Crypto firms fear being shut out of the UK market as operational readiness lags behind ambition

By Zumo

● Initial findings from Zumo’s UK Regulatory Preparedness Assessment survey show seven in ten crypto firms see losing UK market access as a key risk of the incoming regulatory regime – yet just one in ten feel fully prepared for the new rules.

● With the FCA opening its application gateway in September, 60% of firms are still assessing how to adapt their UK operating model to meet the new requirements, while 30% are finding it challenging to determine which rules apply to them and what permissions are needed.

● As nine out of ten firms prepare to submit applications, these early insights from Zumo’s live survey show a gap between ambition and firms’ readiness; collaboration will be required to close this gap, with Zumo calling on firms to feed into its assessment to help make compliance a more structured, manageable process.

Crypto firms see continued access to UK customers as the most pressing matter at stake as the country’s regulatory regime takes shape but the majority acknowledge they aren’t yet ready for it, according to new research from digital assets platform Zumo.

Early insights from the company’s landmark survey of cryptoasset service providers serving UK clients reveal 70% identify losing the ability to serve their UK customers as a main risk of not being ready for the new regime. Half (50%) have concerns about financial penalties or regulatory sanctions, with the same figure worrying about subsequent loss of revenue or market share.
Following the publication of its final rules and guidance, the Financial Conduct Authority (FCA) is preparing to open its application gateway for firm authorisations on 30 September 2026, ahead of the implementation of a comprehensive regulatory regime for cryptoassets in October 2027.

However, just 10% of providers consider themselves fully prepared for the new rules, while six in ten are still assessing how to adapt their UK operating model to meet the new requirements. Eight in ten perceive their risk of not being ready in time as moderate to high, while 60% believe their current operating model would be exposed to regulatory enforcement.

Ambition ahead of execution

Their ambition, by contrast, is in little doubt.
Nine in ten firms intend to apply for authorisation during the FCA’s application window, which will shut in February 2027, and 60% expect the regime to expand their UK business – the same figure (60%) believe the incoming regime will boost interest among their customer base in crypto as an asset class.
While awareness of the regime is universal among respondents, execution is at an early stage with half (50%) of firms still at the planning phase when it comes to their regulatory readiness initiatives.

When asked about their organisation’s single biggest challenge, three in ten said it’s determining which rules apply to them and what permissions are needed. Beneath this headline challenge lies a consistent set of operational pain points, including the cost and internal resource demands of getting ready, mapping services to UK regulated activities, and implementing compliant custody or safeguarding arrangements.

Confidence that the regime is unfolding in firms’ favour remains limited: only two in ten agree it’s developing in a way that sets firms up to operate successfully in the UK.

The call for collaboration
The early insights from Zumo’s survey show the gap between ambition and firms’ current state of readiness is now the defining feature of the market.

Few are attempting to close this gap alone. Some seven in ten have sought, or plan to seek, external support from legal and compliance advisers, industry bodies, or technology providers as they work through the challenges.
Respondents are also looking for more support from the regulator. While FCA guidance to date was rated ‘fair’ by 80% of firms – with none rating it ‘poor’ – the research has uncovered a consistent set of asks: clearer guidance on regulatory scope and applicability, more time and transitional arrangements, and better signposting of UK-compliant infrastructure and technology solutions.

The FCA’s Pre-Application Support Service (PASS) meetings for cryptoasset firms are now officially underway, which provide an opportunity to connect some of the dots. These meetings give firms an opportunity to ask questions and discuss their business plans ahead of the application window.

Commenting on the emerging survey findings, Zumo’s Founder and Chief Executive Nick Jones said:
“With the UK’s regulatory regime now set in stone, authorisation will become a game changer. Authorised market participants will have the potential to shift the status quo and unlock pent-up institutional appetite.”
“The early findings from our survey indicate a market caught between ambition and execution; firms have decided the UK is worth the effort, but must overcome a number of obstacles to be ready in time to realise the opportunity. It’s encouraging that firms are treating readiness seriously and reaching for the expertise they need – the cost of getting it wrong is cutting off access to one of the world’s most compelling markets.”

“The asks emerging from this research are practical ones – clarity on scope, realistic timelines, and visibility of the infrastructure that meets UK-specific requirements. At Zumo, we’re focused on providing the UK market solutions to help firms accommodate new levels of operating obligations. From customer onboarding to UK-routed liquidity and compliant safeguarding, we’re building the core components of a full UK-ready tech stack.”

“It’s an exciting time for the UK, but also the end of an era: of offshore provision, start-up style business processes, and unregulated business models. As the industry moves onshore, providers will need access to critical partner infrastructure that can act as a bridge to the scaling UK cryptoasset market.”

