## 1. Cross Country Experiences with Fintech

## Source details

**Canonical URL:** [1. Cross Country Experiences with Fintech](https://www.imf.org/-/media/files/publications/wp/2018/wp18201.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/wp/2018/wp18201.pdf.md)
- [Structured JSON version](/-/media/files/publications/wp/2018/wp18201.pdf.json)

---

### Overview and objectives
- Fintech defined per FSB (2017) as “technologically enabled financial innovation that could result in new business models, applications, processes, or products with an associated material effect on financial markets and institutions and the provision of financial services”.
- Study scope and methods:
  - Innovations covered: mobile and online banking, payments, lending and capital raising (P2P platforms, crowdfunding), money transfer platforms, digital currencies, digital wallets, cloud computing and Distributed Ledger Technology (DLT)/blockchain.
  - Analysis covers developments through the end of April 2018 and is based on primary and secondary research including interviews, presentations, speeches, and analytical reports.
- Five research questions:
  - What is the state of fintech in MENAP and CCA and growth drivers?
  - What factors constrain fintech from realizing its potential?
  - Are there financial stability risks from fintech and how do regulations balance promotion vs safeguarding stability?
  - What is the value proposition for adopting fintech in MENAP and CCA?
  - What policies can leverage fintech’s potential for financial inclusion and inclusive growth?

### Fintech architecture, benefits and systemic risks
- Technologies, intermediaries and product areas:
  - Intermediaries: Start-up fintech firms, banks, MNO & MTO, big tech firms, others.
  - Product/service areas: Deposits; Lending and Capital Raising (Crowd-Funding, Debt crowdfunding, Equity crowdfunding, Reward-based, Donation-based, E-Lending, P2P MPL, Balance sheet lending, Micro Credits); Payments/Clearing/Settlement (value-transfer networks, FX wholesale, digital exchange platforms, P2P transfers, e-wallets, digital currencies and tokens); Risk Management (credit risk management, regulatory compliance, fraud detection); Insurance; Wealth Management (RoboAdvisors); Financial Market Infrastructure.
  - Technologies: IT/Software, Cloud computing, API, Automation, Big data, Machine Learning, Predictive modelling, Biometrics (vocal, facial), DLT, Cryptography, Smartcontracts.
- Key benefits:
  - Lower-cost, faster, multi-channel payments.
  - Extend services to unbanked populations and lower SME funding gaps.
  - Reduce cross-border remittance costs and delays.
  - Improve government efficiency and transparency; improve collateral management, fraud detection, credit risk management, and regulatory compliance via DLT and AI.
- Key risks:
  - Cyber and operational risks amplified by increased connectivity and new entrants.
  - Money laundering, consumer protection, regulatory perimeter ambiguity, cross-border legal issues.
  - Cyberattacks can cause direct monetary losses, data privacy breaches, and reputational damage (examples: US$81 million heist from the Central Bank of Bangladesh; Bitfinex losses of more than $65 million in one day).

### MENAP and CCA fintech landscape: scale, segments, and growth
- Regional adoption and investment:
  - Fintech investments into the MENA region were estimated at less than 2 percent of the cumulative global investments between 2010-14.
  - Adoption of mobile payment services in MENAP remains significantly below other regions.
- Startup growth and geography:
  - Fintech startups in 12 MENA countries increased at a Compound Annual Growth Rate (CAGR) of 40 percent between 2011-16, going from 46 to 145 firms.
  - Fintech startups in MENA more than doubled since 2012 (CAGR 2011-2016: 40 percent; earlier period 2006-2010 CAGR: 26 percent).
  - In MENAP, UAE, Lebanon, Jordan and Egypt hosted 73 percent of the 145 fintech startups; UAE accounted for more than 30 percent.
- Segment distribution (Wamda 2016):
  - Payments: 50 percent
  - Lending and capital markets: 34 percent
  - Other: 16 percent
- Mobile money expansion and crowdfunding:
  - Mobile financial services expanded from initial emergence in Afghanistan in 2008 to 11 countries by end-2017 (Afghanistan, Egypt, Iran, Iraq, Jordan, Mauritania, Morocco, Pakistan, Qatar, Somalia and Tunisia).
  - In MENAP, 30 percent of startups offered lending solutions; many crowdfunding platforms are donation or rewards-based targeting social projects.
  - Only a few countries (UAE, Jordan, Lebanon) have crowdfunding platforms that target SMEs.
- Cryptocurrencies and national digital currencies:
  - Exchanges and trading occur in several MENAP countries (Bahrain, Egypt, Iran, UAE) despite regulatory headwinds.
  - National digital currency initiatives noted: Tunisia issued E-dinar in 2015 and later put it on blockchain; UAE (Dubai) launched emCash in 2017; UAE and Saudi Arabia cooperating on digital currency; Iran and Lebanon indicated interest; Kazakhstan indicated plans in CCA.
- Technology adoption uneven:
  - Blockchain, AI and cloud computing adoption rising but uneven; some banks and governments (UAE, Bahrain, Saudi Arabia, Tunisia, Jordan) more active.
  - In CCA, blockchain pilots include land title registries (Georgia) and tax collection (Kazakhstan).

