This country-specific Q&A provides an overview of the legal framework and key issues surrounding fintech law in Iceland.
This Q&A is part of the global guide to Fintech.
For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech-2nd-edition
What are the sources of payments law in your jurisdiction?
The key legislation, in this regard, includes the Act on Financial Undertakings no. 161/2002, the Securities Act no. 108/2007 and the Payment Services Act no. 120/2011, all as later amended. The Payment Services Act awaits the implementation of Directive (EU) 2015/2366, PSD II. Further, companies wishing to provide financial services are subject to the supervision of the Financial Supervisory Authority (FSA) and generally must obtain operating licenses/authorizations from the FSA to provide their services.
Iceland implements most of its financial regulatory framework from the EU, through its participation of the European Economic Area (EEA). With regards to PSD II, the EEA Joint Committee adopted the directive within the EEA area on 14 June 2019. A legislative bill is expected to be introduced before the Icelandic Parliament in the fall of 2019. It is also worth mentioning that on 8 March 2018, the European Commission adopted a specific action plan in the field of fintech which might cause amendments that might take effect in Iceland, due to its membership of the EEA.
Can payment services be provided by non-banks, and if so on what conditions?
Payment services can be provided by non-banks pursuant to the Payment Services Act. To be granted an operating licence as a payment service provider there are various conditions which need to be satisfied, such a minimum capital, capital adequacy requirements and organisational requirements which include requirements on the knowledge and expertise of directors and officers.
What are the most popular payment methods and payment instruments in your jurisdiction?
Iceland has generally been quick to adopt new methods in payments with card-based payments being the predominant payment method in consumer transactions. More recently mobile apps have become a commonly used payment method in Iceland. To use these apps, the user must link his card details (debit or credit card) to the app, creating a user profile. Once there, the user can pay, charge or split amounts, by using only cell phone numbers. These amounts are often trivial transactions such as when buying lunch, reimbursing gas money, splitting restaurant checks, etc. Furthermore, well known mobile solutions such as Apple Pay have recently been introduced in Iceland.
In larger transactions bank transfers are the predominant method of payment, a large majority of which is directly initiated by the end user through online banking portals.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Currently open banking is not mandated by law which however will change once PSD II will be implemented into Icelandic law.
Efforts have however been made by government bodies to open up competition in the financial sector as evidenced by a decision of the Icelandic Competition Authority, wherein it concluded that information about the banks’ commissions, rates, terms and conditions should be publicly issued on the banks’ websites through an open API interface, of which third parties may benefit.
Very recently, an incumbent financial institution launched A2A payment solution available to fintechs which do not require the use of any other solution offered by that financial institution, marking a step towards open banking.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
Iceland being a party of the EEA, the General Data Protection Regulation (GDPR) was implemented into Icelandic legislation with the Act on Data Protection and Processing of Data (Act on Data Protection) in July 2018. Thus, providers of financial services to consumers and businesses are subject to extensive obligations to ensure adequate data protection in all processing activities pursuant to GDPR. The regulation of data impacts the financial service providers by obliging them to adapt certain measures such as (i) ensuring that processing activities are only conducted on a lawful basis and that general principles of data protection are adhered to particularly in relation to obtaining the consent of a data subject for transferring data to third parties, (ii) creating mechanisms and providing information to data subjects that enable them to utilize their rights pursuant to the GDPR, (iii) ensuring data protection via organisational and technical measures, (iv) ensuring that all processors used are GDPR compliant and (v) ensuring that processes and procedures concerning breach notifications are in place.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
The financial regulators and policy makers in Iceland are generally receptive to fintech innovation and the expected changes to the financial services market. In December 2018, the White Paper on the Future of Iceland´s Financial System was published. It stressed, among other things, the importance of the role of fintech in the future of Iceland´s banking system and its possible effects.
The most noteworthy initiatives have been set forth by the FSA, who set up a specific Fintech Help Desk. The Fintech Help Desk assists those who provide, or aim to provide, new financial services classified as fintech. The Fintech Help Desk operates as an internal fintech task force, within the FSA, assisting individuals and companies with regulatory issues or business-specific questions. It is intended to support and promote communication with fintech parties and analyze whether the financial services in question are in accordance with the applicable law and regulations, as well as whether any licenses and/or authorizations are required. The procedure operates in a way that a fintech party sends the “FSA Fintech Questionnaire” to the Fintech Help Desk and then receives a response from the FSA within 10 business days. Subsequently, the relevant fintech party may receive counselling from the Fintech Help Desk by phone (maximum 30 minutes) or request a meeting in person with the Fintech task force (maximum one hour).
Despite the FSA being the main governmental driving force within the fintech industry in Iceland, other pertinent governmental institutions may influence the market, for example, the Consumer Agency, the Icelandic Competition Authority and the Icelandic Data Protection Authority.
As concerns regulatory sandboxes, they have not been implemented in Iceland. However, the White Paper on the Future of Iceland´s Financial System does suggest it as one measure to deal with the rapid fintech innovation. To do so, changes to the regulatory framework would be required to authorize the FSA to grant exemptions in those cases.
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
Currently there are no foreseeable risks to the growth of fintech as innovations have been largely well accepted by both consumers and existing financial institutions. The implementation of PSD II into Icelandic law is only likely to enhance the already favourable conditions.
What tax incentives exist in your jurisdiction to encourage fintech investment?