Zumo’s UK Regulatory Preparedness Assessment survey is open until Wednesday 30 September 2026, and available at here.

Why financial crime detection needs a new approach

By Swagatam Sen, Founder & CEO, ControlOne

A few years ago, I sat in a meeting with a financial crime team at a major bank. They had just finished a year-long project using machine-learning to spot suspicious activity from past data. The number of alerts was down. By the usual measures, the system was doing well. Everyone in the room agreed it was an improvement.

Then someone asked a quiet question. “Are we catching more crime?”

Nobody could answer with confidence.

That moment has stayed with me. It gets to the heart of what the industry has been doing for the last decade: improving the machinery of compliance without solving the underlying detection problem. From the outside the two things look similar. They are not the same.

The problem is not the technology. It is what we choose to look at.

Money laundering is a crime of networks. Criminal organisations do not work through single accounts acting on their own. They work through coordinated groups: accounts used to move money on behalf of criminals (often called “mules”), long chains of transfers designed to hide where the money came from, and companies that exist only on paper. Any single transaction looks harmless, but put together the pattern clearly reveals criminal activity. Every major laundering method that the Financial Action Task Force (FATF) have documented over the last twenty years shares this feature. The risk sits between accounts, not within any one of them.

Yet every generation of detection system has been built to assess one account at a time.

Rules: easy to explain, but frozen in place

The first generation of these systems relied on fixed rules. Flag any cash deposit above a set amount. Raise a flag on transfers sent to high-risk countries. Rules can be checked and traced, regulators understand them, and the teams using them can explain why every alert was raised. But by their nature they never change. Criminal networks work out where the limits are set and simply route around them. The result is a system that reliably catches the tricks of the past while raising thousands of false alarms — keeping investigators busy without catching much organised crime.

Rules were never going to solve the problem. But they set an important expectation inside these institutions: that a detection system should be explainable. That expectation matters. Any architecture that replaces them has to meet it.

The first wave of machine learning: smarter scoring, same limit

The industry’s first serious move into machine learning — software that learns patterns from data rather than following fixed rules — brought genuine improvements to how alerts were sorted and how risky each customer was judged to be. These systems are quicker to update than rules, better at handling complicated combinations of information, and far more accurate by the usual measures.

But they depend entirely on clues that people have to define in advance. You have to know what you are looking for before you can teach the system to find it. It catches someone breaking a large deposit into lots of small ones only because a person told it to look for exactly that. A new laundering method that doesn’t match a known template stays invisible. The system can only ever be as good as the clues it has been given, and no one can describe a pattern the bank has never seen before.

Mapping the network: the connections become visible, but frozen in time

The realisation that financial crime is a network problem led to serious investment in approaches that map how accounts connect to one another. Instead of looking only at what a single account does, these systems learn from the links between accounts. This is genuine progress. Connecting accounts that share the same trading partners, the same hidden owners, or the same flows of money reveals patterns that account-by-account systems simply cannot see.

But most of these systems in use today treat the network as a single frozen photograph. They learn who is connected to whom at one moment in time. They do not learn the sequence of events flowing through those connections over time.

Financial crime is not a structure. It is a process. A network of mule accounts is defined not just by how it is wired together but by the rhythm of the money moving through it: the gaps in timing, the order in which accounts are used, the coordinated pattern that appears when several accounts act together over weeks or months. A frozen snapshot captures the wiring and misses the movement.

Following events over time: the timeline arrives, but not the group

The latest approaches are powerful at reasoning about sequences of events. They can learn patterns of timing across long transaction histories, apply what they have learned across different kinds of institution, and spot unusual activity that no rule-writer ever thought to describe. In some tasks like reviewing documents, writing up case summaries, building a picture of customer behaviour, they are game-changing.

But they are almost always pointed at one account at a time. One model. One customer. One timeline.

Financial crime does not operate one customer at a time. It operates across many customers at once. A system racing through individual account histories side by side is still solving the wrong problem. Doing it efficiently, and on a huge scale, but the wrong problem all the same.

What a detection system actually needs to do

Each generation has solved a real part of the problem. Rules gave us the ability to explain decisions. The first wave of machine learning gave us the ability to adapt. Mapping the network let us see the connections. The latest models let us follow events over time. But no system in use today has combined all four of these strengths while looking at the right thing.

What is needed is a system that treats whole groups of accounts; not single accounts; as the main thing it examines. One that learns the tell-tale sequences of criminal behaviour directly from the data, without needing analysts to spell out the patterns in advance. One that works out the role each account is playing within a group, not from fixed rules but from the patterns that emerge in the data itself. And one that produces an explanation you can genuinely follow: not a risk score with a rough justification bolted on afterwards, but a clear, step-by-step record showing exactly which coordinated chain of behaviour led to the decision.

