1. The Fintech Landscape
1.1 Please describe the types of fintech businesses that are active in your jurisdiction and the state of the development of the market, including in response to the COVID-19 pandemic and ESG (Environmental, Social and Governance) objectives. Are there any notable fintech innovation trends of the past year within particular sub-sectors (e.g. payments, asset management, peer-to-peer lending or investment, insurance and blockchain applications)?
The UK continues to be ranked as one of the most “fintech-friendly” countries in the world, and in 2022 was second only to the United States as the most popular destination for fintech investment globally. In this environment, a broad spectrum of fintech businesses at various stages of growth and development are represented both in London and the UK more widely. The UK’s credibility as a centre for tech and innovation was arguably reinforced by the recent government-backed HSBC acquisition of Silicon Valley Bank’s UK operations.
The UK is continuing to drive forward the recommendations made in an independent fintech strategic review, led by Ron Kalifa OBE (former CEO of Worldpay) published in February 2021. In the past year significant progress has been made by HM Treasury – acting in partnership with the City of London Corporation it launched the Centre for Finance, Innovation and Technology (CFIT) (one of the key suggestions made by the review). It is hoped that this organisation will bring together experts from finance, technology, academia and policy-making to identify and remove barriers to fintech sector growth, and support the creation of high-income tech-based employment across the country. CFIT will be chaired by Charlotte Crosswell, who formerly held senior positions at Innovate Finance (Britain’s fintech trade body) and Nasdaq NLX.
The UK was an early adopter of payments technology, and this market has now reached a degree of maturity. By the end of the year more than seven million customers had used Open Banking – with just under 18% of these customers being first-time users. The FCA continues to take an active interest in the potential benefits of applying Open Banking beyond retail banking alone. In March 2022 the FCA announced that (together with the Payment Systems Regulator, the Competition and Markets Authority and HM Treasury) it had formed a Joint Regulatory Oversight Committee to consider the vision and strategic roadmap for further developing Open Banking.
Big data continues to play an important role both for start-ups and established financial services firms. Following on from the launch of its National AI Strategy in September 2021, the UK government has issued its first AI Action Plan (further detailing key national priorities), published the results of the Future of Computer Review (an AI regulation policy paper) and issued a new AI rulebook (which proposed a “pro-innovation” framework). The UK government has also indicated its desire to develop the presence of AI in the national security and healthcare policy areas. The FCA’s Data Strategy has reinforced the regulator’s position as a potential creator and user of regtech solutions.
Distributed ledger technologies (DLT) continue to emerge in diverse sectors across the UK (though there are currently few applications which are developed beyond a proof-of-concept stage). Investment and trading in cryptoassets have been dampened by recent turbulence in the cryptomarkets that emerged in 2022 (auguring a “cryptowinter”), although recent surveys indicate that 5–10% of UK adults now own cryptoassets.
The UK is widely acknowledged as a world leader in the creation of new forms of crowdfunding and that market continues to grow, driven by companies such as Seedrs and Crowdcube.
Both fintech and ESG are high on the UK government’s agenda and there are likely to be crossovers as the UK seeks to implement net zero whilst remaining a thriving space for innovation and tech. Fintech businesses are among the founding members of the TechZero charter, a climate action group for UK tech companies working together to accelerate progress to net zero. In 2022, the FCA in collaboration with the City of London Corporation ran a second digital sandbox pilot focusing on solving the regulatory challenges related to new products and services in the area of ESG data and disclosure. Moreover, the Bank of England continues to indicate its interest in a UK central bank digital currency, which could play a role in the transition to a net zero economy and may offer enhanced data and analytics.
1.2 Are there any types of fintech business that are at present prohibited or restricted in your jurisdiction (for example cryptocurrency-based businesses)?
There are currently no prohibitions or restrictions that are specific to fintech businesses in the UK. Depending on the nature of the business, fintechs may need to be regulated in the same way as other traditional financial services firms.
That said, the FCA has prohibited the marketing, distribution or sale – in or from the UK – to all retail clients of derivatives and exchange traded notes (ETNs) that reference certain types of unregulated, transferable cryptoassets since 6 January 2021.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) require all cryptoasset exchanges and custodian cryptowallet providers to comply with anti-money laundering (AML) requirements, including registering with the FCA, and implementing identity and other AML checks. This has presented a challenge for certain cryptoasset firms; the FCA confirmed in November 2022 that 85% of licence applications from cryptotrading firms have either been rejected or withdrawn.
We note that HM Treasury is bringing the promotion of certain unregulated cryptoassets within the scope of the financial promotions regime and is in the process of expanding the regulatory perimeter to encompass a broader range of cryptoasset activities. The annexation of activities that issue or facilitate the use of fiat-backed stablecoins used as a means of payment will mark the first stage of this process.
See further question 3.2 for details of the UK legal and regulatory approach to cryptocurrencies.
