Enabled by artificial intelligence (AI), big data, cloud computing and other innovation in financial technology, FinTech enhances efficiency and productivity by reducing costs such as transaction costs and intermediation costs, ultimately serving the public good. Beyond improving institutional efficiency, FinTech expands access to financial services and grants users greater autonomy in decision-making, fostering financial inclusion while enhancing the quality of consumer choices. However, these advancements are accompanied by new risks, requiring a regulatory approach that carefully balances financial innovation with consumer protection and systemic risk. Regulators must navigate the delicate balance between fostering competitiveness and ensuring financial stability and integrity in the evolving FinTech landscape. Against this backdrop, Professors Ross Buckley, Douglas Arner and Dirk Zetzsche’s FinTech: Finance, Technology and Regulation offers a timely and comprehensive analysis of the FinTech revolution, offering valuable insights into its opportunities, challenges and the regulatory frameworks needed to address its far-reaching implications.

After the introductory Chapter 1, the book is structured into five parts. Part I (chs. 2–6) establishes the conceptual framework for understanding the FinTech by examining its history, evolution and structural foundations. Chapter 2 highlights the enduring interconnection between finance and technology, noting their mutually reinforcing development over time. The authors divide FinTech evolution into four distinct periods. FinTech 1.0 (1866–1967) was shaped by electrification, with technologies such as the telegraph enabling the rapid transmission of financial information. FinTech 2.0 (1967–2008) marked the transition from analogue to digital financial services, driven by computerisation (including financial calculators and personal computers), mass communication technologies (such as the Internet and mobile devices) and the rise of electronic payments, alongside the shift from paper-based processes to digital mechanisms and the move from physical to electronic securities trading. FinTech 3.0 (2008–2019) was characterised by the widespread application of transformative technologies, shaped by the 2008 global financial crisis and the subsequent expansion of regulatory frameworks. FinTech 4.0 (2020–present), by contrast, has been driven by the COVID-19 pandemic, the rise of large digital platforms, the development of central bank digital currencies and advancements in AI. While the distinction between these periods is open to debate (e.g. big technology firms had begun offering financial services well before the pandemic accelerated these trends), this categorisation nonetheless provides a useful framework for understanding FinTech’s evolution. Although not explicitly stated, the book primarily focuses on FinTech developments that emerged in the aftermath of post-crisis regulatory change.

For regulators, post-crisis reforms have shifted focus from frameworks of restrictive versus permissive regulation to comprehensive macro- and micro-prudential approaches, coupled with broader consumer protection efforts. In response to FinTech innovation, regulators typically adopt one of four main strategies. First, some take a permissive approach, allowing innovation to develop with minimal intervention, stepping in with regulation only when necessary, as seen in China. Conversely, others proactively establish new regulatory frameworks or reform existing ones to accommodate FinTech developments, such as the introduction of FinTech-specific regulations for equity and loan crowdfunding. Between these extremes, some regulators adopt a cautiously permissive stance, exercising case-by-case discretion through mechanisms such as no-action letters, restricted licensing or regulatory forbearance. The fourth approach involves creating structured environments for controlled experimentation, such as regulatory sandboxes, which provide a “safe space” for disruptive innovations to be tested under supervision. Chapter 3 underscores the necessity of “smart regulation” to balance innovation with financial stability, while Chapter 4 explores the role of regulatory technology (RegTech) in modern financial oversight. In the light of extensive mandatory data disclosures since 2008 and the growing digitalisation of financial services, RegTech facilitates a transformation in financial regulation by enabling real-time risk detection and regulatory compliance monitoring. By leveraging automation and digitalisation, RegTech not only enhances regulators’ ability to identify risks and discrepancies but also assists financial institutions in meeting compliance requirements in areas such as know your customer (KYC) processes, anti-money laundering (AML) measures, prudential reporting and stress testing.

The COVID-19 pandemic tested the resilience of digital financial infrastructure. Chapter 5 highlights that the data-driven nature of digital finance has enabled policy-makers to structure and scale stimulus measures with precision, providing mechanisms to monitor financial and economic conditions and directly allocate resources to those most in need. At the same time, lockdowns and social distancing accelerated the digitisation and datafication of the financial sector. This transformation has been particularly evident in areas such as electronic payments and digital money, the adoption of RegTech and supervisory technology (SupTech), the use of digital identity and market integrity measures for AML and countering the financing of terrorism and the expansion of digital finance platforms. Chapter 6 then identifies three main interconnected drivers of such digital financial transformation: namely efficiencies and performance enhancements (stemming from both conventional and data-driven economies of scale), financial inclusion (aimed at providing affordable financial services to all) and financial sustainability.