This is not a matter of fine-tuning the systems we already have. It calls for something built around the criminal network, not the individual account, from the ground up.

Where this leads

The institutions spending tens of billions every year on fighting financial crime are not failing for lack of effort or money. They are running systems designed for a different problem. The question is not whether to upgrade. Regulators and investors are already forcing that conversation. The question is whether the next generation of tools will change what we look at or simply run faster while looking at the same old thing.

Closing the detection gap means starting from the right place. That means looking at the whole ring, not just one of its members.

That is what ControlOne is building.

Why payments automation is key to operational resilience for growing businesses

By Myles Stephenson, Founder & CEO at Modulr

The world is becoming increasingly uncertain, and for businesses, this means that market and economic volatility is now the norm. Disruption can hit from many angles, and if your organisation is not resilient, the consequences can be damaging both reputationally and to your bottom line.

This is something that Scottish businesses deeply understand and is reflected in their current outlook. In Scotland, for example, recent MFMac survey data shows that 25% of firms say their most recent financial year performed worse than expected (up from 16% a year earlier), while 47% now identify a weak economy as their primary concern.

But business leaders must move beyond merely admiring the problem and take steps to protect and improve their business resilience to weather these fast-evolving conditions.

In the industries we operate in, including payroll, lending, and travel, we are seeing one thing very clearly: businesses that focus on their payments infrastructure as a driver for growth rather than a simple function are significantly strengthening their position and competitiveness.

And within this context, operational resilience is an essential element of the systems that automate money movement.

Resilience in the core payments that drive your business

Consider payroll, a function that exists in every organisation. When it goes wrong, the effect on employee productivity and engagement is considerable. Research indicates that 25% of UK employees have been hit by payroll errors, and 46% of those affected have seen it happen more than once. In more than half of cases, the problem took over a week to fix. This results in time lost as staff resolve these issues and erodes employee sentiment in an already unsettled climate, which in turn feeds into staff churn.

Businesses that have not automated payroll encounter inefficiency at every step. Manual file exports, reconciliations, and disconnected workflows introduce failure points across the process. Bringing payroll and payments together into one automated flow strips out those handoffs, cuts errors, and creates an operating model that can absorb higher volumes without adding overhead.

Real-time payments integration provides the speed, control, and transparency needed to keep up as volumes rise. Future-proofing payroll means designing systems that take change in their stride rather than buckling under it. The organisations that manage this reliably, and at scale, convert payroll from an operational liability into a foundation for lasting growth.

Speed as the new competitive edge in lending

Lending is another market where we’re seeing firms differentiate themselves through automation. Here, reliability alongside speed and accuracy in collections is key. Streamlined, automated payments strengthen operational stability by accommodating irregular or partial repayments, enabling quick schedule changes, and delivering dependable processing.

Lenders are handling high volumes of collections, reconciliations, and reporting at once, often spanning multiple products and borrower segments. In an industry where margins are thinner and borrowers more sensitive, a single payment error can create compliance risk, damage borrower relationships, and open up operational exposure at the very moment a lender can least afford it.

Automated, real-time payment infrastructure takes much of that vulnerability away. Collections are validated automatically, and reconciliation happens in real time instead of at the end of a manual process.

Building resilience in an unpredictable travel market

One of our other key sectors, travel, must also deal with its own pressures, sharpened by the cross-border nature of travel payments. Additionally, disruption has been growing in this sector for some time with no sign of easing, which makes operational resilience more critical than ever.

Earlier this year, we saw geopolitical tensions cause mass flight cancellations and disruption. More recently, the World Cup has put strain on the travel industry with last-minute travel plans being made as the tournament progresses. This presents complex challenges for travel firms.

The consumer-facing side tends to grab attention, but supplier-side problems are frequently far more intricate and demand tighter cash flow management.

Travel companies are settling payments with airlines, hotels, ground transport providers, and a range of other suppliers. When disruption and uncertainty take hold, two operational risks intensify: time swallowed up by manual processes and running short of funds at a key moment.

Many operators are still tied to manual processes and legacy infrastructure that generate errors and slow processing times, precisely when speed and precision matter most. Late or incorrect supplier payments can put partnerships under strain, activate penalty clauses, and set off a second round of operational problems at the worst possible time. The effect only grows at scale, as larger volumes across multiple currencies create further complications. With automation, payments are triggered and processed without manual involvement, supplier settlements stay on schedule whatever the level of disruption, cash flow and reconciliations are tracked in real time, and the errors that pile up in manual environments fall away.

Payment infrastructure is the foundation of operational resilience

This is a pattern that shows up time and again across payroll, lending, and travel. External pressure builds, and the businesses that manage this well are those with automated, real-time payment infrastructure beneath them.

