EMERGING FINTECH RISK MONITORING: A DETAILED LEGAL ANALYSIS WITH INDIAN CASE LAWS, INDIAN LEGISLATION AND INTERNATIONAL REGULATORY FRAMEWORKS

1. INTRODUCTION

Financial technology, commonly known as FinTech, refers to the application of modern technology to financial services and activities. It involves the use of digital platforms, artificial intelligence, machine learning, blockchain technology, cloud computing, mobile applications, digital wallets, online payment systems, cryptocurrencies and automated financial services.

The rapid development of FinTech has transformed the traditional banking and financial services industry. Financial transactions that previously required physical interaction with banks can now be completed through mobile applications, internet banking, digital wallets, Unified Payments Interface (UPI), online lending platforms and other electronic financial systems.

In India, the growth of FinTech has been particularly significant due to the development of Digital India, Aadhaar-based authentication, the Unified Payments Interface, the Jan Dhan financial inclusion programme and increasing smartphone penetration.

However, technological advancement has also introduced several emerging risks, including cyber fraud, identity theft, data breaches, money laundering, algorithmic discrimination, unauthorised digital lending, cryptocurrency-related risks and operational failures.

Therefore, Emerging FinTech Risk Monitoring has become an essential component of modern financial regulation. It involves identifying, assessing, preventing, detecting and controlling risks associated with technology-driven financial services.

Risk monitoring is important not only for protecting financial institutions but also for safeguarding consumers, maintaining financial stability, preventing financial crimes and ensuring public confidence in the digital financial ecosystem.

The Reserve Bank of India (RBI), the Securities and Exchange Board of India (SEBI), the Ministry of Finance, the Financial Intelligence Unit–India (FIU-IND) and other regulatory authorities play important roles in monitoring and regulating risks associated with FinTech activities.

The central objective is to ensure that technological innovation develops within a framework of transparency, accountability, security, consumer protection and legal compliance.

2. MEANING AND CONCEPT OF EMERGING FINTECH RISK MONITORING

Emerging FinTech Risk Monitoring refers to the continuous process of identifying, analysing, evaluating and controlling potential threats arising from the use of financial technologies.

It includes the systematic supervision of digital financial transactions, technological infrastructure, customer information, lending activities, payment systems, financial algorithms and third-party service providers.

Unlike traditional financial risk management, which mainly focuses on credit, market and liquidity risks, FinTech risk monitoring also addresses technology-related and digitally generated risks.

For example, a traditional bank may monitor whether a borrower is capable of repaying a loan. A digital lending platform must additionally monitor whether its customer information is protected, whether its automated credit-scoring algorithm is fair, whether its lending application complies with RBI directions and whether third-party service providers are operating securely.

FinTech risk monitoring therefore combines financial supervision, technological security, legal compliance and consumer protection.

2.1 Main Objectives

The principal objectives of FinTech risk monitoring are:

1. To identify emerging financial and technological risks at an early stage.
2. To prevent cybercrime, digital fraud and unauthorised financial transactions.
3. To protect consumers' personal and financial information.
4. To ensure compliance with applicable financial and data protection laws.
5. To prevent money laundering and terrorist financing.
6. To maintain the stability and reliability of digital payment systems.
7. To monitor third-party technology providers and outsourcing arrangements.
8. To promote transparency and accountability in automated financial decision-making.
9. To protect investors and maintain the integrity of financial markets.
10. To encourage responsible innovation in the FinTech industry.

3. NATURE AND CHARACTERISTICS OF EMERGING FINTECH RISKS

FinTech risks possess certain distinctive characteristics.

3.1 Rapid Technological Development

Financial technology changes continuously. Artificial intelligence, blockchain, biometric authentication and automated lending systems introduce new risks that may not be adequately addressed by traditional regulatory mechanisms.

3.2 Cross-Border Transactions

Digital financial services frequently operate across national boundaries. Consequently, a single transaction may involve customers, payment intermediaries, financial institutions and technology providers located in different countries.

This creates jurisdictional difficulties and challenges relating to international cooperation.

3.3 High Volume of Digital Transactions

UPI, mobile banking and digital wallets process large numbers of transactions. Even a small security weakness can potentially affect thousands or millions of users.

3.4 Dependence on Third-Party Service Providers

FinTech companies frequently depend on cloud service providers, payment gateways, software developers, data processors and outsourced customer-service providers.

Failure of any critical service provider may interrupt financial services or expose confidential information.

3.5 Data-Driven Financial Services

Modern financial institutions collect and analyse substantial quantities of personal, financial and behavioural information. Improper collection, processing or disclosure of this information may violate privacy and data protection requirements.