Part II (chs. 7–11) explores the major emerging technologies underpinning the digitisation and datafication of finance in the FinTech era, including AI, distributed ledgers, decentralised finance (DeFi) and big data. AI is essentially a software system that mimics human cognitive functions through machine learning and can leverage data to infer the probability of an event based on prior knowledge of related conditions. Its ability to process large-scale data (including data collection, analysis, decision-making and execution) underpins its important role in strategy setting, compliance and risk management, among others. Advantages of cost savings, enhanced efficiency, new opportunities brought by AI do not come without risks. However, the traditional regulatory approaches like sanctioning (e.g. withholding compensation, naming and shaming, and financial penalties) would have little meaning for AI. Following Singapore’s practice, which requires organisations to ensure that AI-driven decision-making is explainable/transparent/fair and that AI solutions remain human-centric, Chapter 7 argues that human responsibility is central to addressing the challenges posed by AI’s black-box nature and proposes AI-adjusted personal responsibility frameworks. For example, individuals should conduct thorough due diligence in assessing dataset bias, data gaps and data quality, while AI’s functions, limitations and risks should be explainable to a responsible person.

Chapter 8 examines distributed ledger technology (DLT) and blockchain as information storage devices. While DLT-based financial market infrastructure can enhance speed and reduce costs by removing the need for a centralised ledger provider for clearing, settlement and recording, it also presents challenges such as operational risks and systemic risks. These challenges necessitate careful regulatory considerations, requiring regulators to define the applicable financial and private law frameworks as they apply to distributed ledgers and to determine where liability should be assigned. Enabled by DLT and other technologies, financial services can now be delivered in a decentralised manner. This decentralisation, or disintermediation, remove geographical borders, jurisdictional constraints and centralised control, posing a direct challenge to traditional state-based regulatory systems. To address enforcement challenges, data protection concerns and security risks, Chapter 9 proposes embedded regulation based on the earlier discussion of RegTech. However, further refinement is needed in terms of implementation strategies and practical application.

Both AI and DLT rely fundamentally on data. Financial firms use client data to assess credit risk and determine the suitability of financial products, while for some tech companies, such data have even become principal assets in the financial services value chain. Accordingly, Chapter 10 focuses on data regulation in the context of data-driven finance, offering a comparative analysis of the EU’s general approach (e.g. General Data Protection Regulation [GDPR]), the more laissez-faire and sector-specific approach in the US and the regulatory practices of China and India. These differing regulatory approaches reflect the cultural values and aspirations of each jurisdiction, shaping how data are acquired and used. For instance, the relatively relaxed data protection regulations in the US and China have facilitated the emergence of major tech firms that dominate their respective data sectors

Innovation is also deeply embedded in the regulatory approach, driving a shift from a static framework reliant on ex-ante authorisation and ex-post enforcement to a more dynamic system better suited to the rapidly evolving financial sector. One common regulatory tool is the regulatory sandbox, which offers a controlled testing environment where FinTech firms receive temporary exemptions from certain regulatory requirements. However, Chapter 11 argues that due to entry restrictions, limitations on target customers and other uncertainties, innovation hubs may be a more effective means of fostering market benefits traditionally associated with sandboxes, such as promoting a pro-innovation message and facilitating regulatory learning. The chapter emphasises that regulators should prioritise the development of robust innovation hubs, where firms can engage with regulators and receive guidance on navigating regulatory frameworks, with sandboxes functioning as a complementary tool within these broader hubs.

Part III (chs. 12–15) shifts the focus to the role of digital financial infrastructure in advancing financial digitalisation. Drawing on India’s FinTech strategy, Chapter 12 identifies four pillars of digital financial infrastructure: digital identity and e-KYC as foundational elements, mobile money and payments to enhance financial connectivity, digital government services to broaden accessibility and the development of innovative financial services (such as credit, investment and insurance) built upon these infrastructures. Chapter 13 further explores digital identity as a transformative enabler in financial services, highlighting how the Internet has redefined traditional identity verification methods by incorporating dynamic behavioural characteristics, such as social media activity and online consumer behaviour. It examines national digital identity systems like India’s Aadhaar, Australia’s GovPass and the European eIDASR, assessing their role in mitigating risks such as fraudulent e-identities, privacy loss, monopolisation and the misuse of market power. Additionally, the chapter explores how digital identity advancements facilitate paperless verification and due diligence, streamlining the account opening process. The discussion concludes by considering the integration of sector-specific e-KYC utilities into broader digital identity frameworks.