In a world where disruption is becoming a regular feature, payment infrastructure sits at the heart of how businesses protect themselves, serve their customers, and stay competitive. The organisations that see this now will be in a far stronger position than those that wait for the next shock to discover that payment infrastructure has become much more than an operational function.

Rethinking cross‑border payments: Market Town’s Bitcoin approach from Edinburgh

Written by Henry Murray-Smith, Market Town

“Imagine a contract where every January first, forever, I will give you one dollar. You can sell and transfer this contract. You want to sell this contract to Charlie. How much does he pay?”

This question is really asking “why is a dollar today worth more than a dollar tomorrow?” and is as fundamental to finance as a writer of the English language starting on the left hand side of the page. Charlie buys the contract for about eight dollars.

In 2021, five years into an informal financial education, I stood in the kitchenette of a data centre waiting for tea to brew, closing a wealth management textbook from the CISI (the Chartered Institute for Securities and Investment). Concluding my first reading I was more certain finance was, at its most favourable angle, a hot mess. And for all the detail and breadth of my education, I still had no idea what money was.

Some years later, the best definition I can muster is that money is part of human nature. It’s a phenomenon that appears with any collection of people, expressed through technology. My favourite example is cigarettes in prison, because they’re so perfectly divisible and scarce. They also have a practical purpose: you *can* save them to trade another day, or smoke one in a moment of reflection. But step outside prison and cigarettes are no longer tender. A shopkeeper will no sooner trade cigarettes for groceries than they would accept a nugget of gold.

When investigating money, the inevitable subject of Bitcoin appeared. My cynicism only began to erode reading Fidelity’s ‘Bitcoin First Revisited’ which explains why Bitcoin, not the thousands of other ‘web3 projects’ satisfies the properties of money to a greater degree than fiat currencies and gold. I still despised its energy consumption, because I hadn’t connected the dots that, if electricity is almost all of your running costs, finding stranded and renewable energy would be incentivised.

I also hadn’t considered the energy cost of the current system: millions of offices, bank branches, and autoteller machines serviced by vehicles – that system full of failure points, gatekeepers and opaque fees. So what backs Bitcoin? Even if fiat currency isn’t backed by gold (anymore) it’s backed by a government’s ability to raise taxes and sell bonds. Well, it takes a lot of energy to mine one Bitcoin, almost a hundred thousand US dollars of electricity. It can’t be created without significant cost. Saying it’s backed by energy doesn’t exactly stir the soul, but it is, and the market values that captured energy, or that Bitcoin, very highly.

So why wasn’t there a browser for the Bitcoin network, I wondered? Why didn’t some clever developer build a portal like so many thousands of startups during the early days of the internet, which had Mosaic and Netscape? The sad truth is that many of the innovation dollars went to adjacent crypto projects pretending to be superior to Bitcoin, optimised for different things, and now they’re all fading. Only Bitcoin persists, everything else dies and, yet, few use it as currency.

Today, half a billion people own Bitcoin, most indirectly, and it’s one per cent of global money supply. Numbers like these inspire us to build the future of payments, banking and financial services.

After eighteen months of product development, our mobile app is being designed in California by Alexander Lambert, who led the design, often from day one, of Friendster.com, car sharing platform Getaround.com, and Airkit.com (acquired by Salesforce).

To explore our roadmap beyond global payments, say hello@market.town

Learn more about Edinburgh fintech Market Town and its Bitcoin‑powered cross‑border payments platform.

Aveni extends market leading wealth and compliance platform into consumer agentic AI for financial services

£12m investment accelerates launch of Agent Assure, closing the AI agent safety gap

Aveni, the UK’s leading AI fintech specialist in wealth management, financial advice and banking, today announced a £12 million funding round led by PXN Ventures, the UK’s fastest-growing venture and investments firm outside London and the South East, and supported by existing investors Puma Growth Partners, Lloyds Banking Group, Nationwide and Scottish Enterprise. The investment will accelerate development of Aveni’s Unified Assurance Platform (UAP) and the launch of its new Agent Assure and Agent Approve solutions, purpose-built to assess the conduct risk of AI agents that interact with consumers in financial services.

Aveni is the established market leader in AI adoption across UK wealth and banking, with over seven years of live deployments and product development. Its products Aveni Assist, an AI productivity solution for advisers and operations teams, and Aveni Detect, its AI compliance monitoring tool, are deployed across the UK’s leading banks, wealth managers and financial advisers. Underpinning both is FinLLM, Aveni’s proprietary suite of specialist small language models built for and utilising UK financial services data.