3.6 Difficulty in Detecting New Forms of Fraud

Cybercriminals continuously develop new techniques, including phishing, deepfake impersonation, SIM swapping, malicious applications, account takeovers and synthetic identity fraud.

Consequently, risk monitoring must remain continuous rather than being limited to periodic inspections.

4. MAJOR EMERGING RISKS IN THE FINTECH INDUSTRY

4.1 Cybersecurity and Data Breach Risks

Cybersecurity risk is one of the most significant challenges facing FinTech companies.

Financial platforms store confidential customer information, including bank account details, payment credentials, identification information, transaction histories and other sensitive financial data.

Cybercriminals may exploit technological vulnerabilities to gain unauthorised access to such information.

Common cybersecurity threats include:

• Phishing and fraudulent messages.
• Malware and ransomware attacks.
• Identity theft and account takeover.
• SIM swapping and OTP interception.
• Unauthorised access to financial databases.
• Denial-of-service attacks.
• Credential theft and password attacks.
• Deepfake-based financial impersonation.

For example, a criminal may send a fraudulent message claiming to represent a bank and persuade a customer to disclose an OTP. The criminal may then use that information to initiate an unauthorised financial transaction.

Risk monitoring measures: Financial institutions should implement encryption, multi-factor authentication, continuous transaction monitoring, vulnerability assessments, penetration testing, incident-response procedures and customer awareness programmes.

4.2 Digital Payment and Transaction Fraud

Digital payment platforms have increased the speed and convenience of financial transactions. However, they have also created opportunities for sophisticated financial fraud.

Examples include fraudulent UPI collect requests, fake QR codes, unauthorised payment links, impersonation scams and manipulation of payment credentials.

FinTech organisations should monitor suspicious transaction patterns, unusual transaction frequency, abnormal account behaviour, device changes and unexpected beneficiary additions.

Artificial intelligence and machine learning can assist in identifying suspicious transactions in real time.

4.3 Money Laundering and Terrorist Financing Risks

FinTech platforms may be misused to transfer illegally obtained money through digital wallets, online payment systems, virtual assets and multiple financial accounts.

Criminals may divide large amounts into smaller transactions, use multiple identities or transfer funds through different intermediaries to conceal the original source of money.

Such techniques are commonly associated with money laundering.

The prevention of these activities requires:

• Know Your Customer (KYC) verification.
• Customer Due Diligence (CDD).
• Enhanced Due Diligence (EDD) for high-risk customers.
• Transaction monitoring.
• Suspicious Transaction Reports (STRs).
• Identification of beneficial ownership.
• Screening against applicable sanctions lists.

The Prevention of Money Laundering Act, 2002 is particularly important in the Indian context.

4.4 Digital Lending and Predatory Lending Risks

Digital lending platforms enable customers to obtain loans through mobile applications without visiting a bank branch.

However, certain unauthorised lending applications have engaged in unfair practices, including excessive interest charges, hidden fees, unauthorised access to contacts and photographs, harassment and coercive recovery methods.

Other risks include inaccurate credit scoring, inadequate disclosure of loan terms and irresponsible lending.

The RBI's Digital Lending Directions, 2025 provide an updated regulatory framework for digital lending by regulated entities and their lending service providers.

Important safeguards include:

• Transparency in loan agreements.
• Disclosure of the Key Facts Statement.
• Appropriate borrower consent.
• Restrictions on unnecessary access to mobile phone resources.
• Proper handling of customer information.
• Monitoring of lending service providers.
• Effective grievance redressal mechanisms.

The responsibility of a regulated financial institution cannot simply be avoided by outsourcing its digital lending activities.

4.5 Cryptocurrency and Virtual Asset Risks

Cryptocurrencies and other virtual assets operate through digital systems, frequently using distributed ledger technology.

Although blockchain technology can improve transaction transparency and efficiency, virtual assets may create risks relating to price volatility, hacking, wallet theft, market manipulation, money laundering and terrorist financing.

The decentralised nature of certain virtual assets can also make supervision and recovery of lost funds difficult.

In India, virtual digital assets are subject to applicable tax provisions and anti-money laundering requirements. However, this should not be interpreted as meaning that all cryptocurrencies have been granted legal-tender status or unrestricted regulatory approval.

Risk monitoring should include customer verification, transaction tracing, wallet screening, sanctions screening and identification of suspicious transfers.

4.6 Artificial Intelligence and Algorithmic Risks

Artificial intelligence is increasingly used for credit scoring, fraud detection, investment recommendations, customer identification and automated financial decisions.

However, algorithmic systems can create risks such as:

1. Biased lending decisions.
2. Incorrect credit assessments.
3. Discrimination against particular groups.
4. Lack of transparency in automated decisions.
5. Manipulation of training data.
6. Model errors and unexpected outputs.
7. Excessive dependence on automated systems.

