How Fintech Regulation Differs Between Countries

Why the same fintech service can face different rules

A payment app can look identical in London, Dubai and Singapore while operating under very different legal arrangements. One version might hold electronic money, another might connect customers to a partner bank, and a third might provide payment services without maintaining customer balances.

These differences determine who owes the customer money, which activities are permitted and what happens if the provider fails.

Most jurisdictions regulate the underlying activity rather than the label “fintech”. Payments, deposit-taking, lending, investments and cryptoasset services can each trigger separate requirements. A licence for one does not automatically authorise the others.

This guide compares established regulatory structures. Detailed requirements, exemptions and transitional arrangements can change, so a specific service should always be checked against the relevant regulator’s rules and register.

The questions every regulatory system asks

What activity is actually taking place?

Regulators examine the movement of money and the contractual relationships behind the interface. Important distinctions include:

• Deposit-taking: accepting repayable funds under arrangements that fall within banking law.
• Payments and electronic money: executing transfers or issuing stored monetary value for payments.
• Credit: lending, arranging loans or servicing debts.
• Investments: advising on, arranging or executing transactions in financial instruments.
• Cryptoasset services: activities such as custody, exchange or operation of a trading platform.

The boundaries differ. A token described as a “digital dollar” might fall under payment-token, electronic-money, securities or stablecoin-specific rules, depending on its structure and jurisdiction.

Who is responsible for the service?

A fintech may operate under its own authorisation, act as an agent, or distribute services provided by another regulated institution. These structures are not interchangeable.

A technology provider working for a bank does not automatically become a bank. Equally, using a bank partner does not remove every licensing or consumer-protection obligation from the fintech.

Where is the customer?

Incorporation in one country rarely provides unrestricted permission to serve customers elsewhere. Customer residence, targeted advertising, local establishments and the location of regulated activity can all matter.

Cross-border access is therefore a separate question from whether a provider is properly authorised at home.

European Union: shared frameworks, national supervision

The EU combines common legislation with authorisation and supervision largely carried out by national competent authorities.

Payments, electronic money and passporting

The established foundations include the Second Payment Services Directive, or PSD2, and the Second Electronic Money Directive, or EMD2. These distinguish payment institutions and electronic money institutions from banks.

A payment institution can provide the payment services covered by its authorisation. An electronic money institution can issue electronic money and provide permitted payment services. Neither status is a general banking licence.

Within the applicable European framework, authorised institutions can use passporting procedures to provide covered services across borders or through branches. Passporting still requires notifications and does not eliminate every host-country obligation.

For customers, the distinction between bank deposits and electronic money is crucial. Payment and e-money institutions generally protect relevant customer funds through safeguarding arrangements rather than treating those balances as deposits covered by a bank deposit guarantee scheme.

Cryptoassets have a separate framework

The Markets in Crypto-Assets Regulation, or MiCA, establishes rules for covered cryptoasset issuers and service providers. It distinguishes asset-referenced tokens, e-money tokens and other cryptoassets.

MiCA is not a universal wrapper for every token. Tokens qualifying as financial instruments generally fall under financial-services legislation instead. National transitional arrangements and the provider’s precise permissions should be checked with the competent authority.

Practical implication: EU authorisation can support regional expansion, but only for activities and territories covered by the relevant legal route.

United Kingdom: separate authorisation and activity-specific permissions

The UK has its own regulatory perimeter. EU passporting does not provide general access to the UK market, and UK authorisation does not create an EU passport.

FCA status must be read carefully

The Financial Conduct Authority regulates payment institutions and electronic money institutions under the UK’s respective payments and electronic money regimes. Depending on the business, authorisation or a more limited registration route may apply.

Bank authorisation involves the Prudential Regulation Authority and the FCA. Consumer credit, investments and other services have their own permission requirements.

A firm’s appearance on the Financial Services Register is therefore a starting point, not a complete answer. Readers should examine its status, permissions, restrictions and any principal or agent relationship.

Safeguarding is not deposit insurance

Money held with a UK payment or e-money institution is generally subject to safeguarding requirements, rather than being an eligible bank deposit protected directly by the Financial Services Compensation Scheme.

Safeguarding aims to protect relevant funds if the institution fails, but recovery can involve insolvency procedures, delays and costs. It should not be presented as identical to deposit protection.

Cryptoasset anti-money laundering registration is also distinct from broader financial-services authorisation. Crypto-related permissions and financial-promotion requirements must be assessed separately as the framework develops.

Practical implication: check the permission for the particular product, not merely whether the brand says it is “FCA regulated”.

United States: federal and state requirements overlap

The US does not have one general fintech licence. Responsibilities are divided among federal authorities and state regulators.

Payments can require a state-by-state analysis

A non-bank money transmitter may need licences in multiple states, subject to each state’s laws and exemptions. Federal registration with the Financial Crimes Enforcement Network, or FinCEN, may also apply under the money services business framework.