### Legal, regulatory and supervisory environment
- Legal traditions and implications:
  - MENAP: mixed systems of civil, religious, customary law; a few common law systems (Oman, Pakistan, Sudan). UAE DIFC has English common law. In civil law jurisdictions, lack of express permission can be binding for fintech.
  - CCA: civil law; Astana International Financial Centre (AIFC) in Kazakhstan uses English common law.
- Regulatory gaps and reform progress:
  - Legacy financial laws predate fintech; many fintech concepts (big data, crowdfunding, e-wallets, virtual currencies, exchanges, regulatory sandboxes, API) are not defined in legacy laws.
  - Reforms underway in selected countries (UAE, Bahrain, Kazakhstan, Egypt, Iraq, Jordan, Tunisia, Morocco, Pakistan, Georgia, Kyrgyzstan).
- Regulatory sandboxes and licensing:
  - As of the report: four established sandboxes and two in development in MENAP. Locations: DIFC and ADGM (UAE), Bahrain (Central Bank), Saudi Arabia (Capital Markets Authority in 2018). AFSA in Kazakhstan introduced a sandbox in 2017.
  - Payment sector models: operator-led (nonbanks can issue e-money) and bank-led (nonbanks operate through banks).
  - Crowdfunding regulations present in three countries by end-2017: Bahrain, Lebanon, UAE.
- Crypto and other regulatory matters:
  - Crypto regulation: largely unregulated or in a legal grey area; some countries prohibited or issued warnings (Qatar prohibited financial institutions from trading cryptocurrencies; Morocco issued warnings; Egypt and Kuwait issued “Fatwas”; Pakistan and Saudi Arabia banned trading).
  - Consumer protection, data protection and AML/CFT:
    - Consumer protection frameworks predate fintech; gaps around e-wallet dormant balances, dispute resolution, digital certification, and treatment of e-money in deposit insurance.
    - Data protection laws present in most MENAP countries (excluding Pakistan) but often piecemeal; CCA countries also have diffused data frameworks.
    - AML/CFT frameworks established in all countries but implementation of risk-based frameworks uneven; simplified CDD/tiered KYC present in some countries (Pakistan, Morocco).
  - Outsourcing regulations often lack clarity on access, audit rights, chain outsourcing, contingency plans, data location and processing; few regulators have authority to directly supervise third-party providers (partial authority examples: Saudi Arabia, UAE).

### Supervisory capacities and cooperation
- Institutional adaptations and surveillance:
  - Countries with specific fintech oversight developments include Bahrain, Iran, Pakistan, UAE.
  - Bahrain established a Fintech and innovation unit in October 2017.
  - Official data on authorized fintech firms and their performance are generally lacking.
  - Few jurisdictions provide stress testing or public reporting on cyber risk preparedness (some examples: Saudi Arabia stress tests; Bahrain covers cyber risks in Financial Stability Reports).
- Cross-sector and cross-border cooperation limited but emerging:
  - Examples: cooperation agreements between Bahrain EDB and ADGM; ADGM/DFSA arrangements with MAS.

### Cyber risks and operational vulnerabilities
- Cyber risk characterization:
  - Cyber risks identified as major challenge due to increasing frequency, unpredictability, potential systemic impact, and gaps in cyber security frameworks.
  - Symantec intelligence (2018): UAE second most targeted country for ransomware in MENA; several GCC states among top 10 globally targeted with email malware and spam.
- Incidents (MENAP and CCA, 2012–2018):
  - 2012–2013: cybercriminals hacked two card processing centers in India handling prepaid card processing for a bank in Oman and another in the UAE; criminals increased available balances and withdrawal limits and coded fake cards to withdraw US$45 million from ATMs in 27 countries.
  - 2016: malicious software forced ATMs to dispense cash in Armenia, Georgia, Kyrgyzstan, and the UAE.
  - 2017: infiltration of bank computers in Armenia with losses of 133 million AMD (approximately US$273,000).
  - 2017: Azerbaijani bank hacked with losses of 3.7 million manats ($2 million).
  - 2012: disruption of websites of Abu Dhabi Securities exchange, Saudi Arabia exchange, UAE central bank websites and the Arab Bank Palestine.
  - 2015: Azerbaijan Central Bank website defaced and customer data stolen.
  - 2015: UAE bank hacked and ransom demanded in Bitcoin by leaking confidential transactions and client details on social networking.
  - 2016: one of Qatar’s largest banks suffered a data breach involving client information.
- Contributing vulnerabilities:
  - Cybersecurity frameworks deficient across MENAP and CCA in legal, technical, organization, capacity building and cooperation dimensions; only Oman (MENAP) and Georgia (CCA) reported comprehensive frameworks as of mid-2017.
  - Human factors: employee mistakes and third-party providers major threats; insufficient employee training on cybersecurity noted.
  - Infrastructure weaknesses: unreliable electricity and low broadband hinder resilience and cloud adoption; over 40 percent in MENAP and 58 percent in CCA were on low-speed 2G networks; 4G coverage uniformly low across MENAP and CCA.
- Other operational risks:
  - IT outages in countries with unreliable electricity/internet (Egypt, Lebanon, West Bank and Gaza, Yemen).
  - Consumer funds in stored-value facilities not generally covered by deposit insurance.
  - Risks of regulatory arbitrage due to cross-border operations and unclear jurisdiction over non-banks.

### Factors impeding fintech growth and inclusion impact
- Core constraints reported by fintech firms (Wamda Research Lab, 2016):
  - Dealing with financial regulations; hiring & retaining talent; raising funds from investors; acquiring customers; expanding into other countries; competing against established corporations and international startups; building corporate partnerships.
- Key impediments:
  - Regulatory gaps and ill-suited legacy laws (civil law constraint where what is not stated is generally not allowed).
  - Scattered institutional licensing and regulation landscape requiring multi-agency cooperation.
  - Lack of harmonization in cross-border laws limiting scalability for small domestic markets.
  - Restrictions on role of agents and nonbanks; extensive customer ID requirements limiting reach to unbanked.
  - Talent gap in advanced technology areas (cloud, cybersecurity, machine learning, AI).
  - Underdeveloped private equity and venture capital markets; funding concentrated (e.g., UAE accounted for as much as 70 percent of total PE and VC flows into MENA in 2017).
  - ICT and payment infrastructure gaps:
    - Over 40 percent in MENAP and 58 percent in CCA were on low-speed 2G networks.
    - 4G coverage uniformly low across MENAP and CCA.
    - Few countries with interoperable mobile wallets (examples: Pakistan, Egypt, Jordan).
    - Low ATM and POS penetration; “cash-in” and “cash-out” constraints.
  - Business environment challenges: restrictive labor regulations, access to finance, inefficient bureaucracy, policy instability, corruption, foreign ownership limits (e.g., UAE and Qatar non-nationals limited to 49 percent shareholding).
  - Demand-side constraints: lack of trust, low financial literacy, entrenched informal mechanisms (Hawala), low incomes, concerns about data security and cyber risks, preference for cash-on-delivery in e-commerce.
- Impact on inclusion:
  - Fintech has focused on services for banked populations (retail payments) more than on innovations for financial inclusion (mobile financial services for unbanked, RegTech, credit scoring, marketplace lending).
  - Failure rates: MENA fintech firm failure rate estimated at 28 percent (Wamda 2016); high failure rates in CCA crowdfunding platforms reported.