For instance, an automated lending algorithm trained on historically biased information may systematically reject otherwise creditworthy applicants.

Therefore, financial institutions should conduct regular algorithmic audits, model validation, fairness assessments and human oversight.

4.7 Third-Party and Outsourcing Risks

FinTech organisations depend heavily on external technology providers.

A failure or cyberattack affecting a cloud provider, payment gateway or software service provider may disrupt the entire financial service.

Important monitoring mechanisms include:

• Background checks and due diligence.
• Security audits.
• Contractual allocation of responsibilities.
• Periodic performance assessments.
• Data protection requirements.
• Business continuity planning.
• Disaster recovery arrangements.
• Exit and transition strategies.

4.8 Operational and Systemic Risks

Operational risks arise from internal failures, inadequate processes, human error, technological breakdowns and external events.

A prolonged outage of a major payment infrastructure may affect businesses, consumers and financial institutions simultaneously.

If multiple financial institutions depend on the same technology provider, the failure of that provider may create systemic consequences.

Therefore, FinTech risk monitoring must also consider the interconnected nature of the financial system.

5. MECHANISMS AND METHODS OF FINTECH RISK MONITORING

Effective risk monitoring requires an integrated technological and legal framework.

5.1 Artificial Intelligence-Based Monitoring

AI systems analyse large volumes of transactions and identify suspicious patterns.

For example, if a customer who generally makes small domestic payments suddenly initiates multiple high-value transfers to unfamiliar accounts, the system may flag the activity for further investigation.

5.2 Machine Learning-Based Fraud Detection

Machine learning models can learn from historical transaction information and identify unusual behaviour.

These systems can improve fraud detection, although their accuracy and fairness must be regularly assessed.

5.3 Real-Time Transaction Monitoring

Real-time monitoring enables financial institutions to identify suspicious transactions while they are being initiated or processed.

Depending on applicable legal and operational requirements, suspicious transactions may be flagged, subjected to additional authentication or escalated for investigation.

5.4 Know Your Customer Monitoring

KYC monitoring helps establish the identity of customers and identify unusual changes in customer behaviour.

Customer profiles should be updated in accordance with applicable regulatory requirements and risk assessments.

5.5 Regulatory Technology (RegTech)

RegTech refers to the use of technological solutions to assist financial institutions in complying with legal and regulatory requirements.

It includes automated reporting, sanctions screening, compliance monitoring, audit trails and regulatory document management.

5.6 SupTech

Supervisory Technology, commonly called SupTech, refers to technological tools used by regulatory and supervisory authorities to improve oversight of financial institutions.

It may include data analytics, automated reporting systems and tools for identifying emerging financial risks.

5.7 Cybersecurity Audits

Periodic cybersecurity audits help identify weaknesses in information systems, applications, networks and databases.

These audits should examine access controls, encryption, authentication, incident response and data storage practices.

5.8 Continuous Compliance Monitoring

FinTech companies should continuously monitor their compliance with RBI directions, data protection requirements, anti-money laundering obligations, consumer protection laws and applicable international standards.

6. INDIAN LEGAL FRAMEWORK GOVERNING FINTECH RISK MONITORING

India does not have one single comprehensive statute governing every aspect of FinTech. Instead, FinTech activities are regulated through multiple statutes, delegated legislation, RBI directions, SEBI regulations and other regulatory frameworks.

6.1 Reserve Bank of India Act, 1934

The Reserve Bank of India Act, 1934 establishes the RBI and provides its statutory powers and responsibilities.

The RBI plays an important role in regulating monetary policy, financial stability and the activities of regulated financial institutions.

Sections 45JA and 45L are relevant to the regulation and supervision of certain financial institutions and activities.

The Act provides an important legal foundation for RBI's regulatory intervention in emerging financial technologies.

6.2 Banking Regulation Act, 1949

The Banking Regulation Act, 1949 governs banking companies and provides regulatory powers to the RBI.

Section 35A empowers the RBI to issue directions to banking companies in the public interest, in the interest of banking policy or to prevent conduct detrimental to depositors or the interests of banking companies.

This provision is important in supervising technology-related risks arising from digital banking and financial innovation.

6.3 Payment and Settlement Systems Act, 2007

The Payment and Settlement Systems Act, 2007 is one of the most important Indian statutes governing digital payment infrastructure.

It provides the RBI with powers relating to the regulation and supervision of payment systems.

Section 4 requires authorisation to commence or operate a payment system, subject to the statutory framework.

Section 10 deals with the RBI's power to determine standards relating to payment systems.

Section 18 empowers the RBI to issue directions in the public interest and for the management and operation of payment systems.

The Act is relevant to payment gateways, payment aggregators and other regulated payment infrastructure.