2. Funding For Fintech
2.1 Broadly, what types of funding are available for new and growing businesses in your jurisdiction (covering both equity and debt)?
The UK has mature debt and equity capital markets accessible to businesses above a certain size. Raising finance through an IPO has been a popular avenue for certain fintech businesses in recent years. For those fintech businesses that are not yet in a position to raise finance through “traditional” routes, there are a number of other funding sources available in the UK.
In December 2021, new rules came into force to address, and build on, recommendations made in the Kalifa Review concerning the listing of companies on UK public markets. A targeted form of dual class share structures within the premium listing segment is now permitted, with a view to encouraging innovative, often founder-led companies onto public markets sooner and so broaden the listed investment landscape for UK investors. In addition, the amount of shares an issuer is required to have in public hands (i.e. free float) has been reduced from 25% to 10%, while the minimum market capitalisation threshold for both the premium and standard listing segments for shares in ordinary commercial companies has increased from £700,000 to £30 million.
In May 2022, the FCA published a discussion paper which examined broader potential reform to the way companies list in the UK. One proposal under consideration by the regulator is that companies wishing to list in the UK would no longer have to choose between two different segments with different branding and standards – instead, all listed companies would need to meet one set of criteria and could then choose to opt into a further set of obligations. The FCA is currently considering the comments received from market participants on the discussion paper.
Early-stage venture capital funding before it is possible to put a valuation on a company is often done through a form of convertible loan note (CLN). The CLN becomes convertible into equity on the occurrence of certain events such as a material funding round, an exit or an IPO, usually at a discount to the value per share applied by such event. An alternative to the CLN, structured so as to qualify for certain tax reliefs, is the advanced subscription agreement, whereby the investor subscribes for future equity determined by reference to the relevant trigger event.
As a company matures, it will typically undergo a series of equity fundraisings (seed funding, Series A, Series B and so on). In 2022, for example, the API-provider Codat undertook a EUR96 million Series C fundraising.
Crowdfunding continues to grow in popularity in the UK for start-up businesses. In particular, it offers private investors an opportunity to invest in early-stage businesses, which would previously have only been accessible to business angels or venture capitalists, through platforms such as Crowdcude and Seedrs. Many fintech start-ups have combined crowdfunding finance with finance raised from more traditional sources, such as from venture capital and business angels. Incubators, which generally offer facilities and funding for start-ups in return for an equity stake, are also increasingly prevalent in the UK and may present an attractive option to small and growing fintech businesses. Whilst the UK’s fintech start-ups raised USD12.5 billion in 2022, this figure marks a year-on-year decrease of 8%.
Whilst small businesses are unlikely to have recourse to “traditional” bank loans, there are more tech-focused banks, such as Silicon Valley Bank UK (bought by HSBC) and OakNorth Bank, which specifically provide debt finance to tech start-ups. There are also numerous peer-to-peer lending platforms and invoice financing firms operating in the UK, which provide alternative sources of debt finance to small and growing businesses.
2.2 Are there any special incentive schemes for investment in tech/fintech businesses, or in small/medium-sized businesses more generally, in your jurisdiction, e.g. tax incentive schemes for enterprise investment or venture capital investment?
The UK government offers various tax incentives for investment in start-ups. Generally speaking, these incentives are not specific to the tech or fintech sectors and are available to qualifying companies and investors in all sectors.
These include the Seed Enterprise Investment Scheme (SEIS), which offers a 50% income tax relief for UK taxpayers investing up to £100,000 in qualifying start-ups. A company can raise no more than £150,000 in total via SEIS investment. To qualify for SEIS, a company must (among other qualifying criteria) be no more than two years old, have assets of less than £200,000 and have fewer than 25 employees. This complements the Enterprise Investment Scheme (EIS), which offers tax relief for investment in more mature companies (though the tax relief available under the EIS is 30%). Equivalent relief is also applicable if an investment is made through a venture capital trust (VCT).
There are also SME R&D tax credits of up to 230% for certain companies with fewer than 500 employees. In the November 2021 Budget it was announced that R&D tax credits for innovation would be extended to data and cloud computing, a change that took effect in April 2023.
2.3 In brief, what conditions need to be satisfied for a business to IPO in your jurisdiction?
The precise conditions depend on the type of listing and the market on which the shares will be listed. A premium listing on the main market of the London Stock Exchange will, for example, entail more onerous requirements than a listing on the Alternative Investment Market (AIM).
In summary, a standard listing on the main market of the London Stock Exchange would require compliance with the following key requirements:
- The company must be duly incorporated, validly existing and operating in conformity with its constitution, and its shares must comply with the laws of the company’s place of incorporation, duly authorised and have all necessary statutory and other consents.
- The company’s shares must be freely transferable and free from any restrictions on the right of transfer.
- The company must have an expected aggregate market value of at least £30 million.
- The company must publish an approved prospectus.
