SECTION 1: LEARNING OBJECTIVES

By the end of this lesson, you will be able to:

  • Understand the regulatory landscape affecting digital banking.

  • Identify key regulations – GDPR, PSD2, AML/KYC, Basel III, and others.

  • Understand the impact of regulations on digital banking operations.

  • Apply a regulatory compliance framework for digital banking.

  • Understand the role of RegTech in compliance management.

  • Measure regulatory compliance using key metrics.

  • Develop a compliance strategy for a digital bank.


SECTION 2: THE REGULATORY LANDSCAPE

2.1 Key Regulations Affecting Digital Banking
 
 
Regulation Region Focus Impact on Digital Banking
GDPR EU Data protection and privacy. Customer data handling, consent, breach notification.
PSD2 EU Payment services and open banking. Strong Customer Authentication, API access.
AML/KYC Global Anti-money laundering and customer identification. Customer verification, transaction monitoring.
Basel III Global Bank capital and liquidity. Capital adequacy, risk management.
IFRS 9 / CECL Global/US Expected credit loss. Loan loss provisioning.
ECOA / Fair Lending US Non-discrimination in lending. Fair lending practices, disparate impact testing.
CCPA US Consumer privacy. Data protection, consumer rights.
FATF Global Anti-money laundering standards. AML/CFT compliance.
MiCA EU Crypto-asset regulation. Digital asset compliance.
EU AI Act EU AI regulation. AI model compliance, transparency.
2.2 The Regulatory Compliance Framework
text
┌─────────────────────────────────────────────────────────────────────────────┐
│                    REGULATORY COMPLIANCE FRAMEWORK                        │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    REGULATORY IDENTIFICATION                        │   │
│  │  Identify applicable regulations, monitor changes                  │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    RISK ASSESSMENT                                  │   │
│  │  Assess compliance risks, impact assessment                        │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    CONTROLS IMPLEMENTATION                          │   │
│  │  Implement compliance controls, policies, procedures               │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    MONITORING & TESTING                             │   │
│  │  Monitor compliance, test controls, conduct audits                 │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    REPORTING & REMEDIATION                         │   │
│  │  Report to regulators, remediate issues                            │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘

SECTION 3: KEY REGULATIONS IN DEPTH

3.1 GDPR (General Data Protection Regulation)
 
 
Aspect Requirement Banking Impact
Data Protection Protect personal data. Encryption, access controls.
Consent Obtain explicit consent. Consent management.
Right to Access Customers can access their data. Data subject access requests.
Right to Erasure Customers can request deletion. Data deletion processes.
Breach Notification Notify within 72 hours. Incident response.
Data Transfers Restrict cross-border transfers. Data location controls.
3.2 PSD2 (Payment Services Directive 2)
 
 
Aspect Requirement Banking Impact
Strong Customer Authentication Multi-factor authentication. MFA for payments.
Open Banking APIs Provide API access. API development and security.
Payment Initiation Third-party payment initiation. TPP access and security.
Account Information Third-party access to account data. Data sharing controls.
Consumer Protection Protect consumer rights. Dispute resolution.
3.3 AML/KYC Requirements
 
 
Aspect Requirement Banking Impact
Customer Identification Verify customer identity. KYC processes, eKYC.
Customer Due Diligence Assess customer risk. Risk scoring, PEP screening.
Transaction Monitoring Monitor transactions. Real-time monitoring, suspicious activity alerts.
Record Keeping Maintain records. Document storage, audit trails.
Reporting File suspicious activity reports. SAR filing.

SECTION 4: REGTECH IN BANKING

4.1 What is RegTech?

Regulatory Technology (RegTech) is the use of technology to facilitate the delivery of regulatory requirements more efficiently and effectively than existing capabilities.

4.2 RegTech Applications
 
 
Application Description Benefit
KYC Automation Automated identity verification. Faster onboarding, reduced costs.
Transaction Monitoring Real-time suspicious activity detection. Improved AML compliance.
Regulatory Reporting Automated report generation. Faster, more accurate reporting.
Risk Assessment Automated risk scoring. Better risk management.
Compliance Monitoring Continuous compliance monitoring. Reduced compliance risk.
Data Protection Automated data protection. GDPR/CCPA compliance.
4.3 RegTech Benefits
 
 
Benefit Description
Efficiency Reduce manual effort and costs.
Accuracy Reduce errors in reporting.
Speed Faster compliance processes.
Scalability Handle growing regulatory requirements.
Real-Time Real-time compliance monitoring.
Risk Reduction Reduce compliance risk.