6.4 Information Technology Act, 2000

The Information Technology Act, 2000 provides the principal statutory framework addressing various electronic transactions and cyber-related offences.

Important provisions include:

Section 43: Provides for compensation in specified circumstances involving unauthorised access, downloading, disruption or damage to computer resources.

Section 43A: Historically provided compensation for failure by a body corporate to maintain reasonable security practices in relation to sensitive personal data. Its present operation must be read with the subsequent data protection legislation and applicable commencement and repeal provisions.

Section 66: Deals with computer-related offences committed dishonestly or fraudulently.

Section 66C: Addresses identity theft.

Section 66D: Addresses cheating by personation using computer resources.

Section 70: Deals with protected systems.

Section 72: Addresses breach of confidentiality and privacy in specified circumstances.

Section 79: Provides conditional safe-harbour protection to intermediaries, subject to statutory requirements.

The Act is particularly important in monitoring digital payment fraud, identity theft and cybercrime.

6.5 Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a statutory framework for the processing of digital personal data in India.

It is particularly important for FinTech companies because they collect and process personal information for customer onboarding, digital lending, payment processing, identity verification and financial analytics.

Important principles include:

• Lawful processing of personal data.
• Consent and applicable legitimate uses.
• Transparency regarding data processing.
• Reasonable security safeguards.
• Responsibilities of Data Fiduciaries.
• Rights of Data Principals.
• Breach-related obligations.
• Accountability for non-compliance.

The Digital Personal Data Protection Rules, 2025 provide further implementation details.

FinTech organisations must examine the applicable commencement notifications and phased implementation provisions when determining which statutory obligations are operative at a particular time.

6.6 Prevention of Money Laundering Act, 2002

The Prevention of Money Laundering Act, 2002 (PMLA) is an important statute for preventing the misuse of digital financial services for laundering proceeds of crime.

Section 3 defines the offence of money laundering.

Section 4 prescribes punishment for money laundering.

Section 12 establishes record-keeping and reporting obligations for reporting entities.

FinTech businesses falling within the relevant reporting-entity framework must comply with applicable customer identification, record maintenance and reporting requirements.

The inclusion of specified virtual digital asset service providers within the PMLA reporting framework is particularly significant for cryptocurrency-related risk monitoring.

6.7 Consumer Protection Act, 2019

The Consumer Protection Act, 2019 protects consumers against unfair trade practices, deficient services and misleading advertisements.

Digital financial services must provide accurate information regarding fees, charges, interest rates, risks and contractual conditions.

Where a FinTech service amounts to a consumer service under the Act, consumers may seek remedies through the appropriate consumer dispute redressal mechanism.

6.8 Indian Evidence Act, 1872 and Bharatiya Sakshya Adhiniyam, 2023

The Indian Evidence Act, 1872 historically governed the admissibility of electronic records, particularly under Section 65B.

The Bharatiya Sakshya Adhiniyam, 2023 replaced the Indian Evidence Act with effect from 1 July 2024.

Its provisions concerning electronic and digital records are especially relevant to FinTech disputes and cybercrime investigations.

Financial institutions should maintain reliable transaction logs, electronic records, audit trails, authentication records and other relevant evidence in accordance with applicable evidentiary requirements.

6.9 Bharatiya Nyaya Sanhita, 2023 and Bharatiya Nagarik Suraksha Sanhita, 2023

The Bharatiya Nyaya Sanhita, 2023 replaced the Indian Penal Code, 1860, with effect from 1 July 2024.

It provides the general criminal law framework applicable to relevant offences such as cheating, forgery and related fraudulent activities.

The Bharatiya Nagarik Suraksha Sanhita, 2023 replaced the Code of Criminal Procedure, 1973 and provides the procedural framework for criminal investigations and proceedings.

These statutes are relevant when digital financial fraud involves criminal conduct.

6.10 Foreign Exchange Management Act, 1999

The Foreign Exchange Management Act, 1999 regulates foreign exchange transactions and cross-border financial activities.

It is relevant to international digital remittances, foreign investments, cross-border payment services and other financial activities involving foreign exchange.

FinTech organisations engaged in such activities must comply with applicable RBI directions and FEMA regulations.

6.11 Securities and Exchange Board of India Act, 1992

SEBI regulates securities markets and protects investors.

FinTech platforms offering securities trading, investment advisory services, portfolio management or other regulated securities-related services must comply with applicable SEBI legislation and regulations.

Technology-based trading systems also require appropriate risk management, cybersecurity and operational controls.

6.12 RBI Directions and Regulatory Frameworks

Apart from the above statutes, the RBI has issued several important regulatory directions.