- At least 10% of the shares must be held by the public at the time of admission.
To obtain a premium listing on the London Stock Exchange, a company would need to comply with requirements additional to the standard listing requirements above, such as supplying three years of audited financial accounts and demonstrating a sufficient revenue-earning record and working capital.
In August 2021, the FCA introduced changes designed to make the UK a more attractive proposition for the listing of Special Purpose Acquisition Companies or SPACs, following the recommendations of Lord Hill’s Review on UK listings (which was produced at the behest of HM Treasury).
2.4 Have there been any notable exits (sale of business or IPO) by the founders of fintech businesses in your jurisdiction?
According to the latest data by Dealroom, the UK is now home to 122 unicorns and 258 “futurecorns” (high-growth tech companies that are predicted to reach the USD1 billion mark in the future). There is the potential for a number of UK firms to embark on an IPO in the upcoming year, including Zopa, WorldRemit and Checkout.com.
The popularity of SPAC transactions in jurisdictions such as the United States has not yet been mirrored in the UK. However, it was announced in November 2021 that Hambro Perks Acquisition Company, a special purpose acquisition vehicle sponsored by Hambro Perks (the international investment firm focused on technology investing), intends to raise up to £150 million through listing on the London Stock Exchange. In 2022, Hambro Perks began investing in a number of UK-based fintech companies, including Fintern – a fair lending platform.
More generally, statistics show that despite challenging global factors, investment in fintech in the UK was resilient in 2022, raising double the funding of any other European market and ranking second globally for start-up investment in the first half of 2022.
3. Fintech Regulation
3.1 Please briefly describe the regulatory framework(s) for fintech businesses operating in your jurisdiction, and the type of fintech activities that are regulated.
There is no specific regulatory framework for fintech businesses, which are subject to the existing body of UK financial regulation. Fintech firms will fall within the regulatory perimeter if they carry on certain regulated activities (specified in legislation) by way of business in the UK and do not fall within the scope of an exemption. This regulatory perimeter covers “traditional” financial services, such as provision of banking, consumer credit and insurance services, as well as certain areas more typically associated with fintech start-ups, such as crowdfunding. The perimeter is set to expand, moreover, to encompass a wide range of cryptoasset activities where these mirror, or closely resemble, regulated activities performed in traditional financial services. See question 3.2 below.
It is important to note that just because a firm regards itself as more “tech” than “fin”, this does not necessarily mean that it will escape regulation; many activities that might be regarded as mere technological services can fall within the scope of the regulatory perimeter. And indeed the provision, or operation, of technology and financial regulation is becoming increasingly enmeshed in certain contexts. A recent example of this trend can be found in (well progressed) proposals to regulate certain services provided by “critical” third parties, such as cloud service and other ICT service providers, to financial services and financial market infrastructure firms.
A firm that wishes to undertake regulated activities in the UK will need to obtain authorisation from one of the UK’s financial regulators, the FCA or the Prudential Regulation Authority (PRA). Once authorised, those firms will be subject to a range of additional primary legislation, as well as detailed (and in some cases, activity-specific) rulebooks published by the FCA and the PRA.
3.2 Is there any regulation in your jurisdiction specifically directed at cryptocurrencies or cryptoassets?
In February 2023, the government articulated (and launched a consultation paper on) its vision for the future financial services regulatory regime for cryptoassets. Comprehensive in scope, the government is proposing to introduce a number of new regulated or designated activities tailored to the cryptoasset market into the existing regime under the Financial Services and Markets Act 2000 (FSMA). These activities nominally include cryptoasset custody, issuance and operating a cryptoasset trading venue.
This proposed absorption of cryptoasset activities within FSMA heralds the phasing out of the registration regime that has existed for cryptoasset exchange providers and custodian wallet providers under the MLRs since January 2020. It also expands on a regulatory approach that has (broadly) sought to regulate cryptoassets by reference to existing regulatory regimes; for example, at present, cryptoassets which amount to “e-money” may be regulated under the UK’s E-Money Regulations, and the UK’s Payment Services Regulations.
While this FSMA-based future is currently nascent, wheels are already in motion to bring activities that issue or facilitate the use of stablecoins used as a means of payment, including custodial activities, into the UK regulatory perimeter via the Financial Services and Markets Bill. To a similar timetable, we are moving towards a position where the majority of cryptoasset promotions will fall within the UK’s financial promotion regime. In other words, the UK is well on its way towards building a more cohesive regulatory framework for cryptoassets.
3.3 Are financial regulators and policy-makers in your jurisdiction receptive to fintech innovation and technology-driven new entrants to regulated financial services markets, and if so how is this manifested? Are there any regulatory ‘sandbox’ options for fintechs in your jurisdiction?
UK financial regulators and policy-makers continue to be receptive to fintech. Both the government and industry continue to pursue a range of recommendations made in the Kalifa Review, with a view to ensuring that “the UK maintains its global leadership in this vital sector”. This support for innovation has been matched by regulatory action to protect consumers and markets where deemed necessary.
