DYNAMIC LICENSING OF FINTECH BANKS IN SPAIN AND THE EUROPEAN UNION – REGULATORY MODEL, DETAILED EXPLANATION WITH CASE LAWS

1. INTRODUCTION

Dynamic Licensing of Fintech Banks in Spain and the European Union refers to a regulatory approach in which financial institutions and financial technology businesses are authorized, supervised, and subjected to changing regulatory requirements according to their activities, risks, business models, and technological developments.

The expression dynamic licensing is primarily a regulatory and academic description rather than the name of a single legally established licensing category under Spanish or European Union law.

Under the existing framework, fintech businesses may require different authorizations depending on whether they conduct banking, payment services, electronic money issuance, investment services, crypto-asset services, or other regulated financial activities.

Spain operates within the European Union's financial regulatory architecture, which combines national supervisory authorities with European institutions and harmonized regulatory requirements.

Important authorities include:

Banco de España (Bank of Spain).

European Central Bank (ECB).

European Banking Authority (EBA).

European Securities and Markets Authority (ESMA).

Comisión Nacional del Mercado de Valores (CNMV).

European Insurance and Occupational Pensions Authority (EIOPA).

The regulatory objective is to encourage financial innovation while maintaining financial stability, consumer protection, operational resilience, cybersecurity, market integrity, and compliance with anti-money-laundering requirements.

Dynamic licensing is particularly relevant where fintech companies progressively expand their activities from technological service providers into regulated payment institutions, electronic money institutions, investment firms, crypto-asset service providers, or fully licensed credit institutions.

2. MEANING AND CONCEPT OF DYNAMIC LICENSING

Dynamic licensing may be understood as a risk-sensitive and activity-based approach to financial authorization and supervision.

Under such an approach, regulatory requirements evolve as a financial institution changes its business model, scale, products, operational arrangements, or risk profile.

However, changes to a firm's authorization must follow the legally prescribed procedures. A regulatory sandbox participant or payment institution does not automatically become a licensed bank merely because its business expands.

Essential Characteristics

Activity-based authorization.

Risk-sensitive supervisory requirements.

Continuous regulatory monitoring.

Regulatory reporting and compliance assessment.

Technology and cybersecurity supervision.

Authorization for additional regulated activities where necessary.

Proportional application of regulatory requirements where legally permitted.

Supervisory intervention where risks or regulatory breaches arise.

Example

A fintech company in Spain initially develops software for payment processing.

If it begins providing regulated payment services, it may need authorization as a payment institution or another legally appropriate status.

If it subsequently proposes to accept deposits from the public and conduct banking activities, it may need authorization as a credit institution.

The applicable licensing requirements depend on the substance of the activities and the relevant legislation.

This illustrates dynamic regulatory progression, not an automatic conversion between licenses.

3. OBJECTIVES OF DYNAMIC FINTECH LICENSING

3.1 Financial Stability

Regulators seek to prevent financial innovation from creating unacceptable risks to depositors, customers, payment systems, and financial markets.

3.2 Consumer Protection

Fintech institutions must comply with applicable requirements concerning transparency, customer information, data protection, complaint handling, and fair treatment.

3.3 Technological Innovation

A proportionate regulatory framework can encourage innovation without removing essential legal safeguards.

3.4 Prevention of Regulatory Arbitrage

Activity-based regulation reduces the possibility that businesses perform regulated financial functions without appropriate authorization merely by describing themselves as technology companies.

3.5 Operational Resilience

Regulated financial institutions must manage technology failures, cybersecurity threats, outsourcing risks, and disruptions to critical services.

3.6 Regulatory Adaptability

Supervisors must be able to respond to developments in artificial intelligence, blockchain technology, digital payments, cloud computing, and crypto-assets.

4. EUROPEAN UNION REGULATORY FRAMEWORK

4.1 Capital Requirements Directive – CRD

Directive 2013/36/EU, as amended, establishes important requirements concerning authorization, governance, prudential supervision, and the operation of credit institutions.

The framework has been further amended by Directive (EU) 2024/1619, commonly associated with CRD VI.

Credit institutions must satisfy applicable authorization requirements concerning capital, governance, management, ownership, and business organization.

A fintech company conducting activities reserved for credit institutions cannot avoid banking authorization merely because its services are delivered digitally.

4.2 Capital Requirements Regulation – CRR

Regulation (EU) No 575/2013, as amended, establishes directly applicable prudential requirements for institutions within its scope.