A. RBI Digital Lending Directions, 2025

These directions establish the updated regulatory framework for digital lending involving regulated entities and lending service providers.

They address due diligence, borrower protection, disclosures, data practices, monitoring and accountability.

B. RBI Master Direction on Digital Payment Security Controls, 2021

These directions establish minimum security controls for digital payment products and services, including internet banking, mobile banking and card payments.

C. RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023

This framework addresses IT governance, technology risk management, information security, assurance and related controls.

D. RBI Master Direction on Outsourcing of Information Technology Services, 2023

This framework addresses risks arising from outsourcing IT services and the responsibilities of regulated entities.

E. RBI Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, 2024

These directions strengthen cybersecurity and operational resilience requirements for applicable non-bank payment system operators.

F. RBI Framework for Self-Regulatory Organisation(s) in the FinTech Sector, 2024

This framework promotes responsible industry conduct, transparency, ethical standards, governance and self-regulation within the FinTech ecosystem.

G. RBI Master Direction on Regulation of Payment Aggregators, 2025

This framework provides updated regulatory requirements for payment aggregators, including governance, authorisation and operational responsibilities.

7. SEVEN IMPORTANT INDIAN CASE LAWS RELATING TO FINTECH RISK MONITORING

Indian courts have developed important legal principles relating to privacy, cybersecurity, digital transactions, electronic evidence, regulatory supervision and financial accountability.

Although not every judgment directly concerns a FinTech company, these seven decisions provide important legal principles applicable to the regulation and monitoring of emerging financial technologies.

CASE LAW 1: JUSTICE K.S. PUTTASWAMY (RETD.) V. UNION OF INDIA (2017)

Citation: (2017) 10 SCC 1.

Court: Supreme Court of India.

Date of Judgment: 24 August 2017.

Facts of the Case:

The case arose from constitutional challenges concerning the Aadhaar identification programme and the collection and use of personal and biometric information.

The principal issue before the nine-judge Constitution Bench was whether the right to privacy was protected as a fundamental right under the Constitution of India.

Judgment:

The Supreme Court unanimously recognised the right to privacy as a constitutionally protected fundamental right under Article 21 and as part of the freedoms guaranteed under Part III of the Constitution.

The Court recognised that informational privacy is an important component of individual privacy.

It also explained that restrictions affecting privacy must satisfy the requirements of legality, legitimate state purpose and proportionality.

Relevance to FinTech Risk Monitoring:

This decision is extremely important for digital financial services.

FinTech companies collect substantial quantities of personal and financial information, including customer identities, biometric authentication information, transaction histories and credit-related information.

The judgment establishes that technological convenience cannot justify unlimited collection or misuse of personal information.

FinTech companies should therefore ensure:

1. Lawful collection and processing of personal information.
2. Transparency regarding data usage.
3. Appropriate security safeguards.
4. Restrictions on unauthorised access.
5. Proportionate data collection.
6. Accountability for privacy violations.

Legal Principle:

The right to privacy is a fundamental right, and informational privacy must be protected when financial institutions use digital technologies.

CASE LAW 2: SHREYA SINGHAL V. UNION OF INDIA (2015)

Citation: (2015) 5 SCC 1.

Court: Supreme Court of India.

Date of Judgment: 24 March 2015.

Facts of the Case:

The petition challenged the constitutional validity of Section 66A of the Information Technology Act, 2000, which criminalised certain forms of online communication.

The petition also raised questions concerning intermediary liability and the regulation of online information.

Judgment:

The Supreme Court struck down Section 66A as unconstitutional because it violated the freedom of speech and expression guaranteed under Article 19(1)(a).

The Court also interpreted Section 79 of the Information Technology Act concerning intermediary safe-harbour protection.

It clarified the importance of legally recognised grounds and appropriate procedures when intermediaries are required to remove or disable access to online information.

Relevance to FinTech Risk Monitoring:

FinTech companies often operate digital platforms connecting customers, banks, merchants, lenders and payment service providers.

The judgment is relevant to understanding the responsibilities of online intermediaries and the legal limits of content regulation.

It also demonstrates that technological monitoring must operate within constitutional and statutory safeguards.

For example, a financial platform should have legally appropriate procedures for handling unlawful content, fraudulent advertisements and impersonation activities without exercising arbitrary powers over users.

Legal Principle:

Digital platforms must comply with intermediary obligations while respecting constitutional freedoms and procedural safeguards.

CASE LAW 3: INTERNET AND MOBILE ASSOCIATION OF INDIA V. RESERVE BANK OF INDIA (2020)

Citation: (2020) 10 SCC 274; 2020 INSC 264.

Court: Supreme Court of India.

Date of Judgment: 4 March 2020.

Facts of the Case:

The RBI issued a circular dated 6 April 2018 directing entities regulated by it not to provide banking services to individuals and businesses dealing with virtual currencies.

