Rented Regulation: The Structural Case for Direct Authorisation

A large part of the digital finance industry does not hold the regulatory permissions on which its products depend. Instead, it reaches those permissions through arrangement: a customer-facing firm builds an application, acquires users, and designs an experience, while the underlying regulated activity — issuing electronic money, executing payments, safeguarding funds — is conducted by a separate, licensed institution acting as the firm's partner. This arrangement has a name in the market: Banking-as-a-Service, or the partner-bank model. It is widely used, and for good reason. It allows a firm to bring a product to market quickly, without the time and capital that direct authorisation demands. The Group has examined this model closely, and has chosen not to build on it. This article sets out why.

The Intermediated Model

In the intermediated model, regulatory standing belongs to the partner institution, not to the firm the customer sees. The firm operates as a distributor, an agent, or a programme manager. Its name is on the application; the licence sits elsewhere. The customer relationship, the brand, and the product design are the firm's; the regulatory permission, the regulatory relationship, and ultimately the regulatory accountability are the partner's.

For many businesses this division is entirely workable. It is the fastest route from concept to live product, and it lowers the capital barrier to entry considerably. The difficulty is not that the model is unsound. The difficulty is what the model concentrates, and where.

Where the Model Strains

Three pressures bear on the intermediated model, and they have become more visible as the sector has matured.

The first is concentration. A single partner institution typically supports many customer-facing firms at once. That institution becomes a shared dependency. If it withdraws from the market, loses its own authorisation, or simply decides to exit the line of business, every firm that depends on it is affected at once — regardless of how well each of those firms is individually run.

The second is continuity. A firm in the intermediated model does not control the infrastructure on which its customers rely. Should the partner institution fail, the firm's product can be interrupted, or its customers' access to funds delayed, through no fault and no decision of the firm itself. The firm carries the customer relationship but not the means to protect it.

The third is supervisory attention. Regulators have increasingly focused on the partner institutions that sit behind these arrangements, and on the adequacy of those institutions' oversight of the firms they support. As that scrutiny intensifies, the cost and complexity of the intermediated model rise, and the firm is again exposed to consequences set in motion elsewhere.

None of these pressures is a prediction of failure. Each is a description of where control sits. In the intermediated model, a firm's regulatory destiny is, to a meaningful degree, not its own.

Direct Authorisation as Architecture

The architecture the Group designs is built on the opposite principle. In it, each regulated activity would be conducted by the entity that holds the relevant authorisation directly from the competent regulator. A payment service would be offered by the entity holding the payment permission; electronic money would be issued by the entity authorised to issue it; a digital asset service would be provided by the entity registered to provide it. This describes a design principle, not the current status of any company of the Group.

This is a deliberate structural choice, not an operational preference. In that design, regulatory standing would sit inside the Group: the regulatory relationship and the regulatory accountability would be the Group's own, and the continuity of the regulated activity would not depend on the survival or the commercial decisions of an unrelated institution. It should be said plainly that this approach has costs, and the Group does not present it otherwise.

The Trade-off, Stated Honestly

Direct authorisation is slower. An authorisation process measured in months, sometimes longer, stands between intention and live operation. The intermediated model can be faster to market by a wide margin.

Direct authorisation is more capital-intensive. Regulators require authorised firms to hold capital, to maintain operational substance, and to demonstrate governance and control in each jurisdiction. Every authorisation the Group may seek in future would carry that cost.

Direct authorisation demands operational substance in every jurisdiction where a licence is held. Local presence, local governance, and local accountability are not optional features of the model; they are conditions of it.

The Group accepts these costs as the price of the property it values most: that its regulatory standing is held, not rented. A firm that holds its own permissions controls its own continuity. A firm that rents them does not.

Architecture, Not Convenience

The choice between intermediated access and direct authorisation is sometimes treated as a question of speed, or of cost, or of operational convenience. The Group regards it as a question of architecture. An integrated financial ecosystem intended to operate across multiple regulated activities and multiple jurisdictions is, by its nature, a long-term construction. A long-term construction should not rest on a foundation controlled by someone else. Direct authorisation is the slower and more demanding path. The Group's position is that, for what it is building, it is also the more durable one.