Joined-Up Regulation: Coordination Between Data Protection and Financial Authorities in Emerging Markets
This report examines how data protection and financial authorities in ten emerging markets work together, why coordination falls short, and what would help, while also proposing a way to measure progress.
Authors
Financial Innovation for Impact
Pavle Avramovic, Director of Research & Policy
Max Bentovim, Data Protection Lead
Tanya Ghuman, Research Associate
Sarah Ombija, Senior Research Associate
Cambridge Centre for Alternative Finance, Cambridge Judge Business School
Yue Wu, Data Scientist
Abdulrahman Adebayo, Johanan Awah, Csaba Dosa, Shibhangi Ghose, Mark Farrell, Caroline Macharia, Milicent Malau, Tony Oche, Research Interns
Introduction
Digital financial services run on data. Identity checks, fraud controls, open finance, credit models and cross-border payments all sit under two regulatory regimes at once: data protection and financial regulation. These regimes grew up through separate institutions, with separate mandates, international networks and ways of working. As finance has become a data business, they now govern many of the same activities, firms and records.
That makes the bridge between data protection and financial regulation one of the most consequential links in the regulation of digital finance. No single authority can regulate digital financial services alone. Whether customers can trust how their data is used; whether fraud signals can be shared lawfully; whether open finance can launch on settled terms; who answers when an automated credit decision goes wrong—these all depend on how well the two sets of authorities work together.
The same lessons apply to the other regulatory and public authority boundaries that digital finance increasingly crosses, from competition to telecommunications, health to energy, transportation to housing to education. As data becomes increasingly central to all walks of life, they become increasingly central to both what is being regulated and administered by governments and public bodies, and how those institutions effect their public purposes. Data protection—and data protection authorities—therefore structurally intersect and overlap with the work of more and more of their counterparts. Those intersections and overlap in substance do not, however, translate automatically into joined-up work. Like developing cities with increasing potential for interchange and trade but seperated by rivers, bridges must be built. Financial regulation, itself intersecting with so many other aspects of life and work, is in importance and urgency where these first bridges must be slated for construction.
This report, published in October 2026, finds that coordination is falling short of what is needed to keep pace with technological and market change, but that the main obstacle is institutional rather than legal. Most of what authorities need to work together is already within their reach.
Produced by Financial Innovation for Impact, in collaboration with the Cambridge Centre for Alternative Finance, the report draws on 27 interviews and four convenings with data protection and financial authorities, international bodies, industry and civil society. It covers ten emerging markets and developing economies: Brazil, Ethiopia, India, Indonesia, Kenya, Nigeria, Pakistan, the Philippines, South Africa and Uganda. It is written for regulators, international organisations and standard-setters, development partners, and market, academic and other stakeholders in the regulation of digital financial services. The research is supported by the Gates Foundation.
Highlights from the report
-
Financial regulation and data protection now govern many of the same activities, companies and markets. Where a data protection authority is operating, the legal tools to settle the questions this overlap raises are generally in place. Half the focus countries have statutes that direct the authority to coordinate with other regulators (Brazil, Nigeria and the Philippines) or provide for delegation or sectoral codes (Kenya and South Africa). What is missing is the machinery to make coordination routine and effective. The issue isn't willingness: authorities on both sides said they want to coordinate more, and better.
-
Contact points, joint guidance, sandboxes and information-sharing arrangements exist in several focus countries. However, most are bilateral, event-driven or dependent on individuals, and some exist on paper only.
-
In open finance, fraud prevention and AML/CFT, financial-sector frameworks were typically designed before the data protection authority was involved. Reconciliation then happens after launch, when it is costlier and less effective.
-
Data protection authorities are often newer and smaller, yet responsible for every sector of the economy. Financial regulators are generally older, better resourced and embedded in international standard-setting. Without deliberate design, joint work drifts towards one authority's priorities.
-
Financial standard-setters set standards and assess their implementation; data protection bodies mainly convene. Early bridges exist, such as the FSB's Forum on Cross-Border Payments Data and the FATF's July 2026 call for joint guidance, but they are recent and mostly convened from the financial side.
-
At the time of publication, India, Indonesia and Pakistan lacked a fully operational data protection authority. In such jurisdictions, financial regulators often protect data through their own licensing perimeter, so protection stops where the perimeter does, and data-driven services may narrow to licensed firms. The period before an authority is established is also the cheapest time to design coordination in.
-
Compliance uncertainty weighs most on smaller and newer providers. Harms that fall between mandates weigh most on low-income consumers, women and rural users, who have less capacity to pursue redress through two authorities.
From evidence to action: seven recommendations and a way to measure progress
Seven recommendations:
The report traces the shortfall to five impediments that reinforce one another and shows how they play out in three patterns across the focus countries. It recommends seven interlocking forms of work, most of which authorities can begin under powers they already hold:
Start with one shared problem and make the result visible.
Designate counterparts and referral routes.
Bring the data protection authority in at the design stage.
Develop joint guidance.
Build each authority's understanding of the other's domain.
Measure and report on coordination.
Connect national coordination to regional and international standard-setting.
The Regulatory Coordination Index (RCI):
The RCI is a proposed framework for measuring how much coordination exists between a data protection authority and a financial-sector authority. It records whether the pre-conditions are in place: a legal basis, a route to resolve conflicts, and review of the relationship. It then scores how far coordination is practised across information sharing, capacity building, policy design, supervision and enforcement, and maps the results onto the regulatory cycle to show where coordination is concentrated or missing. Paired with outcome data, it supports scenario sizing of what is at stake. The report applies the RCI to the ten focus countries on an illustrative basis, and authorities could adopt it as a self-assessment tool.
The report is accompanied by ten country case studies (Annex A), a mapping of regional and global initiatives (Annex B) and the quantification methodology (Annex C).
Join the launch event!
Joined-Up Regulation: Closing the Coordination Gap in Digital Finance
Discover the report's key findings and practical recommendations for policymakers, regulators and industry leaders.
You'll also gain insights from a panel of regulators and experts discussing what effective coordination looks like in practice, why it matters now, and where progress can begin.