The circular effectively restricted the banking relationship between regulated financial institutions and cryptocurrency-related businesses.

The Internet and Mobile Association of India challenged the circular before the Supreme Court.

Judgment:

The Supreme Court recognised the RBI's statutory authority to regulate financial activities and protect the financial system.

However, the Court set aside the impugned circular because the measure failed the proportionality test in the circumstances of the case.

The Court considered the significant impact of the restriction on businesses dealing with virtual currencies and found that the measure was disproportionate.

Relevance to FinTech Risk Monitoring:

This is one of the most important Indian judgments concerning emerging financial technologies.

It establishes that financial innovation can be regulated to protect public and financial interests, but regulatory restrictions must be legally justified and proportionate.

It is particularly relevant to:

1. Cryptocurrency regulation.
2. Virtual asset exchanges.
3. Digital financial innovation.
4. Regulatory risk assessment.
5. Proportionate supervision of emerging technologies.
6. Balancing financial stability with commercial freedom.

Legal Principle:

Regulatory authorities possess substantial powers to protect financial stability, but regulatory measures affecting technological businesses must satisfy constitutional proportionality requirements.

CASE LAW 4: ANVAR P.V. V. P.K. BASHEER (2014)

Citation: (2014) 10 SCC 473.

Court: Supreme Court of India.

Date of Judgment: 18 September 2014.

Facts of the Case:

The dispute concerned the admissibility of electronic records as evidence in legal proceedings.

The Supreme Court considered the requirements for proving electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Judgment:

The Supreme Court clarified the requirements governing the admissibility of electronic records and the importance of compliance with Section 65B.

The judgment established that electronic evidence must satisfy the applicable statutory requirements before it can be admitted through the relevant evidentiary procedure.

The subsequent law on electronic evidence, including the Bharatiya Sakshya Adhiniyam, 2023, must also be considered in present-day proceedings.

Relevance to FinTech Risk Monitoring:

Digital financial transactions generate electronic evidence, including:

• UPI transaction records.
• Bank statements.
• Electronic payment confirmations.
• Server logs.
• Emails and SMS records.
• Digital loan agreements.
• Authentication records.
• Electronic communications.

When digital fraud occurs, such records may become essential evidence.

FinTech companies must therefore maintain reliable electronic records and ensure that their preservation and production comply with applicable evidentiary laws.

Legal Principle:

Electronic records are important forms of evidence, but their admissibility and proof must satisfy the applicable statutory requirements.

CASE LAW 5: STATE OF MAHARASHTRA V. DR. PRAFUL B. DESAI (2003)

Citation: (2003) 4 SCC 601.

Court: Supreme Court of India.

Date of Judgment: 1 April 2003.

Facts of the Case:

The case involved the question of whether evidence could be recorded through video conferencing under the criminal justice system.

The issue was whether the use of modern communication technology was consistent with the applicable procedural and evidentiary requirements.

Judgment:

The Supreme Court recognised that technological methods such as video conferencing could be used for recording evidence.

The Court adopted a practical and progressive interpretation of procedural law, recognising that technology could assist the administration of justice.

Relevance to FinTech Risk Monitoring:

The decision is relevant because FinTech activities frequently involve electronic communication, remote verification, digital transactions and technology-based documentation.

It demonstrates the legal importance of recognising electronic methods in the administration of justice.

In cases involving digital financial fraud, video conferencing and other electronic methods may facilitate the examination of witnesses and the presentation of relevant evidence, subject to applicable procedural law.

Legal Principle:

Law must adapt to technological developments, and electronic methods may be accepted where they satisfy applicable legal requirements.

CASE LAW 6: STATE BANK OF INDIA V. SHYAMA DEVI (1978)

Citation: (1978) 3 SCC 399.

Court: Supreme Court of India.

Facts of the Case:

The dispute concerned the liability of a bank for money entrusted by a customer to a bank employee who subsequently misappropriated it.

The Supreme Court considered whether the bank could be held liable for the employee's actions in the circumstances of the case.

Judgment:

The Court examined the relationship between the bank, its employee and the customer and considered the circumstances in which the employee's conduct could be attributed to the bank.

The case is important for understanding the limits of a bank's liability for an employee's fraudulent conduct and the significance of the employee's authority and the circumstances of the transaction.

Relevance to FinTech Risk Monitoring:

The judgment provides a useful foundation for examining institutional responsibility in financial transactions.

In the modern FinTech environment, comparable issues may arise where fraud involves employees, agents, outsourced service providers or individuals acting through institutional systems.

