) Society for Worldwide Interbank Financial
Telecommunication (SWIFT)

Regulation and Standard in Financial Technology 22

PCI-DSS

• is an information security standard to protect against credit card fraud and numerous additional
security threats & vulnerabilities.
• Has formally existed since 2004 to help reduce the risk of card fraud through the adoption and
continued application of a recognized set of base level security measures.
• Credit/Debit card providers, such as MasterCard and Visa etc., implement the mechanisms and
security controls specified and suggested in PCI DSS.
• The entities that store, process and transmit the card information also implement PCI DSS.
• PCI DSS latest version 3.2.1 was released in May 2018.
• PCI SSC (Payment Card Industry Security Standards Council) is a governing body established in
September 2006 as a joint venture by MasterCard, American Express, Visa, JCB International
and Discover Financial Services.
• All the PCI DSS versions after 2006 were released by PCI SSC.

Regulation and Standard in Financial Technology 23

PCI-DSS

Regulation and Standard in Financial Technology 24

PCI-PTS

• PCI Pin Transaction Security

• Set of security requirements focused on characteristics and management of devices related to
payment processing activities.
• For manufactures to be followed during the design, manufacture and transport of the device.
• PIN Transaction Security (PTS) devices are used by a merchant at the point-of-interaction for
capturing payment card data and validating approval of its use for a transaction.
• The Council, via PCI Recognized Laboratories, validates the conformance of PTS devices to the
PCI PTS standard and provides a list of approved devices.
• The Council urges merchants to use approved PTS devices in their payment environments.

Regulation and Standard in Financial Technology 25

PA-DSS

• Payment Application Data Security Standard

• formerly referred to as the Payment Application Best Practices (PABP)
• For only software applications that store, process or transmit card holder data as part of
authorization and settlement.
• Applied to only off the shelf sold applications.
• The standard aims to prevent developed payment applications for third parties from storing
prohibited secure data including magnetic stripe, CVV2, or PIN.

Regulation and Standard in Financial Technology 26

PA-DSS Compliant

• Do not retain full track data, card verification code or value (CAV2, CID, CVC2, CVV2), or PIN block data.
• Protect stored cardholder data.
• Provide secure authentication features.
• Log payment application activity.
• Develop secure payment applications.
• Protect wireless transmissions.
• Test payment applications to address vulnerabilities and maintain payment application updates.
• Facilitate secure network implementation.
• Cardholder data must never be stored on a server connected to the Internet.
• Facilitate secure remote access to payment application.
• Encrypt sensitive traffic over public networks.
• Secure all non-console administrative access.
• Maintain a PA-DSS Implementation Guide for customers, resellers, and integrators.
• Assign PA-DSS responsibilities for personnel, and maintain training programs for personnel, customers,
resellers, and integrators.

Regulation and Standard in Financial Technology 27

PA-DSS Governance and enforcement

• PCI SSC has compiled a list of payment applications that have been validated as PA-DSS
compliant, with the list updated to reflect compliant payment applications as they are
developed.
• Creation and enforcement of these standards currently rests with PCI SSC via Payment
Application-Qualified Security Assessors (PA-QSA).
• PA-QSAs conduct payment application reviews that help software vendors ensure that
applications are compliant with PCI standards.
• In May 2016, version 3.2 of the PA-DSS Program Guide and Standards were released.