These include requirements concerning:

Own funds.

Capital adequacy.

Liquidity.

Leverage.

Large exposures.

Prudential reporting.

The requirements depend on the institution's classification and the applicable regulatory provisions.

4.3 Payment Services Directive – PSD2

Directive (EU) 2015/2366 governs payment services within the European Union.

PSD2 establishes authorization and operational requirements for payment service providers.

It also addresses customer protection, payment security, and access to payment accounts by authorized third-party providers.

A payment institution license is distinct from a banking license.

Payment institutions generally cannot accept deposits as banks do.

4.4 Electronic Money Directive

Directive 2009/110/EC establishes the regulatory framework for electronic money institutions.

Electronic money institutions may issue electronic money subject to authorization and safeguarding requirements.

Electronic money is not legally identical to a bank deposit.

4.5 Markets in Crypto-Assets Regulation – MiCA

Regulation (EU) 2023/1114 establishes a harmonized regulatory framework for specified crypto-assets and crypto-asset services.

MiCA includes provisions concerning:

Crypto-asset service providers.

Asset-referenced tokens.

Electronic money tokens.

Authorization requirements.

Governance.

Consumer protection.

Market abuse.

Regulatory supervision.

The principal crypto-asset service provider provisions became applicable on 30 December 2024, subject to transitional arrangements.

MiCA does not establish a general banking license for crypto-asset businesses.

4.6 Digital Operational Resilience Act – DORA

Regulation (EU) 2022/2554 became applicable on 17 January 2025.

DORA establishes requirements for covered financial entities concerning:

ICT risk management.

ICT-related incident reporting.

Digital operational resilience testing.

ICT third-party risk management.

Oversight of designated critical ICT third-party service providers.

DORA is an operational resilience framework rather than a separate fintech licensing regime.

4.7 Anti-Money-Laundering Regulation

The EU's evolving anti-money-laundering framework includes Regulation (EU) 2024/1624 and the establishment of the Anti-Money Laundering Authority under Regulation (EU) 2024/1620.

Different provisions have different application dates.

Fintech institutions must comply with the AML and counter-terrorist-financing requirements applicable to their activities and authorization status.

5. SPANISH REGULATORY FRAMEWORK

Spain regulates fintech activities through national legislation, directly applicable EU regulations, and the supervision of competent national and European authorities.

5.1 Law 10/2014 on Credit Institutions

Law 10/2014 of 26 June governs the organization, supervision, and solvency of credit institutions.

It operates alongside EU banking legislation.

The law addresses matters including:

Banking authorization.

Prudential supervision.

Governance.

Supervisory powers.

Regulatory compliance.

Administrative sanctions.

5.2 Royal Decree 84/2015

Royal Decree 84/2015 develops important aspects of Law 10/2014.

It addresses authorization, governance, and supervisory matters relating to credit institutions.

5.3 Royal Decree-Law 19/2018

Royal Decree-Law 19/2018 establishes the Spanish framework for payment services and related urgent financial measures, implementing key aspects of PSD2.

It regulates payment service providers and relevant customer protections.

5.4 Law 7/2020 – Spanish Financial Regulatory Sandbox

Law 7/2020 of 13 November establishes a controlled testing environment for technological innovation in the financial sector.

The Spanish regulatory sandbox enables qualifying innovative financial projects to be tested under supervisory arrangements.

Its objectives include:

Supporting financial innovation.

Identifying regulatory challenges.

Improving supervisory understanding.

Evaluating technological risks.

Encouraging appropriate consumer safeguards.

Participation in the sandbox does not itself constitute authorization to conduct all regulated financial activities.

5.5 Law 10/2010 – Anti-Money Laundering

Law 10/2010 establishes important obligations concerning the prevention of money laundering and terrorist financing.

Relevant fintech entities may be required to implement customer due diligence, monitoring, internal controls, and suspicious transaction reporting.

5.6 Spanish Data Protection Framework

The General Data Protection Regulation, Regulation (EU) 2016/679, applies to personal data processing within its scope.

Spain's Organic Law 3/2018 complements the GDPR.

Fintech institutions using automated profiling, artificial intelligence, and customer financial data must comply with applicable data protection requirements.

6. INSTITUTIONAL SUPERVISION

Banco de España

Banco de España performs important national functions concerning payment institutions, electronic money institutions, and banking supervision within the applicable allocation of responsibilities.

