Why Product-by-Product Regulation Misses the Group
A BigTech financial service can be licensed and still be difficult to supervise as an economic system. This chapter examines the gap between the activity a rule names and the wider group that controls the customer interface, combines the data, supplies the technology, or influences the partner’s incentives. The practical judgment is not that sector rules should be discarded. It is that they need to be layered with monitoring, coordination, risk-based supervision, and—when dependencies justify it—group-wide oversight.
A licensed activity can sit inside a much larger dependency
Activity-based regulation starts from a sound principle: the same activity, with the same risks, should produce the same regulatory outcomes. A payment provider should not escape basic safeguards merely because its interface looks like a shopping application. A nonbank lender should not avoid consumer-protection duties because a loan is offered at checkout. Insurance intermediation and asset management should remain subject to the standards that apply to those activities when BigTech firms enter them.
The difficulty begins when the activity is only one part of how the service works. Imagine a platform that offers a wallet, uses transaction data to identify borrowers, displays a bank’s loan, and services repayments through the same account. The wallet may be licensed as a payment activity. The bank may be licensed as a lender. The parent company may run the marketplace and control the user relationship. The data may come from a social or e-commerce business. A cloud service supplied by the wider group may support the bank’s operations. Every individual description can be accurate, yet none describes the entire dependency.
The IMF identifies four ways that this combination can become relevant to financial stability. A single activity, such as digital retail payments to consumers or small businesses, may become systemically important where it has little direct substitute. Several activities that are not systemic alone may become important in combination—for example, payments that generate the information used to lend to previously excluded borrowers. BigTech can become financially connected to incumbents through direct ownership or joint intermediation. And financial institutions can become operationally connected through cloud, data, artificial intelligence, or other technology services supplied by a small number of providers.
These routes are not interchangeable. A payment service may matter because users cannot switch quickly. A lending bundle may matter because the payment account and credit decision reinforce each other. A partnership may transmit losses or poor incentives through compensation and risk sharing. A cloud service may create a common operational dependency without appearing in any consumer’s financial contract. A useful supervisor must therefore ask not only how large an activity is, but what other activities rely on it and how quickly an alternative could take over.
This is the blind spot created by a product-only view. A product is usually the unit named in a license, disclosure, or reporting form. Dependence is a relationship among products, entities, users, and infrastructure. The first unit is easier to count. The second is closer to the way harm spreads.
The first response is to learn what the group is doing
Regulation cannot follow a dependency that authorities cannot see. The IMF’s first recommendation is therefore monitoring and horizon scanning: market studies, research, stakeholder discussions, quantitative data, qualitative evidence, and direct demonstrations of new products. The goal is not surveillance for its own sake. It is to identify which BigTech firms provide financial services, how those services are connected to nonfinancial activities, and where a new business model may fall outside an existing supervisory assumption.
This matters because the group may not present itself to a single authority. A payment supervisor may see the wallet. A banking supervisor may see a partner loan. An insurance supervisor may see an intermediary. A competition authority may see a platform with a powerful distribution position. A data-protection authority may see cross-business information sharing. No one view is necessarily wrong. Each is incomplete if the authorities do not exchange enough information to connect the views.