Regulation and Standard in Financial Technology 28

PCI-DSS

Regulation and Standard in Financial Technology 29

PCI-DSS High Level Overview

Regulation and Standard in Financial Technology 30

PCI-DSS Applicability

• Systems that STORE, PROCESS and TRANSMIT card holder data

• Systems that provide security services or may impact the security of Card Data Environment
(CDE)
• Any other components or devices located within or connected to CDE

Regulation and Standard in Financial Technology 31

COBIT 5 for Information Security

• COBIT 5 for Information Security leverages the COBIT 5 framework—the globally accepted
information and technology management and governance framework— through a security
lens.
• provides guidance to help IT and security professionals understand, utilize, implement and
direct important information security-related activities, and make more informed decisions
while maintaining awareness about emerging technologies and the accompanying threats.
• Focus on
• Reduce complexity and increase cost-effectiveness
• Increase user satisfaction with information security arrangements and outcomes
• Improve integration of information security
• Inform risk decisions and risk awareness
• Reduce information security incidents
• Enhance support for innovation and competitiveness

Regulation and Standard in Financial Technology 32

Common Global Implementation (CGI)

• Initiated by Society for Worldwide Interbank Financial Telecommunication (SWIFT)

• Aims to simplify various payment related corporate-to-bank implementations by promoting the wider
acceptance of ISO 20022 XML.
• Provides a forum for financial institutions (banks and bank associations) and non-financial institutions
(corporates, corporate associations, vendors and market infrastructures) to progress various
corporate-to-bank implementation topics on the use of ISO messages and to other related activities,
in the payments domain.
• Works to achieve its goals through consultation, collaboration and agreement on common
implementation templates for various ISO 20022 financial messages. By publishing and promoting
these messages, the group aims to attain their widespread recognition and adoption.
• Focuses on the general message structure and successful creation of individual transactions that can
be executed by participating banks.
• A corporate can use the same message structure for all their payments with all of their transaction
banks reaching any payment system across the globe.

Regulation and Standard in Financial Technology 33

CGI and ISO 20022

Regulation and Standard in Financial Technology 34

FI Members-SWIFT

Regulation and Standard in Financial Technology 35

Non FI Members-SWIFT

thereof and the oversight of the money market

and foreign exchange market. BNM also
regulates the Islamic financial sector, largely
under the Islamic Financial Services Act 2013.

Regulation and Standard in Financial Technology 36

 FinTech Regulations

• Financial regulation is becoming increasingly complex and intrusive, with major financial
institutions facing multiple regulatory jurisdictions, and regulators requesting increasing
amounts of granular data from firms.
• The complexity of regulation comes at a price, with financial institutions burdened by stringent
and detailed requirements that discourage innovation in new financial products.
• There is a requirement for flexible regulation of new global alternative finance entrants, such as
PayPal, Apple, Facebook, Amazon, etc.; and importantly balancing FinTech innovation with
regulation (e.g., payday loans, peer-to-peer, crowdsourcing).
• This situation is both a challenge and an opportunity. A challenge to make financial regulation
and reporting transparent, efficient and effective; but an opportunity to apply the innovative
FinTech paradigms and big data analytics to regulation and compliance.

Regulation and Standard in Financial Technology 37

Aims of financial regulation

Market to maintain confidence

confidence in the financial system

contributing to the
protection and Financial
enhancement of
stability of the financial stability
system

securing the
Consumer appropriate degree of
protection protection for
consumers.

https://en.wikipedia.org/wiki/Financial_regulation

Regulation and Standard in Financial Technology 38

Structure of supervision

• Acts empower organizations, government or non-government, to monitor activities and enforce

actions. There are various setups and combinations in place for the financial regulatory
structure around the globe.

Supervision of stock • Exchange acts ensure that trading on the exchanges is conducted
in a proper manner. Most prominent the pricing process, execution
exchanges and settlement of trades, direct and efficient trade monitoring

Supervision of listed • Financial regulators ensure that listed companies and market
companies participants comply with various regulations under the trading acts.

Supervision of • Asset management supervision or investment acts ensures the

investment management frictionless operation of those vehicles

Supervision of banks • Banking acts lay down rules for banks which they have to observe
and financial services when they are being established and when they are carrying on
providers their business.

