Payments Services Directive 3 (PSD3) is in motion. The Date (Use & Access) Act (DUAA) has passed. Financial Data Access regulation (FiDA) – for all its controversy – is still somewhere on the European Commission\u2019s desk. The regulatory architecture of open finance is being built in real time. But here\u2019s what the regulatory debate tends to obscure: compliance and risk management are not the same thing.<\/p>\n\n\n\n
You can be fully compliant and still be exposed. You can tick every box your regulator requires and still have no clear answer to the question of who bears the liability when something goes wrong in your open finance chain.<\/p>\n\n\n\n
What the regulation requires – and what it leaves unanswered<\/strong><\/p>\n\n\n\n PSD3, FiDA, and the DUAA set out who can participate, under what conditions, and with what rights. What they do not do is manage the risk that operates within those boundaries. Regulation tells you who is allowed in the room. It does not tell you whether the people in the room are safe to share data with.<\/p>\n\n\n\n The picket fence problem<\/strong><\/p>\n\n\n\n Regulators are, by design, vertical. They own their segment; banking, payments, insurance, pensions. Think of them as the slats in a picket fence: effective within their boundaries, entirely blind to what happens in the gaps between them.<\/p>\n\n\n\n Open finance doesn\u2019t stay in its lane. Data moves horizontally – across segments, across sectors, across borders. A consumer shares banking data with a fintech that uses it alongside income data and insurance data. The data has crossed three regulatory verticals. No single regulator has jurisdiction over the whole journey.<\/p>\n\n\n\n That is not a failure of regulation. It is a structural feature of how open finance works. Cross-segment risk management cannot be solved by regulation alone. It has to be built by the market.<\/p>\n\n\n\n Point-in-time compliance is not enough<\/strong><\/p>\n\n\n\n Onboarding checks and annual audits tell you what a participant looked like at a fixed moment. A fintech that was fully compliant at accreditation can suffer a cyberattack six months later. In a real-time data ecosystem, ongoing dynamic risk monitoring isn\u2019t a nice-to-have. It\u2019s the minimum viable approach. <\/p>\n\n\n\n Money20\/20 Europe<\/strong><\/p>\n\n\n\n On 3 June at Money20\/20 Europe, Louise Beaumont <\/a>will chair \u2018Regulation as the Edge in Open Finance\u2019 on the Horizon Stage, with Agnieszka Scott<\/a> (Head of Smart Data, UK Government), Michael Salmony <\/a>(EU regulation expert) and Todd Clyde <\/a>(CEO, Token). Horizon Stage. 12:15. Come armed with your views.<\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Payments Services Directive 3 (PSD3) is in motion. The Date (Use & Access) Act (DUAA) has passed. Financial Data Access regulation (FiDA) – for all its controversy – is still somewhere on the European Commission\u2019s desk. The regulatory architecture of open finance is being built in real time. But here\u2019s what the regulatory debate tends […]<\/p>\n","protected":false},"author":15,"featured_media":1126,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,9],"tags":[14,19,21],"class_list":["post-1125","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-insights","category-open-banking","tag-open-banking","tag-open-finance","tag-open-finance-risk-management"],"yoast_head":"\n