European Central Bank

Under the Single Supervisory Mechanism, the ECB is responsible for the authorization of credit institutions in participating Member States, following the relevant procedures involving national competent authorities.

The ECB also directly supervises significant credit institutions and works with national authorities concerning less significant institutions.

CNMV

The CNMV supervises securities markets and regulated investment activities within its competence.

It also has important responsibilities concerning crypto-asset service providers under Spain's allocation of MiCA supervisory functions.

European Banking Authority

The EBA develops technical standards, guidelines, and supervisory convergence initiatives within its legal mandate.

The EBA does not ordinarily grant individual banking licenses.

7. DYNAMIC LICENSING MODEL – STAGES

Stage 1: Business Model Identification

The fintech company identifies its proposed financial services and determines whether they fall within regulated activities.

Stage 2: Regulatory Classification

The business is assessed to determine whether it requires authorization as a:

Credit institution.

Payment institution.

Electronic money institution.

Investment firm.

Crypto-asset service provider.

Other regulated financial entity.

Stage 3: Authorization Application

The applicant submits the information required under the applicable licensing regime.

Requirements may include business plans, governance arrangements, capital information, ownership disclosures, and internal control frameworks.

Stage 4: Regulatory Assessment

The competent authority evaluates whether the applicant satisfies the relevant authorization conditions.

Stage 5: Commencement of Authorized Activities

The institution may conduct activities permitted by its authorization, subject to applicable restrictions and supervisory requirements.

Stage 6: Continuous Supervision

Supervisors monitor financial soundness, governance, operational resilience, consumer protection, and regulatory compliance.

Stage 7: Business Expansion or Regulatory Modification

Where the institution introduces new regulated activities, it may require additional authorization, notification, approval, or another legally prescribed process.

Stage 8: Enforcement or Withdrawal

Supervisory authorities may impose corrective measures or sanctions and, where the legal requirements are satisfied, withdraw authorization.

8. SEVEN IMPORTANT CASE LAWS

The following cases establish important principles concerning EU financial supervision, authorization, regulatory accountability, consumer protection, and technological financial services.

They are not seven judgments specifically recognizing a separate legal category called dynamic fintech licensing.

CASE LAW 1: Landeskreditbank Baden-Württemberg v. European Central Bank

Case: C-450/17 P

Court: Court of Justice of the European Union

Judgment: 8 May 2019

Facts:

Landeskreditbank Baden-Württemberg challenged its classification as a significant supervised entity under the Single Supervisory Mechanism.

The dispute concerned the allocation of supervisory responsibilities between the ECB and national authorities.

Legal Issue:

Whether the institution could be treated as less significant and supervised directly by the national competent authority.

Judgment:

The Court upheld the relevant interpretation of the Single Supervisory Mechanism framework and rejected the appeal.

Legal Principle:

The allocation of banking supervisory responsibilities must follow the applicable EU regulatory criteria.

Relevance to Dynamic Licensing:

The case demonstrates that supervisory classification depends upon legally established criteria rather than institutional preference.

CASE LAW 2: Berlusconi and Fininvest v. Banca d'Italia and IVASS

Case: C-219/17

Court: Court of Justice of the European Union

Judgment: 19 December 2018

Facts:

The dispute concerned supervisory proceedings relating to the acquisition of a qualifying holding in an Italian credit institution.

The process involved national authorities and the ECB.

Legal Issue:

Which court had jurisdiction to review national preparatory acts forming part of a composite EU administrative procedure.

Judgment:

The Court held that where the ECB has final decision-making authority in the relevant procedure, judicial review of the national preparatory acts forming part of that process falls within the EU judicial system.

Legal Principle:

Composite supervisory procedures must respect the allocation of decision-making and judicial review powers under EU law.

Relevance to Dynamic Licensing:

The judgment is relevant to ownership approvals and supervisory decision-making affecting fintech banks.

CASE LAW 3: ECB v. Trasta Komercbanka AS and Others

Joined Cases: C-663/17 P, C-665/17 P and C-669/17 P

Court: Court of Justice of the European Union

Judgment: 5 November 2019

Facts:

The dispute followed the ECB's withdrawal of a Latvian bank's authorization.

Legal proceedings raised questions concerning representation and the ability to challenge supervisory decisions.

Legal Issue:

Whether the bank and its shareholders could challenge the withdrawal decision and how representation issues affected judicial proceedings.