### Value proposition for MENAP and CCA
- Financial inclusion and inclusive growth:
  - Mobile penetration often exceeds bank deposit penetration in more than half of MENAP countries; CCA more pronounced with over 60 percent of population in rural areas and mostly unbanked.
  - Mobile financial services can leverage rural mobile reach where bank branches are sparse.
  - Fintech channels to promote inclusion: mobile financial services, crowdfunding/marketplace lending, predictive analytics for SME credit scoring, DLT for collateral registries, e-wallets, digital payments for government transfers.
- SME finance and employment:
  - SMEs account for between 80 percent and 95 percent of formal sector enterprises and about 50 percent of employment in MENAP and CCA; growth constrained by limited access to finance due to poor records, lack of collateral.
  - Big data and predictive analytics can improve credit assessment and unlock SME lending; marketplace lending and crowdfunding can provide alternative funding.
  - Startups and fintech firms can create digital-age jobs to help reduce high youth unemployment (youth unemployment rates in several countries range between 30–50 percent).
- Government efficiency, transparency and humanitarian utility:
  - Digital payments and mobile transfers can increase transparency, reduce corruption, and deliver social transfers while preserving dignity (examples: use of mobile money in Jordan, Afghanistan for government salaries and social transfers).
- Remittances and informal sector:
  - MENAP and CCA are major inward/outward remittance corridors; fintech (P2P transfers, DLT) can reduce remittance costs and attract funds into formal sector.

### Policy recommendations: unlocking fintech while safeguarding stability
- Overarching strategy:
  - Multi-pronged approach tailored to country stage of fintech development, focusing on cyber risk mitigation, legal/regulatory updates, supervisory capacity building, and demand-side measures.
- Cybersecurity:
  - Treat cyber security as top policy priority: develop comprehensive frameworks covering prevention, detection, information sharing, monitoring, financial and technology literacy, and recovery.
  - Ensure cybersecurity across the payments chain, including merchants/agents; integrate security in design of new technologies and invest in staff training.
- Legal and regulatory reform:
  - Review legal and regulatory frameworks to identify gaps and restrictions; update laws to provide legal certainty for fintech transactions and licensing.
  - Use regulations and guidelines to allow dynamic responses while ensuring laws provide authority for implementation.
  - Utilize regulatory sandboxes to understand firm-specific risks and inform regulation design.
- Prudential and conduct regulations:
  - Adopt functional and proportional regulation to level playing fields and avoid stifling innovation.
  - Payment regulations should clarify operations of electronic money institutions.
  - Virtual currencies and crypto exchanges: regulate to prevent AML/CFT risks, address consumer protection, technology governance, and custody.
  - Equity crowdfunding and online lending: require prudential and conduct-of-business rules; strengthen minority shareholder protections and insolvency regimes.
  - Outsourcing regulations should cover cloud computing and third-party providers, including monitoring, contingency plans and authority to examine third parties.
- Supervisory capacity and cooperation:
  - Upgrade supervisory expertise in operational risk, IT, cyber preparedness, outsourcing oversight, concentration risks in third-party providers.
  - Develop reporting requirements for licensed fintech entities for monitoring and risk identification.
  - Strengthen cross-sector cooperation (telecom, competition, consumer protection agencies) and cross-border collaboration given fintech’s transnational nature.
  - Enforce compliance with international standards (CPSS-IOSCO, FATF guidance).
- Demand-side and broader reforms:
  - Promote financial and digital literacy and strengthen consumer protection frameworks (data/privacy, treatment of customer funds, dispute resolution).
  - Consider liquidity guidelines for payment service providers to ensure “cash-out” capabilities.
  - Encourage interoperability without mandating it; enable agency networks and POS investments to enhance cash-in/cash-out reach.
  - Public-private partnerships: hackathons, incubation for SME finance solutions, credit reporting and collateral registry digitization.
- Structural and medium-term reforms:
  - Infrastructure: ensure reliable electricity, deregulate ICT to increase competition, invest in fiber optics and high-speed networks (3G/4G), modernize payment system infrastructure.
  - Credit infrastructure: strengthen credit registries, secured transaction and collateral regimes (STCR), and insolvency frameworks.
  - Capital markets and funding: address constraints to private equity and venture capital; consider easing foreign investment restrictions to attract capital and established fintech firms.
  - Talent: education reform to supply digital-economy skills and visa/work-permit reforms to attract specialized talent.
- Sequencing and balance:
  - Sequence reforms to avoid stifling innovation while mitigating risks and maintaining customer confidence; tailor approaches to country-specific priorities of financial inclusion, economic diversification, transparency, and financial stability.