DLTs and blockchain offer innovative payment solutions aimed at enhancing safety and efficiency, which are key policy objectives of traditional bank-intermediated and state-centred national payment systems. In particular, the introduction of global stablecoins, such as Facebook’s Libra (later renamed Diem), backed by major fiat currencies and financial instruments, has disrupted sovereign fiat currencies and traditional payment systems. In response, central banks worldwide have introduced central bank digital currencies (CBDCs). Chapter 14 presents case studies on various national CBDC initiatives, including China’s central bank digital currency/electronic payments project, Sweden’s pilot programme for the e-krona and its project to test cross-border retail CBDC payments, the European Central Bank’s Digital Euro project and the Bahamian Central Bank’s Sand Dollar. The chapter also critically considers the different design choices for CBDCs such as centralised, decentralised or hybrid model, along with the corresponding opportunities and regulatory challenges. The authors predict that successful CBDCs will most likely emerge through public–private partnerships, where central banks define the framework, interfaces and accounts, while the private sector (including commercial banks, payment system operators and FinTech firms) develops applications and operational interfaces to serve mass clients effectively.

Chapter 15 focuses on the European experience in the digitisation and datafication of finance, consolidating discussions on the EU that were previously scattered across earlier chapters. The extensive reporting obligations imposed on financial intermediaries since the 2008 financial crisis have accelerated Europe’s financial digital transformation and driven the evolution of RegTech. However, while stringent data protection regulations such as the GDPR safeguard consumer privacy, they may also be seen as limiting the potential of fully data-driven business models by restricting the benefits of prior data-gathering activities. In contrast, the EU’s Second Payment Services Directive has facilitated the entry of technology firms into the payments sector by requiring incumbent financial intermediaries to share client data with third parties, including emerging competitors. Alongside digital identity frameworks such as the eIDASR, financial regulation, data protection and payments emerge as key driving forces shaping the EU’s digital financial transformation and RegTech ecosystem. This approach differs from the US’s highly market-driven model and India’s centralised strategy. Given the deep intertwining of finance, data and technology, it is suggested that well-designed RegTech ecosystems may better achieve regulatory objectives by balancing innovation with risk management. At the same time, most jurisdictions may benefit from both a general data regulation framework and a specialised regulatory regime tailored specifically to the financial sector.

Unlike the risks associated with FinTech explored in the preceding chapters, Part IV (chs. 16–19) examines the “darker aspects” of digital financial transformation, specifically how scale and market concentration may hinder innovation and competition in the era of FinTech 4.0. This book refers to technology companies offering financial services as TechFins. Different from FinTech start-ups which seek to disrupt the incumbents, TechFins are established tech companies leveraging their pre-existing data to provide financial services. Sourced from software, hardware, social media, search engines, e-commerce and telecommunications companies, this data advantage grants TechFins significant market power. Additionally, digital finance platforms (DFPs) have emerged as key players, benefiting from network effects and economies of scale. Unlike digital e-commerce platforms, DFPs are not parties to the financial transactions conducted on their platforms but instead facilitate and execute decisions for third-party transactions within a comprehensive financial ecosystem. While TechFins’ extensive data capabilities can lower transaction costs, enhance business decisions and promote financial inclusion, Chapter 16 aptly points out the potential risks arising from the increasing concentration of technology and finance, including reduced competition, stifled innovation, security vulnerabilities and rising inequality – a phenomenon the authors describe as a new “digital too-big-to-fail” (p. 263).

Following digitisation and datafication, the authors argue that technology risk should no longer be classified under operational risk but instead recognised as a distinct category of risk. Among these, cybersecurity has emerged as the most significant source of systemic risk in the financial sector, with potentially catastrophic effects on the real economy. The increasing reliance on complex digital information technology hubs heightens cyber exposure, while cyberattacks can disrupt payment systems, corrupt data and cripple financial infrastructure. The convergence of national security and financial stability in the cyber domain further complicates the risks involved. To mitigate uncertainty in the event of a cyber-induced crisis, Chapter 17 advocates for coordinated efforts at multiple levels: nationally (to address national security concerns), sectorally (to safeguard financial stability) and within the industry (e.g. FinTech firms assess system vulnerabilities and associated costs). The chapter outlines seven key steps for addressing new tech-induced threats (pp. 281–82).