Agentic AI adoption in financial services is accelerating, but deployment at scale is being held back by a critical gap in assurance. With just 2% of firms reporting adequate AI guardrails, the absence of robust, regulated oversight for AI agents that interact directly with consumers is the number one challenge for the industry. Regulators are clear that the mode of engagement, human or machine, is secondary to consumer outcomes, which must be assessed consistently across all interactions.

Agent Assure directly addresses this gap. A natural extension of the Aveni Detect proposition, it enables firms to monitor and manage the conduct risk of AI agents alongside human interactions, in a single unified view. Together with Aveni Assist, Aveni Detect and the new Agent Approve solution, this Assure forms the Unified Assurance Platform: the financial service industry’s first comprehensive framework for assuring both human and agent interactions with consumers at scale.

Aveni is a participant in the FCA’s Supercharged Sandbox programme and has established the Agent Assurance Expert Council to support development of responsible AI governance frameworks. The company is working directly with regulators and industry bodies to shape the emerging standards for AI in financial services.

Two men and a woman standing in Victoria Street, Edinburgh — Aveni.ai founders Joseph Twigg, CEO; Jamie Hunter, COO; and Professor Lexi Birch, Chief Scientist

Joseph Twigg, CEO of Aveni, said: “The continued confidence shown by our existing investors is a powerful endorsement of the direction we’re taking. We have spent seven years building the models, the experience and the regulatory relationships that make us uniquely qualified to solve the hardest problem in AI adoption right now: how do you assure the conduct of an AI agent interacting with a real consumer? Agent Assure is our answer — and this investment accelerates our ability to deliver our full platform at scale.”

Alastair Moore at PXN Ventures, said: “Aveni is fast becoming financial advisers’ go-to tool for helping them leverage AI in a safe and appropriate way. The team now has seven years of live deployments and proprietary models built within the UK financial services sector. Their infrastructure is answering one of the biggest questions in AI adoption: how to manage real client interactions and build trust, so advisers can focus on what they do best. We’re proud to support Aveni through multiple PXN funds, including the Praetura Growth VCT, as they continue their growth journey and demonstrate the world-class fintech capabilities of the North of the UK.”

Ben Leslie, Investment Director, Puma Growth Partners, commented: “The impact Aveni is making in deploying AI into UK financial services is already significant, and we continue to see a substantial growth opportunity ahead. With agentic AI adoption accelerating and regulators rightly focused on consistent consumer outcomes, robust assurance for AI agents is rapidly becoming a core requirement for the sector. As a standout example of Scotland’s growing strength as a technology hub, Aveni is well placed to lead this next phase. We are delighted to invest again from our Scotland office to support Joseph, Jamie, Professor Lexi Birch and the wider team as they scale the Unified Assurance Platform and launch Agent Assure.”

Kirsty Rutter, Fintech Investment Director at Lloyds Banking Group, said: “Agentic AI represents a significant opportunity for financial services to enhance customer experience through more personalised interactions. Aveni is helping firms adopt this technology in a safe and responsible way. We’re pleased to continue supporting Aveni’s ongoing development through investment and partnership.”

The continued backing of existing investors reflects confidence in Aveni’s roadmap and market position. PXN Ventures led the round alongside Puma Growth Partners, Lloyds Banking Group, Nationwide and Scottish Enterprise.

Navigating Consumer Duty: The Hidden Cost of Friction

By Shiyu Chen, behavioural scientist and founder at BehaviourAI Lab

Consumer Duty has reshaped the way financial services firms need to think about customer journey. The FCA’s shift from tick-box compliance to outcome-based evidence doesn’t come with sirens or warning, but it does change the ground we’re standing on.

What used to be a design preference is now part of a firm’s regulator responsibility. And this shift invites a different kind of conversation: not about what we’ve declared to customers, but about what they actually encounter.

It’s time to step back, understanding how user journey shapes outcomes, and to diagnose, redesign, and measure those behavioural dynamics through a behavioural science approach.

*Shiyu Chen, behavioural scientist and founder at BehaviourAI Lab*

Sludge: The Silent Enemy in Consumer Duty

Behavioural scientists often talk about nudges – subtle design choices that help people make better decisions. But there is a darker twin: sludge. Where a nudge supports good outcomes, sludge creates friction that slows, confuses, or traps consumers, often preventing them from acting in their own best interests. Sometimes it’s deliberate. More often, it’s accidental by product of growth driven design.

Under Consumer Duty, however, sludge is no longer a UX flaw. It is a regulatory risk. In other words, user journey is no longer a design preference; it is a regulatory obligation.

