By Alessandro Hatami
Europe’s regulatory drive could become a platform for financial inclusion, helping institutions protect customers while opening commercially valuable underserved markets.
For banks, fintechs and investors, the compliance burden is becoming harder to ignore. New rules on resilience, crypto-assets, AI and payments all demand time, money and strategic focus. Yet the more useful question is not whether regulation is burdensome, but whether the capabilities it forces organisations to build could unlock new markets. Financial inclusion offers a test of that argument.
For Europe’s financial services leaders, regulation can feel like an expanding list of obstacles. DORA, MiCA, the AI Act and the forthcoming PSD3 regime all demand investment, leadership attention and changes to technology and operating models.
The familiar question is whether Europe is regulating innovation out of existence. But there is another way to look at the issue: could regulation become a competitive advantage?
That possibility was reflected in the conversations at Money20/20 Europe, where regulation featured alongside AI, stablecoins and payments infrastructure as one of the forces reshaping the sector. The discussion centred on how firms could turn new requirements into trusted products, stronger infrastructure and more resilient business models.
Financial inclusion is where this argument becomes particularly important. According to the World Bank’s Global Findex 2025, 1.3 billion adults worldwide remain without an account at a financial institution or mobile money provider. The equivalent EU number is rapidly shrinking but it is estimated at over 10m. Many are excluded not because they lack commercial value, but because existing systems are too rigid to assess, onboard and serve them effectively.
Thin credit files, weak identity infrastructure, fragmented data, cross-border complexity and inflexible risk models can all make potentially profitable customers appear unviable. Financial inclusion is therefore not simply an ESG concern. It is a market opportunity for institutions able to serve these customers responsibly and at scale.
The strategic question is whether European institutions can structure around regulation so that it protects customers, opens these markets and turns inclusion into a source of growth rather than a reputational obligation.
Here’s how:
1. Build regulation around the customers you want to reach
The first step is to stop treating each new regulation as a self-contained compliance programme.
DORA, MiCA, the AI Act and PSD3 have different objectives and reporting requirements. But they also push institutions towards many of the same underlying capabilities: stronger resilience, more reliable identity checks, better data governance, clearer accountability and more transparent decision-making.
These are also the capabilities needed to serve excluded and underserved customers.
The Digital Operational Resilience Act requires institutions to understand their technology dependencies, prepare for disruption and exercise greater oversight of external providers. That matters particularly for people who rely entirely on digital access and may have no branch network or alternative provider to fall back on when systems fail.
Meanwhile the EU’s Markets in Crypto-assets Regulation creates a common framework for crypto-assets and their providers. Although it raises compliance requirements, greater certainty could support safer stablecoin services and lower-cost cross-border payments, including remittances for customers poorly served by traditional channels.
The EU AI Act is forcing organisations to examine how automated systems are built, tested and governed. This is essential if firms want to use AI and alternative data to assess customers with limited conventional credit histories without reproducing discrimination or making decisions that cannot be explained.
For its part, the proposed PSD3 and Payment Services Regulation are intended to modernise Europe’s payments framework, strengthen fraud prevention and improve the functioning of the payments market. Better use of payments data could help institutions understand customers who lack formal credit records but have consistent histories of paying rent, bills or suppliers.
The opportunity is to bring regulation and innovation together around the challenge of financial inclusion. A stronger digital identity system should not exist solely to satisfy a regulatory requirement. It should also reduce fraud, improve onboarding and make it possible to serve customers who lack standard documentation. Monese presents a real life example: After UK banks rejected founder Norris Koppel because he lacked a utility bill, he built a real-time KYC engine that verifies customers without standard paperwork, turning identity compliance into the product’s main selling point.
Regulation becomes a platform for inclusive growth when institutions use it to guide innovation towards real customer needs, rather than building separate systems around individual rules.
2. Make customer protection part of the proposition
The second step is to recognise that protection is not in conflict with financial inclusion. It is what makes inclusive products commercially sustainable.
A lender may use alternative data to reach customers excluded by traditional credit scoring. But the model will not scale if its decisions cannot be explained, its data is unreliable or its algorithms produce unfair outcomes.
A digital payments provider may make cross-border transfers cheaper. However customers will not remain with it if their funds are inaccessible when systems fail, complaints are difficult to resolve or fraud protections are inadequate.
Trust is therefore part of the product. It should be considered alongside pricing, acquisition costs, repayment performance and customer lifetime value. The World Bank has found that a lack of trust in banks remains a significant barrier to opening an account worldwide.
This is also what makes financial inclusion investable. Growth among underserved customers may appear attractive, but investors will discount it if the company cannot demonstrate robust governance, operational resilience and consumer protection.
By contrast, a business that can reach new customer groups while controlling fraud, protecting data and explaining its decisions has a more defensible model. Its regulatory capabilities become part of the reason it can grow safely.
That requires compliance and risk teams to be involved at the start of product development. Their role should not simply be to approve or reject a finished proposition. Instead they should work with product, commercial and data teams to establish what evidence, controls and safeguards are needed to serve a customer group viably.
The objective is not to reduce standards in order to widen access. It is to design protection in a way that supports sustainable access rather than unintentionally reinforcing exclusion.
3. Organise the business around inclusion
The third step is organisational. Financial inclusion cannot become a meaningful source of growth while it remains primarily the responsibility of ESG, sustainability or corporate affairs teams.
It needs to sit within the core business, with product, commercial, risk, compliance, data and technology leaders working around defined customer and market opportunities.
Institutions should begin by identifying where exclusion occurs in their existing processes. Are applicants rejected because they lack a conventional credit file? Does onboarding assume that everyone has standard identity documents? Are customers with irregular or cross-border income treated as inherently higher risk? Do products reflect traditional employment patterns that no longer match how people earn?
They can then identify where solving those problems could create commercial value. That might involve using transaction data to assess small businesses, improving digital identity checks, developing more accessible remittance services or combining automated tools with human support.
Regulatory investment should be aligned with those priorities. Instead of asking only how the institution will comply with DORA, MiCA, the AI Act or PSD3, leaders should ask which capabilities will allow it both to comply and to serve its target customers successfully.
Accountability must also extend beyond regulatory milestones. Institutions should measure customer acquisition, fraud, repayment performance, retention and lifetime value alongside accessibility and inclusion.
Social impact explains why an opportunity matters. Sustainable demand, manageable risk and repeatable economics determine whether the business continues to invest in it.
4. From obligation to growth
Europe’s regulatory density does not automatically create an advantage. Overlapping rules can protect incumbents, discourage new entrants and divert investment away from product development. Policymakers must reduce duplication, provide proportionate pathways for smaller firms and give businesses sufficient certainty to invest.
Nor should every compliance cost be reframed as an opportunity. Regulation that is inconsistent, excessively prescriptive or unable to keep pace with technology can become a genuine barrier to competition.
But financial inclusion depends on trust, and trust requires resilient services, responsible use of data and clear accountability when things go wrong.
The question for European institutions is how to structure the business so that the capabilities built to comply also help it understand, onboard and serve customers the existing system overlooks.
That means building shared infrastructure around customer needs, making protection part of the commercial proposition and putting inclusion at the centre of product, risk and growth decisions.
Regulation will not create inclusive growth on its own. But institutions that organise around it intelligently may find that the capabilities needed to comply are also those needed to enter new markets.
That is how financial inclusion moves from reputational obligation to investable growth, and how regulation moves from millstone to moat.
Alessandro Hatami
