Coordination Between Data Protection and Financial Authorities in Emerging Markets
Yue Wu, Abdulrahman Adebayo, Johanan Awah, Csaba Dosa, Shibhangi Ghose, Mark Farrell, Caroline Macharia, Milicent Malau, Tony Oche, Pavle Avramovic, Max Bentovim, Tanya Ghuman, Sarah Ombija.
Digital financial services run on data. Identity checks, fraud controls, open finance, credit models and cross-border payments all sit under two regulatory regimes at once: data protection and financial regulation. These regimes grew up through separate institutions, with separate mandates, international networks and ways of working. As finance has become a data business, they now govern many of the same activities, firms and records.
That makes the bridge between data protection and financial regulation one of the most consequential links in the regulation of digital finance. No single authority can regulate digital financial services alone. Whether customers can trust how their data is used, whether fraud signals can be shared lawfully, whether open finance can launch on settled terms, who answers when an automated credit decision goes wrong – these all depend on how well the two sets of authorities work together.
The same lessons apply to the other regulatory and public authority boundaries that digital finance increasingly crosses, from competition to telecommunications, health to energy, transportation to housing to education. As data becomes increasingly central to all walks of life, they become increasingly central to both what is being regulated and administered by governments and public bodies, and how those institutions effect their public purposes. Data protection – and data protection authorities – therefore structurally intersect and overlap with the work of more and more of their counterparts. Those intersections and overlap in substance do not, however, translate automatically into joined-up work. Like developing cities with increasing potential for interchange and trade but seperated by rivers, bridges must be built. Financial regulation, itself intersecting with so many other aspects of life and work, is in importance and urgency where these first bridges must be slated for construction.
This report finds that co-ordination is falling short of what is needed to keep pace with technological and market change, but that the main obstacle is institutional rather than legal. Most of what authorities need to work together is already within their reach.
Produced by Financial Innovation for Impact (Fii), in collaboration with the Cambridge Centre for Alternative Finance (CCAF), the report draws on 27 interviews and 4 convenings with data protection and financial authorities, international bodies, industry and civil society. It covers 10 emerging markets and developing economies:
- Brazil
- Ethiopia
- India
- Indonesia
- Kenya
- Nigeria
- Pakistan
- the Philippines
- South Africa
- Uganda
It is written for regulators, international organisations and standard-setters, development partners, and market, academic and other stakeholders in the regulation of digital financial services. The research is supported by the Gates Foundation.
Highlights from the report
1
Overlap is structural – the co-ordination gap is institutional
Financial regulation and data protection now govern many of the same activities, companies and markets. Where a data protection authority is operating, the legal tools to settle the questions this overlap raises are generally in place. Half the focus countries have statutes that direct the authority to coordinate with other regulators (Brazil, Nigeria and the Philippines) or provide for delegation or sectoral codes (Kenya and South Africa). What is missing is the machinery to make co-ordination routine and effective. The issue isn’t willingness: authorities on both sides said they want to co-ordinate more, and better.
2
Co-ordination is growing, but it is often partial, ad hoc or fleeting
Contact points, joint guidance, sandboxes and information-sharing arrangements exist in several focus countries. However, most are bilateral, event-driven or dependent on individuals, and some exist on paper only.
3
One authority often arrives late
In open finance, fraud prevention and AML/CFT, financial-sector frameworks were typically designed before the data protection authority was involved. Reconciliation then happens after launch, when it is costlier and less effective.
4
Capacity is unequal, and the asymmetry shapes the relationship
Data protection authorities are often newer and smaller, yet responsible for every sector of the economy. Financial regulators are generally older, better resourced and embedded in international standard-setting. Without deliberate design, joint work drifts towards one authority’s priorities.
5
The international architecture reproduces the gap
Financial standard-setters set standards and assess their implementation; data protection bodies mainly convene. Early bridges exist, such as the FSB’s Forum on Cross-Border Payments Data and the FATF’s July 2026 call for joint guidance, but they are recent and mostly convened from the financial side.
6
Where there is no data protection authority, the financial regulator fills the space, at a cost
At the time of publication, India, Indonesia and Pakistan lacked a fully operational data protection authority. In such jurisdictions, financial regulators often protect data through their own licensing perimeter, so protection stops where the perimeter does, and data-driven services may narrow to licensed firms. The period before an authority is established is also the cheapest time to design co-ordination in.
7
The costs fall hardest on those with the fewest alternatives
Compliance uncertainty weighs most on smaller and newer providers. Harms that fall between mandates weigh most on low-income consumers, women and rural users, who have less capacity to pursue redress through 2 authorities.
From evidence to action: 7 recommendations and a way to measure progress
The report traces the shortfall to 5 impediments that reinforce one another and shows how they play out in three patterns across the focus countries. It recommends 7 interlocking forms of work, most of which authorities can begin under powers they already hold:
- Start with one shared problem and make the result visible.
- Designate counterparts and referral routes.
- Bring the data protection authority in at the design stage.
- Develop joint guidance.
- Build each authority’s understanding of the other’s domain.
- Measure and report on coordination.
- Connect national coordination to regional and international standard-setting.
The Regulatory Coordination Index (RCI)
The RCI is a proposed framework for measuring how much coordination exists between a data protection authority and a financial-sector authority. It records whether the pre-conditions are in place: a legal basis, a route to resolve conflicts, and review of the relationship. It then scores how far coordination is practised across information sharing, capacity building, policy design, supervision and enforcement, and maps the results onto the regulatory cycle to show where coordination is concentrated or missing. Paired with outcome data, it supports scenario sizing of what is at stake. The report applies the RCI to the ten focus countries on an illustrative basis, and authorities could adopt it as a self-assessment tool.
The report is accompanied by 10 country case studies (Annex A), a mapping of regional and global initiatives (Annex B) and the quantification methodology (Annex C).