### Box 1 — Key cross-country findings and illustrative country experiences
- Cross-country findings:
  - With appropriate regulations, fintech innovations in payments and lending can promote financial inclusion and enhance SME access to finance.
  - Fintech growth is supported by: high-quality infrastructure, abundant talent, and availability of seed, venture and growth capital (US example).
  - Regulatory frameworks affect fintech growth: government support and regulatory clarity can foster development (UK example), while regulatory uncertainty across multiple federal and state regulators can dampen growth (US example).
  - Cyber risks are dynamic and multi-dimensional, including data privacy risks, third-party vendor risks, ATM and infrastructure compromises, denial-of-service attacks, and large-scale data breaches.
- Illustrative cases:
  - United States: wide fintech presence; marketplace lenders (Zopa, Lending Club, Funding Circle) faced governance and asset quality problems; state-of-the-art cybersecurity exists but data breaches occurred (Facebook–Cambridge Analytica misuse cited).
  - United Kingdom: ‘Project Innovate’ program, innovation hub and regulatory sandbox; crowdfunding regulated with minimum capital standards and resolution plans; challenger banks increased market share from 4 percent in 2012 to 12 percent in 2014 (Ernst and Young 2016a).
  - China: rapid fintech growth driven by e-commerce, online/mobile penetration, large unbanked population, lax regulations and capital access; Ezubao Ponzi scandal (2016) led to almost 1 million investors losing US$7.6 billion.
  - Kenya: M-Pesa reached 80 percent of households within four years (World Bank 2016); Central Bank of Kenya adopted a functional regulatory approach permitting banks and nonbanks, including mobile network operators, to provide mobile money services.
- Infrastructure critical components (Box 2 summary):
  - ICT Infrastructure: connectivity requires higher broadband such as 3G, 4G and 5G; G2 does not enable internet.
  - Payment System: interoperability and real time settlements needed.
  - Credit Information: credit information infrastructure to inform credit decisions and lower credit costs.
  - Agency network: PoS and agents crucial for cash-in and cash-out.
  - Energy: reliable electricity required to enable internet operations.
  - Authentication: legal identification and customer legitimation necessary to avoid illicit activity or data breaches.
- Cyber incidents and implications (Box 3 summary):
  - Threats include third-party hacking, ATM compromises, bank computer intrusions, denial-of-service attacks, and data breaches.
  - Policy implications: adopt functional and risk-based regulatory design, use sandboxes and innovation hubs, enforce prudential and governance safeguards for marketplace lenders, strengthen data protection, invest in cybersecurity and third-party risk management, and prioritize infrastructure investments (broadband, energy, interoperable payments, credit information, agent networks).

*Source: wp18201 - 1. Cross Country Experiences with Fintech (PDF chapter), canonical URL: https://www.imf.org/-/media/files/publications/wp/2018/wp18201.pdf*

### 1. Cross Country Experiences with Fintech _______________________________________________ 41

### 1. Cross Country Experiences with Fintech

### Major chapter sections
- 1. Cross Country Experiences with Fintech _______________________________________________ 41
- 2. Infrastructure for Digital Financial Inclusion ____________________________________________ 42
- 3. Cyberattacks Impacting Financial Institutions in MENAP and CCA, 2012-2018 _____________ 43

### Key thematic figure inventory
- 1. Architecture of the Fintech Industry ____________________________________________________ 4
- 2. Enabling Environment for Fintech ______________________________________________________ 5
- 3. Scale of Fintech in the MENAP and CCA regions _________________________________________ 6
- 4. Fintech Startups and Investments ______________________________________________________ 7
- 5. Geographical Distribution of Fintech Startups and mobile money services _________________ 8
- 6. Fintech Segments ____________________________________________________________________ 9
- 7. Internet and Mobile Phone Penetration _______________________________________________ 12
- 8. State of Funding for Startups _________________________________________________________ 13
- 9. Legal Systems in the MENAP and CCA ________________________________________________ 14
- 10. Countries with Regulatory Sandboxes ________________________________________________ 16
- 11. Protection of Minority Creditors and Insolvency Regimes ______________________________ 18
- 12. Status of cybercrime legislations in the MENA and CCA ________________________________ 19
- 13. Cyber Security Threats _____________________________________________________________ 23
- 14. Key Challenges Facing Fintech Firms _________________________________________________ 25
- 15. State of the ICT, Payment System and Credit Evaluation Infrastructure __________________ 28
- 16. Factors Adversely Impacting the Business Environment ________________________________ 29
- 17. Customer Preferences and Literacy Levels ____________________________________________ 30
- 18. Unbanked populations and Rural Urban Divide _______________________________________ 32
- 19. Unemployment Levels and SME Access to Finance ____________________________________ 34
- 20. Displaced Populations and Social Transfers ___________________________________________ 35
- 21. Remittances Volumes and Transfer Costs _____________________________________________ 36

### Intended analytic focus (as implied by chapter headings and figures)
- Cross-country experiences with fintech across MENAP and CCA, including scale, segments, startups, investments, and geographic distribution.
- Infrastructure dimensions for digital financial inclusion: Internet and mobile penetration, ICT, payment systems, credit evaluation infrastructure, and legal/regulatory frameworks (including regulatory sandboxes).
- Cybersecurity and cybercrime: status of cybercrime legislation, cyber security threats, and recorded cyberattacks impacting financial institutions in MENAP and CCA over 2012-2018.
- Business environment and market challenges: funding for startups, factors adversely impacting business environment, protection of minority creditors and insolvency regimes.
- Financial inclusion and social resilience: unbanked populations, rural-urban divides, customer preferences and literacy, unemployment and SME access to finance, displaced populations and social transfers, remittances volumes and transfer costs.

