The Global Risks Alliance (GRA)
What readiness means in fintech Nexus: the evidence, governance and documentation a programme needs before a competent institution can review it independently.
Resilience and finance… · Programme year 1
owner · stage · status
| Token platform risk review | Supervisor | Build | M8 · week 5 | On track |
| Regtech reporting pilot | Chief compliance officer | Review | M5 · week 20 | On track |
| Operational resilience mapping | Consumer protection lead | Build | M3 · week 16 | On track |
| AI credit scoring audit | Bank partner | Scoping | M6 · week 39 | On track |
| Inclusion outcome study | Consumer protection lead | Build | M8 · week 39 | Blocked |
person-weeks
Fintech Nexus · Workstream trackerWorkstream tracker, in outline: domain structure with placeholder names and illustrative values, not a record.
Readiness in Fintech Nexus is the state in which a programme's evidence, governance and documentation let a competent institution review it independently, against frameworks such as CPMI-IOSCO Principles for financial market infrastructures (PFMI) and Digital Operational Resilience Act (DORA). A readiness file is released only at the owner's written direction, and GRA does not approve, rate, underwrite, lend or invest.
Fig.A programme from scoping to the owner's decision. Design, not a record.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
A readiness file describes a programme's evidence, risks and governance so that an institution can carry out its own review. GRA does not approve, rate, underwrite, lend or invest, and it recommends no counterparty.
A readiness file maps an activity to its likely regime. Authorisation decisions belong to the competent supervisor.
| Activity | Typical regime | What the reviewer checks |
|---|---|---|
| Payment initiation and account information | PSD2 in the EU, open banking rules elsewhere | Authorisation, strong customer authentication, API security |
| E-money and stablecoins | E-money rules; MiCA for asset-referenced and e-money tokens in the EU | Reserve assets, redemption rights, governance |
| Crypto-asset services | MiCA, national registration, FATF Recommendation 15 | Custody, market abuse controls, travel rule compliance |
| Credit scoring with AI | EU AI Act high-risk regime from 2 December 2027; consumer credit law | Data governance, human oversight, explanation to applicants |
| Critical ICT services to financial entities | DORA oversight of critical ICT third-party providers | Resilience testing, incident reporting, exit plans |
Many fintechs are third parties to banks and insurers, so their outages count against their clients' impact tolerances under the BCBS principles and DORA. A readiness file therefore documents recovery objectives, hosting regions and sub-outsourcing. Cloud dependency evidence comes from GCRI cloud and third parties; topic depth at fintech operational risk.
A file is released only at the programme owner's written direction, to a party the owner chooses, with no fee tied to any transaction.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Readiness file | A document set describing a programme's evidence, risks, governance and data so that a competent institution can carry out its own independent review; it is not an approval, rating or offer of finance. |
| Due diligence | The independent investigation a lender or investor carries out before committing finance. |
| Environmental and social safeguards | Requirements lenders set so financed projects avoid, minimise and offset harm to people and the environment. |
| Instant payment | A payment settled to the payee within seconds, at any time of day, every day of the year. |
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.