FinTech Global FS Regulatory Round-up - W/e 25 July 2025

In this edition we round up FinTech-related financial services regulatory developments for the week ending 25 July 2025.

ICYMI

• The Genius Act and other US legislative developments concerning cryptocurrency

UK

SI: The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 – Smart Data

The Data (Use and Access) Act 2025 (Commencement No. 1) Regulations 2025 have been made. Regulation 2(a) brings into force Part 1 of the Act which relates to access to customer and business data in connection with the development of Smart Data schemes. [24 Jul 2025] #SmartData

HM Treasury: Framework for reconnection best practice

HM Treasury has published the G7 Cyber Expert Group (CEG) framework for reconnection best practice. Reconnection is the process of restoring technical access and integration to an organisation that has been technically quarantined after suffering a material cyber incident. The paper provides sector-level guidance to assist jurisdictions and their institutions in developing their own reconnection frameworks for restoring access to an organisation that has suffered a material cyber incident. The guidance is not prescriptive and can be tailored and adapted to institutions of different maturities and complexities. [23 Jul 2025] #Cyber

Government publishes consultation outcome to ransomware proposals

The Government has published the outcome of its consultation on ransomware legislative proposals which included

• a targeted ban on ransomware payments for owners and operators of regulated-critical infrastructure;
• a ransomware payment prevention regime; and
• a mandatory incident reporting regime.

The Government said that the overall response to the proposals was positive; feedback received will inform the development of the policy in collaboration with industry.

With regard to the targeted ban and the payment prevention regime, the Government noted feedback included questions on liability for compliance, particularly with reference to financial institutions which could be asked to process payments on behalf of victim organisations. On the proposed reporting regime, the Government reported that the majority of respondents considered 72 hours was a reasonable timeframe for a victim to make an initial report of an incident. [22 Jul 2025] #Ransomware #Payments

OFSI report: Sanctions compliance in crypto sector – threat assessment

The Office of Financial Sanctions Implementation (OFSI) has published a report which outlines its assessment of threats to sanctions compliance involving UK cryptoasset firms from January 2022 to May 2025.

Key assessment findings include:

• it is almost certain that UK cryptoasset firms have under-reported suspected breaches of financial sanctions to OFSI since August 2022;
• it is likely that most non-compliance by UK cryptoasset firms has occurred inadvertently due to common issues such as direct and indirect exposures to designated persons (DPs) and suspected breaches being identified after a delay in attribution;
• it is highly likely that UK cryptoasset firms have been directly or indirectly exposed to the designated Russian exchange Garantex since its designation in 2023, resulting in breaches of UK financial sanctions; and
• it is likely that UK cryptoasset firms are currently facilitating transfers to Iranian cryptoasset firms with suspected links to DPs.

This publication is one in a series of sector-specific assessments by OFSI addressing threats to UK financial sanctions compliance. [22 Jul 2025] #Crypto #DigitalAsset

Europe

EBA Q&As in relation to DORA

The European Banking Authority (EBA) has published the follow Q&As, which relate to the Digital Operational Resilience Act (DORA):

• Scope of Register of Information for Contractual Arrangements on the use of ICT Services Provided by ICT Third-party Service Providers.
• Elaboration on the meaning of a separated and dedicated network for ICT asset administration.
• The scope of the regulation described in Article 6 mismatches what is presented as an option in the Annex I, Part 2 of the same regulation. [25 Jul 2025] #DORA #OpRes

Australia

Full Court of the Federal Court dismisses ASIC's appeal against decision finding crypto-based product was not a 'debenture'

The Full Court of the Federal Court of Australia (Full Court) has dismissed an appeal brought by ASIC against a decision of the Federal Court of Australia (primary decision), which found that Wallet Ventures Pty Ltd (Wallet Ventures) had not engaged in unlicensed financial conduct.

Facts:

Wallet Ventures, a registered digital currency exchange, operated an exchange service through which customers could buy and sell certain cryptocurrencies. Separately, it also offered a mobile application known as 'Finder', which allowed its customers to access the 'Finder Earn' product. Customers could invest in the Finder Earner product by exchanging funds in their 'Finder Wallet' account to obtain 'TrueAUD' stablecoins, the ownership of which was transferred to Wallet Ventures to enable the customers to earn a 'return' quantified in 'TrueAUD' which, upon the expiry of the term, was credited to the customer's Finder Wallet account in Australian dollars.

Primary decision:

ASIC argued before the primary judge that the Finder Earn product was a 'debenture' within the meaning of the Corporations Act because it involved an undertaking by Wallet Ventures to repay as a debt the money customers deposited with it. If it was a debenture, Wallet Ventures was required to have held an Australian financial services licence, which it did not.

The primary judge rejected the argument that the 'Finder Earner' product was a debenture on the basis that (i) there was no money' deposited with or loaned to' Wallet Ventures and (ii) if there was a deposit or loan, it was not made to Wallet Ventures as part of the company's working capital. The primary judge found that, under the particular terms of service, it was TrueAUD, not money, that was 'transferred or loaned' to Wallet Ventures. Further, the primary judge concluded that, even if there had been a loan of money, the meaning of 'debenture' under the legislation required that it be made as part of the company's 'working capital', which it was not.