From Theory to Practice: Where Sludge Hides

Across the four Consumer Duty outcomes, sludge shows up in predictable and measurable ways. Here are some of the most common patterns observed when conducting behavioural diagnostics:

In Consumer Understanding, sludge emerges when complex layouts bury key risks “below the fold”, leading users to skim past critical information. This becomes visible when users spend only a few seconds on a lengthy Terms and Conditions page before clicking “Accept”.

In Consumer Support, sludge takes the form of exit friction, where cancelling a product requires far more effort than signing up. For example, a two step onboarding journey contrasted with a ten step cancellation process.

In Price & Value, sludge appears through fee shrouding, where total costs are only revealed at the final payment stage, often triggering sharp drop offs when users encounter unexpected charges.

In Products & Services, sludge shows up as dark nudges, such as urgency cues (“Only 2 left!”) that push consumers toward unsuitable choices, reflected in high cooling off cancellations shortly after purchase.

These patterns aren’t simply UX quirks. They are behavioural signals that parts of the journey may be misaligned with Consumer Duty expectations.

Evidence in Practice: Decoding the Metrics

Understanding where harm may emerge in a user journey often begins with simple behavioural signals. Metrics such as reading time vs. scroll depth reveal whether customers meaningfully engage with key information. Similarly, basket abandonment at payment indicates moments where unexpected fees or late‑stage cost disclosures prompt users to drop off.

Other indicators point to friction that distorts decision‑making. The parity ratio can reveal disproportionate effort that may hinder Consumer Support. And the reversal rate often signals that urgency cues or other dark patterns may have pushed users toward unsuitable products.

These metrics don’t provide the full diagnostic picture, but they offer early behavioural clues about where journeys may be creating unintended barriers or risks.

The Behavioural Toolkit: Hook-Fix-Proof

The BehaviourAI Lab offers a structured approach to help financial services firms identify and mitigate sludge before it becomes a regulatory issue. The Hook-Fix-Proof framework integrates behavioural diagnostic, behavioural design, and behavioural validation to improve user journeys.

Hook focuses on identifying the behavioural dynamics that create sludge – the friction points, hidden barriers and decision pathways that shape how users actually behave. This stage surfaces the subtle patterns that traditional UX reviews often miss.

Fix applies choice architecture principles to redesign those pathways, removing unnecessary friction and reducing sludge so that decisions become clearer, smoother, and more aligned with users’ goals. The emphasis is on enabling better choices, not nudging toward predetermined ones.

Proof brings empirical validation, using behavioural measurements to demonstrate whether the redesigned journey truly improves outcomes. This stage provides the outcome based evidence that Consumer Duty now expects – showing measurable behavioural change, not just good intentions.

Is your product journey hiding a Sludge Red Flag?

At BehaviourAI Lab, we help financial services firms diagnose, redesign, and validate their journeys using behavioural science and metrics that evidence Consumer Duty outcomes.

Don’t wait for the regulator to spot the friction. Book a Sludge Diagnostic and get ahead of the risk.

The AI Sovereignty Trap: Why UK Financial Services Are Sleepwalking Into It

By Nagu Gopalakrishnan, Co-founder, Vidai

Governance cannot live at the application layer for regulated platforms. I learnt that running regulatory engineering for the Ads Creative Infrastructure programmes at Amazon, taking us through EU Digital Markets Act and Digital Services Act compliance, MiFID II‑grade regulation for large platforms, with penalties of up to 10% of global turnover. You either build a horizontal control plane that every product team inherits, or you spend the next five years putting out fires one integration at a time.

I am watching UK financial services make the second choice with AI right now. The regulators have already told them not to. And the economics of agentic AI will punish them for it before the regulators do.

*Nagu Gopalakrishnan, Co-founder, Vidai*

The Problem Is Jurisdictional, Not Operational

Most conversations about AI vendor strategy in financial services frame the issue as cost or flexibility. Pick the right model. Negotiate the right rate. Avoid getting trapped on a single roadmap. These are real concerns, but they miss the deeper one.

Extraterritorial data laws are a fact of the cloud era. The US CLOUD Act is the most discussed example: it allows US authorities to compel any US‑headquartered provider to disclose customer data they hold anywhere in the world. Other jurisdictions have similar mechanisms. The relevant question for a UK‑regulated firm is not ‘which country?’ but ‘how many jurisdictions does my AI stack expose me to, and have I done it consciously?’.

Data residency clauses help less than they appear to. A contract with your UK‑region cloud provider has no force over the frontier model providers your applications then call into; those are separate contractual relationships, often with different jurisdictional anchors. The EU‑US Data Privacy Framework offers some cover for one specific corridor, but it has been struck down twice already and faces a credible third challenge.

For a UK firm serving Scottish or EU customers, every model API call sends data outside the protections that residency contracts negotiated — and across an agentic workflow, those calls compound into exposure most firms cannot quantify.