FinCEN registration concerns federal anti-money laundering obligations. It is not a substitute for state licensing, a banking charter or regulatory approval of a product.

Lending presents another set of questions involving state licensing, interest and fee restrictions, federal consumer law and, where relevant, bank partnerships.

A partner bank changes the structure, not every obligation

Some fintechs provide interfaces for accounts or payment services supplied by an insured bank. In these arrangements, customers should identify the actual bank and establish whether their funds have reached it.

Pass-through federal deposit insurance can depend on the legal ownership structure, records and other conditions. It protects qualifying deposits against the insured bank’s failure—not against every loss caused by a fintech intermediary failing.

Securities and derivatives activities can bring additional federal and state oversight. A money transmission permission does not authorise investment brokerage.

Practical implication: a US provider’s legal position may depend on both the customer’s state and the institutions delivering each part of the service.

Switzerland: the business model determines the licence

Switzerland distinguishes banks, securities firms, portfolio managers and other regulated financial businesses. FINMA is the principal financial-market supervisory authority, although supervision and anti-money laundering arrangements vary by category.

The FinTech licence is not a banking licence

Switzerland has a specific FinTech licence category that permits qualifying institutions to accept public deposits within statutory limits and conditions. Under this model, the accepted deposits must generally neither be invested nor bear interest.

It is therefore not a route to unrestricted deposit-funded lending. Deposits accepted under this licence are not protected by the Swiss deposit insurance scheme.

Other businesses may fall under banking, securities, collective-investment or anti-money laundering requirements. Some financial intermediaries fulfil anti-money laundering supervision requirements through recognised self-regulatory organisations rather than holding a prudential FINMA licence.

Tokens are assessed by function

Swiss regulatory analysis distinguishes payment, utility and asset characteristics, with hybrid tokens possible. The rights attached to a token and its economic function matter more than its marketing label.

Practical implication: “Swiss regulated” is insufficiently precise. Establish whether the provider holds a prudential licence, operates under another supervisory arrangement, or relies on an exemption.

United Arab Emirates: the regulatory location matters

The UAE contains distinct regulatory jurisdictions. A provider operating under the federal framework may face a different authorisation route from one established in a financial free zone.

Federal oversight and financial free zones

The Central Bank of the UAE oversees banking and important payment activities under the applicable federal framework. Other financial and virtual-asset activities can involve different authorities, depending on their nature and location.

Two financial free zones have their own financial regulators:

• Dubai International Financial Centre: the Dubai Financial Services Authority.
• Abu Dhabi Global Market: the Financial Services Regulatory Authority.

Dubai also has the Virtual Assets Regulatory Authority for relevant virtual-asset activities within its jurisdiction, which excludes the DIFC.

A commercial licence from a free-zone authority is not itself a financial-services authorisation. Nor should a financial permission in one UAE jurisdiction be assumed to permit unrestricted business throughout the country.

Practical implication: identify the legal entity, its regulatory jurisdiction and its permitted customer base before comparing UAE providers.

Singapore: integrated supervision, separate activity permissions

The Monetary Authority of Singapore combines central banking and financial supervisory responsibilities. This provides a relatively integrated institutional structure, but not a single licence covering every fintech activity.

Payment services are divided into categories

The Payment Services Act regulates specified payment activities, including account issuance, domestic and cross-border money transfers, merchant acquisition, e-money issuance and digital payment token services.

Depending on the activities and applicable thresholds, a business may require a money-changing, standard payment institution or major payment institution licence, unless an exemption applies.

Customer-money protection requirements depend on the service and licence category. Major payment institutions face safeguarding requirements for relevant customer money under the applicable rules. These arrangements should not be confused with bank deposit insurance.

Investment dealing, financial advice and banking are governed by separate frameworks. Permission to provide digital payment token services does not automatically authorise securities trading or deposit-taking.

Practical implication: check the activities listed in MAS’s directory, not just whether the institution has a payments licence.

How to compare providers across borders

Use the same checklist regardless of country:

1. Identify the contracting entity. One brand may use different companies for different markets or products.
2. Verify its regulatory status. Distinguish authorisation, registration, agency and exemption.
3. Match permissions to the service. Payments permission does not necessarily cover lending, investments or cryptoassets.
4. Trace the money. Determine whether it becomes a bank deposit, electronic money, safeguarded payment funds or another legal claim.
5. Understand failure protection. Check eligibility conditions, exclusions, responsible institutions and potential recovery delays.
6. Check cross-border access and redress. Establish whether the provider can serve that customer and which complaints process applies.

Regulatory sandboxes deserve particular care: participation usually means controlled testing, not unrestricted authorisation or a guarantee of safety.

The most useful comparison is not which country is “fintech-friendly”. It is whether the regulatory structure fits the activity, clearly allocates responsibility and gives customers understandable protections when something goes wrong.