This country-specific Q&A provides an overview to Fintech law in Finland.
It will cover open banking, regulation of data, cryptocurrencies, blockchain, AI and insurtech.
This Q&A is part of the global guide to Fintech. For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech/
What are the sources of payments law in your jurisdiction?
The provision of payment services is mainly regulated by two Finnish acts, the Payment Institutions Act (297/2010, as amended) and the Payment Services Act (290/2010, as amended), which implemented the EU's Payment Services Directives 1 and 2 ("PSD1" and "PSD2") in Finland.
Finnish legislation related to payments is generally based on EU law. For example, also the Act on Detecting and Preventing Money Laundering and Terrorist Financing (444/2017, as amended) is based on the EU directives regulating anti-money laundering obligations.
The Consumer Protection Act (38/1978, as amended) is relevant in terms of offering of consumer credits and other relevant products and services to consumers in Finland.
Can payment services be provided by non-banks, and if so on what conditions?
Finnish law does not require that the provider of payment services is a bank, but provision of payment services requires a prior authorisation or registration with the Finnish Financial Supervisory Authority ("FIN-FSA").
Generally, payment services may be provided under a notification (i.e. without authorisation) to the FIN-FSA, if the total value of the transactions completed by a legal person does not exceed 3 million euros per month.
While there are certain exceptions to the authorisation and notification requirements, payment services can be provided only if the service provider meets the requirements laid down in the Payment Institutions Act.
As a recent development, new payment service providers such as payment initiation service providers ("PISPs") and account information service providers ("AISPs") may also provide services in Finland under the supervision of the FIN-FSA.
What are the most popular payment methods and payment instruments in your jurisdiction?
By far the most popular payment methods in Finland are card payments and bank-transfers. While card payments dominate the payment scheme, and it is the most popular payment method if measured with the quantity of individual transactions, bank-transfers hold the first place if measured based on the value of the transactions.
Contactless payments are also increasingly popular, as the amount of contactless payments doubled in 2017 compared to the previous year.
What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?
Finland was among the first Member States to implement PSD2. The Payment Services Act, implementing PSD2, requires banks to provide access to their customers’ bank accounts to authorised third party service providers, subject to the customers' consent.
This requirement is fostering open banking and overall boosting a more open financial sector in Finland. Many fintechs are currently putting up new services utilizing PSD2, but also larger banks have taken steps towards open banking.
However, customers will have to wait for the new services in a larger scale, as PISPs will first need to receive authorisation and AISPs register with the FIN-FSA. Also existing payment service providers have to demonstrate to the FIN-FSA that they comply with PSD2 requirements before offering new services.
Most importantly, there is a delay in offering new services, because the security-related provisions of PSD2, as specified in the Technical Standards on Strong Customer Authentication and Common and Secure Communication (SCA-RTS), are not yet applicable and will take effect only after a transitional period in September 2019.
During the transitional period banks are not yet required to provide dedicated interfaces to allow third party service providers to access customer accounts, but interim solutions for the account access are currently being developed and assessed in Finland. In addition, the FIN-FSA has encouraged all parties to comply with the SCA-RTS as soon as possible, i.e. already during the transitional period.
How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?
The EU General Data Protection Regulation (2016/679), known as the GDPR, became applicable on 25 May 2018. The GDPR aims to harmonise the European data protection legislation, and the Finnish legislators respect that aim. As financial information can be linked easily with an individual of whom the information is generated from, personal data processing plays a big role in fintech services.
Most importantly, personal data may be processed only for a specified and lawful purpose. In accordance with the "privacy by design" principle, all processing activities should be planned in advance. This is relevant not only from a compliance perspective, but from a business side, too. When personal data is collected for certain purpose, the controller (i.e. the service provider) is bound by that purpose. New, other, business opportunities that are later discovered may prove to be impossible from a legislative perspective, if they were not taken into account when planning the processes.
Some areas of processing of personal data, such as processing of employee personal data and processing of communications data, is regulated on a national level and subject to stricter requirements than those in many other countries, even in other EU Member States. In addition, the bank secrecy rules, as applicable, restrict the disclosure of financial information of private persons.
