GRA · Fintech Nexus
Spatial financeWhere capital meets hazard, exposure and transition
Resilience and finance readiness
Fintech readiness asks what a supervisor, a bank partner or an investor would need to see about a digital financial service before relying on it: its dependencies, its resilience to outage and cyber attack, its identity and anti-money-laundering controls and its model governance. Fintech Nexus prepares that evidence and the diligence questions; it never licenses, recommends or invests in any service.
The workspace for resilience and finance readiness.
Workstream tracker
Resilience and finance · Programme year 1 · Example interface, not a record
Workstreams
owner · stage · status
| Token platform risk review | Supervisor | Build | M8 · week 5 | On track |
| Regtech reporting pilot | Chief compliance officer | Review | M5 · week 20 | On track |
| Operational resilience mapping | Consumer protection lead | Build | M3 · week 16 | On track |
| AI credit scoring audit | Bank partner | Scoping | M6 · week 39 | On track |
| Inclusion outcome study | Consumer protection lead | Build | M8 · week 39 | Blocked |
Effort against plan
person-weeks
Milestones
- W5M1Token platform risk review: scoping note signed
- W17M2Inputs qualified at the gate
- W22M3Regtech reporting pilot: build review
- W27M4Controlled test with observers
- W42M5Publication and decision record
Fintech Nexus · Workstream tracker. Workstream tracker: example names and illustrative values, not a record.
Readiness is not approval.
A readiness file describes a programme's evidence, risks and governance so that an institution can carry out its own review. The Global Risks Alliance (GRA) does not approve, rate, underwrite, lend or invest, and it recommends no counterparty.
Which regime a fintech activity falls under.
A readiness file maps an activity to its likely regime. Authorisation decisions belong to the competent supervisor.
| Activity | Typical regime | What the reviewer checks |
|---|---|---|
| Payment initiation and account information | PSD2 in the EU, open banking rules elsewhere | Authorisation, strong customer authentication, API security |
| E-money and stablecoins | E-money rules; MiCA for asset-referenced and e-money tokens in the EU | Reserve assets, redemption rights, governance |
| Crypto-asset services | MiCA, national registration, FATF Recommendation 15 | Custody, market abuse controls, travel rule compliance |
| Credit scoring with AI | EU AI Act high-risk regime from 2 December 2027; consumer credit law | Data governance, human oversight, explanation to applicants |
| Critical ICT services to financial entities | DORA oversight of critical ICT third-party providers | Resilience testing, incident reporting, exit plans |
How the process runs.
Process explorer · Process
Resilience and finance readiness: Due diligence to suspicion report
9 steps·4 stages
Process
Resilience and finance readiness: Due diligence to suspicion report
The FATF Recommendations set customer due diligence, transaction scrutiny and suspicion reporting to the financial intelligence unit, without prescribing monitoring systems.
01 Know the customer
- 01Customer due diligenceDataset · SupervisorThe institution verifies the customer and beneficial owner and understands the relationship's purpose. Due diligence is ongoing.
- 03Risk-based approach and customer riskModel · SupervisorMeasures are proportionate to the risks identified. The Recommendations read here do not fix risk labels or the review period.
02 Monitor
- 02TransactionsSource · SupervisorTransactions through the relationship are the input to scrutiny.
- 04Transaction monitoringModel · SupervisorTransactions are checked against what the institution knows of the customer, their business and risk profile.
03 Investigate
- 05Alert reviewStep · SupervisorFlagged activity is reviewed and either closed or escalated for investigation. The Recommendations do not describe this step.
- 06InvestigationStep · SupervisorAn escalated case is examined to decide whether suspicion exists. The Recommendations do not describe the case process.
04 Decide and report
- 07Decision to reportDecision · Compliance officer at management level (in some countries called the MLRO)If the institution suspects funds are crime proceeds or linked to terrorist financing, law should require it to report promptly.
- 08Report to the FIUStep · SupervisorThe report goes to the financial intelligence unit, the national centre for such reports. The text says promptly, with no day count.
- 09Test and improve monitoringStep · SupervisorAn independent audit function tests the system. Authorities should give guidance and feedback that help detection and reporting.
Outline of an external standard or method, from its public sources. It describes what the framework says, not a record of any run. It does not show that Nexus or any partner performs, certifies or approves a step. A gate is a step of the method, never a Nexus approval. Steps shown as general practice are marked in the QA record. The Recommendations here apply to financial institutions.
Fintechs as nodes in other firms' services.
Many fintechs are third parties to banks and insurers, so their outages count against their clients' impact tolerances under the BCBS principles and DORA. A readiness file therefore documents recovery objectives, hosting regions and sub-outsourcing. Cloud dependency evidence comes from GCRI cloud and third parties; topic depth at fintech operational risk.
Who sees a readiness file.
A file is released only at the programme owner's written direction, to a party the owner chooses, with no fee tied to any transaction.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- EU Markets in Crypto-Assets Regulation (MiCA), Regulation 2023/1114
- FATF Recommendations, including revised Recommendation 16 on payment transparency (June 2025; implementation by end-2030)
- EU AI Act (Regulation 2024/1689) as amended by the AI Omnibus, Regulation 2026/1744 (credit-scoring high-risk duties from 2 December 2027)
- EU Digital Operational Resilience Act, Regulation 2022/2554 (applies from 17 January 2025)
- BCBS Principles for Operational Resilience (2021)
Pages in Resilience and finance readiness.
Questions and answers.
Does a readiness file mean finance is available?
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.