Global Banking & Finance Compliance and Regulation Guidelines
Here’s a practical, UX-centred guide to the global banking & finance regulations you should consider when designing fintech products, plus concrete UX implications and patterns you can apply immediately.
Core regulations & standards
(what they are — and why UX designers must care)
- GDPR (EU) — Data protection & privacy by design.
Designers must minimise data collection, enable clear consent, build data access/erasure flows, and document “privacy by design.” - PSD2 / Open Banking (EU) — Strong Customer Authentication (SCA) & open APIs.
Impacts payments and account-access flows: two-factor auth, explicit consent for third-party access, clear transaction confirmation and consent screens. - PCI DSS (global payment card standard) — secure handling of card data.
If you handle cardholder data, the UI and flows must avoid capturing/storing sensitive data (or use hosted fields), prompt secure entry, and show secure payment UX affordances. - FATF Recommendations / AML & KYC (global) — anti-money-laundering controls.
Requires KYC/KYB collection, identity verification, ongoing monitoring and suspicious activity reporting — which translates to onboarding UX, progressive verification, and transaction review screens. - Accessibility (WCAG 2.2 and related laws) — inclusive access.
Financial services are frequently legally required to be accessible; design must meet WCAG success criteria for readability, keyboard/navigation, colour contrast, and cognitive accessibility. - Local financial regulators & tech/security rules (examples: RBI for India, MAS for Singapore).
National/local rules drive KYC modes, digital onboarding options (Aadhaar e-KYC, V-CIP in India), tech risk and cloud rules — these directly shape onboarding choices, identity flows and how you present legal notices. - AI / model governance (EU AI Act, supervisory guidance).
If you use AI for credit scoring, fraud detection, or personalised pricing, expect requirements for explainability, fairness, documentation, risk classification and user-facing explanations. - Security & audit frameworks (ISO 27001, SOC 2, local cyber hygiene notices).
These include session handling, logging, consent audit trails, and how you present security states to users (e.g., session timeout UX, re-auth flows). (See vendor/regulator guidance for specifics.)
Concrete UX implications & recommended patterns
Below are actionable UI patterns you can implement to meet the regulations without wrecking conversion or usability.
Onboarding & KYC
- Progressive verification: request minimal info up front; defer higher-friction docs until needed (KYB/KYC tiering). (Reduces drop-off and matches AML risk-based approach.)
- Clear status & next steps: show verification status, estimated wait time, and exactly what’s missing (copy + iconography).
- Secure capture widgets: use hosted/iframe card inputs or tokenised payment components to avoid PCI scope.
Authentication & Payments
- SCA-friendly flows: design smooth 2FA UX: choice of possession (OTP), inherence (biometric), knowledge (PIN); support 3-D Secure where needed and explain why extra auth is requested.
- Fallbacks & error messaging: clear, non-technical error copy for failed auth and clear recovery paths (backup codes, call support).
- Transaction confirmation: show payer, payee, amount, fees, legal disclosures and an explicit consent button for API/third-party access.
Privacy & Consent
- Consent UI that’s usable: short, layered notices — one-line summary + “why we need this” + expandable details. Store consent audit trail.
- Data minimisation patterns: toggles for optional data; pre-checked boxes are not acceptable for consent in many jurisdictions.
AML monitoring & fraud flow
- Explainable holds & declines: when accounts or transactions are flagged, show a neutral explanation, next steps, and a channel for appeal. Do not reveal detection rules, but be transparent about remedial steps.
- Adaptive friction: increase verification for high-risk actions (higher limits, unusual destinations) rather than for every user.
Accessibility & Inclusion
- WCAG baseline: aim for WCAG 2.2 AA at minimum for critical flows (onboarding, payments, account management). Include keyboard focus order, high contrast, readable fonts, and simple language for cognitive accessibility.
AI & automated decisions
- User-facing explanations: for credit/score decisions, show actionable reasons (e.g., “Your credit offer is lower because X”), and how to dispute or improve — aligned with EU AI Act high-risk rules.
Security & Trust signals
- Design trust anchors: show last-login info, device list, and simple steps to lock the account. Use progressive disclosure for technical details (more info links for power users).
- Session & timeout UX: warn users before logout and provide secure save/restore options for in-progress forms.
Quick UX compliance checklist
(Use this during design reviews)
- Privacy & Consent: layered consent, data minimisation, audit trail of consent.
- Authentication & Payments: SCA flows, 3-D Secure support, good error/recovery UX.
- Card Data: use tokenisation/hosted fields — avoid storing PAN in UI forms.
- KYC/AML: progressive onboarding, KYB where required, clear verification status UX.
- Accessibility: WCAG 2.2 AA checks for all critical user journeys.
- AI/Model Governance: explanation copy and appeal flow for automated adverse decisions.
- Local regulator needs: check country-specific KYC, data residency & payment rules (RBI, MAS, etc.) and map them into experience variations.
How I recommend you use this in your process
(Practical next steps)
- Map requirements to journeys: create a matrix (Regulation → Journey → UX impact) for onboarding, payments, account, lending, and admin.
- Design patterns library: build reusable components (consent modal, verification status card, SCA modal, secure payment field) with compliance notes.
- Run an accessibility & privacy UX audit (WCAG + GDPR checklist) during prototype review.
- Engage Legal/Compliance early — iterate on copy and required data fields together so UX can minimise friction while remaining compliant.