Judgment:

The Court addressed admissibility, representation, and effective judicial protection in proceedings concerning the withdrawal of banking authorization.

Legal Principle:

Banking supervisory decisions are subject to judicial review, but standing and representation must satisfy applicable legal requirements.

Relevance to Dynamic Licensing:

The case demonstrates the importance of procedural safeguards when banking authorization is withdrawn.

CASE LAW 4: Banco Español de Crédito SA v. Joaquín Calderón Camino

Case: C-618/10

Court: Court of Justice of the European Union

Judgment: 14 June 2012

Facts:

The dispute concerned enforcement of a consumer credit agreement containing a contractual term challenged as unfair.

Legal Issue:

Whether national procedural rules adequately protected consumers against unfair contractual terms under Directive 93/13/EEC.

Judgment:

The Court emphasized the obligation of national courts to examine potentially unfair contractual terms of their own motion where the relevant legal and factual elements are available.

Legal Principle:

Consumer protection under EU law requires effective judicial scrutiny of unfair contractual terms.

Relevance to Dynamic Licensing:

Digital lenders and fintech banks must comply with consumer contract protections even where lending is conducted through automated platforms.

CASE LAW 5: Aziz v. Caixa d'Estalvis de Catalunya, Tarragona i Manresa

Case: C-415/11

Court: Court of Justice of the European Union

Judgment: 14 March 2013

Facts:

The dispute involved Spanish mortgage enforcement proceedings and contractual terms alleged to be unfair.

Legal Issue:

Whether Spanish procedural rules provided effective protection against unfair terms in consumer mortgage contracts.

Judgment:

The Court held that aspects of the national procedural framework were incompatible with the effective protection required by Directive 93/13/EEC.

Legal Principle:

National procedures must provide effective protection against unfair contractual terms.

Relevance to Dynamic Licensing:

Fintech lenders offering mortgage-related services in Spain must comply with EU consumer protection requirements.

CASE LAW 6: SCHUFA Holding (Scoring)

Case: C-634/21

Court: Court of Justice of the European Union

Judgment: 7 December 2023

Facts:

The dispute concerned automated credit scoring and the use of probability values to assess an individual's creditworthiness.

Legal Issue:

Whether automated generation of a creditworthiness score could constitute automated individual decision-making under Article 22 GDPR.

Judgment:

The Court held that automated establishment of a probability value may constitute automated individual decision-making where a third party draws strongly on that value to establish, implement, or terminate a contractual relationship.

Legal Principle:

Automated financial decision-making may be subject to GDPR restrictions and safeguards.

Relevance to Dynamic Licensing:

Fintech banks using AI-based credit scoring must assess compliance with data protection and automated decision-making requirements.

CASE LAW 7: C-203/22, Dun & Bradstreet Austria

Court: Court of Justice of the European Union

Judgment: 27 February 2025

Facts:

The dispute concerned an automated creditworthiness assessment and the information that a data subject could obtain regarding the logic involved in automated decision-making.

Legal Issue:

The scope of the right to meaningful information about the logic involved in automated decision-making under the GDPR.

Judgment:

The Court clarified that the information provided must enable the data subject to understand the procedure and principles actually applied to their personal data in reaching the automated decision.

Legal Principle:

Transparency concerning automated decision-making must be meaningful and understandable, subject to the applicable legal framework.

Relevance to Dynamic Licensing:

The judgment is important for fintech institutions using automated lending assessments and algorithmic customer evaluation.

9. COMPARISON BETWEEN TRADITIONAL AND DYNAMIC LICENSING

10. MAJOR LEGAL RISKS

10.1 Unauthorized Banking Activities

Fintech companies may face enforcement action if they conduct activities requiring authorization without holding the appropriate license.

10.2 Regulatory Classification Risk

A business may incorrectly classify its products as unregulated technological services.

10.3 Consumer Protection Risk

Digital financial products may involve inadequate disclosures, unfair terms, misleading advertising, or improper complaint handling.

10.4 Data Protection Risk

Automated credit scoring and financial profiling may violate GDPR requirements if conducted without a lawful basis or applicable safeguards.

10.5 Cybersecurity Risk

Digital banking platforms may experience ICT incidents, outsourcing failures, or cyberattacks.

10.6 Anti-Money-Laundering Risk

Inadequate customer due diligence and transaction monitoring may result in regulatory breaches.

10.7 Cross-Border Regulatory Risk

EU passporting rights depend on the relevant authorization framework and compliance with applicable notification procedures.