Personal data processing legislation is often seen as the biggest restriction for data driven innovations, but, although it does bring about some restrictions, it also creates new business opportunities and enables the use of personally identifiable data, provided that the service provider knows the relevant rules and complies with them.
What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?
Finnish regulators and authorities are generally supportive for innovation in the financial sector.
Over the years, Finnish society has been an eager adopter of internet and mobile technologies and adopted e.g. online banking and electronic invoicing very early.
Although Finland does not have any regulatory sandboxes, there have been discussions of whether such should be put up. At the time of writing, no officinal proposals have been published. However, to help fintechs and boost innovations, the FIN-FSA has set up an Innovation Help Desk, which welcomes start up companies as well as already established enterprises in the financial sector that are planning a new type of product, service or way of operating.
The Ministry of Finance has a group of experts monitoring developments in financial technologies with the aim to improve the competitiveness of the Finnish financial markets with due regard to their stability. In addition, there are many fintech related organizations and activities. For example, the Finnish Institute of Financial Technology Helsinki (The 5th) has been established to coordinate fintech related research and boost the Finnish fintech ecosystem, whereas Fintech Finland is a non profit organization created to help fintech companies grow also internationally. Helsinki Fintech Farm should be mentioned as an active fintech platform, too.
There are also some recent sector specific regulations affecting fintechs, such as the Crowdfunding Act (734/2016, as amended).
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
Both the Finnish regulators and authorities have been aiming to foster innovations and development of fintech in Finland, and we do not foresee any imminent risks to the growth of either one.
However, the rules in place are not always clear to fintechs as they come partly from the EU level and partly from national legislation. It might sometimes also take time for fintechs to receive necessary authorisations.
What tax incentives exist in your jurisdiction to encourage fintech investment?
Finland does not have any tax incentives aimed specifically for fintech investments. The general corporate tax rate is relatively low, currently 20%, which can be considered a general incentive to establish a business in Finland. Further, Finland has a broad tax treaty network. The tax treaties are aimed to eliminate double taxation and to provide reduced withholding rates for qualifying cross-border transactions.
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?
Especially corporate solutions and infrastructure have attracted investment. For example, a Finnish fintech Zervant, providing online invoicing software for small business and entrepreneurs across Europe, had a successful financing round in 2018.
Crowdfunding is another field which has attracted interest and investment. Many of the crowdfunding platforms are already well established, such as Mesenaatti and Invesdor that was chosen as the winner of the finance technology category in the Finnish finals of the Nordic Startup Awards in 2018. Fellow Finance has grown to be an international crowdfunding company listed on the Nasdaq First North Finland marketplace.
Fintech is attracting investment also on other fields, in particular in payments, and also in the form of fintech acquisitions. For example, a Finnish payment service provider Maksuturva was acquired by the Swedish Svea Ekonomi in 2018.
In general, there is a large and growing interest towards new kinds of payment and financial services, and many of these kinds of businesses are past the experimental phase. The investments we have already seen have mostly been seed-stage, but fintechs are growing fast, and attract more investment.
If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?
Finland has a good track record in boosting the development of fintech and welcoming startups.
According to the Digital Economy and Society Index 2017 (DESI), published by the European Commission, Finland has the second most advanced digital economy in the EU. Finland scored highly in particular for its human capital and digital skills, integration of digital technology and digital public services.
From a legal perspective, founding a company is not subject to hard bureaucracy and also e.g. a foreign payment institution authorised in the EEA may provide services in Finland by setting up a branch or providing services across the border.
The national implementation of PSD2 respects the harmonisation and Finnish payment service legislation does not set material additional requirements or restrictions for payment service providers. Same applies to the legislation on processing of customer (i.e. the payee or end user) personal data. Processing of HR data is, however, strictly regulated.
Finland is a good choice especially for fintech entrepreneurs, as the Startup Permit described below makes it easy for entrepreneurs to come to Finland to establish a fintech startup.
Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?
As free movement of workers is a fundamental principle in the EU, EU citizens are free to work in Finland for a period of three months after registering the right of residence at the immigration authorities in Finland. For employees coming from outside the EU and EEA, working in Finland requires a residence permit.