Regulation and Standard in Financial Technology 39

Regulators in Malaysia

Regulation and Standard in Financial Technology 40

Bank Negara Malaysia (BNM)

• Is empowered to act as the regulator of banking institutions under the Financial Services Act 2013
(FSA), the Islamic Financial Services Act 2013 (IFSA) and the Central Bank of Malaysia Act 2009 (CBA).
• Has broad powers of supervision and control over banking institutions licensed under the FSA and the
IFSA.
• In discharging its supervisory functions, BNM adopts a risk-based supervision approach, under which
financial institutions are assessed and monitored based on risk profiles and adequacy of risk
management systems.
• The Minister of Finance (Minister) also plays an active role in the regulation of banks and Islamic
banks and is the approving authority for applications for banking licenses with the power to impose
conditions on such licenses. The Minister also has powers to revoke licenses and to direct
investigation.
• The supervisory framework applies to all types of financial institutions thereby ensuring consistency
in the treatment of similar risks throughout the financial sector and enabling consolidated supervision
of financial conglomerates.

https://uk.practicallaw.thomsonreuters.com/w-008-
0538?transitionType=Default&contextData=(sc.Default)&firstPage=true&comp=pluk&bhcp=1#co_anchor_a634539
Regulation and Standard in Financial Technology 41
Role of BNM-Central Bank

• Promotes financial stability.

• Formulates monetary policy through its monetary policy committee.
• Advises the government on macroeconomic policies and managing the public debt.
• Is also the sole authority for issuing currency as well as managing the country's international
reserves.
• Regulates and supervises financial institutions which are subject to the laws enforced by it
• Oversees payment systems and money and foreign exchange markets.

BNM relies heavily on the work of external auditors and actuaries appointed by financial
institutions for supervisory purposes.

https://uk.practicallaw.thomsonreuters.com/w-008-
0538?transitionType=Default&contextData=(sc.Default)&firstPage=true&comp=pluk&bhcp=1#co_anchor_a634539

Regulation and Standard in Financial Technology 42

Securities Commission of Malaysia (SC)

• The SC is a statutory body established under the Securities Commission Act 1993, and is the
primary regulatory authority for capital market activities in Malaysia.
• Investment banks which undertake capital market activities in addition to banking activities are
also regulated by the Securities Commission of Malaysia (SC).
• BNM and the SC cooperate in regulating investment banks and have jointly issued the
Guidelines on Investment Banks.
•BNM is responsible for the prudential regulation of investment banks to ensure their safety and
soundness and the overall stability of the financial system.

•The SC is responsible for the investment banks' business and market conduct, to promote market integrity
and investor protection in the capital markets.

Regulation and Standard in Financial Technology 43

Labuan Financial Services Authority (Labuan FSA)

• Is the supervisory and regulatory body for the Labuan International Business Financial Centre
(Labuan IBFC).
• Entities operating in the Labuan IBFC are subject to separate federal legislation specific to the
Labuan IBFC.
• Labuan banks and Islamic banks are subject to the Labuan Financial Services and Securities Act
2010 (LFSSA) and the Labuan Islamic Financial Services and Securities Act 2010 (LIFSSA)
respectively.

Regulation and Standard in Financial Technology 44

Functions of Labuan FSA(1)

• To administer, enforce, carry out and give effect to the provisions of the following laws:
• Labuan Companies Act 1990
• Labuan Business Activity Tax Act 1990
• Labuan Trusts Act 1996
• Labuan Financial Services Authority Act 1996
• Labuan Foundations Act 2010
• Labuan Financial Services and Securities Act 2010
• Labuan Islamic Financial Services and Securities Act 2010
• Labuan Limited Partnerships and Limited Liability Partnerships Act 2010
• Any other laws relating to business and financial services in Labuan

https://www.labuanibfc.com/about-labuan-ibfc/the-regulator/functions-of-labuan-fsa

Regulation and Standard in Financial Technology 45

Functions of Labuan FSA(2)

