When caution replaces judgement

More regulation means more operational work

Over the five years to 2026, EU rules have expanded what financial businesses must demonstrate about their operations. DORA, applicable since January 2025, covers technology risk and operational resilience for firms in scope. A payment company needs to understand what happens if a critical supplier fails, test its response and maintain the records required for incident reporting.

That changes the business case for a technology partnership. Management must consider recovery arrangements and contractual responsibilities alongside price and functionality. Compliance requires people who can assess these arrangements and keep them up to date as the service changes.

Sources: ESMA: Digital Operational Resilience Act

What the new AML rules change

The EU's 2024 anti-money-laundering package moves more requirements into a directly applicable regulation, generally applying from 10 July 2027. It tightens and harmonises rules on customer due diligence and identifying the people who ultimately own or control a business.

For a payment provider, preparation means reviewing the evidence it collects at onboarding, the way it assesses customer risk and the records that explain its decisions. More consistent rules can make operations across EU countries easier to standardise. Reaching that point requires changes to procedures and staff training, with extra work for firms whose current practices fall short.

The new authority, AMLA, coordinates supervision and is preparing to directly supervise selected high-risk financial institutions from 2028. Other firms remain subject to national supervision within a more coordinated EU framework. Management should therefore expect closer attention to whether its controls work consistently across the business.

Sources: Council of the EU: Anti-money-laundering package, May 2024 · EUR-Lex: AML regulation: application from July 2027 · AMLA: Selection in 2027 and direct supervision from 2028

When caution becomes a governance problem

Directors know that regulatory failures can have consequences for the company and, depending on the circumstances, for them personally. Yet a board may find it difficult to judge how an individual payment process creates that exposure. It relies on its Head of Compliance to interpret the rules and explain the risk.

Our concern is that this dependence can make refusal feel like the safest default. A recommendation may receive little scrutiny, even where better evidence or a narrower service could address the concern. The commercial cost then appears as delayed launches, lost customers or a service that excludes more businesses than its controls require.

EBA guidance assigns responsibilities to both management bodies and AML compliance officers. In practice, informed oversight means asking which requirement applies, what evidence supports the recommendation and whether the team has considered workable controls. The board needs enough understanding to take responsibility for the decision and fund the controls it approves.

Sources: EBA: Roles of management bodies and AML compliance officers, June 2022

What a considered decision looks like

The EBA's guidance on de-risking challenges the exclusion of whole customer categories without assessing individual risk. A broad label can hide meaningful differences between businesses and lead a provider to reject customers it could serve responsibly.

Consider a remittance business seeking an account. A useful review examines its ownership, payment routes and monitoring arrangements. Missing ownership evidence calls for a specific request. A route outside the provider's risk appetite may call for a narrower scope. A case that cannot meet legal requirements must be refused. Each outcome should follow the actual issue and the provider's ability to control it.

Sources: EBA: Guidelines challenging unwarranted de-risking, March 2023

What this means for investors

Investors should examine how a team reaches and revisits decisions. Repeated requests for the same documents suggest poor coordination. A named case owner, an explanation of the outstanding issue and a route for new evidence give the customer a practical way forward.

This is the approach Single Control is building into its service. Relevant records and accountable people need to work together so that a review reaches a defensible decision promptly. That helps customers plan their business while giving management a clear basis for the risks it accepts.