The favourable political environment has influenced the approach of the PRA and the FCA. In particular, the FCA is generally regarded as one of the most forward-thinking regulators in the world in this area. It began its own innovation project in 2014, with an Innovation Hub, a Regulatory Sandbox and a Global Financial Innovation Network (GFIN).
The Innovation Hub provides a means by which new and established businesses – both regulated and non-regulated – can introduce innovative financial products and services to the market, with support from the regulator on the application of the regulatory framework. The Sandbox allows businesses to test innovative products, services, business models and delivery mechanisms with real consumers in a controlled environment. A Direct Support team provides a contact for innovative businesses looking to understand the FCA’s expectations and explore the risks and benefits of new business models or innovative variations on existing models. The FCA also assists in connecting scaling entities with international peers, through the GFIN.
The Bank of England also has a Fintech Hub through which it seeks to understand what fintech means for the stability of the financial system, the safety and soundness of financial firms and its ability to perform its operational and regulatory roles. The Bank also has an active regtech agenda and has been actively engaged in a dialogue on the appropriate design of a central bank digital currency.
The UK’s Information Commissioner’s Office (ICO), the main data privacy regulator in the UK, launched a sandbox in March 2019 to support organisations in developing innovative products and services, using personal data in different ways.
3.4 What, if any, regulatory hurdles must fintech businesses (or financial services businesses offering fintech products and services) which are established outside your jurisdiction overcome in order to access new customers in your jurisdiction?
Where a fintech firm wishes to perform regulated activities in the UK, it will need to consider whether it requires authorisation to do so. It is important to note that a person does not need to be established in the UK in order to carry out regulated activities in the UK – a fintech business based overseas that deals with customers in the UK is likely to be viewed as carrying on activities in the UK. Where an overseas fintech firm performs regulated activities in the UK, it will need to obtain authorisation from the UK financial regulators (as described further in our answer to question 3.1 above) and rely on an exemption to the authorisation regime.
There are numerous exemptions to the performance of regulated activities, some of general application and others associated with specific activities. Application of these exemptions is, of course, fact dependent, but it is worth noting that one exemption – the “overseas person exemption” – is specifically targeted at firms established outside of the UK. This exemption is, however, restrictive in scope, applying only to certain activities and where there is direct involvement of an authorised or exempt firm in the performance of the activity or a “legitimate approach” by an overseas person (e.g. an approach that does not breach the UK’s financial promotions regime). There are ongoing plans to review the scope of the overseas perimeter and whether it remains appropriate for the UK.
Overseas fintech firms should also have regard to the UK financial promotions regime under which firms are not permitted, in the course of business, to communicate (or cause to be communicated) an invitation or inducement to engage in investment activity, unless that person is authorised or the communication falls within the scope of an exemption. As with regulated activities, one such exemption relates to overseas communicators.
4. Other Regulatory Regimes / Non-Financial Regulation
4.1 Does your jurisdiction regulate the collection/use/transmission of personal data, and if yes, what is the legal basis for such regulation and how does this apply to fintech businesses operating in your jurisdiction?
Following the end of the Brexit transition period on 31 December 2020, the UK effectively “onshored” the EU’s General Data Protection Regulation (the EU GDPR) onto UK law, with certain modifications to ensure that the onshored legislation would operate effectively in the UK (the UK GDPR). The UK GDPR regulates the processing of personal data and special category data and applies to fintech organisations established in the UK. However, the UK GDPR has extra-territorial effect and may also apply to some fintech organisations established outside the UK (see question 4.2 below). For now, the UK and EU GDPR are broadly aligned, and have equivalent extra-territorial application, but divergences in enforcement approaches and in the interpretation of the rules on international transfers are becoming apparent. Fintech organisations will need to assess which (or both) of the regimes apply to any given processing of personal data.
Processing is defined widely to cover any operation performed on personal data, including collecting, storing or destroying that data. Fintech organisations caught by the UK GDPR can be controllers, joint controllers or processors. Under the UK GDPR:
- “controllers” are those organisations which process personal data and determine the purpose and means of such processing;
- “joint controllers” are two or more controllers that jointly determine the purposes and means of processing; and
- “processors” include service providers and other persons which process personal data on behalf of a controller.
The UK GDPR follows a principles-based approach: those processing personal data must comply with a set of principles (for example, personal data must be processed fairly, lawfully, transparently and securely) and need a “lawful basis” for the processing (for example, consent). The UK GDPR requires high standards of privacy compliance, including mandatory breach notification provisions, implementing data protection by design and default, and complying with accountability requirements.