A Spanish authorization does not automatically authorize every financial activity throughout the European Union.

11. INDIAN LEGAL FRAMEWORK AND COMPARATIVE POSITION

India does not operate under the EU banking passporting system.

However, Indian financial regulation also distinguishes between different categories of financial activities and institutions.

11.1 Banking Regulation Act, 1949

Section 22 establishes licensing requirements for banking companies, subject to the applicable statutory framework.

11.2 Reserve Bank of India Act, 1934

The RBI Act provides important regulatory powers concerning non-banking financial companies and monetary and financial supervision.

11.3 Payment and Settlement Systems Act, 2007

Section 4 generally requires authorization for operating a payment system, subject to statutory exceptions.

11.4 RBI Regulatory Sandbox

The RBI has established a regulatory sandbox framework for controlled testing of eligible financial innovations.

Participation does not automatically confer a banking license.

11.5 Digital Lending Directions

The RBI's digital lending framework regulates specified digital lending activities involving regulated entities and their lending service providers.

Relevant obligations include transparency, borrower protection, disbursement arrangements, data practices, and grievance redress.

11.6 Digital Personal Data Protection Framework

India's Digital Personal Data Protection Act, 2023 and associated implementation framework are relevant to fintech processing of digital personal data.

The application of particular obligations depends on the commencement and transitional provisions in force.

Comparative Analysis

Both India and the European Union regulate fintech activities according to the nature of the financial services provided.

However, the EU framework includes harmonized authorization regimes and passporting arrangements for specified financial services.

India primarily relies on domestic authorization and supervision by competent regulators.

12. INTERNATIONAL REGULATORY PRINCIPLES

Basel Committee on Banking Supervision

Basel standards provide internationally influential principles concerning prudential supervision, governance, capital, liquidity, and operational risk.

Financial Stability Board

The FSB monitors vulnerabilities and develops recommendations concerning financial stability, including risks arising from technological innovation.

Financial Action Task Force

FATF standards establish international recommendations concerning anti-money-laundering and counter-terrorist-financing controls.

OECD

OECD principles and policy work address digital financial markets, innovation, consumer protection, and responsible business practices.

These international standards have different legal statuses and generally require implementation through applicable national or regional legal frameworks.

13. RECOMMENDED REGULATORY MODEL FOR SPAIN AND THE EU

A legally workable dynamic licensing model should preserve existing statutory authorization categories while allowing supervision to respond proportionately to changing business activities and risks.

Component 1: Activity-Based Classification

Regulators should determine which activities require banking, payment, electronic money, investment, or crypto-asset authorization.

Component 2: Proportionate Requirements

Regulatory requirements should reflect institutional risks and the proportionality permitted by applicable legislation.

Component 3: Supervisory Technology

Regulators may use supervisory technology to improve regulatory reporting, risk detection, and compliance monitoring.

Component 4: Controlled Innovation

Regulatory sandboxes may help authorities evaluate innovative financial services before wider deployment.

Component 5: Consumer Protection

Digital institutions must comply with applicable disclosure, transparency, unfair-term, and complaint-handling rules.

Component 6: Operational Resilience

Covered entities should implement effective ICT risk management and comply with DORA and other applicable security requirements.

Component 7: Judicial Accountability

Authorization decisions, supervisory interventions, and sanctions must comply with applicable procedural requirements and judicial review mechanisms.

14. CRITICAL LEGAL ANALYSIS

Dynamic licensing presents both opportunities and regulatory challenges.

Its principal advantage is that supervision can respond to the changing risks of technologically innovative financial institutions.

However, flexibility cannot replace legal certainty.

A fintech company must know which activities require authorization, which authority is competent, and which legal obligations apply.

Similarly, regulators cannot impose entirely new licensing conditions without an appropriate legal basis.

The principles of legality, proportionality, legal certainty, equal treatment, and effective judicial protection remain essential.

EU case law concerning supervisory competence and banking authorization demonstrates that regulatory flexibility must operate within established legal procedures.

Consumer protection decisions show that technological innovation does not eliminate obligations arising under consumer contract law.

Automated credit-scoring judgments further demonstrate that digital financial services must comply with data protection requirements even when decisions are generated through complex algorithms.

Consequently, the most legally defensible dynamic licensing model is not an unrestricted system of continuously changing licenses.

Instead, it is an integrated framework combining established authorization categories, proportionate supervision, regulatory innovation mechanisms, and enforceable legal safeguards.

