Burges Salmon's Martin Cook talks regulation in fintech

Fintech is a fast-moving and at times unpredictable industry. One thing that strikes fear into the heart of any fintech startup or entrepreneur is the word regulation. Often, regulation can be a force for good, an enabler of innovation. But as data security worms its way into the collective psyche of consumers, and new assets like cryptocurrencies threaten to bring unwanted attention from governments, the regulatory horizon is an uncertain one.

Martin Cook is a Partner and Head of Fintech for independent UK law firm Burges Salmon. A highly regarded lawyer, he has a wealth of experience in fintechs both in-house and in private practice. It means he is perfectly placed to offer a perspective of what’s coming over the hill in terms of new regulation. As Cook explains, we don’t have to think of every new regulatory move as a threat to the survival of fintechs.

We catch up with him for a quick Q&A into the state of the fintech space, what the changing nature of fintechs has taught us, and why it’s more important than ever to know who you’re doing business with.

Tell us about your background – how did you come to specialise in fintech law?

I studied history at university, but during my time there I decided that it would be a fine thing to become a lawyer despite, frankly, knowing very little about law, lawyering or the City. I trained and worked at leading corporate firms in the City and really enjoyed it. My early years there coincided with the development of technology law as a standalone discipline, and while I advised on intellectual property, data, commercial contracts and M&A, I realised that the technology work brought all these things together. It also gave me the opportunity to work with really interesting clients and their major projects from an early stage in my career.

A lot of the clients of those firms were major banks, insurers and other financial institutions, and so it was natural that a lot of our technology work related to that sector. I also worked on a project to set up a new high street bank (the first time that had happened for over 100 years at the time), and worked on a lot of international technology transactions.

When I decided to go in-house and work as a lawyer in industry, I was keen to try something new. I found myself working in what felt, at the time, a new type of company whose product offering was entirely online (Wonga Group). It seems ubiquitous now – open plan working, new ways of creating and delivering products to customers (digital only), the use of technology to make business decisions, ping pong and pool tables – but really it was quite revolutionary at the time. This is what would now be termed a fintech company, but that terminology hadn’t even been coined.

I developed more experience on the finance and financial regulation side of things when I moved into subsequent roles in international lending platforms and payments firms, and also built significant experience in risk management and regulatory policy work. Working in industry for a decent chunk of time allowed me to really see projects through from inception to final execution and help develop products and business operations in line with the market developing overall.

What do you do at Burges Salmon?

As Head of Fintech, I am part of the technology and the financial services/financial regulatory teams in the firm. My client-facing role splits between working with technology entrepreneurs and B2B/B2C fintechs on one hand, and with established and significant financial institutions and banks on the other.

I could be working with lawyers in the fintech team on delivering advice on a new product, advising on technology projects or data strategy, or helping prepare supplier or customer contracts. I could also be speaking with clients – alongside colleagues with other legal specialisms – on their commercial disputes, regulatory investigations, employee and incentive issues and their corporate fundraising. For banks and established institutions, my work can cover technology transformation projects, digital services and business process outsourcing and offshoring.

One of the things that I really like about my role is that, given my experience working in three different fintechs (Wonga Group, Funding Circle and WorldRemit – now Zepz) and working with many more over the years, I understand the market and can see parallels between what clients are trying to do and projects that I’ve worked on in the past. Clients seem to value the experience I can bring from industry, and having worked in scale-ups and with some very significant global organisations.

A lot of my time is spent engaging with industry and the market generally. While we are a UK-based law firm our clients come from all parts of the UK and – particularly relevant given the make-up of the fintech market globally – from overseas. We have clients based in the US, Australia, New Zealand, Singapore, Nigeria and from across Europe.

Sometimes I do regulatory or commercial and technology work for non-fintech clients such as e-commerce, energy or pure technology businesses (like those working in artificial intelligence). I think this is really interesting, because it means that we can offer flexibility to lawyers in our team but also understand market developments in other sectors and “cross-fertilise” ideas and experiences. Similarly, I work with colleagues in other areas of the firm’s practice (private wealth/private client, banking, corporate finance) to consider trends and the way in which, together, we can better serve clients.

What does the current legislative and regulatory landscape look like for fintechs?