The UK GDPR is supplemented by the Data Protection Act 2018 (DPA 2018), which includes a number of exemptions, provisions relating to international transfers and detail on the ICO’s enforcement powers. It also covers areas (such as law enforcement and processing by the intelligence services) that were not previously covered by the EU GDPR. In addition, the Data Protection (Charges and Information) Regulations 2018 impose a data protection fee of between £40 and £2,900 on data controllers (depending on the size and type of organisation, unless they are exempt).
Unsolicited direct marketing by electronic means is covered by both the UK data protection regime and the Privacy and Electronic Communications Regulations 2003 (PECR), which implemented an EU Directive. A new ePrivacy Regulation, to replace this Directive, is currently being negotiated at EU level, but it is unclear when it may be finalised and whether the UK will choose to enact similar or equivalent provisions.
On 8 March 2023, the Data Protection and Digital Information (No. 2) Bill was laid before Parliament, largely replicating the previous draft Bill proposed in July 2022. The Bill does not fundamentally alter data privacy laws in the UK but aims to update and simplify the UK’s current framework so as to reduce burdens on organisations while maintaining high data protection standards. The UK government have stated they expect the Bill to be passed within a year, and with minimal amendment.
Sector-specific regulators, including those in the finance sector, also regulate the use of data by organisations that fall within their remit.
4.2 Do your data privacy laws apply to organisations established outside of your jurisdiction? Do your data privacy laws restrict international transfers of data?
The UK GDPR has a wide extra-territorial reach, applying to any controllers and processors established outside the EU that offer goods or services to individuals in the UK, or monitor their behaviour in the UK.
The UK GDPR also restricts the transfer of personal data outside the UK unless adequate protection is in place. Under the UK GDPR and the DPA 2018, a number of jurisdictions have been approved as being “adequate”, including all the EEA Member States and the territories having the benefit of an adequacy decision from the EU Commission under the EU GDPR. If there is no formal adequacy decision in place for a jurisdiction, other mechanisms set out in the UK GDPR and the DPA 2018 may be relied on to transfer personal data out of the UK. These include, among other things, using “approved form” standard contractual clauses relating to data export or obtaining consent from the individual whose data is being transferred.
4.3 Please briefly describe the sanctions that apply for failing to comply with your data privacy laws.
There are a range of sanctions available, including:
- Large fines – the UK regulator, the ICO, can impose fines of up to 4% of annual worldwide turnover or £17.5 million (whichever is greater) on controllers and/or processors.
- Criminal liability – the DPA 2018 includes a number of criminal offences; for example, knowingly or recklessly obtaining or disclosing personal data without the controller’s consent. Directors, managers and officers can (in certain circumstances) be held personally liable for offences by corporations.
- Damages claims – individuals who have suffered as a result of infringement of the UK GDPR may be entitled to compensation. There is also the potential for representative and group actions in certain circumstances.
4.4 Does your jurisdiction have cyber security laws or regulations that may apply to fintech businesses operating in your jurisdiction?
There are a variety of laws and regulations that could apply following a cyber breach in the UK, and many of them were originally derived from EU legislation. For example:
- data protection rules (for example, around security and breach notification) will apply where personal data is involved (see above);
- the Computer Misuse Act 1990, which is currently under review, creates a number of cyber-crime offences relating to actions such as unauthorised access or interference with a computer and DDoS attacks; and
- the Product Security and Telecommunications Infrastructure Act 2022, which – amongst other things – creates a new regulatory regime to make consumer connectable devices and products more secure.
Sector-specific rules may also apply. For example: (i) fintech businesses that are telecoms operators or internet service providers (ISPs) may face action from the ICO for breach of the PECR; and (ii) FCA rules may apply in the financial services sector (see below). The UK also has laws relating to the interception of communications and the ability of public bodies to carry out surveillance, although they are beyond the scope of this chapter.
Cyber continues to be a regulatory priority for the FCA, which has responsibility under the FSMA to take regulatory action to counter financial crime. It launched the Cyber Coordination Group (CCG) programme in 2017 bringing together cyber-security and technology risk leaders from industry and connecting them with multiple authorities responsible for cyber resilience across the financial sector. Authorised firms are expected to report material cyber incidents to the FCA.
The UK’s National Cyber Security Centre also provides cyber support for organisations, produces guidance (including on specific risks such as the Ukraine crisis, ransomware and supply chain risk) and offers various certification schemes.
Note: The UK’s Network and Information Systems Regulations 2018 do not apply to most UK fintech organisations. Although the EU Directive on which the Regulations are based imposes security requirements and incident notification obligations on banks and financial markets, the UK government excluded the finance sector from the list of relevant sectors when implementing the Directive into UK law (as it considered this area to be sufficiently regulated). The regime has, however, undergone a review resulting in changes. For example, managed IT service providers are being brought in scope. This review was one of a number of actions that came out of the UK’s new Cyber Strategy, which was published in December 2021.
4.5 Please describe any AML and other financial crime requirements that may apply to fintech businesses in your jurisdiction.