Financial institutions should therefore monitor:

1. Employee access to customer accounts.
2. Internal authorisation procedures.
3. Segregation of duties.
4. Suspicious employee activity.
5. Outsourced service-provider conduct.
6. Internal fraud and transaction irregularities.

The judgment should not be understood as creating automatic bank liability for every fraudulent transaction. Liability depends on the applicable legal principles and facts.

Legal Principle:

Financial institutions must maintain proper internal controls, while liability for employee misconduct depends on the nature of the employment relationship and the circumstances of the transaction.

CASE LAW 7: RBI V. JAYANTILAL N. MISTRY (2016)

Citation: (2016) 3 SCC 525.

Court: Supreme Court of India.

Date of Judgment: 16 December 2015.

Facts of the Case:

The dispute concerned requests for information held by the Reserve Bank of India under the Right to Information Act, 2005.

The issue involved the disclosure of information relating to regulatory inspections, financial institutions and the RBI's supervisory activities.

Judgment:

The Supreme Court emphasised the importance of transparency and accountability in the functioning of the RBI.

It rejected the broad contention that the RBI could routinely withhold information by relying upon fiduciary relationships with regulated banks.

The Court recognised the importance of disclosure in strengthening public accountability, subject to the applicable statutory framework.

Relevance to FinTech Risk Monitoring:

The decision is relevant to the transparency of financial regulation and supervisory accountability.

As FinTech becomes increasingly complex, financial regulators must ensure that their regulatory and supervisory activities operate within a framework of accountability.

It supports the broader proposition that financial institutions and regulators must maintain appropriate records, follow lawful supervisory procedures and respect applicable disclosure obligations.

Legal Principle:

Financial regulation requires accountability and transparency, and confidentiality cannot be used as a blanket justification to avoid legally required disclosure.

8. COMPARATIVE ANALYSIS OF THE SEVEN CASE LAWS

The seven decisions collectively provide an important judicial foundation for FinTech risk monitoring.

1. Justice K.S. Puttaswamy v. Union of India: Establishes the constitutional protection of privacy and informational autonomy.
2. Shreya Singhal v. Union of India: Clarifies intermediary obligations and the limits of online regulation.
3. Internet and Mobile Association of India v. RBI: Establishes the importance of proportionality in financial technology regulation.
4. Anvar P.V. v. P.K. Basheer: Explains the evidentiary requirements for electronic records under the earlier evidence law.
5. State of Maharashtra v. Dr. Praful B. Desai: Recognises the use of technology in judicial proceedings.
6. State Bank of India v. Shyama Devi: Provides principles concerning bank liability and employee misconduct.
7. RBI v. Jayantilal N. Mistry: Emphasises transparency and accountability in financial supervision.

Together, these judgments demonstrate that FinTech risk monitoring is not merely a technological exercise. It is also a constitutional, regulatory, evidentiary and institutional responsibility.

9. INTERNATIONAL REGULATIONS AND STANDARDS GOVERNING FINTECH RISK MONITORING

FinTech operates across national boundaries. Therefore, international regulatory frameworks play an important role in establishing common standards for cybersecurity, financial integrity, data protection and operational resilience.

9.1 General Data Protection Regulation, European Union (GDPR)

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, establishes a comprehensive framework for protecting personal data within its territorial scope.

It regulates the collection, processing, storage and transfer of personal information.

Important provisions include:

• Article 5: Principles relating to personal data processing.
• Article 6: Lawfulness of processing.
• Article 17: Right to erasure.
• Article 25: Data protection by design and by default.
• Article 32: Security of processing.
• Article 33: Notification of personal data breaches.
• Article 35: Data Protection Impact Assessment.

Relevance to FinTech:

FinTech companies handling personal data within the GDPR's territorial scope must implement appropriate data protection measures, maintain transparency and protect customer information.

9.2 Financial Action Task Force (FATF) Recommendations

The Financial Action Task Force is an international standard-setting body responsible for developing measures to combat money laundering, terrorist financing and proliferation financing.

Its 40 Recommendations provide an important international framework.

Important areas include:

1. Customer due diligence.
2. Beneficial ownership transparency.
3. Record keeping.
4. Suspicious transaction reporting.
5. Risk-based supervision.
6. International cooperation.
7. Regulation of virtual asset service providers.

Recommendation 15 is particularly important because it addresses new technologies and virtual assets.

Recommendation 16 addresses payment transparency.

Relevance to FinTech:

FATF standards assist countries in ensuring that digital financial services are not misused for illicit financial activities.

9.3 Digital Operational Resilience Act (DORA), European Union

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, establishes a comprehensive framework for digital operational resilience in the European financial sector.

It became applicable on 17 January 2025.

DORA addresses:

• Information and communication technology risk management.
• ICT-related incident reporting.
• Digital operational resilience testing.
• Third-party technology risk.
• Oversight of critical ICT third-party service providers.
• Business continuity and operational resilience.