SECTION 5: IMPLEMENTATION IN PYTHON – REGULATORY TOOLS

python
# ===================================================================
# MODULE 6, LESSON 1: THE REGULATORY LANDSCAPE
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("THE REGULATORY LANDSCAPE IN DIGITAL BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: REGULATORY INVENTORY
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Regulatory Inventory")
print("-"*60)

# Define regulatory inventory
regulations = pd.DataFrame({
    'Regulation': ['GDPR', 'PSD2', 'AML/KYC', 'Basel III', 'IFRS 9', 'ECOA', 'CCPA', 'FATF', 'MiCA', 'EU AI Act'],
    'Region': ['EU', 'EU', 'Global', 'Global', 'Global/US', 'US', 'US', 'Global', 'EU', 'EU'],
    'Status': ['Active', 'Active', 'Active', 'Active', 'Active', 'Active', 'Active', 'Active', 'Active', 'Pending'],
    'Compliance Deadline': ['2018-05-25', '2019-09-14', 'Ongoing', 'Ongoing', '2018-01-01', 'Ongoing', '2020-01-01', 'Ongoing', '2024-12-30', '2026-01-01'],
    'Compliance Status': ['✅', '✅', '🟡', '🟡', '✅', '🟡', '✅', '🟡', '🟡', '🟡'],
    'Impact': ['High', 'High', 'High', 'High', 'High', 'Medium', 'High', 'High', 'Medium', 'High']
})

print("Regulatory Inventory:")
print(regulations.to_string(index=False))

# ----------------------------------------------------------------
# PART B: REGULATORY MATURITY ASSESSMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Regulatory Maturity Assessment")
print("-"*60)

maturity_dimensions = {
    'Regulatory Identification': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Risk Assessment': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Controls Implementation': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'Monitoring & Testing': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'},
    'Reporting & Remediation': {'Current Score': 3, 'Target Score': 4, 'Priority': 'Medium'},
    'RegTech Adoption': {'Current Score': 2, 'Target Score': 4, 'Priority': 'High'},
    'Data Privacy': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'},
    'AML Compliance': {'Current Score': 3, 'Target Score': 5, 'Priority': 'High'}
}

maturity_df = pd.DataFrame(maturity_dimensions).T
print("Regulatory Maturity Assessment:")
print(maturity_df)

# Visualise
fig, ax = plt.subplots(figsize=(10, 6))
dimensions = list(maturity_df.index)
current = maturity_df['Current Score'].tolist()
target = maturity_df['Target Score'].tolist()

x = np.arange(len(dimensions))
width = 0.35

ax.barh(x - width/2, current, width, label='Current', color='blue', alpha=0.7)
ax.barh(x + width/2, target, width, label='Target', color='green', alpha=0.7)

ax.set_yticks(x)
ax.set_yticklabels(dimensions)
ax.set_xlabel('Maturity Score (1-5)')
ax.set_title('Regulatory Maturity Assessment')
ax.legend()
ax.grid(True, alpha=0.3, axis='x')

plt.tight_layout()
plt.savefig('regulatory_maturity.png', dpi=300, bbox_inches='tight')
plt.show()
print("Regulatory maturity visualisation saved as 'regulatory_maturity.png'")

# ----------------------------------------------------------------
# PART C: REGULATORY RISK ASSESSMENT
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Regulatory Risk Assessment")
print("-"*60)

# Define regulatory risks
regulatory_risks = pd.DataFrame({
    'Risk': [
        'Non-Compliance Penalties',
        'Data Breach Fines',
        'Reputational Damage',
        'Operational Disruption',
        'Customer Complaints',
        'Regulatory Scrutiny',
        'Third-Party Risk',
        'Technology Risk'
    ],
    'Likelihood (1-5)': [3, 3, 4, 3, 4, 4, 3, 3],
    'Impact (1-5)': [5, 5, 5, 4, 3, 5, 4, 4],
    'Risk Score': [15, 15, 20, 12, 12, 20, 12, 12],
    'Mitigation': [
        'Compliance program, monitoring',
        'Data protection controls, encryption',
        'Transparency, communication',
        'BCP, DR planning',
        'Customer service, complaint handling',
        'Regulatory engagement, compliance',
        'Third-party management',
        'Technology governance, controls'
    ]
})

print("Regulatory Risk Assessment:")
print(regulatory_risks.to_string(index=False))

# ----------------------------------------------------------------
# PART D: REGULATORY REPORTING REQUIREMENTS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Regulatory Reporting Requirements")
print("-"*60)

reporting_requirements = pd.DataFrame({
    'Report': [
        'AML/SAR Reports',
        'Basel III Reports',
        'IFRS 9 Reports',
        'GDPR Breach Reports',
        'PSD2 Compliance Reports',
        'Fair Lending Reports'
    ],
    'Frequency': ['Monthly', 'Quarterly', 'Quarterly', '72 hours', 'Annual', 'Annual'],
    'Owner': ['Compliance', 'Risk', 'Finance', 'Privacy', 'Compliance', 'Compliance'],
    'Status': ['Automated', 'Partial', 'Partial', 'Manual', 'Manual', 'Manual'],
    'Priority': ['High', 'High', 'High', 'High', 'Medium', 'Medium']
})

print("Regulatory Reporting Requirements:")
print(reporting_requirements.to_string(index=False))