Financial crime is governed in the UK by a range of legislation.
The key piece of AML legislation is the Proceeds of Crime Act 2002 (POCA), which sets out the principal money-laundering offences, including concealing, disguising, converting or transferring the proceeds of crime. There are also various “secondary” offences, which include tipping-off of persons engaged in money laundering as to any investigation.
Firms operating in the regulated sector, including fintech firms, must comply with the MLRs, which back up the provisions in POCA. These set out detailed requirements in respect of customer due diligence and AML policies and procedures, aligning the UK regime with the Financial Action Task Force’s international standards and designating the FCA as the AML and counter-terrorist financing supervisor in relation to certain cryptoasset businesses.
The FCA specifies additional rules in respect of anti-financial crime systems and controls in its Handbook, which applies to authorised firms. Both the PRA and the FCA regard adoption of rigorous and robust anti-financial crime systems and controls as essential to meeting the ongoing regulatory requirements of being an authorised firm.
The Bribery Act 2010 (BA) is the UK’s anti-bribery legislation. The BA is generally regarded as rigorous and onerous by worldwide standards, and specifies offences in respect of bribing another person, being bribed, bribery of foreign public officials and a corporate bribery offence relating to the failure of commercial organisations to prevent bribery. As with the basic AML offences in POCA, the BA applies generally to any entity doing business in the UK.
4.6 Are there any other regulatory regimes that may apply to fintech businesses operating in your jurisdiction (for example, AI)?
Please refer to our comments above on the UK data protection regime and cyber-security laws or regulations. There is no legislation in the UK that is aimed specifically at the fintech sector.
In relation to AI, the UK government’s 2021 National AI Strategy confirmed that the UK would publish a white paper setting out its “pro innovation” position on regulating AI in 2022. Although this paper has not yet been released, an interim policy paper was published in July 2022, which suggested the UK should maintain its current sector-specific approach but introduce six core principles which all regulators would apply.
Any additional regulatory regimes would likely be specific to the sector in which a particular fintech firm operates. The FCA, Bank of England and PRA have a particular interest in the safe and responsible adoption of AI in financial services, which includes considering how policy and regulation can best support it. More specifically, these regulators continue to examine (including through the publication of a joint Discussion Paper (DP22/4), which closed to comments in February 2023) whether AI in UK financial markets can be managed through clarifications of the existing regulatory framework, or whether a new approach is needed.
5. Accessing Talent
5.1 In broad terms, what is the legal framework around the hiring and dismissal of staff in your jurisdiction? Are there any particularly onerous requirements or restrictions that are frequently encountered by businesses?
Subject to the mandatory benefits referred to in question 5.2 below, individuals can generally be hired on whatever terms are considered appropriate. When hiring, it is important to bear in mind that the prohibition of discrimination in employment applies to everything from job advertisement, candidate selection and recruitment, to employment terms and reasons for dismissal. Unlike most other employment-related claims, compensation for discrimination is uncapped.
Under UK law, the term “dismissal” incorporates employer terminations, expiry of fixed-term contracts and constructive dismissals (where the employee resigns and treats himself as dismissed due to a repudiatory breach by the employer).
Broadly, employees with two years’ service can claim unfair dismissal if a dismissal: (i) does not fall within one of five fair reasons (such as conduct, capability or redundancy); (ii) does not follow a fair procedure (including compliance with relevant codes of practice); or (iii) is not fair and reasonable considering all the circumstances, including the employer’s size and resources. Remedies include compensation (subject to statutory caps), or in limited circumstances, reinstatement or re-engagement. Dismissals for certain reasons (such as whistleblowing) are automatically unfair; they do not require a qualifying period of employment, and compensation is uncapped.
Except in cases of gross misconduct or other repudiatory breach, dismissing an employee without the required notice period (or payment in lieu, where permitted under the contract) generally leads to a wrongful dismissal, allowing the employee to claim for loss of earnings that he/she would have received during the notice period.
5.2 What, if any, mandatory employment benefits must be provided to staff?
Employers must pay all workers at least the specified national minimum/living wage, and must contribute to the state pension and health system on the workers’ behalf. In addition, eligible jobholders must be automatically enrolled into a personal or occupational pension scheme meeting certain minimum requirements (unless they opt out).
All workers are entitled to at least 28 paid days of annual leave (which includes public holidays and is pro-rated for part-time workers), as well as specified minimum daily and weekly rest periods. Shifts longer than six hours must usually also include breaks. Workers may not work more than 48 hours per week averaged over 17 weeks, unless they opt out of the 48-hour limit (which is very common in practice).
Employees who are unfit for work may be entitled to statutory sick pay after the third day of absence, although employment contracts often provide for more generous company sick pay. Special rules apply in respect of the minimum periods of leave and pay for employees taking maternity, paternity, adoption or shared parental leave and certain other family or study-related types of leave.