This is precisely the concentration risk the UK’s Critical Third Parties Regime (CTPR) was designed to confront. CTPR is, at its heart, about systemic dependencies on a small number of providers serving the financial system. A single AI provider handling AML triage, customer correspondence drafting, claims assessment or internal policy retrieval is the textbook example.

Agentic AI Makes It Worse and More Expensive

The shift to agentic AI changes this calculus by an order of magnitude. When a human asks a model a question, the data exposure is one prompt. When an agent runs a fifty‑step reasoning loop touching customer records, transaction history and internal policy documents, every step is a potential exposure path, and every step is a billable token.

Forrester predicts machine‑initiated traffic to financial institutions will surge by 40% by the end of 2026, while human visits drop by 20%. That is not a usage statistic. It is simultaneously a sovereignty exposure curve and a cost curve. Most current AI governance tooling was built for neither. Whether you are a tier‑1 bank, an insurer, an asset manager or a fintech selling into regulated buyers, the maths is the same.

The cost side of that curve is worth dwelling on. A workflow that costs pennies in pilot can cost five‑figure sums per day in production once the agents start chaining. Most finance teams in regulated firms were not staffed to forecast that, and most current AI tooling does not give them the visibility to try.

The dominant approach today is to bolt observability and policy enforcement into application‑side libraries written in Python or Node, designed for episodic human chat traffic. Under sustained machine‑to‑machine throughput, these layers do not fail loudly; they fail expensively. We benchmarked our Rust‑based control plane against a leading Python gateway on identical workloads, and we held up nearly double the throughput‑per‑core on hardware four generations older. The full methodology and source code are public at vidai.uk/blog/rust-python-vidai. The headline number matters less than what it implies: the architecture you choose for your governance layer determines whether multi‑model AI is economically viable at agentic scale, or whether it cannibalises your margins the moment traffic ramps.

The Control Plane Answer

A horizontal control plane, sitting between your applications and the models, should deliver governance across three axes — sovereignty, cost and compliance — and one engineering concession that makes adoption possible.

Sovereignty by design: Vidai runs entirely inside your VPC, deployed in minutes. No SaaS path, no phone‑home, no licence ping, no usage telemetry. We do not see your prompts, your responses or your timing. Your data, your control, your infrastructure. Egress is enforced inside the control plane: you decide what crosses to model providers and what does not, including from your own applications. That removes a class of third‑party dependency a SaaS gateway would add, and that CTPR would expect you to register

Cost governance: Real‑time, per‑team, per‑agent, per‑request, per‑workflow, per‑model spend is the floor. The ceiling is full historical lineage of how pricing changed over time. When a provider shifts rates mid‑year, your finance team can see what the same workload would have cost under the old pricing, what it costs now and what it would cost if re‑routed. Cost‑based routing then closes the loop, sending each workload to whichever provider is cheapest for that latency profile at that moment, not whichever vendor has the lowest headline rate.

Compliance governance: A single security and compliance review covers every model behind the control plane, with full request and response retention for regulatory inspection. Adding a new provider becomes a configuration change, not a six‑month procurement cycle. The ‘sign‑off tax’ that pushes regulated firms towards single‑vendor lock‑in disappears.

A drop‑in path, not a re‑platforming project: Most gateways force engineering teams into an OpenAI‑compatible shape, which means every team using Anthropic, Bedrock or Google native SDKs has to refactor before they can join the control plane or add an additional application‑side library. Vidai sits transparently in front of whatever SDK is already in production. Joining the control plane is a base URL change, not a sprint. That single design choice is often the difference between a multi‑model strategy that ships this quarter and one that lives in a slide deck for two years.

This is what we are building at Vidai, from Scotland, with a team whose backgrounds span hyperscale EU regulatory navigation and national critical infrastructure resilience. The combination is deliberate. The next decade of financial AI will be defined less by which model wins and more by who governs the substrate the models run through.

The Choice for UK Financial Leaders

The UK has a window here that will not stay open for long. CTPR is live. DORA is live. The Bank of England, FCA and PRA are all signalling that AI concentration risk is moving up the supervisory agenda. The firms that build their multi‑model strategy now, on a sovereign control plane they actually own, will be ahead of the requirement when it lands. The firms that wait will be retrofitting under regulatory pressure, on someone else’s timeline.

The goal is not to pick the winning AI model. It is to build the infrastructure that lets you use any winning model without losing control of your data, your budget or your sovereignty.

That is a decision that gets made at the architecture layer, not the application layer. And it gets made now, or it gets made for you.

Localising for North America: Lessons for Scottish Fintechs

By Atlantic Fintech

Expanding into North America is a natural next step for many ambitious Scottish fintechs. The market is large, sophisticated, and innovation-friendly – but it is not a single, unified landscape. Success depends less on scaling what already works at home, and more on adapting thoughtfully across product, language, and market expectations.