• To exercise, discharge and perform such powers, duties and functions in accordance with the laws;
• To maintain the good reputation of Labuan IBFC as an international business and financial centre;
• To carry out research and commission studies on financial services in Labuan IBFC;
• To make recommendations for the creation and improvement of facilities to enhance the attraction of
Labuan IBFC as a centre for financial services;
• To collaborate with financial institutions and industry associations in Labuan IBFC to promote and
provide financial services to foster high standards for Labuan IBFC's financial services;
• To advise and make recommendations to the government on matters relating to financial services in
Labuan IBFC; and
• To carry out all such activities and to do all such things as necessary or advantageous and proper for
the administration of the Authority, or for such other purposes as may be directed by the Minister.

https://www.labuanibfc.com/about-labuan-ibfc/the-regulator/functions-of-labuan-fsa
Regulation and Standard in Financial Technology 46
Fintech Regulations in Malaysia

• There is no specific regulatory framework for fintech businesses in Malaysia, apart from the
incentives and functions of governmental or government owned entities.
• Where a fintech business falls within any business, or includes an activity that is regulated or
licensed in Malaysia, the regulatory and legal requirements to conduct such business or activity
must be complied with in accordance with the applicable Malaysian laws.
• Fintech activities which involve banking, investment banking, insurance or takaful, money
changing, and remittance, operating a payment system or issuing payment instruments business
will come under the purview of the BNM.
• The Financial Services Act 2013 (FSA) is the statute that regulates and provides supervision of
conventional financial institutions, payment systems and operators thereof and the oversight of
the money market and foreign exchange market.
• BNM also regulates the Islamic financial sector, largely under the Islamic Financial Services Act
2013.

Regulation and Standard in Financial Technology 47

Legislative Regulation In Malaysia

• The Financial Services Act 2013 (FSA)

•is the key statute governing the conventional finance industry.
• replaced the Banking and Financial Services Act 1989, the Insurance Act 1996, the Payment Systems Act 2003
and the Exchange Control Act 1953.
• The Islamic Financial Services Act 2013 (IFSA)
•is the FSA's counterpart for the Islamic finance sector
•replaced statutes such as the Islamic Banking Act 1983 and the Takaful Act 1984.
• Central Bank of Malaysia Act 2009 (CBA)
• Securities Commission Act 1993
• Labuan Financial related Acts (see Labuan FSA Functions)
• Capital Markets and Services Act 2007 (CMSA)
• Development Financial Institutions Act 2002
• Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001
• Money Services Business Act 2011
• The Personal Data Protection Act 2010 (PDPA)

Regulation and Standard in Financial Technology 48

Cyber Security Laws may apply

• Communications and Multimedia Act 1998

• Communications and Multimedia Commission Act 1998.
• Malaysian Communications and Multimedia Content Code (Version 6, published in 2012).
• Computer Crimes Act 1997.
• Digital Signature Act 1997.
• Copyright Act 1987.
• Electronic Commerce Act 2006.
• Consumer Protection Act 1999.
• Consumer Protection (Electronic Trade Transactions) Regulations 2012.

Regulation and Standard in Financial Technology 49

Financial Technology Regulatory
Sandbox Framework

• To provide a regulatory environment that is conducive for the deployment of fintech

innovations.
• Use for reviewing and adapting regulatory requirements that may unintentionally inhibit
innovation or render them non-viable.
• Provides for innovation by fintech companies to be deployed and tested in a live environment,
within specified parameters and timeframes, and whether to allow the product, service or
solution to be introduced to the market on a wider scale.
• If allowed, the participating fintech companies intending to carry out regulated businesses will
be assessed based on applicable licensing, approval and registration criteria under the
applicable laws.

Regulation and Standard in Financial Technology 50

Financial Technology Enabler Group (FTEG)

• The Financial Technology Enabler Group (FTEG) was established by Bank Negara Malaysia (BNM)
in June 2016 to support innovations that will improve the quality, efficiency and accessibility of
financial services in Malaysia.
• Comprising of cross functional group within BNM, the FTEG is responsible for formulating and
enhancing regulatory policies to facilitate the adoption of technological innovations in the
Malaysian financial services industry.