Bonuses, which are typically linked to performance criteria, are often non-contractual or involve discretion if included in the contract. Many companies also offer share incentives to their employees.
5.3 What, if any, hurdles must businesses overcome to bring employees from outside your jurisdiction into your jurisdiction? Is there a special route for obtaining permission for individuals who wish to work for fintech businesses?
Following Brexit, free movement rights of EEA and Swiss nationals ended on 1 January 2021. EEA and Swiss nationals and qualifying family members residing in the UK before 1 January 2021 may remain and work in the UK, if they have secured their immigration status under the EU Settlement Scheme.
A new points-based immigration system was introduced in the UK on 1 December 2020, and since 1 January 2021 the same scheme has also applied to EEA and Swiss nationals. All migrants are now subject to the same tiered points-based system and (with some exceptions) must be sponsored by an employer and pass a points assessment. Minimum skill and salary levels apply, and workers must typically satisfy minimum English language skills and maintenance requirements. The most popular immigration route used by fintech businesses in the UK is currently the “global talent” route, which is for exceptionally talented or promising individuals in certain fields (including digital technology) who wish to come to the UK to work. Unlike many of the other routes, this does not require the business to hold a sponsor licence (see below). There is also a new “scale-up” route, which was opened in August 2022, to allow a broader range of workers to come to the UK to do eligible jobs for fast-growing UK businesses, including in the fintech sector. Although there are advantages both to the business and the individual of using this route, there are also eligibility conditions that must be satisfied; it remains to be seen how popular this will prove within fintech. The system also incorporates a skilled worker route (which is another popular category used by fintech businesses) and allows for a transfer of overseas employees to UK companies within the same corporate group in some circumstances.
Businesses wishing to employ overseas workers must typically obtain a sponsor licence, allowing them to issue certificates of sponsorship to migrants (there are exceptions where the migrant holds a global talent or scale-up visa). Sponsors must comply with various requirements, including conducting right-to-work checks, complying with record-keeping duties and reporting certain employee events to authorities. Sponsors are rated based on their compliance; if a sponsor’s rating is downgraded below a certain threshold, it is not able to issue new certificates of sponsorship (but can usually still sponsor extensions for its existing workers).
6.1 Please briefly describe how innovations and inventions are protected in your jurisdiction.
Innovations and inventions can be protected in the UK by various different IP rights. Copyright and patents are of particular relevance to the fintech sector, but other IP rights such as database rights, as well as the law of confidentiality, can also play a part.
- Copyright: Copyright is an unregistered right which protects various different categories of “work” in the UK. These include literary, dramatic, musical and artistic works, as well as other types of work such as films, sound recordings, broadcasts and typographical arrangements. Of particular importance to the fintech sector, computer programs (both object code and source code) are protected as literary works. Other elements that are produced when a computer program is running, such as screen displays, graphics and sound effects are also protectable by copyright. However, whilst the threshold for copyright protection in the UK is generally considered to be low, there are limits – for example, the English High Court recently found that the bitcoin file format is not protected by copyright as it failed the requirement of fixation.
- Database right: There are two different types of protection available for databases in the UK: (i) copyright, which protects the structure of the database; and (ii) sui generis database right, which protects the data or content stored in the database. A database will be protected by copyright if, by reason of the selection or arrangement of the contents of the database, the database constitutes the author’s own intellectual creation. A database will be protected by the sui generis right if there has been a substantial investment in obtaining, verifying or presenting the contents of the database.
- Patents: Patents are the most common way to protect inventions in the UK and provide the owner with a 20-year monopoly right. They are registered rights and therefore need to be registered before they become effective. In order to be patentable, an invention must be new, involve an inventive step, be capable of industrial application and not be excluded from protection under the Patents Act 1977. Of particular relevance to the fintech sector, computer programs, business methods and mathematical methods are not patentable in the UK, unless they possess a technical character. What gives these things the required technical character is often difficult to determine, but the English courts have come up with certain tests and signposts to assist with the analysis. The approach taken also varies across jurisdictions and between the UK and the European Patent Office.
- Confidentiality: The laws of confidentiality and trade secrets can also be used to protect inventions and innovations in appropriate cases. Almost any type of information can be protected by the law of confidentiality, provided it remains confidential. This includes details of inventions that may not be patentable, as well as things like software source code. Where a fintech business is unable to obtain a patent for an innovation or invention (e.g. for a particular computer program), confidentiality or trade secrets can be a good way of seeking to prevent third parties from copying that invention or innovation.
- Trade marks: The branding of fintech companies, as well as individual products and services, may be protected by registered and unregistered trade marks. Registered trade marks can be applied for and registered in the UK at the UK Intellectual Property Office (UK IPO). Unregistered trade mark rights may be enforceable through the English courts under the law of passing off.
6.2 Please briefly describe how ownership of IP operates in your jurisdiction.
The rules on ownership of IP vary from right to right and depend upon the context in which they are created. A high-level summary of the position for each type of IP right mentioned above is set out below.