Decision of the Full Court:

The Full Court dismissed ASIC's appeal against the primary decision, agreeing with the primary judge that the Finder Earner product did not 'answer the statutory requirement of "money" deposited with or lent to [Wallet Ventures]'. In light of that finding, it was unnecessary for the Full Court to consider the primary judge's separate conclusion that, if there had been a loan of money, it was not part of the company's 'working capital' as required under the legislation.

ASIC is considering the decision. [24 Jul 2025] #Crypto #DigitalAsset

APRA Chair John Lonsdale addresses ABA Conference, promises to 'cut red tape' where possible

The Chair of the Australian Prudential Regulation Authority (APRA), John Lonsdale, delivered a speech at the Australian Banking Association (ABA) Banking Conference. The speech focused on the balance between risk and regulation.

Mr Lonsdale's speech outlined several key risks facing the financial system, especially cybersecurity risks, operational risk and geopolitical risk. He also noted broader economic challenges facing Australia such as weak productivity growth, a lack of dynamism, and cost-of-living pressures.

In response to these challenges, Mr Lonsdale cautioned against responding to these risks with inappropriate or excessive regulation. He stated that APRA has identified areas where regulatory requirements may be adjusted to allow more scope for sensible risk-taking. He noted that introducing regulatory measures that are not essential for financial stability can pose risks in themselves because of their impact on competition and efficiency. At the same time, Mr Lonsdale urged increased vigilance in certain high-risk areas including cybersecurity, warning that financial institutions could not afford to be complacent. He highlighted authentication controls as a critical area for improvement.

Mr Lonsdale concluded by reaffirming APRA's commitment to striking the right balance between regulation and risk – ensuring the financial system supports both system resilience and innovation. He indicated that APRA would 'continue to look for more ways to enhance proportionality and cut red tape where it's safe to do [so]'. [24 Jul 2025] #Cyber

ASIC Chair Joe Longo addresses ABA Conference, highlights opportunities and risks of AI

The Chair of ASIC, Joe Longo, delivered a speech at the ABA Banking Conference . The address, titled 'AI: A Better Blueprint for Banking', outlined the regulator's evolving stance on the use of AI in the provision of financial services.

Mr Longo acknowledged the 'exciting' potential of AI and the potential benefits it offers in the delivery of financial services – including, for example, enhanced scam detection and assessment of customer complaints. At the same time, he cautioned that the technology comes with significant risks. He noted that Australians' trust in AI has declined, partly due to perceptions that it is being imposed on consumers and diminishing the quality of customer service.

Despite the risks AI poses, Mr Longo stated that the position of ASIC was not to 'rush into more AI regulation'. This, he argued, would not be appropriate given, first, existing financial services laws are technology-neutral and therefore already serve as important guardrails in the use of AI. Second, Mr Longo observed that the 'more specific' regulation becomes, the 'more complex' it gets. This complexity makes it 'harder to comply with' and 'harder for regulators to enforce' – while at the same time being a 'handbrake on innovation'. However, Mr Longo noted that ASIC was continually reviewing its position to assess whether further, targeted regulation is required.

In the absence of new, AI-specific regulation, Mr Longo emphasised that financial services providers should expect ASIC to be 'bolder' about how it used its existing powers. His advice for financial firms was to remember that 'good AI innovation keeps the customer front and centre', and he indicated that ASIC had no intention of holding back 'customer-centric AI innovation'.[23 Jul 2025] #AI

Hong Kong

HKMA to publish finalised guidelines on supervision of stablecoin issuers and on AML/CFT requirements by end of July 2025 and an explanatory note on licensing of stablecoin issuers around the same time

The Chief Executive of the HKMA, Mr Eddie Yue, has published an inSight article in which he elaborates on the regulatory perspectives and next steps for implementing the Stablecoins Ordinance, which will come into effect on 1 August 2025.

Mr Yue cautions against undue speculation surrounding stablecoins, noting that a few dozen institutions have already proactively reached out to the HKMA, with some clearly expressing their intention to apply for a stablecoin issuer licence, and others simply looking for a sounding board. Many of such proposals remain conceptual and lack practical use cases. The institutions also fail to put together viable and concrete plans as well as implementation roadmaps. Mr Yue reiterated that the HKMA will at most grant a handful of stablecoin issuer licences at the initial stage.

The hype surrounding stablecoins has also led to excessive exuberance. For example, a mere announcement of intention to explore stablecoin-related business would send stock prices and trading volumes soaring. Moreover, fraudulent activities have recently been observed under the guise of promoting digital assets and stablecoins, resulting in public losses. A key concern lies in ways to prevent stablecoins from being used by criminals as a tool for money laundering, especially in cross-border use cases. The Bank for International Settlements emphasised at great length in their latest Annual Economic Report the importance of preventing money laundering risks associated with stablecoins.