*Source: wp18201 - 1. Cross Country Experiences with Fintech (PDF chapter), canonical URL: https://www.imf.org/-/media/files/publications/wp/2018/wp18201.pdf*

### References _________________________________________________________________________ 45

### wp18201 - References _________________________________________________________________________ 45

### Overview and objectives
- Fintech defined per FSB (2017) as “technologically enabled financial innovation that could result in new business models, applications, processes, or products with an associated material effect on financial markets and institutions and the provision of financial services”.
- Study covers innovations in mobile and online banking, payments, lending and capital raising (P2P platforms, crowdfunding), money transfer platforms, digital currencies, digital wallets and adoption of emerging technologies (cloud computing and Distributed Ledger Technology (DLT) or blockchain).
- Analysis covers developments through the end of April 2018 and is based on primary and secondary research including interviews, presentations, speeches, and analytical reports.
- Five research questions:
  - What is the state of fintech in MENAP and CCA and growth drivers?
  - What factors constrain fintech from realizing its potential?
  - Are there financial stability risks from fintech and how do regulations balance promotion vs safeguarding stability?
  - What is the value proposition for adopting fintech in MENAP and CCA?
  - What policies can leverage fintech’s potential for financial inclusion and inclusive growth?

### Fintech architecture, benefits and systemic risks
- Technologies and intermediaries: Start-up fintech firms, banks, MNO & MTO, big tech firms, others.
- Product and service areas: Deposits, Lending and Capital Raising (Crowd-Funding, Debt crowdfunding, Equity crowdfunding, Reward-based, Donation-based, E-Lending, P2P MPL, Balance sheet lending, Micro Credits), Payments/Clearing/Settlement (value-transfer networks, FX wholesale, digital exchange platforms, P2P transfers, e-wallets, digital currencies and tokens), Risk Management (credit risk management, regulatory compliance, fraud detection), Insurance, Wealth Management (RoboAdvisors), Financial Market Infrastructure.
- Technologies: IT/Software, Cloud computing, API, Automation, Big data, Machine Learning, Predictive modelling, Biometrics (vocal, facial), DLT, Cryptography, Smartcontracts.
- Key benefits: lower-cost, faster, multi-channel payments; extend services to unbanked populations; lower SME funding gaps; reduce cross-border remittance costs and delays; improve government efficiency and transparency; improve collateral management, fraud detection, credit risk management, and regulatory compliance via DLT and AI.
- Key risks:
  - Cyber and operational risks amplified by increased connectivity and new entrants.
  - Money laundering, consumer protection, regulatory perimeter ambiguity, cross-border legal issues.
  - Cyberattacks can cause direct monetary losses, data privacy breaches, and reputational damage (examples referenced include the US $81 million heist from the Central Bank of Bangladesh and Bitfinex losses of more than $65 million in one day).

### MENAP and CCA fintech landscape: scale, segments, and growth
- Regional adoption and investment:
  - Fintech investments into the MENA region were estimated at less than 2 percent of the cumulative global investments between 2010-14.
  - Adoption of mobile payment services in MENAP remains significantly below other regions.
- Startup growth:
  - Fintech startups in 12 MENA countries increased at a Compound Annual Growth Rate (CAGR) of 40 percent between 2011-16, going from 46 to 145 firms.
  - Fintech startups in MENA more than doubled since 2012 (CAGR 2011-2016: 40 percent; earlier period 2006-2010 CAGR: 26 percent).
- Geographic concentration:
  - In MENAP, UAE, Lebanon, Jordan and Egypt hosted 73 percent of the 145 fintech startups; UAE accounted for more than 30 percent.
- Segment distribution in MENA startups (from Wamda 2016):
  - Payments: 50 percent
  - Lending and capital markets: 34 percent
  - Other: 16 percent
- Mobile money expansion:
  - Mobile financial services expanded from initial emergence in Afghanistan in 2008 to 11 countries by end-2017 (countries listed include Afghanistan, Egypt, Iran, Iraq, Jordan, Mauritania, Morocco, Pakistan, Qatar, Somalia and Tunisia).
- Crowdfunding and lending:
  - In MENAP, 30 percent of startups offered lending solutions; many crowdfunding platforms are donation or rewards-based targeting social projects.
  - Only a few countries (UAE, Jordan, Lebanon) have crowdfunding platforms that target SMEs.
- Cryptocurrencies and national digital currencies:
  - Exchanges and trading occur in several MENAP countries (Bahrain, Egypt, Iran, UAE) despite regulatory headwinds.
  - National digital currency initiatives noted: Tunisia issued E-dinar in 2015 and later put it on blockchain; UAE (Dubai) launched emCash in 2017; UAE and Saudi Arabia cooperating on digital currency; Iran and Lebanon indicated interest; Kazakhstan indicated plans in CCA.
- Technology adoption uneven:
  - Blockchain, AI and cloud computing adoption rising but uneven; some banks and governments (UAE, Bahrain, Saudi Arabia, Tunisia, Jordan) more active.
  - In CCA, blockchain pilots include land title registries (Georgia) and tax collection (Kazakhstan).

### Legal, regulatory and supervisory environment
- Legal traditions:
  - MENAP: mixed systems of civil, religious, customary law; a few common law systems (Oman, Pakistan, Sudan). UAE DIFC has English common law. In civil law jurisdictions, lack of express permission can be binding for fintech.
  - CCA: civil law; Astana International Financial Centre (AIFC) in Kazakhstan uses English common law.
- Regulatory gaps and progress:
  - Legacy financial laws predate fintech; many fintech concepts (big data, crowdfunding, e-wallets, virtual currencies, exchanges, regulatory sandboxes, API) are not defined in legacy laws.
  - Reforms underway in selected countries (UAE, Bahrain, Kazakhstan, Egypt, Iraq, Jordan, Tunisia, Morocco, Pakistan, Georgia, Kyrgyzstan).
- Regulatory sandboxes:
  - As of the report: four established sandboxes and two in development in MENAP. Locations: DIFC and ADGM (UAE), Bahrain (Central Bank), Saudi Arabia (Capital Markets Authority in 2018). AFSA in Kazakhstan introduced a sandbox in 2017.
- Licensing and prudential approaches:
  - Payment sector: mixed operator-led and bank-led models across countries; operator-led allows nonbanks to issue e-money, bank-led requires nonbanks to operate through banks.
  - Crowdfunding regulations present in three countries by end-2017: Bahrain, Lebanon, UAE.
  - Crypto regulation: largely unregulated or in a legal grey area; some countries prohibited or issued warnings (examples: Qatar prohibited financial institutions from trading cryptocurrencies; Morocco issued warnings; Egypt and Kuwait issued “Fatwas”; Pakistan and Saudi Arabia banned trading).
- Other legal/regulatory gaps:
  - Consumer protection frameworks predate fintech; gaps around e-wallet dormant balances, dispute resolution, digital certification, and treatment of e-money in deposit insurance.
  - Data protection laws present in most MENAP countries (excluding Pakistan) but often piecemeal; CCA countries also have diffused data frameworks.
  - AML/CFT: frameworks established in all countries but implementation of risk-based frameworks uneven; simplified CDD/tiered KYC present in some countries (Pakistan, Morocco).
  - Outsourcing regulations often lack clarity on access, audit rights, chain outsourcing, contingency plans, data location and processing; few regulators have authority to directly supervise third-party providers (examples of partial authority: Saudi Arabia, UAE).