- Copyright: The basic position is that the author of the work will be the first owner of any copyright in it. In most cases, the author will be the person who creates the work. However, for computer-generated works, the author will be the person who undertakes the arrangements necessary for the creation of the work. If a copyright work is created by an employee during the course of their employment, copyright will generally belong to the employer. Where, however, a business commissions a third party to develop works on its behalf, then the third-party contractor will own the resulting copyright unless the copyright has been assigned by written agreement to the commissioning business. There are many debates at national and international level in relation to how copyright is impacted by the use of AI technologies.
- Patents: As registered rights, patents need to be applied for and registered before they become effective. Any person can apply for a patent, but only certain people are entitled to be granted one. Entitlement primarily rests with the inventor, but, similar to copyright, if the invention is made by an employee during the course of their employment, then the rights to the patent will generally belong to the employer. There are also statutory provisions for compensation to employees for patents which are of outstanding benefit to the employer. The UK Court of Appeal, EPO and USPTO have recently confirmed that a computer (AI algorithm) cannot be an “inventor” of a patent. However, the UK decision has been appealed. The Supreme Court heard the appeal in early March 2023, with the judgment expected later this year. As with copyright, there are many debates at national and international level in relation to what role, if any, the patent system should play in encouraging the development and use of AI technologies.
- Trade marks: Generally, the person who applied for and registered the trade mark is the owner of that trade mark.
- Sui generis database rights: The first owner of sui generis database rights will be the “maker” of the database, that is, the person who took the initiative in obtaining, verifying or presenting the contents of the database and who assumed the risk of investing in the same. As with patents and copyright, in an employment scenario the rights will generally belong to the employer (absent agreement to the contrary).
6.3 In order to protect or enforce IP rights in your jurisdiction, do you need to own local/national rights or are you able to enforce other rights (for example, do any treaties or multi-jurisdictional rights apply)?
As IP rights are territorial rights, in the majority of cases local rights will be needed to ensure protection in the UK. The main exception is for copyright where international copyright conventions (such as the Berne Convention) provide automatic reciprocal protection in the UK and overseas for qualifying works. The WIPO Copyright Treaty, which is a special agreement under the Berne Convention, particularly deals with protection of copyright for software and databases.
Patent protection in the UK may be obtained by (1) the national UK route, (2) the European patent system (EPC), or (3) the international patent system (PCT). The UK is not participating in the Unitary Patent and the centralised enforcement system of the Unified Patent Court. UK patents (including UK designations of European patents or international patents) will be needed in order to enforce patent rights in the UK.
Trade mark protection in the UK may be obtained by (1) the national UK route, or (2) the international Madrid System (designating the UK). EU trade marks no longer have effect in the UK. As a result, UK trade marks (including UK designations of international trade marks) will be needed in order to enforce trade mark rights in the UK.
Prior to Brexit, sui generis database right protection (see above) could be obtained at the EU level and enforced in the UK. However, EU-wide database rights no longer provide protection in the UK for databases created after 1 January 2021. Instead, UK entities can now obtain an equivalent UK-specific database right which offers equivalent protection. Owners of EU-wide database rights that came into effect before 1 January 2021 were automatically granted an equivalent UK right.
6.4 How do you exploit/monetise IP in your jurisdiction and are there any particular rules or restrictions regarding such exploitation/monetisation?
IP is usually exploited/monetised by assignment (transfer), licensing and granting security interests.
- Assignment: Generally, an assignment of an IP right must be in writing and signed. However, if the whole of a business is transferred, then its registered trade marks are also automatically transferred, except where there is agreement to the contrary or circumstances clearly dictate otherwise. Copyright assignments do not need to be registered in the UK. Assignments of UK patents and registered trade marks must be registered as soon as practicable with the UK IPO so as to maintain priority against later third-party interests and within six months of the date of the transaction to maintain a right to costs for infringement proceedings relating to conduct before registration.
- Licences: Exclusive copyright licences must be in writing and signed by or on behalf of the copyright owner if the licensee wishes to maintain standing to sue for infringement (non-exclusive can be oral or in writing). Patent licences are not required to be in writing or to be signed, but it is advisable in order to clarify terms and assist with registration with the UK IPO. Trade mark licences must be in writing and signed by the licensor and should ideally be registered with the UK IPO. It should also be noted that licensing of IP rights (particularly patents) can give rise to competition issues, so care is needed.
- Security interests: IP rights can be used as security for finance. Details of the security interest (such as mortgage or charge) must be registered with UK Companies House within 21 days of its creation otherwise it will be void against a liquidator, administrator and any creditors of the business. Mortgages (which usually take effect as an assignment and licence back) and charges of UK patents and registered trade marks should also be registered with the UK IPO as soon as possible after the transaction and in any event within six months.