Looking ahead:

• The HKMA is currently refining the draft guidelines on supervision of stablecoin issuers and on anti-money laundering (AML) and counter-financing of terrorism (CFT) requirements (see our previous update for the consultations), based on the consultation feedback received. The target is to publish the guidelines by the end of July 2025, and it is expected that the final version will not differ significantly from the consultation drafts. However, in light of shared international regulatory concerns, more stringent requirements will be imposed in respect of AML to minimise the risks of stablecoins being used as a money laundering tool.
• The HKMA will release its 'Explanatory Note on Licensing of Stablecoin Issuers' in the week commencing 28 July 2025, which will outline the HKMA's arrangements for accepting and processing licence applications. [23 Jul 2025] #Stablecoin #DigitalAsset

Malaysia

BNM: MIFC Global Impact Challenge 2025 is open for applications

BNM has announced that the Malaysia International Islamic Financial Centre (MIFC) Global Impact Challenge 2025 is open for applications. The competition calls for impact-driven financial solutions with propositions to strengthen social resilience and address climate challenges. This aims to spur innovative solutions in Islamic finance and encourage investments in fintech and impact-driven startups.

Shortlisted applicants will participate in the accelerator programme which is structured to help applicants improve the commercial viability of their solutions as well as strengthen their measurable impact. Up to four winners will be selected on the demo day on 12 October 2025 and they will be announced at the Global Islamic Finance Forum 2025 on 13 October 2025 in Kuala Lumpur. In addition to cash prizes, winners will receive a broad range of support from the partners for up to 12 months.

Applications close on 18 August 2025. [18 Jul 2025] #Fintech

Thailand

SECT requests comments on proposed ICO portal regulations – knowledge and suitability tests

The Securities and Exchange Commission Thailand (SECT) is seeking comments on proposed regulations regarding the criteria for investor communication and service provision by initial coin offering (ICO) portals. The proposed regulations would require ICO portals to ensure that investors who are not institutional investors, ultra-high-net-worth investors, or high-net-worth investors complete a knowledge test before investing unless they have previously passed such a test. Additionally, ICO portals would be required to conduct a suitability test for all investors in digital tokens, and this assessment must be reviewed and updated at least every two years.

Feedback is requested by 1 August 2025. [18 Jul 2025] #DigitalAsset

Philippines

SECP hosts UNDP and Philippine Human Development Network report launch: AI as a driver of sustainable development

The SECP has hosted an event to mark the launch of a report by the UN Development Programme (UNDP) and the Philippine Human Development Network which highlights the increasing role of AI in driving inclusive and sustainable human development.

SECP Commissioner Javey Paul D. Francisco commented, 'AI can help us direct capital toward sustainable enterprises, enhance market integrity, and protect investors more effectively than ever before, but innovation must go hand-in-hand with responsibility.' [18 Jul 2025] #AI

SECP issues reminder that crypto rules and guidance entering into force on 5 July

The SECP has published a reminder that its rules on cryptoasset service providers (CASP) and guidelines on the operations of CASPs officially took effect on 5 July 2025. The rules apply to all CASPs which offer or engage in one or more cryptoasset services and third-party service providers who engage in the marketing of cryptoassets and cryptoasset services. This includes entities that operate or make available digital platforms through which such cryptoasset services are provided. [16 Jul 2025] #Crypto #DigitalAsset

US

GENIUS Act signed into law

The President signed the GENIUS Act into law on July 18, 2025. The Act creates a regulatory system for stablecoins.

Statements on the enactment have been issued by:

• the Secretary of the Treasury Scott Bessent;
• the Comptroller of the Currency Jonathan V. Gould;
• the Chair of the SEC Paul S. Atkins;
• SEC Commissioner Hester M. Peirce; and
• the Acting CFTC Chair Caroline D. Pham.

For more on the GENIUS Act and other crypto-related legislation, see our recent article: The Genius Act and other US legislative developments concerning cryptocurrency. [18 July 2025] #Stablecoin #Crypto #DigitalAsset

CFTC Commissioner hosts regulators' roundtable in London

The CFTC has reported that Commissioner Kristin Johnson convened the third annual international financial markets regulation roundtable in London. The roundtable attendees discussed the increasing integration of AI, cyber threats, and the adoption of digital assets.

Roundtable attendees included representatives of the Federal Reserve Bank of Chicago, the Bank of England, the UK Financial Conduct Authority, Banco de España, the European Securities and Markets Authority (ESMA), Deutsche Bundesbank, the Comisión National del Mercado de Valores, the City of London, the Financial Action Task Force (FATF), the Cambridge Centre for Alternative Finance, and the London School of Economics Law School, among others. [18 Jul 2025] #AI #Cyber #DigitalAsset

FINRA Foundation releases sixth wave of financial capability study

The FINRA Investor Education Foundation has released the sixth wave of the National Financial Capability Study; the study has been conducted every three years since 2009. Among the headlines which the foundation's press release identifies are that there has been a decline in 'adults' ability to make ends meet and save for emergencies' and that 20% of adults are interesting in financial advice from AI. [16 Jul 2025] #AI