Relevance to FinTech:

DORA is particularly significant for financial technology companies because it recognises that financial stability depends on the reliability of technology infrastructure.

It provides a strong international model for monitoring cloud providers, payment infrastructure and other critical technology dependencies.

9.4 Markets in Crypto-Assets Regulation (MiCA), European Union

The Markets in Crypto-Assets Regulation, Regulation (EU) 2023/1114, establishes a regulatory framework for crypto-assets and related service providers within its scope.

It addresses:

• Issuance of certain categories of crypto-assets.
• Authorisation of crypto-asset service providers.
• Disclosure and transparency.
• Market abuse.
• Governance and operational requirements.
• Consumer and investor protection.

Its principal provisions became applicable in stages during 2024.

Relevance to FinTech:

MiCA provides a structured approach to monitoring crypto-asset activities and reducing risks associated with unregulated or inadequately supervised digital asset markets.

9.5 Payment Services Directive 2 (PSD2), European Union

The Revised Payment Services Directive, Directive (EU) 2015/2366, establishes rules governing payment services in the European Union.

It addresses:

• Authorisation of payment service providers.
• Strong Customer Authentication.
• Security of electronic payments.
• Consumer protection.
• Rights and obligations of payment service providers.
• Open banking and access to payment account information.

Relevance to FinTech:

PSD2 provides a framework for secure digital payment services and supports innovation while requiring appropriate authentication and security measures.

9.6 Basel Committee Principles for Operational Resilience

The Basel Committee on Banking Supervision has developed principles concerning operational resilience.

These principles address the ability of banks to continue delivering critical operations during disruptions.

Important areas include:

• Governance.
• Operational risk management.
• Business continuity.
• Third-party dependency management.
• Incident response.
• Cybersecurity.
• Resilience testing.

Relevance to FinTech:

These principles provide guidance for financial institutions that depend on digital platforms, cloud computing and outsourced technology services.

9.7 United States Bank Secrecy Act and Anti-Money Laundering Framework

The United States Bank Secrecy Act establishes requirements relating to financial record keeping, reporting and anti-money laundering controls.

It requires covered financial institutions to maintain appropriate anti-money laundering programmes and report certain suspicious activities.

FinCEN plays an important role in implementing and supervising relevant financial crime compliance obligations.

Relevance to FinTech:

The framework is important for digital payment providers, money service businesses and other covered financial technology businesses operating within the relevant US regulatory perimeter.

9.8 United States Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act establishes privacy and safeguarding requirements for certain financial institutions handling consumers' non-public personal information.

It requires applicable institutions to protect customer financial information and provide relevant privacy disclosures.

Relevance to FinTech:

The Act demonstrates the importance of protecting customer information in technology-based financial services.

9.9 International Organization for Standardization: ISO/IEC 27001

ISO/IEC 27001 provides an internationally recognised framework for establishing, implementing, maintaining and continually improving an Information Security Management System.

It addresses information security risks through systematic controls and governance.

Relevance to FinTech:

FinTech organisations may use this standard to strengthen information security management, protect financial records and improve cybersecurity governance.

10. COMPARISON BETWEEN INDIAN AND INTERNATIONAL FINTECH REGULATIONS

Indian and international regulatory frameworks share common objectives, although their legal structures and supervisory approaches differ.

A. Data Protection

India: Digital Personal Data Protection Act, 2023 and applicable Rules.

European Union: General Data Protection Regulation.

United States: Gramm-Leach-Bliley Act and other applicable privacy and financial-sector laws.

B. Cybersecurity

India: RBI cybersecurity and IT governance directions, Information Technology Act, 2000 and applicable CERT-In directions.

European Union: Digital Operational Resilience Act.

International standards: ISO/IEC 27001 and Basel operational resilience principles.

C. Anti-Money Laundering

India: Prevention of Money Laundering Act, 2002 and applicable Rules.

International: FATF Recommendations.

United States: Bank Secrecy Act and applicable FinCEN regulations.

D. Digital Payments

India: Payment and Settlement Systems Act, 2007 and RBI directions.

European Union: PSD2.

E. Cryptocurrency and Virtual Assets

India: Applicable PMLA provisions, tax laws and relevant regulatory requirements.

European Union: Markets in Crypto-Assets Regulation.

International: FATF standards for virtual assets and virtual asset service providers.

F. Operational Resilience

India: RBI IT governance, outsourcing and cybersecurity directions.

European Union: DORA.

International: Basel Committee principles for operational resilience.

These frameworks demonstrate that effective FinTech risk monitoring requires cooperation between financial regulators, technology authorities, law enforcement agencies and international standard-setting organisations.