There are no quota systems or immigration gaps in place which would help or hinder the access to talents. However, in spring 2018, a so-called Startup Permit was introduced for startup founders coming outside the EU and willing to build a startup company in Finland. The applicant of the Startup Permit must fulfil the requirements for residence permit (e.g. employment, salary) and the application must be backed by Business Finland, which is a Finnish innovation funding, trade, investment, and travel promotion organization fully owned by the Finnish Government.
In addition, some specialists may perform specialist work in Finland without residence permit, provided that they meet the salary thresholds.
Non-EU/EEA managers, specialists and trainee employees granted with an intra-corporate transferee permit in another EU member state may also to come to Finland to work in a unit belonging to the same company or group for which a person has been working for in another EU member state without applying a separate residence permit for Finland.
All employees working in Finland are protected by Finnish labour laws and applicable collective agreements (if any), which typically set out minimum terms of employment e.g. on working hours and salaries. The purpose of this is to ensure that Finnish and foreign employees are treated equally.
If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?
As described above, Finland has recently taken steps towards improving access to talents by amending immigration laws. There are no major gaps in access to talent, and, therefore, there are no legislative proposals currently being discussed which would aim to improve access to talent. As the Startup Permit was introduced only recently, Finnish legislators and authorities will most likely want to see the results before initiating any new projects.
The fintech industry may influence the immigration policy in particular through labour market organisations, which have overall a big impact on the policies Finland.
What protections can a fintech use in your jurisdiction to protect its intellectual property?
As with other type of companies, fintechs are likely to have several types of intellectual property which they should aim to define and protect, especially when they are working with several third parties in creating such IP.
Copyright is an important IP asset for fintech companies, as fintech businesses rely significantly on software. Software code is automatically protected by copyright, as well as e.g. related possible visual interface features. In Finland, if a computer program and a work directly associated with it has been created in the scope of duties in an employment relation, the copyright in the computer program and the work shall pass to the employer.
As trust is an important asset of companies dealing with financial assets and confidential information, brands and trademarks are of great importance for fintechs in differentiating their services from those of others. Trademark registrations are a cost efficient way to protect brands against dilution and copying by third parties. As an EU country, Finland is covered by the EU trademark registrations (EUTM). Design registrations can also be used to protect different features used in business, e.g. debit cards and computer interfaces.
Trade secrets can form an extremely important part of the fintech company's business core. There is no formal registration process, but the company should take reasonable steps to keep them secret. In Finland business secrets are protected against unauthorized use by the Unfair Business Practices Act (1061/1978, as amended) and criminal law.
Technology companies and different financial institutions are racing to secure patents to different fintech innovations around the world. Patents are very useful tools of trade as they can be used to protect the functionality of the invention, regardless of the copyright protected code. Investors also tend to view patents as valuable assets and indications of a strong position in the IP landscape. However, not all fintech inventions are patentable and the related jurisprudence is constantly evolving.
How are cryptocurrencies treated under the regulatory framework in your jurisdiction?
Finland is preparing an Act on Providers of Virtual Currencies in the course of implementing the Fifth Anti-Money Laundering Directive. The new Act is expected to be in force in the beginning of 2019.
Cryptocurrencies or virtual currencies are currently not explicitly regulated by Finnish law and they are not considered to be payment instruments under the payment service legislation. The proposed Act would both define virtual currencies for the first time under Finnish law and also set specific requirements for those providing services related them, including a requirement to register with the FIN-FSA. The scope of the Act would cover also issuers of virtual currencies (when the identity of such is known).
Fintechs providing services related to cryptocurrencies are also bound by applicable other legislation and, thus, especially consumer protection legislation and tax issues should be taken into account.
From the perspective of tax law, even when there is no specific tax legislation on cryptocurrencies, the general tax legislation and principles apply. The Finnish Tax Administration has issued guidance on tax aspects related to cryptocurrencies, most recently updated in May 2018 (A49/200/2018). There is also published case law on certain cryptocurrency related tax questions but none of the cases are yet final. Overall, the tax practice and case law on various tax questions related to cryptocurrencies is expected to develop over the coming years.
How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?
