Innovation, payments, and digital assets

The convergence of market dynamics and new regulations will further accelerate the transformation of the payment sector. EU and UK consumers and merchants are demanding more convenience and value amidst a challenging economic environment.¹ Policymakers in both jurisdictions are introducing new regulations to bolster consumer protection, choice, and resilience. These include promoting instant, open banking payments, and Digital ID; finalising stablecoins frameworks; and enhancing anti-fraud measures.

The implementation of virtually all these regulations is set to start in 2024/2025.² Their impact will coalesce over the next two to three years, with significant implications for Payment Service Providers (PSPs).

First, new regulations will intersect with evolving payment preferences of customers and merchants, and growing adoption of enabling technologies such as digital wallets, connected devices, biometrics, and Distributed Ledger Technology (DLT). This will expand the range of Alternative Payment Methods (APMs) and distribution channels that PSPs can, or must, offer.

Meanwhile crypto natives operating in unbacked digital assets markets (e.g., Bitcoin) face a fragmented regulatory landscape, despite the EU Markets in Crypto-assets Regulation (MiCAR) technically going live in 2024.¹¹ MiCAR empowers individual member states (MS) to delay compliance deadlines and maintain local regimes for custodians, exchanges, and other intermediaries to July 2026. MS must declare their plans by June 2024, and some have already done so, e.g., Spain has postponed its MiCAR compliance deadline to December 2025.¹² Adding to this complexity, in our experience, timings to obtain local licences vary between two weeks and two years across the EU27.¹³ As firms determine their location strategies, local approaches to MiCAR will be a key decision factor, along with access to talent, bank accounts, payment infrastructure, and other factors.

The combination of MiCAR compliance costs and persistent revenue pressures, with trading volumes remaining suppressed, will exacerbate profitability challenges for crypto-native firms. Therefore, firms will need to evaluate the regulatory implications for their viability. They must consider not only MiCAR, but also broader FS rules to which they will be subject as regulated firms. A key example is the Digital Operational Resilience Act (DORA), which will require enhanced operational resilience capabilities and business continuity planning. Therefore, we expect some firms may consider exiting the EU market in 2024, as we saw in the UK in 2023 after the implementation of digital asset financial promotion rules.

The UK regulatory framework for unbacked digital assets remains uncertain. Final rules are unlikely before year-end, but we know they will be based on securities rules. Also, existing AML registrations will not automatically convert to full digital asset services licences, meaning that all firms should prepare for heightened scrutiny.¹⁴

Links to wider group entities and client asset protection will be focus areas, drawing on lessons from the 2022 market disruption. Benchmarking against comprehensive MiCAR requirements may help firms prepare until more detailed UK rules emerge.

Regulation of AI is set to take centre stage in 2024, as firms seek to scale their AI capabilities. The EU has taken a bold step by establishing the first comprehensive AI legislative framework – the Artificial Intelligence Act (AIA) – set to enter into force by H1 2024.

The EU is eager to establish the AIA as a global standard, and its extraterritorial impact on any AI system that affects EU residents may yet lend it some clout. However, regulatory divergence is more likely. Despite agreeing high-level principles for international cooperation, major jurisdictions are pushing ahead with their own national approaches.¹⁵ The US, home to some of the largest AI companies, is a prime example, as illustrated by President Biden's recent Executive Order on AI.

The AIA has also received mixed responses, with some industry representatives and policymakers outside the EU questioning its ability to balance innovation and safety. The UK, for example, has proposed a principles-based, non-statutory framework that leverages existing regulatory structures and frameworks. This approach aims to avoid overregulation and mitigate the risk of requirements becoming outdated quickly due to the rapid pace of innovation.

Nevertheless, as the AIA’s implementation begins in 2024 firms must understand its requirements and implications, especially as they start scaling their AI solutions.

The AIA classifies and regulates AI models and systems based on their potential risk to society and individuals. FS firms using AI systems deemed high-risk – such as those of credit and life/health insurance risk assessments, staff monitoring, and recruitment - will face significant compliance demands. Similarly, use of General Purpose AI models and systems will also be subject to strict requirements. The decision to develop in-house or use off-the-shelf AI systems will be strategically important. AI providers – i.e. developers or commissioning firms – will have to comply with some of the AIA’s strictest obligations. Firms also need to manage grey areas, such as where material customisation of third-party AI systems may cause them to be considered developers.

Multinational firms operating in both the EU and other jurisdictions must decide whether to embrace AIA standards globally or adopt EU-specific AI systems. Compliance costs and limits to innovation are among the downsides, while increased trust and reduced risks are potential upsides. Some FS firms – or their Third-Party Providers (TPPs) – may choose to scale back AI development or deployment in the EU to avoid the more comprehensive AIA requirements altogether. Some uncertainty will remain. AIA technical standards, against which firms must demonstrate compliance, will not be available until later in 2024 or 2025. Nevertheless, firms will possess sufficient information to assess their overall exposure, conduct a high-level gap analysis against key requirements, and devise an initial plan of action for product strategy and governance response.

In addition, while AI-specific legislation is a critical component of AI regulation within FS, it is just one piece of a much larger puzzle. Firms will also need to grapple with the existing and technology-neutral regulatory frameworks – such as data and consumer protection, model risk management, and operational resilience – as they apply to their AI use cases.

In the UK, in the absence of an AIA equivalent legislation, supervisors will rely on these frameworks to scrutinise firms’ use of AI. The Financial Conduct Authority (FCA), for example, has been particularly vocal about its plans to use the Consumer Duty to oversee AI conduct risks. Similarly, in the EU, regulations such as the General Data Protection Regulation (GDPR) and DORA will intersect with the AIA, although the degree of interaction will only become clearer once AIA technical standards emerge.

In summary, the regulatory changes surrounding retail payments, digital assets, and AI have created a complex and evolving landscape for FS firms. As firms adapt to this shifting regulatory environment and new digital financial markets, they must navigate a range of strategic opportunities and challenges.