### Supervisory capacities and cooperation
- Institutional adaptations:
  - Countries with specific fintech oversight developments include Bahrain, Iran, Pakistan, UAE.
  - Bahrain established a Fintech and innovation unit in October 2017.
- Surveillance gaps:
  - Official data on authorized fintech firms and their performance are generally lacking.
  - Few jurisdictions provide stress testing or public reporting on cyber risk preparedness (some examples: Saudi Arabia stress tests; Bahrain covers cyber risks in Financial Stability Reports).
- Cross-sector and cross-border collaboration limited but emerging (examples: cooperation agreements between Bahrain EDB and ADGM; ADGM/DFSA arrangements with MAS).

### Cyber risks and operational vulnerabilities
- Cyber risk characterization:
  - Cyber risks identified as major challenge due to increasing frequency, unpredictability, potential systemic impact, and gaps in cyber security frameworks.
  - Symantec intelligence (2018) findings: UAE second most targeted country for ransomware in MENA; several GCC states among top 10 globally targeted with email malware and spam.
- Incidents cited:
  - Card processing center hack in India leading to U.S. 45 million dollars withdrawals affecting UAE and Oman clients.
  - ATM skimmer malware and data breaches in UAE; disruption of central bank and securities exchange websites in UAE, WBG and Saudi Arabia.
  - CCA incidents: phishing (Kazakhstan), ATM skimmer malware (Armenia, Georgia, Kyrgyzstan), infiltration of bank computers (Armenia, Azerbaijan).
- Contributing vulnerabilities:
  - Cybersecurity frameworks deficient across the MENAP and CCA in legal, technical, organization, capacity building and cooperation dimensions; only Oman (MENAP) and Georgia (CCA) reported comprehensive frameworks as of mid-2017.
  - Human factors: employee mistakes and third-party providers major threats; insufficient employee training on cybersecurity noted.
  - Infrastructure weaknesses: unreliable electricity and low broadband (4G coverage uniformly low) hinder resilience and cloud adoption.
- Other operational risks:
  - IT outages in countries with unreliable electricity/internet (Egypt, Lebanon, West Bank and Gaza, Yemen).
  - Consumer funds in stored-value facilities not generally covered by deposit insurance.
  - Risks of regulatory arbitrage due to cross-border operations and unclear jurisdiction over non-banks.

### Factors impeding fintech growth and inclusion impact
- Core constraints identified by fintech firms (Wamda Research Lab, 2016):
  - Dealing with financial regulations; hiring & retaining talent; raising funds from investors; acquiring customers; expanding into other countries; competing against established corporations and international startups; building corporate partnerships.
- Key impediments:
  - Regulatory gaps and ill-suited legacy laws (civil law constraint where what is not stated is generally not allowed).
  - Scattered institutional licensing and regulation landscape requiring multi-agency cooperation.
  - Lack of harmonization in cross-border laws limiting scalability for small domestic markets.
  - Restrictions on role of agents and nonbanks; extensive customer ID requirements limiting reach to unbanked.
  - Talent gap in advanced technology areas (cloud, cybersecurity, machine learning, AI).
  - Underdeveloped private equity and venture capital markets; funding concentrated (e.g., UAE accounted for as much as 70 percent of total PE and VC flows into MENA in 2017).
  - ICT and payment infrastructure gaps:
    - Over 40 percent in MENAP and 58 percent in CCA were on low-speed 2G networks.
    - 4G coverage uniformly low across MENAP and CCA.
    - Few countries with interoperable mobile wallets (examples: Pakistan, Egypt, Jordan).
    - Low ATM and POS penetration; “cash-in” and “cash-out” constraints.
  - Business environment challenges: restrictive labor regulations, access to finance, inefficient bureaucracy, policy instability, corruption, foreign ownership limits (e.g., UAE and Qatar non-nationals limited to 49 percent shareholding).
  - Demand-side constraints: lack of trust, low financial literacy, entrenched informal mechanisms (Hawala), low incomes, concerns about data security and cyber risks, preference for cash-on-delivery in e-commerce.
- Impact on inclusion:
  - Fintech has focused on services for banked populations (retail payments) more than on innovations for financial inclusion (mobile financial services for unbanked, RegTech, credit scoring, marketplace lending).
  - Failure rates: MENA fintech firm failure rate estimated at 28 percent (Wamda 2016); high failure rates in CCA crowdfunding platforms reported.

