The Regulatory Test: Follow the Dependency, Not Just the Product

BigTech financial risk crosses product boundaries when one platform connects users, payments, data, credit, distribution, technology, and partners in a way that no single product label can describe. This final chapter brings those relationships together and asks what a defensible regulatory judgment should follow from them. The answer is not to treat every BigTech firm as a bank, or to assume that every digital service is already a systemic threat. It is to identify the dependency the platform has created, measure who controls it and who bears the risk, and apply proportionate oversight wherever that dependency crosses an activity, entity, or national border.

Follow the dependency across the platform

The most useful unit of analysis is not the app screen and not the legal entity in isolation. It is the path through which value and decisions move. A nonfinancial platform attracts users or merchants. Payments make the relationship more frequent and connect the platform to the movement of money. The resulting data can support personalization, credit screening, or the distribution of other products. A loan, insurance policy, investment product, or deferred-payment arrangement creates a financial obligation or a promise of liquidity. A bank, insurer, asset manager, or technology provider may perform the regulated function behind the interface. The user may still experience the whole path as one service.

Risk crosses a product boundary when a later outcome depends on an earlier relationship. A credit decision depends on payment or commerce data. Repayment depends on access to the payment account or marketplace. An insurance offer depends on the interface and information used to reach the customer. A money-market investment can become a payment concern when users expect immediate redemption. A bank’s service continuity can depend on a BigTech cloud or data provider even when the technology service is not itself a financial product.

This is why the phrase “product-by-product regulation misses the group” should not be taken to mean that products are irrelevant. A payment license can require safeguarding, reconciliation, operational controls, fraud prevention, and business continuity. A lending rule can require appropriate underwriting, clear terms, affordability checks, and reporting. Insurance and securities rules can address governance, intermediation, suitability, disclosure, and cooperation. Those controls remain attached to the activity that creates the risk.

The problem is that an activity rule may not reveal the relationships that make the risk material. A wallet can be an interface over a regulated card rail, or it can become a major domestic route for retail payments. A bank can originate a loan, while the platform supplies the data, chooses which users see the offer, and services repayment. A financial firm can use BigTech technology as an efficient outsourcing arrangement, or it can become one of many institutions dependent on the same provider. The same legal category can sit inside very different economic structures.

The IMF identifies four ways these structures can matter beyond an individual product. One payment activity may become critical because it has few direct substitutes. Several activities may become important in combination, such as payment data supporting credit to previously underserved borrowers. Financial interconnectedness may grow through ownership or joint intermediation with incumbents. Operational interconnectedness may grow when financial institutions rely on a small number of BigTech providers for cloud, data, artificial intelligence, or other critical services.

These are mechanisms, not automatic verdicts. The IMF also says that the current financial-stability implications of BigTech remain limited in most jurisdictions, even as activity grows rapidly in emerging market and developing economies. A risk assessment should therefore distinguish present exposure from a plausible transition. The important signal may be movement from optional to necessary: a service becomes the practical route to payments, customer access, credit history, liquidity, or technology before users and authorities can replace it.

Substitutability is the connecting idea. Market share alone does not tell us whether a service is critical. A smaller provider may be difficult to replace if its data history cannot travel or if merchants cannot reach the same customers elsewhere. A large provider may create less immediate systemic concern if several alternatives can take over and its financial activities are ring-fenced from the wider group. The relevant question is how much disruption follows when users, partners, or authorities attempt to exit.

Separate value from vulnerability

BigTech’s expansion into finance has genuine reasons for adoption. A payment service can lower the friction of an everyday transaction. A mobile-money network can reach rural, unbanked, or underbanked users. A platform can use scale to distribute a product at a lower operational cost, and payment or commerce data can help a lender assess a user with little conventional credit history. A one-stop application can reduce repeated navigation and make small investments, insurance, or credit easier to reach.

The IMF’s account of M-Pesa illustrates this potential without proving a universal rule. It reports that access to financial services in Kenya rose from 14 percent to 83 percent of the population between 2006 and 2019 after the launch of M-Pesa, based on a cited case study. That association is consistent with the value of a widely distributed payment channel, but it does not establish that M-Pesa alone caused every part of the change. The distinction matters because inclusion is a real outcome to preserve, not a justification for every platform practice.

The same distribution can become a gate.