Currently there are no specific tax incentives to encourage fintech investment. There are however tax incentives available to fintech companies, which entail a specific tax deduction in relation to incurred research and development costs.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Fintech is attracting investment on basically all levels, including angels. However, competition for investors has grown due to the increasing popularity of fintech and limited investments. Fintech companies have recently received extensive funding, e.g. the blockchain identity verification start up Authenteq which raised USD 5 million in a Series A funding which was led by Draper Associates and Capital300, and the crypto fintech start-up Monerium with a USD 2 million round, both in January 2019.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
As previously mentioned, Iceland generally has a high adoption rate for innovative trends which means that it can serve well as a test market for new products. Despite the local market being quite small it is often praised for its diversity in terms of being a good test market.
From a regulatory standpoint an operating licence granted in Iceland as a payment service provider is passportable throughout the EEA and the FSA has generally been openminded with regards to fintech start-ups as evidenced by their Fintech Help Desk.
Finally, the general regulatory environment in Iceland enables a time- and cost efficient setting up of companies and somewhat favourable corporate tax rates (20%).
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
In general, with Iceland being a party of the EEA, citizens of the EEA are authorized to be employed in Iceland without a specific work permit or a visa. These employees would, however, need residence permits from the Icelandic Directorate of Immigration within the first three months of the working period. Citizens from outside the EEA are required to have both work and residence permits.
Non-EEA/EFTA residents can be issued a temporary work permit for a job that requires expert knowledge. There are quite stringent conditions for issuing such a permit, which include that the attempts have been made to find an employee in Iceland and within the EEA/EFTA which has the required expert knowledge.
Furthermore, it is worth mentioning that the Posted Workers Act applies to companies established in another EEA Member State, another EFTA State or the Faroe Islands, which intend to post workers to Iceland, providing services on a temporary basis. During the time these workers are working in Iceland, Icelandic law applies to their terms of service, including collective bargaining agreements containing minimum wages and other employment-related rights.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
There are no specific efforts being made to accommodate immigration policy to any developments in fintech or any shortages in talent in that area. To our knowledge there has not been any attempts by the fintech industry to influence immigration policy in Iceland.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
Fintech intellectual property is subject to the same protection as generally applies to intellectual property in Iceland, i.e. through copyrights, patents and registration of trademarks. Iceland is a party to international conventions on the protection of intellectual property.
Infringements of intellectual property rights can be enforced through injunctive relief as well as compensatory damages can be sought through Icelandic courts for the infringement of intellectual property rights.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Cryptocurrency and cryptoassets are not heavily regulated in Iceland. However, on 29 June 2018, a bill was passed amending the Money Laundering Act with respect to the European Union´s 4th Anti-Money Laundering Directive no. 2015/849 approving a registration requirement for parties operating with cryptocurrencies or cryptoassets. The amendment obliges service provides who already offer transactions with virtual money, electronic money and currencies, as well as service providers of digital wallets, to register with the FSA no later than one month after the Act´s entry into force i.e. before the end of July 2018. The FSA then submits its stance on the relevant registration within 30 days from the receival of the application.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Currently there is no guidance from the FSA on how it would treat ICO’s in Iceland. However, the FSA would likely have regard for ESMA’s statement on the application of the Prospectus Directive, the amended Markets in Financial Industry Directive (MiFID 2) or the Alternative Investment Fund Managers Directive (AIFMD) if tokens are structured and tradeable in a way, that resembles common financial instruments.
Should the FSA determine that a token issued in an ICO is a financial instrument, an ICO cannot occur without the issuance of a prospectus which has been approved by the FSA. The volatility associated with cryptocurrencies may have an impact on the FSA’s determination as one of its roles is to safeguard the interest of unsophisticated investors.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
The most well-known live blockchain project is an identity verification and KYC solution offered by Authenteq which is a blockchain based AI-driven automatic identity verification process. Another project worth mentioning is Monerium which recently received a license from the FSA to issue e-money on blockchains. The full license is the world’s first e-money license for blockchains issued under EU e-money regulations.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
To our knowledge AI is not used in any significant manner in the financial sector. However, AI based solutions have been, and are being, developed in Iceland such as Authenteq and Lucinity. Both are aimed at anti-money laundering, Authenteq in the KYC process and Lucinity to detect suspicious behavior patterns.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Insurtech is not as widespread as fintech innovations in Iceland. However, there have been efforts made by local insurance companies toward far greater automation and self-service through either online portals or mobile apps in which certain insurance policies can be acquired and certain insurance claim process in relation to can be fully completed, i.e. from making the claim to pay-out to the insured party. This trend is likely to continue as the insurance companies are under certain pressure to reduce operating costs.
Are there any areas of fintech that are particularly strong in your jurisdiction?
As Iceland has a very strong payment system in place the strongest area of fintech is through payment services. Fintech companies have many started as payment facilitators and expanded their business to consumer lending operated through the same platform.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
Incumbent financial institutions have been quite supportive of fintechs, through various means and have collaborated/invested in fintechs in an effort to maintain their position in a changing financial world. As a result, the main effect has been more on the collaborative side than disruption.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
All of the banks have an online presence and online banking apps. The apps are all being widely used by Icelanders. A very high percentage of online banking users also use specific electronic certificates to log in to their online banks. The banks have also offered instant loans with the borrowing process conducted solely by electronic means and interest rates based on the borrower’s credit score.
In addition, and as discussed above, the incumbent financial institutions have been working towards open banking initiatives as a means to encourage and facilitate fintech development in Iceland.
Arion Bank has also been hosting Fintech hackathons in cooperation with the payment solutions company Valitor, the information technology company Advania, the IT service centre for Icelandic financial markets RB as well as Meniga, covered below. Íslandsbanki has also been influencing the fintech market with the mobile app, Kass and recently announced a partnership with the global fintech hub LATTICE80.
Are there any strong examples of disruption through fintech in your jurisdiction?
As mentioned above, no great disruption has occurred through fintech. That may be the result of the generally high adaptability of the incumbent financial institutions.