### Value proposition for MENAP and CCA
- Financial inclusion and inclusive growth:
  - Mobile penetration often exceeds bank deposit penetration in more than half of MENAP countries; CCA more pronounced with over 60 percent of population in rural areas and mostly unbanked.
  - Mobile financial services can leverage rural mobile reach where bank branches are sparse.
  - Fintech channels to promote inclusion: mobile financial services, crowdfunding/marketplace lending, predictive analytics for SME credit scoring, DLT for collateral registries, e-wallets, digital payments for government transfers.
- SME finance and employment:
  - SMEs account for between 80 percent and 95 percent of formal sector enterprises and about 50 percent of employment in MENAP and CCA; growth constrained by limited access to finance due to poor records, lack of collateral.
  - Big data and predictive analytics can improve credit assessment and unlock SME lending; marketplace lending and crowdfunding can provide alternative funding.
  - Startups and fintech firms can create digital-age jobs to help reduce high youth unemployment (noted youth unemployment rates in several countries range between 30–50 percent).
- Government efficiency, transparency and humanitarian utility:
  - Digital payments and mobile transfers can increase transparency, reduce corruption, and deliver social transfers while preserving dignity (examples: use of mobile money in Jordan, Afghanistan for government salaries and social transfers).
- Remittances and informal sector:
  - MENAP and CCA are major inward/outward remittance corridors; fintech (P2P transfers, DLT) can reduce remittance costs and attract funds into formal sector.

### Policy recommendations: unlocking fintech while safeguarding stability
- Overarching strategy: multi-pronged approach tailored to country stage of fintech development, focusing on cyber risk mitigation, legal/regulatory updates, supervisory capacity building, and demand-side measures.
- Cybersecurity:
  - Treat cyber security as top policy priority: develop comprehensive frameworks covering prevention, detection, information sharing, monitoring, financial and technology literacy, and recovery.
  - Ensure cybersecurity across the payments chain, including merchants/agents; integrate security in design of new technologies and invest in staff training.
- Legal and regulatory reform:
  - Review legal and regulatory frameworks to identify gaps and restrictions; update laws to provide legal certainty for fintech transactions and licensing.
  - Use regulations and guidelines to allow dynamic responses while ensuring laws provide authority for implementation.
  - Utilize regulatory sandboxes to understand firm-specific risks and inform regulation design.
- Prudential and conduct regulations:
  - Adopt functional and proportional regulation to level playing fields and avoid stifling innovation.
  - Payment regulations should clarify operations of electronic money institutions.
  - Virtual currencies and crypto exchanges: regulate to prevent AML/CFT risks, address consumer protection, technology governance, and custody.
  - Equity crowdfunding and online lending: require prudential and conduct-of-business rules; strengthen minority shareholder protections and insolvency regimes.
  - Outsourcing regulations should cover cloud computing and third-party providers, including monitoring, contingency plans and authority to examine third parties.
- Supervisory capacity and cooperation:
  - Upgrade supervisory expertise in operational risk, IT, cyber preparedness, outsourcing oversight, concentration risks in third-party providers.
  - Develop reporting requirements for licensed fintech entities for monitoring and risk identification.
  - Strengthen cross-sector cooperation (telecom, competition, consumer protection agencies) and cross-border collaboration given fintech’s transnational nature.
  - Enforce compliance with international standards (CPSS-IOSCO, FATF guidance).
- Demand-side and broader reforms:
  - Promote financial and digital literacy and strengthen consumer protection frameworks (data/privacy, treatment of customer funds, dispute resolution).
  - Consider liquidity guidelines for payment service providers to ensure “cash-out” capabilities.
  - Encourage interoperability without mandating it; enable agency networks and POS investments to enhance cash-in/cash-out reach.
  - Public-private partnerships: hackathons, incubation for SME finance solutions, credit reporting and collateral registry digitization.
- Structural and medium-term reforms:
  - Infrastructure: ensure reliable electricity, deregulate ICT to increase competition, invest in fiber optics and high-speed networks (3G/4G), modernize payment system infrastructure.
  - Credit infrastructure: strengthen credit registries, secured transaction and collateral regimes (STCR), and insolvency frameworks.
  - Capital markets and funding: address constraints to private equity and venture capital; consider easing foreign investment restrictions to attract capital and established fintech firms.
  - Talent: education reform to supply digital-economy skills and visa/work-permit reforms to attract specialized talent.
- Sequencing and balance:
  - Sequence reforms to avoid stifling innovation while mitigating risks and maintaining customer confidence; tailor approaches to country-specific priorities of financial inclusion, economic diversification, transparency, and financial stability.

*Source: IMF staff analysis and compilation of fintech developments in MENAP and CCA through end-April 2018.*

### Box 1. Cross Country Experiences with Fintech

### Box 1. Cross Country Experiences with Fintech

### Key cross-country findings
- With appropriate regulations, fintech innovations in payments and lending can promote financial inclusion and enhance SME access to finance.
- Fintech growth is supported by: high-quality infrastructure, abundant talent, and availability of seed, venture and growth capital (US example).
- Regulatory frameworks affect fintech growth: government support and regulatory clarity can foster development (UK example), while regulatory uncertainty across multiple federal and state regulators can dampen growth (US example).
- Cyber risks are dynamic and multi-dimensional, including data privacy risks, third-party vendor risks, ATM and infrastructure compromises, denial-of-service attacks, and large-scale data breaches.

### Country experiences — illustrative cases and specific outcomes
- United States (US)
  - Fintech presence across the spectrum of financial services; growth underpinned by high-quality infrastructure, abundant talent, and capital availability.
  - Limited government support; regulatory uncertainty from multiple federal and state regulators cited as a dampening factor.
  - Marketplace lending firms (Zopa, Lending Club and Funding Circle) experienced rapid growth in online lending but faced weak governance, poor internal controls, and asset quality problems.
  - State-of-the-art technical cybersecurity measures exist, but cyberattacks have resulted in customer data breaches.
  - Misuse of data from Facebook by Cambridge Analytica underscores data privacy risks.

