Online Exclusive: Fintech Disrupts Lending

However recently, some fintech companies have started offering new lending products that compete directly with traditional banks. These fintech lenders often market to businesses and people who might not qualify for loans from banks or credit unions. Fintech’s new loan products may have major impacts on the financial services industry and present risks that internal auditors at financial firms need to monitor.

Fintech’s Regulatory Problem

The lessons of the 2008 financial crisis — caused by risky lending and unchecked speculation — remain fresh. To prevent future crises, governments worldwide have enacted stricter regulations such as the global Basel III framework and the U.S. Dodd-Frank Act.

However, rules for fintech lenders aren’t as clear. According to the 2024 Fintech Founders survey by wealth management and accounting firm Evelyn Partners, not one U.K.-based fintech founder rated the country’s regulatory environment as “excellent.” Instead, 39% called it “poor” or “awful.”

Traditional lending rules often don’t address fintech risks. For example, rather than use credit ratings to determine which consumers qualify for loans, fintech lenders often use alternative data such as bank and investment account data, gig economy income, and social media profiles. This approach can help more people access credit. However, according to a 2018 U.S. Government Accountability Office statement, “Fintech lenders may not know how to use the data and still comply with fair lending laws.”

Chafic Haddad, global head of Fintech Sales at Citi Treasury and Trade Solutions, recently cited high compliance costs, lack of regulatory uniformity, and technology barriers for these shortcomings. In “Fintech and the Criticality of Compliance,” he writes, “The fintech sector evolves quickly, often outpacing the ability of regulators to create laws that specifically address new technologies. Regulators are often playing catch-up, and fintech firms must be proactive in understanding and complying with emerging regulations.”

Further complicating things, some fintech lenders are trying to become more like traditional banks. This subjects them to the regulations of the countries in which they operate, for which they may not be prepared to comply.

For example, in 2016, Berlin-based fintech company N26 became Europe’s first fully licensed mobile bank. Since then, Germany’s financial regulator, BaFin, has criticized N26’s internal controls and processes, which ultimately led the company’s investors to push for new leadership, according to news reports.

Other fintech companies are struggling with regulations, too. According to identity and fraud prevention firm Alloy’s 2023 State of Compliance Benchmark Report, 93% of fintech companies surveyed say it is difficult to meet applicable compliance requirements. In addition, 86% say they paid more than $50,000 in compliance fees in 2022.

Risky Banking

Increased competition is another risk. If consumers consider new fintech loan products more attractive than traditional loans, banks may take on more risk to compete with them. According to a study of more than 10,000 financial intermediaries (FIs) and global fintech activities published in the February 2025 issue of the Journal of Financial Stability, “greater fintech presence is associated with heightened risk-taking by FIs.”

Risk-taking by banks can take many forms, including:

• Rapidly adopting fintech products.
• Purchasing fintech companies to eliminate competition and acquire their technology and consumer data.
• Launching products or services to compete with fintech offerings.
• Forging partnerships with fintech companies, which can make banks key stakeholders in fintech. Silicon Valley Bank and its subsequent collapse is a key example of how significant this risk can be.

Any of these measures can cause issues without appropriate thought. For example, Matej Dras̆c̆ek, chief financial officer at LON Bank in Kranj, Slovenia, says banks must consider the future regulatory environment of their region, and whether they are resilient enough to overcome unexpected changes in regulatory priorities.

“Especially in the U.S. right now, there is an emphasis on deregulation, which is a big mindset change from 15-20 years of thinking about regulation,” he says. “However, there is always the potential that all of that changes again in the next election cycle. When companies take big strategic risks, changes like that have to be weighed.”

Taken to the extreme, increased competition could have repercussions, Dras̆c̆ek notes. “With new lending competitors, I fear the emergence of a parallel economy where standards are lower if proper regulation is lacking," he says. “The erosion of lending standards ultimately leads down a dangerous path.”

Auditing Resilience

Financial institutions do not exist in a bubble. As the environment changes around them, so too does their risk profile. In some cases, these changes can be so significant that they directly affect how internal audit functions assess their company’s resilience.

One example can be seen in how internal audit builds out its stress tests, Drašček says. “When internal auditors assess and risk managers conduct regulatory stress testing, they’ll often envision a scenario where something will go wrong on a grand scale,” he explains. “How things could go wrong in the scenario, however, will be based on the internal auditor’s understanding of the risk environment.”

Consider a scenario where fintech companies capture 10% of market share. “At a 10% market share, a single adverse development could escalate into a systemic crisis affecting the entire banking sector,” Dras̆c̆ek says. Would the bank remain resilient enough to withstand such a shock, and what measures would it take to respond?

To understand the new risks that digital lending competitors bring, internal auditors must spend more time learning about fintech. “Fintech is a part of our industry,” Dras̆c̆ek says. “Maybe it’s on the outskirts now, but all seismic changes begin on the outskirts.”