Risk & Compliance | Banking & Fintech | Payments & Digital Assets | Views my own

Joined March 2011
I'm very happy to share a new article — "In Defense of the Second Line of Defense: The Role of Independent Risk Management" — just published in the 2023 Starling Compendium. To access, click through, choose join, and "Observer Status" (which is free). insights.starlingtrust.com/c…
2
3
18
2,269
"Operational efficiency, automation and productivity were the highest-rated areas of perceived benefit from #AI today. … The highest-rated areas of perceived risk to firms from AI today were data protection and security, third-party and supply chain risk, and GenAI-specific risks (eg, hallucinations, prompt injection or manipulation, data leakage via prompts/outputs, etc). … The most cited perceived regulatory constraints were related to UK data protection and privacy, and international regulation. … Oversight of third party AI systems was the most commonly reported area of governance uncertainty or implementation challenge." bankofengland.co.uk/report/2…
1
15
From the report, Chart 14: Respondents expected all firm-level risks to increase in the future.
8
"The use of fiat-backed #stablecoins (stablecoins) in financial services around the world is on the rise, and one key emerging use of these stablecoins is as a method of faster and easier payments, particularly across international borders. … The proposed Regulations clarify the statutory prohibitions on issuance of stablecoins, including restrictions against (1) making false or misleading representations, (2) paying interest or yield tied to the holding of a stablecoin, and (3) representing a stablecoin as legal tender, a deposit or proof of deposit, or as insured under a public deposit insurance system or guaranteed by the Government. … However, a reward or payment that is tied to only the use and not the holding of a stablecoin, including through income-sharing arrangements, is permitted to encourage adoption of the stablecoin." gazette.gc.ca/rp-pr/p1/2026/…
1
49
From the regulatory analysis section
7
"Firms are increasingly using #AI and other third party tools in their financial crime systems and controls. They must apply governance and oversight to these and remain accountable for managing the financial crime risks they present. … [Self-assessment question:] Where the firm uses AI or machine learning to support fraud detection, customer verification, monitoring or other financial crime controls, how does it ensure that these tools are explainable, appropriately governed and subject to independent validation? … [Example of poor practice:] The firm deploys automated, AI-enabled or machine learning controls without understanding, oversight, testing or validation of how they operate, including whether they remain effective and resilient to AI enabled manipulation or other vulnerabilities over time." fca.org.uk/publication/consu…
1
37
"Financial authorities should adopt #regulatory_frameworks that are: (i) Forward-looking, fit-for-purpose, and risk-based to remain responsive to innovation, evolution in the financial system, and changing business models. … To remain effective, regulatory and supervisory policies by financial authorities, including supervisory processes and practices (collectively, "frameworks"), must keep pace with the dynamic financial sector. While preserving sufficient predictability, these frameworks are most effective if they adapt to new vulnerabilities, technologies, offerings, and economic conditions." fsb.org/uploads/P141026-1.pd…
1
31
Here are the FSB's eight proposed Regulatory and Supervisory Modernization Principles
5
"[The] MiCA Regulation should clearly state that European issuers may only partake in [#stablecoin] multi-issuance arrangements with issuers established in third countries provided that (1) these third countries' regulatory frameworks have been recognized by the European Commission as providing equivalent safeguards against the specific risks posed by multi-issuance models to those of the MiCA Regulation and that (2) memoranda of understanding (MoUs) should be agreed between the supervisory authorities of the third countries and European competent authorities, covering information exchange, on-site inspections and enforcement assistance." amf-france.org/sites/institu…
1
1
42
"The Cryptoassets Amendment Regulations … make issuing #qualifying_stablecoins a controlled activity, and qualifying stablecoins a controlled_investment in their own right. … The Cryptoassets Amendment Regulations create a distinct sub-type of qualifying stablecoin: a 'UK qualifying stablecoin'. … The distinction is important because various exclusions in the Regulated Activities Order apply only in relation to UK qualifying stablecoins. Therefore, a person should not assume that an exclusion available for a UK qualifying stablecoin is also available in relation to other qualifying stablecoins, such as overseas stablecoins or stablecoins issued outside article 9M." fca.org.uk/publication/consu…
1
36
"After carefully considering the comments concerning the #yield_prohibition, the OCC has eliminated the rebuttable presumption [that certain stablecoin issuer arrangements with affiliates and related third parties to pay yield to holders were prohibited] from the final rule. Because payment stablecoins are a nascent market, the OCC does not believe that it is appropriate to impose a rebuttable presumption with respect to the yield prohibition at this time. … Instead of finalizing the proposed rebuttable presumption or otherwise providing guidance on the types of potentially prohibited transactions, the OCC will initially monitor arrangements with permitted payment stablecoin issuers and foreign payment stablecoin issuers as part of its review of issuers' applications and ongoing supervision of such entities." occ.treas.gov/news-issuances…
3
2
109
The final rule eliminates the automatic seven-day extension of the redemption period once redemption requests exceed 10 percent of outstanding issuance value in a single 24-hour period: "The OCC agrees with commenters that the automatic extension could prove pro-cyclical and trigger or exacerbate runs. ... At the same time, the OCC believes that it is important that the OCC receive prompt notice of any sudden spike in redemption requests, which may indicate stress at a permitted payment stablecoin issuer. … The OCC expects to use this authority [to extend the redemption timeframe or limit redemptions] sparingly and that redemption extensions will be rare."
9
"Any #human_oversight controls [of AI] should be designed around the specific use case, the level of AI autonomy and the potential impact on consumers or markets. Effective oversight is not simply about reviewing AI outputs, but about ensuring people have the right authority, information, capability and escalation routes to challenge or intervene where needed. .... Areas for improvement Excessive reliance on human-in-the-loop controls. Firms relied excessively on staff to oversee AI outputs, without addressing underlying model risk or governance responsibilities. ... Lack of meaningful oversight. There was a risk of human review of AI outputs being a 'box-ticking' exercise, rather than meaningful oversight."" fca.org.uk/publications/good…
1
36
Here is the list of key findings from the report.
15
"#Staking_lending_and_borrowing_crypto_assets: MiCA does not regulate crypto-asset staking, lending, and borrowing as standalone activities, despite their growing importance within the crypto-asset market. This presents a regulatory gap. … The [European Commission] should consider whether dedicated regulatory requirements for staking, lending and borrowing crypto assets would be appropriate, taking into account their specific risk profile rather than relying solely on the ancillary coverage provided by the custody provisions of Article 75 to bring them within the Scope of MiCA. … DeFi_arrangements: Where an arrangement claims to be decentralised as set out in Recital 22 MiCA, there may still be significant reliance on the persons or entities concerned to self-assess whether the arrangement falls outside the scope of MiCA. … To address these supervisory gaps and provide greater legal clarity and consistency, the legal framework should define the term “DeFi arrangement” and establish common criteria for determining whether a person or entity performs, provides or exercises effective control over crypto-asset services or activities through such an arrangement. amla.europa.eu/document/down…
2
45