- United Kingdom (UK)
  - Well-developed fintech industry supported by government and regulatory measures under the ‘Project Innovate’ program, including an innovation hub and regulatory sandbox.
  - Crowdfunding ecosystem regulated for transparency and consumer protection; rules include minimum capital standards and requirements for firms to have resolution plans in place to ensure loans continue to be repaid if platforms collapse.
  - Banks required to direct small businesses to alternative finance providers if they can't fulfill financing needs.
  - Market share of “digital first, mobile only” banks (“challenger” banks) and alternative finance providers increased from 4 percent in 2012 to 12 percent in 2014 (Ernst and Young 2016a).
  - Prudential oversight of marketplace lenders (P2P) enabled credit growth while containing credit risks.
  - Significant investments in cybersecurity, yet the “wannacry” cyber-attack exposed vulnerabilities in several financial and non-financial companies.

- China
  - Rapid fintech growth underpinned by e-commerce expansion, online and mobile penetration, large unbanked populations, lax regulations, and easy access to capital.
  - P2P lending platforms expanded funding for unbanked individuals and SMEs, but some platforms misallocated funds or joined stock market surges and then collapsed.
  - The Ezubao scandal in 2016 resulted in almost 1 million investors losing US$7.6 billion through a Ponzi scheme.
  - More rigorous cyber security laws introduced after the global “wannacry” ransomware attack affected some bank operations.

- Kenya
  - M-Pesa achieved financial inclusion by deploying mobile technology, reaching 80 percent of households within four years (World Bank 2016).
  - The Central Bank of Kenya adopted a functional, rather than an institutional, approach to regulation, permitting banks and nonbanks, including mobile network operators, to provide mobile money services.

### Infrastructure for digital financial inclusion (Box 2) — critical components
- ICT Infrastructure
  - Connectivity requires higher broadband such as 3G, 4G and 5G (fixed infrastructure and data centers).
  - G2 does not enable internet.
- Payment System
  - Interoperability is needed to avoid market fragmentation.
  - Real time settlements facilitate meeting payment deadlines.
- Credit Information
  - Credit information infrastructure should provide information on debt and delinquency to help providers assess counterparty risk, increase access to bank financing, and lower credit costs.
- Agency network
  - PoS and agents are crucial assets for mobile money providers because of the need for cash-in and cash-out.
- Energy
  - Reliable supply of electricity is needed to enable internet operations.
- Authentication
  - Fintech products are predominantly web based; legal identification and legitimation of customers is necessary to avoid illicit activity or data breaches.

### Cyber incidents and impacts (Box 3) — MENAP and CCA, 2012–2018
- Threat landscape has increased in volume and diversity; incidents include third-party hacking, ATM infrastructure compromises, bank computer system intrusions, denial-of-service attacks, and data breaches.
- Hacking through third parties
  - In 2012 and 2013 cybercriminals hacked two card processing centers in India handling prepaid card payment processing for a bank in Oman and another in the United Arab Emirates; criminals increased available balances and withdrawal limits and coded fake cards to withdraw US$45 million from ATMs in 27 countries.
- Compromising ATM infrastructure
  - In 2016 malicious software forced ATMs to dispense cash in Armenia, Georgia, and Kyrgyzstan, and the UAE.
  - ATM skimmer malware targets the ATM core responsible for interaction with wider bank infrastructure, card processing and dispensing of cash, enabling capture of account numbers and PINs or direct theft.
- Compromising banks’ computer systems
  - In 2017 cybercriminals infiltrated bank computers in Armenia and stole customer and account data, resulting in losses amounting to 133 million AMD (approximately US$273,000).
  - In 2017 cybercriminals hacked the computer system of an Azerbaijani bank resulting in financial losses of 3.7 million manats ($2 million).
- Denial of service and website disruptions
  - In 2012 cybercriminals hacked and disrupted websites of several financial institutions, including the Abu Dhabi Securities exchange, Saudi Arabia exchange, UAE central bank websites and the Arab Bank Palestine.
  - In 2015 the Azerbaijan Central Bank website was defaced and customer data was stolen.
- Data breaches and ransomware/extortion
  - In 2015 cybercriminals hacked a UAE bank and demanded ransom in Bitcoin by leaking confidential financial transactions and client details on social networking.
  - In 2016 one of Qatar’s largest banks suffered a data breach involving client information.

### Policy-relevant implications and measures (drawn from cases and infrastructure discussion)
- Regulatory design
  - Functional and risk-based approaches can expand provider participation (e.g., Kenya’s functional approach) while aligning regulation with activity risk.
  - Regulatory sandboxes, innovation hubs, and clear consumer protection and resolution planning (UK’s Project Innovate) can support fintech growth while containing risks.
- Prudential and governance safeguards
  - Prudential oversight of marketplace lenders (P2P) can enable credit growth while containing credit risks.
  - Strong internal governance and controls are necessary to avoid asset quality problems experienced by some marketplace lenders.
- Consumer protection and data privacy
  - Transparency, minimum capital standards, and resolution plans for crowdfunding and lending platforms help protect consumers and ensure continuity of loan repayment if a platform collapses.
  - Data privacy incidents (e.g., Facebook–Cambridge Analytica) highlight the need for robust data protection frameworks.
- Cybersecurity and third-party risk management
  - Invest in state-of-the-art technical cybersecurity measures and preparedness for ransomware/“wannacry”-type attacks.
  - Monitor and manage third-party vendor risks (card processors, cloud providers, ATM software vendors).
- Infrastructure investments
  - Prioritize broadband expansion (3G/4G/5G), reliable energy supply, interoperable payment systems, credit information systems, and agent networks to enable digital financial inclusion.
- Identification and authentication
  - Strengthen legal identification, KYC frameworks, and authentication mechanisms to prevent illicit activity and data breaches.

*Box 1. Cross Country Experiences with Fintech.*

---


_Source: https://www.imf.org/-/media/files/publications/wp/2018/wp18201.pdf_