Regulation and Standard in Financial Technology 51

Interoperable Credit Transfer Framework (ICTF)

Regulation and Standard in Financial Technology 52

Cryptocurrency Regulation

Regulation and Standard in Financial Technology 53

Initial Coin Offering (ICO)

Regulation and Standard in Financial Technology 54

Equity Crowdfunding (ECF) -SC

Regulation and Standard in Financial Technology 55

P2P Lending-SC

Regulation and Standard in Financial Technology 56

Robo Advisory Framework

Regulation and Standard in Financial Technology 57

Guidelines by Bank Negara Malaysia (BNM)

Guidelines
Guidelines on Outsourcing of Banking Operations
Guidelines on Data Management and MIS Framework for FSIs.
Guidance on Business Continuity Management.
Guidelines on Management of IT Environment.
Guidelines on the Provision of Electronic Banking Services by FSIs
Guideline on Electronic Money (E-Money)
Guidelines on Risk Management and Internal Controls for Conduct of Money Services
Business
Guidelines on Governance and Operational Requirements on Conduct of Money
Services Business

Regulation and Standard in Financial Technology 58

Enforcement -Example

http://www.bnm.gov.my/index.php?ch=133&pg=552&ac=1&bb=masterfile

Regulation and Standard in Financial Technology 59

 Payment Services Directive (EU) -PSD2

• On 12 January 2016, the revised Payment Services Directive (EU) 2015/2366 - or PSD2 - came into
force in the European Union, and went into effect on 13 January 2018. It was issued by The European
Banking Authority (EBA)
• The PSD2 is an enhancement and further development of the PSD, which was adopted by the EU in
2007.
• The main reason for updating the PSD1 was the massive development and growth within the retail
payment market and the related digital technologies – such as mobile payments.
• Aim of completely revolutionizing the payments industry through simplification and increasing
competition. Applies to all member states within the EU, meaning big changes are occurring for
Europe’s blossoming FinTech hubs such as London, Berlin and Dublin.
• Create opportunities for existing third party providers (TPPs) in payments and also allowing the
creation of many more.
https://www.aon.com/unitedkingdom/insights/how-psd2-will-revolutionise-fintech.jsp

Regulation and Standard in Financial Technology 60

PSD2 Before and After

Regulation and Standard in Financial Technology 61

 General Data Protection Regulation ("GDPR")

• The General Data Protection Regulation ("GDPR") is the new legal framework that will come into
effect on the 25th of May 2018 in the European Union ("EU"), and will be directly applicable in all EU
Member States from that date.
• The GDPR's focus is the protection of personal data, i.e. data about individuals, and builds on existing
data protection laws, setting out the responsibilities of businesses in relation to the personal data
they collect, hold, transmit and otherwise use.
• The GDPR is extra-territorial in nature and applies not just to organizations within the EU who process
the data of individuals but also organizations outside the EU who offer goods or services to individuals
in the EU, or who monitor the behavior of individuals in the EU. Because the EU is a trading partner of
most countries, the GDPR's wider scope means it has implications for many businesses worldwide,
and will effectively require them to be compliant if they wish to operate in EU member states either
directly or as a third-party for others.
• As one example, if a company based in Asia or the United States, or another non-EU country, collects
or processes personal data of any employee, prospect, customer, partner, or supplier that is based in
the EU, that company will need to be compliant with the GDPR.

Regulation and Standard in Financial Technology 62

Thank You
[email protected]
Twitter:@svanank

Regulation and Standard in Financial Technology 63

References
• http://www.fintechmalaysia.org/index.php/home
• http://www.intracen.org/Part-3-Difference-between-standards-and-technical-regulations/
• https://www.iso20022.org/about_iso20022.page
• https://www.consumersinternational.org/media/154710/banking-on-the-future-full-report.pdf

Regulation and Standard in Financial Technology 64