I wouldn’t assume that all legislative change is a threat; there have been several good examples in recent years in terms of regulation driving up standards or managing market and customer risk. Naturally, I would always advocate for proportionate regulation – ensuring a suitable balance of customer and market protection whilst encouraging (and creating the right environment for) innovation and competition. The current regulatory landscape in the UK aims to achieve this balance, and although changing quickly (in many areas), I think that fintechs benefit from sensible, technology-agnostic regulation promoting consumer trust and confidence.

An area that will be closely watched – not least given ongoing market volatility, regulatory warnings and its huge potential – is the bringing of cryptoassets further within the regulatory perimeter, including in terms of anti-money laundering, financial promotions and as specified investments.

More mainstream, for now, will be developments on the B2C side of things including in terms of the new consumer duty and – relevant for all businesses – likely changes in the UK data protection regime (where anything that would impact on the freedom to manage international data flows into Europe and elsewhere overseas will be particularly contentious).

There’s also, rightly, significant interest in regulatory developments relating to ESG topics – including obligations regarding reporting and other steps to avoid “greenwashing”.

Open banking has continued to drive new, innovative product propositions and the move towards open finance will invariably mean regulatory developments to bolster the required infrastructure and address new or emerging consumer or market risks.

Other changes that might have a practical impact for businesses, especially smaller fintechs or those looking to enter the market, are likely rule changes relating to financial promotions and the approved person/regulatory principal regime.

What areas of fintech are you passionate about?

I like fintechs that identify and address a problem in the market. While this sounds a grand sentiment, it makes sense when you apply it back to the customer experience and the benefits it can bring.

For me personally, this includes ways in which innovation has made everyday transactions easier, quicker and safer. This is stuff that just works – it’s not headline grabbing perhaps, but it has also had the effect of pushing more traditional institutions to innovate as well.

I’ve worked in places where we tried to solve problems that didn’t affect me personally but were of significant value to our customers – including unlocking small business funding and helping migrant workers send money home to family and friends, or allowing people to build credit records or to establish themselves in a new country. It’s pretty special being part of a team that can help deliver these changes.

I have always been keen to support the fintech industry develop generally through my work across the sector as a whole, and it’s a privilege to be able to continue that at Burges Salmon.

Increasingly, larger fintechs are applying for banking licenses and starting to resemble the institutions that they set out to challenge. Does this pose a risk?

I’m not sure I see risk in this way. In a sense, it doesn’t matter how a financial service company self-identifies, but rather how it acts and what it does – both for customers and with reference to its wider contribution to society.

From a customer perspective, I could see good service or bad service; brands I trust or don’t trust, services that solve a problem for me or make things easier or more efficient, and that are value for money. These, I think, are the things that matter.

Perhaps the risk is that fintechs – which we typically think of as disruptors and innovators – fall into the trap that some established institutions have done by trying to be all things to all people (and falling short) or failing to challenge themselves and innovate and continue to move forwards.

There is no doubt that working with founders and their teams, looking to solve problems in the market often with novel approaches, is exciting – but the power of effecting significant change comes by achieving bigger scale and having a greater impact. It is no surprise to me that all fintechs have ambitious growth plans, and for virtually all of them success is part-measured in global expansion and significant customer acquisition.

How great is the risk around customer data, considering that banking is becoming more embedded? Is it more important than ever to know who you’re dealing with?

There are a whole host of reasons why firms should really understand who they are working with. This is not only on the customer protection side, including data, but also on the quality of supply chains for ensuring ethical standards are maintained, including avoiding those who harm people (modern slavery or engaging in bribery) or whom harm the environment.

In relation to customer protection, my sense is that there is an increasing awareness of individual consumer rights and asserting them (which I think is a good thing) but I do think that the stakes get higher as our lives are more lived online and services become interconnected.

It should be no surprise that a rise in digital services – including fintech services – is joined by significant market growth in pure technology providers looking to build and deliver robust platform solutions and in cybersecurity firms.

I think that interconnectedness can bring huge benefits to consumers in terms of making everyday life and transactions more straightforward. Imagine if, when we moved house, we could issue one notification of change of address and all our financial, commercial and public service providers would be notified (rather than the separate multiple notifications now) or if I can save time and reduce the risk of error in making financial applications (for mortgages or personal borrowing) by data being pre-populated from reliable source material.

Technology certainly can introduce risk (both on a practical level but also at an existential and ethical level – such as parameters and transparency around artificial intelligence), but it is also part of the solution to deal with the unintended or unwanted consequences of innovation.