At Atlantic Fintech, we’ve worked closely with fintechs on both sides of the Atlantic. A consistent theme emerges: localisation is not a final step – it’s strategy from day one.

North America Is Not One Market

One of the most common misconceptions is treating North America as a single, homogeneous opportunity. In reality, it is a patchwork of regulatory environments, consumer behaviors, and financial systems.

Canada and the U.S. operate under different regulatory frameworks, with further variation at the provincial and state levels.
Payments infrastructure differs significantly (for example, Interac in Canada versus ACH and card-heavy systems in the U.S.).
Procurement cycles, especially in financial institutions, tend to be longer and more relationship-driven than in the UK.

For Scottish fintechs, this means market entry should start with a clear geographic focus rather than a continent-wide approach.

Product Localisation: Beyond Compliance

Adapting your product for North America goes well beyond regulatory compliance. It requires aligning with local user expectations and financial habits.

Integrate with region-specific payment rails and financial data systems.
Reflect local financial terminology and user flows (e.g., “checking account” vs. “current account”).
Ensure your product aligns with local security expectations and trust signals, which can vary by market.

An example: a fintech offering open banking-enabled services in the UK may need to rethink its data access strategy in North America, where open banking frameworks are still evolving and often rely on different providers and standards.

Language and Communication Nuances

Even in English-speaking markets, language localisation matters more than many expect. Subtle differences in tone, terminology, and messaging can affect credibility and conversion.

North American audiences tend to prefer more direct, benefits-driven messaging.
Marketing content often leans less on understatement and more on clarity and value proposition.
Bilingual requirements – particularly in Canada – add another layer. French is not optional in Québec and can strengthen brand trust nationally.

For Scottish fintechs, this is less about translation and more about transcreation: ensuring your message resonates culturally, not just linguistically.

Finding Product-Market Fit

Product-market fit in North America often requires iteration, even for well-established companies.

Customer expectations around onboarding, UX, and support can differ significantly.
Enterprise buyers may expect local presence, partnerships, or pilots before committing.
Pricing models may need adjustment to align with local purchasing norms and budgets.

Partnerships can be a powerful accelerator. Collaborating with local fintech ecosystems, financial institutions, or innovation hubs can provide faster access to networks and insights.

A Note on Atlantic Canada

While Toronto and New York often dominate conversations about North American fintech, Atlantic Canada offers a compelling – and often overlooked – entry point. Atlantic Canada can serve as an effective “soft landing” zone for international fintechs. It allows companies to test, adapt, and refine their North American strategy in a more agile and supportive setting before scaling into larger markets.

The region also shares many similarities with Scotland: a growing fintech sector made up of over 150 ambitious fintechs, strong ecosystem support from government and industry, and a collaborative, community-driven approach to innovation. Scottish companies looking for a familiar yet globally connected environment can benefit from:

Close-knit fintech and startup ecosystems that enable faster relationship-building.
Lower operational costs compared to major financial centres.
Direct access to both North American and European markets through strong trade ties and cultural alignment.

Building for Scale Through Localisation

The most successful fintechs entering North America are those that treat localisation as a growth lever, not a constraint. They invest early in understanding regional differences, build adaptable products, and engage deeply with local ecosystems.

For Scottish fintechs, there is a strong foundation to build on: a reputation for innovation, strong regulatory understanding, and a global outlook. By pairing these strengths with a deliberate localisation strategy, North America becomes not just accessible – but highly scalable.

About Atlantic Fintech

Atlantic Fintech drives fintech innovation and growth across Atlantic Canada’s four provinces: New Brunswick, Nova Scotia, Prince Edward Island, and Newfoundland and Labrador. The organization builds a global fintech community by providing startups and scaling fintech companies with strategic connections, industry expertise, and market entry resources. Atlantic Fintech focuses on fostering collaboration and positioning Atlantic Canada as a recognized fintech hub of international relevance.

Atlantic Fintech offers tailored growth programs, specialized mentorship and go-to-market support. Having developed a strong ecosystem that integrates local talent with global fintech markets, leaders praise the community’s growth opportunities, strategic introductions, and educational events that empower companies to compete worldwide and build sustainable fintech ventures.

Fintechs Legado and Amiqus Partner to Simplify Onboarding in UK Financial Services

From a coffee shop conversation to a partnership

Solving a multi-billion-pound problem

What the partnership delivers

A decade-long peer relationship

Collaboration over competition

Commodities Marketplace BLK secures listing on stock market via Euronext Access Dublin

What does BLK do?

Strong growth

Why list now?