15. CONCLUSION

Dynamic Licensing of Fintech Banks in Spain and the European Union represents an evolving approach to the regulation of digital financial institutions.

Although no single EU-wide authorization category formally bears the name dynamic fintech banking license, existing EU and Spanish legislation supports activity-based licensing, risk-sensitive supervision, regulatory sandboxes, and continuing compliance oversight.

The Capital Requirements Directive, Capital Requirements Regulation, PSD2, Electronic Money Directive, MiCA, DORA, and relevant Spanish legislation collectively establish the principal legal framework.

Spanish Law 7/2020 provides an important mechanism for controlled financial innovation, while the ECB, Banco de España, CNMV, and other competent authorities supervise institutions according to their respective legal mandates.

The seven judicial decisions discussed above demonstrate the importance of lawful supervisory decision-making, judicial protection, consumer rights, and transparency in automated financial services.

The central legal principle is that fintech innovation may justify proportionate and adaptable supervision, but it does not remove the requirement to obtain the legally appropriate authorization or comply with mandatory financial regulation.

A successful regulatory model must therefore balance innovation, financial stability, legal certainty, cybersecurity, consumer protection, and regulatory accountability.

16. REFERENCES

European Union Legislation

Directive 2013/36/EU – Capital Requirements Directive.

Directive (EU) 2024/1619 – Amendments to the Capital Requirements Directive.

Regulation (EU) No 575/2013 – Capital Requirements Regulation.

Directive (EU) 2015/2366 – Payment Services Directive.

Directive 2009/110/EC – Electronic Money Directive.

Regulation (EU) 2023/1114 – Markets in Crypto-Assets Regulation.

Regulation (EU) 2022/2554 – Digital Operational Resilience Act.

Regulation (EU) 2016/679 – General Data Protection Regulation.

Regulation (EU) 2024/1624 – Anti-Money-Laundering Regulation.

Regulation (EU) 2024/1620 – Anti-Money Laundering Authority Regulation.

Council Regulation (EU) No 1024/2013 – Single Supervisory Mechanism.

Spanish Legislation

Law 10/2014 of 26 June – Organization, Supervision and Solvency of Credit Institutions.

Royal Decree 84/2015 – Development of Law 10/2014.

Royal Decree-Law 19/2018 – Payment Services.

Law 7/2020 of 13 November – Digital Transformation of the Financial System.

Law 10/2010 – Prevention of Money Laundering and Terrorist Financing.

Organic Law 3/2018 – Personal Data Protection and Guarantee of Digital Rights.

Seven Judicial Decisions

Landeskreditbank Baden-Württemberg v. ECB, Case C-450/17 P, Judgment of 8 May 2019.

Berlusconi and Fininvest v. Banca d'Italia and IVASS, Case C-219/17, Judgment of 19 December 2018.

ECB v. Trasta Komercbanka AS and Others, Joined Cases C-663/17 P, C-665/17 P and C-669/17 P, Judgment of 5 November 2019.

Banco Español de Crédito SA v. Joaquín Calderón Camino, Case C-618/10, Judgment of 14 June 2012.

Aziz v. Caixa d'Estalvis de Catalunya, Tarragona i Manresa, Case C-415/11, Judgment of 14 March 2013.

SCHUFA Holding (Scoring), Case C-634/21, Judgment of 7 December 2023.

Dun & Bradstreet Austria, Case C-203/22, Judgment of 27 February 2025.

Indian Legislation and Regulations

Banking Regulation Act, 1949.

Reserve Bank of India Act, 1934.

Payment and Settlement Systems Act, 2007.

Reserve Bank of India – Regulatory Sandbox Framework.

Reserve Bank of India – Digital Lending Directions.

Digital Personal Data Protection Act, 2023.

International Regulatory Materials

Basel Committee on Banking Supervision – Core Principles for Effective Banking Supervision.

Financial Stability Board – Financial Innovation and Stability Publications.

Financial Action Task Force – International AML/CFT Recommendations.

European Banking Authority – Reports and Guidelines on Fintech and Financial Innovation.

OECD – Digital Financial Services and Financial Consumer Protection Principles.

Research Note: This explanation distinguishes binding licensing rules from the broader policy concept of dynamic licensing. Regulatory developments, transitional arrangements, and commencement dates should be checked against the official consolidated legislation and supervisory guidance before the material is used for formal legal or compliance purposes.