Closing the financial-data regulatory co-ordination gap

Titled ‘Joined-Up Regulation: Coordination Between Data Protection and Financial Authorities in Emerging Markets’, the report examines policy questions for authorities overseeing increasingly data-driven financial markets. Where do the 2 regimes overlap? Why does co-ordination fall short? And what does it take to make it routine? 

Supported by the Gates Foundation, the report gives regulators, standard setters and development partners evidence from 10 countries, 7 practical recommendations and a proposed framework for measuring co-ordination over time. 

Bridging data protection and financial regulation 

Almost every digital financial service – from opening an account to taking out a loan or sending money abroad – depends on personal data. Data protection and financial regulation grew up through separate institutions, mandates and international networks. As finance has become a data business, they now govern many of the same activities, firms and records. No single authority can regulate digital financial services alone. The bridge between the two shapes whether customers trust how their data is used, whether fraud signals can be shared lawfully, whether open finance launches on settled terms and who answers when an automated credit decision goes wrong. 

The report finds that co-ordination is falling short of what is needed to keep pace with technological and market change. Contact points, joint guidance, sandboxes and information-sharing arrangements exist in several of the 10 countries, but most are bilateral, event-driven or dependent on individuals. In open finance, fraud prevention, anti-money laundering (AML) and countering the financing of terrorism (CFT) data protection authorities were often brought in only after financial-sector frameworks had been designed. Internationally, the early bridges between the 2 domains are recent and mostly convened from the financial side. 

Hunter Sims, Co-Founder and Executive Director of Financial Innovation for Impact (Fii), says that “digital finance can only expand choice and control for women and underserved people if they can trust how their data is used. When data protection and financial authorities work together, that trust is easier to build and harder to lose.”

The powers exist – the machinery often does not

Half the focus countries have data protection statutes that either direct the authority to co-ordinate with other regulators or provide for delegation or sector-specific codes, and most regulators said they would value closer engagement. The report distinguishes overlap (which is structural) from the co-ordination gap (which is institutional). Where the research found harm, it was rarely because a legal question was unanswerable. More often, no forum existed in which to ask it, no authority was obliged to ask it or the authority that should have asked was brought in after the answer had been settled. 

Unsettled questions turn into costs and risks for markets and consumers. Firms may collect more data than they need, price in regulatory risk or withdraw from products that are costly to serve. These costs weigh most on smaller and newer providers. Harms that fall between 2 mandates weigh most on low-income consumers, women and rural users who have the fewest alternatives and the least capacity to pursue redress. 

Pavle Avramović, Director of Research and Policy at Fii, says that “as finance becomes a data business, many of the hardest questions in financial regulation now sit at its boundary with data protection: fraud, open finance and AI in credit. Building a bridge across that boundary is becoming a core regulatory capability. This research shows that much of what authorities need is already in place. The task now is to build the institutional habits that put it to use.”

As finance becomes a data business, many of the hardest questions in financial regulation now sit at its boundary with data protection: fraud, open finance and AI in credit.

Pavle Avramović, Director of Research and Policy, Financial Innovation for Impact

From diagnosis to action: 7 recommendations and a way to measure progress 

The report traces the shortfall to 5 impediments that reinforce one another, from capacity gaps to the absence of shared frameworks. It sets out 7 recommendations for authorities and the international bodies that convene them, beginning with lightweight steps oriented towards tangible near-term results: 

• agreeing one shared problem and delivering a visible result 
• designating counterparts and referral routes 
• bringing the data protection authority in at the design stage 
• developing joint guidance 

They then build towards cross-training between authorities, measuring and reporting on co-ordination and connecting national co-ordination to regional and international standard setting. 

To support that measurement, the report proposes the Regulatory Coordination Index (RCI). The RCI scores how far co-ordination between a data protection authority and a financial-sector authority is in place across the regulatory cycle, from information sharing and capacity building to policy design, supervision and enforcement. It is applied to the 10 focus countries on an illustrative basis, and authorities could adopt it as a self-assessment tool to set a baseline and track progress. 

Max Bentovim, Data Protection Lead at Fii, says that “data protection and financial regulators want many of the same things: innovation, competition, consumer protection and trust. What they often lack is a system for pursuing those goals together. The encouraging news from this research is that the building blocks already exist, as does the desire for change. What’s needed are leaders and public servants ready to take the right next steps.”

The encouraging news from this research is that the building blocks already exist, as does the desire for change. What’s needed are leaders and public servants ready to take the right next steps.

Max Bentovim, Data Protection Lead, Financial Innovation for Impact