# ----------------------------------------------------------------
# PART E: REGTECH USE CASES
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: RegTech Use Cases")
print("-"*60)

regtech_use_cases = pd.DataFrame({
    'Use Case': [
        'KYC Automation',
        'AML Transaction Monitoring',
        'Regulatory Reporting',
        'Compliance Monitoring',
        'Data Privacy Management',
        'Risk Assessment',
        'Fraud Detection',
        'Sanctions Screening'
    ],
    'Technology': [
        'AI/ML, Biometrics',
        'AI/ML, Rule Engines',
        'Automation, AI',
        'AI, RPA',
        'DLP, Encryption',
        'AI/ML',
        'AI/ML',
        'AI/ML'
    ],
    'Benefit': [
        'Faster onboarding',
        'Real-time monitoring',
        'Reduced errors',
        'Continuous compliance',
        'Data protection',
        'Better risk management',
        'Reduced fraud',
        'Compliance'
    ],
    'Status': ['✅', '✅', '🟡', '🟡', '✅', '🟡', '✅', '🟡']
})

print("RegTech Use Cases:")
print(regtech_use_cases.to_string(index=False))

# ----------------------------------------------------------------
# PART F: REGULATORY COMPLIANCE METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Regulatory Compliance Metrics")
print("-"*60)

compliance_metrics = pd.DataFrame({
    'Metric': [
        'Compliance Rate',
        'Regulatory Incident Rate',
        'Audit Findings',
        'KYC Completion Rate',
        'AML Alert Closure Rate',
        'Data Breach Incidents',
        'Regulatory Reporting Accuracy',
        'Customer Complaint Rate'
    ],
    'Current Value': [
        '82%',
        '4/month',
        '12/year',
        '78%',
        '65%',
        '2/month',
        '88%',
        '3.5%'
    ],
    'Target Value': [
        '> 95%',
        '0/month',
        '< 5/year',
        '> 95%',
        '> 90%',
        '0/month',
        '> 98%',
        '< 1%'
    ],
    'Status': ['🟡', '🟡', '🟡', '🔴', '🔴', '🟡', '🟡', '🔴']
})

print("Regulatory Compliance Metrics:")
print(compliance_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART G: REGULATORY ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART G: Regulatory Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Establish regulatory compliance foundation.",
        "Activities": [
            "Complete regulatory inventory and gap assessment.",
            "Implement compliance policies and procedures.",
            "Establish compliance monitoring and reporting.",
            "Implement KYC/AML automation."
        ],
        "Success Metrics": ["Compliance rate > 85%", "KYC completion > 85%"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale compliance capabilities.",
        "Activities": [
            "Implement RegTech solutions.",
            "Automate regulatory reporting.",
            "Implement continuous monitoring.",
            "Enhance data protection controls."
        ],
        "Success Metrics": ["Compliance rate > 90%", "RegTech adoption > 70%"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced compliance capabilities.",
        "Activities": [
            "Implement AI-powered compliance monitoring.",
            "Deploy predictive compliance analytics.",
            "Build compliance dashboards.",
            "Establish compliance culture."
        ],
        "Success Metrics": ["Compliance rate > 95%", "Regulatory incidents = 0"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading compliance.",
        "Activities": [
            "Implement autonomous compliance.",
            "Build predictive regulatory intelligence.",
            "Achieve industry leadership.",
            "Establish compliance as a competitive advantage."
        ],
        "Success Metrics": ["Industry-leading compliance", "Continuous improvement"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART H: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART H: Summary and Recommendations")
print("="*70)

print("""
Regulatory Landscape – Key Takeaways:

1. Key regulations: GDPR, PSD2, AML/KYC, Basel III, IFRS 9, ECOA, CCPA, FATF, MiCA, EU AI Act.
2. Compliance framework: identification → risk assessment → controls → monitoring → reporting.
3. RegTech automates and enhances compliance processes.
4. Key metrics: compliance rate, regulatory incidents, audit findings, KYC completion.
5. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Complete a regulatory inventory and gap assessment.
  - Implement compliance policies and controls.
  - Adopt RegTech for automation.
  - Monitor and report compliance metrics.
  - Engage with regulators proactively.
  - Build a compliance culture.
""")

print("="*70)
print("END OF LESSON 1 – MODULE 6")
print("="*70)

SECTION 6: SUMMARY FOR THE DATA PRACTITIONER

  • Key regulations affecting digital banking include GDPR, PSD2, AML/KYC, Basel III, IFRS 9, ECOA, CCPA, FATF, MiCA, and the EU AI Act.

  • Compliance framework includes regulatory identification, risk assessment, controls implementation, monitoring and testing, and reporting and remediation.

  • RegTech automates and enhances compliance processes, improving efficiency, accuracy, and speed.

  • Key metrics include compliance rate, regulatory incidents, audit findings, KYC completion rate, AML alert closure rate, and data breach incidents.

  • Roadmap progresses from foundation to scaling, advanced, and leadership phases.


SECTION 7: RECOMMENDED NEXT STEPS

  1. Complete a regulatory inventory and gap assessment.

  2. Implement compliance policies and controls.

  3. Adopt RegTech for automation.

  4. Monitor and report compliance metrics.

  5. Engage with regulators proactively.

  6. Build a compliance culture.

  7. Prepare for Lesson 2: AML and KYC Automation.


[END OF LESSON 1 – MODULE 6]