The existing regulatory frameworks for financial services are not equipped to regulate TechFins, which have, to some extent, operated outside traditional regulatory oversight. Consequently, licensed financial intermediaries face higher supervision and compliance costs compared to unregulated TechFins, while potential systemic risks associated with TechFins may accumulate unnoticed. Chapter 18 highlights the necessity of preserving a competitive market environment while developing tailored regulatory criteria for TechFins operating in financial markets. These measures are essential to safeguarding consumer protection and effectively monitoring and mitigating systemic risks. Unsurprisingly, the authors strongly support China’s decision to classify Ant Financial, a Chinese TechFin and DFP serving billions, as a systemically important financial institution (SIFI), thereby bringing it within the regulatory perimeter.

The winner-takes-all effect in digital finance has driven technology-induced centralisation, paradoxically reversing the earlier trends of disintermediation and decentralisation. In response, Chapter 19 examines regulatory approaches to DFPs, ranging from a laissez-faire stance to more interventionist measures such as unbundling. Given that platform dominance stems from control over both data and liquidity, the chapter argues that data gathering and analytics for financial activities (such as lending, asset management, custody and risk management) should be classified as regulated activities, thereby subjecting them to appropriate financial oversight. To mitigate concentration risks in financial services, the authors further advocate for an open data requirement or, more radically, the partial nationalisation of data pools by converting them into public–private joint ventures for firms with strong or dominant market positions.

Part V (ch. 20) concludes the book by emphasising the pivotal role of technology in shaping today’s financial systems. Looking ahead, the financial sector must be prepared for potential fragmentation in the light of the resurgence of geopolitical conflicts, unforeseen crises and the long-term challenges posed by climate change. Lessons from recent decades highlight the necessity of developing new regulatory frameworks alongside digital financial infrastructure. These frameworks should adopt a broader analytical lens, integrate technological advancements, maintain a pro-innovation stance and foster cross-border harmonisation to address the complexities of an evolving financial landscape.

Buckley, Arner and Zetzsche’s central message is clear: while FinTech mitigates inefficiencies in traditional finance (e.g. information asymmetry, agency problems, transaction costs and fragmented liquidity), it simultaneously introduces new risks, requiring regulatory adaptation. Their book offers a comprehensive examination of these challenges from the perspective of traditional financial institutions and regulators. By examining FinTech’s impact on financial systems, regulatory frameworks and market competition, it offers a nuanced assessment of both opportunities and risks, alongside strategic recommendations for navigating this rapidly evolving sector. Although its broad scope results in discussions on topics such as data protection and regulatory approaches being dispersed across multiple chapters, this structure reflects the deeply interconnected nature of FinTech-related issues, highlighting the complexity of the field. Given the growing emphasis on financial inclusion as a key benefit of FinTech, a more in-depth exploration of P2P lending, crowdfunding and their regulatory implications in addressing finance gaps for small businesses and low-income individuals would have been beneficial. Expanding the analysis to consider digital banks, online lending and mobile wealth management from the perspective of financial consumers and investors could also provide further insights. Additionally, future research could build on the book’s findings by examining the evolving regulatory treatment of blockchain-based cryptocurrencies and initial coin offerings (ICOs), which remain critical areas of financial innovation and policy development.

To conclude, FinTech: Finance, Technology and Regulation fills a crucial gap in the existing literature by framing finance, technology and regulation as the three key drivers of FinTech. Its focus on the regulatory aspects of tech-driven risks offers invaluable insights for policy-makers and regulators at both domestic and regional/international levels, making it an essential resource for those shaping the future of financial regulation. At its core, the book underscores, on the one hand, the imperative of balancing financial innovation and efficiency with financial stability and integrity to safeguard consumer protection and mitigate systemic risks and, on the other hand, advocates for a reformed regulatory approach to promote financial inclusion, enhance resilience and support sustainability. For researchers, practitioners and students seeking a deeper understanding of the ongoing FinTech revolution or financial regulation more broadly, this book serves as an authoritative and indispensable reference.