Initial coin offerings ("ICOs") are not explicitly regulated by Finnish law. The FIN-FSA has, however, published unofficial guidance on cryptocurrencies and ICOs, in which it warns the investors of the risks related to investing in ICOs. Similar guidelines have been issued by the European authorities, the European Securities and Markets Authority ("ESMA") and the European Banking Authority ("EBA").
Even when ICOs are not specifically regulated, they may fall within the scope of sector specific legislation, such as legislation regarding securities or even crowdfunding. Applicable legal requirements depend on the type of the ICO (e.g. whether it qualifies as financial instrument).
Firms that utilise ICOs may be bound by, for example, securities markets legislation, mainly the Securities Markets Act (746/2012, as amended), and the anti-money laundering legislation.
As the cryptocurrency and ICO scene is active in Finland, both the regulators and authorities are likely to follow the market developments closely over the next 12-24 months.
Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?
Already several blockchain projects are live and more are being developed in Finland.
Many of the blockchain projects are linked to logistics and supply chains, financial industry and process industry, and are often executed in cooperation. For example, certain Finnish banks and Tomorrow Labs have built a digital trading platform for the residential real estate market.
Another interesting example of using blockchain in financial services is a digital money system based on blockhain, developed by the Finnish startup MONI in cooperation with the Finnish Immigration Service.
One example of a blockchain project is also Pigeon, a blockchain platform that is aimed to provide faster and more transparent tracking and processing of royalties for publishers and music authors. It is developed by the Finnish Composers' Copyright Society Teosto and a Finnish blockchain startup Chainfrog.
In addition to actual blockchain projects, there are also many fintechs and other companies that utilise blockchain at back end solutions, i.e. the business model is not based on innovative use of blockchain.
In terms of bitcoin, Finnish crypto exchanges Prasos and LocalBitcoins have been operating in the market for years and the first bitcoin ATM in Europe was opened in Finland already in 2013.
To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?
Artificial intelligence ("AI") is being used in the financial sector mostly for the purposes of customer services. There are also other types of services based on AI and machine learning, such as in investment counselling. These are the ones most visible to the general public, and back end solutions based on AI are being tested, developed and used.
Finnish law does not impede, nor encourage, further use of AI as such. However, as artificial intelligence requires huge amounts of data, and especially in the financial sector the data may be linked to a certain individual, data protection requirements need to be taken into account.
The most significant legal issue relate to where the data can be generated from, and how to ensure that the data is processed in accordance with data protection laws. Data protection legislation does not impede the use of AI, but sets boundaries to the collection and use of the big data that AI utilises.
Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?
Also in Finland, insurtech is currently lagging behind other areas of fintech. However, the field of insurtech is expected to grow rapidly already within the next few years. Most of the insurtech business models at the moment are related to smart insurances. Some Finnish insurance companies have developed, piloted and issued smart life insurance and smart home insurance products.
Are there any areas of fintech that are particularly strong in your jurisdiction?
The Finnish fintech scheme is, by and large, fairly strong and vivid, and Finland has a long history in fintech.Currently,the Finnish fintech scheme covers lending, crowdfunding, regtech and risk management, tech for tech, trade finance, digital banks, insurtech, wealthtech, payments, cryptocurrencies and blockchain, market analysis and financial management.
Especially crowdfunding platforms and B2B services have been particularly strong. Lately, payment platforms, such as cloud-based payment platform provided by Enfuce Financial Services, and payment and financial services have strengthened. Finnish technology expertise creates a good basis for the development of fintech innovations.
What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?
As a main rule, fintechs and incumbent financial institutions are collaborative and have fairly good relationships with each other. Many Finnish banks have openly stated that they find the best approach being collaboration rather than raw competition.
Many larger incumbent financial institutions have their own partnership programs and innovation platforms, but there are also some good examples of a more concrete cooperation.
As an example from recent months, in May 2018, Nordea and a Finnish fundraising platform Invesdor announced that they will initiate collaboration in digital financing, which aims to improve the availability of alternative financing solutions for Finnish growth companies.
To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?
Most of the major Finnish banks have not watched the fintech development from sidelines.
Many banks have their own mobile banking applications (such as Pivo by OP Bank, MobilePay by Danske Bank and Siirto by Automatia), and services related to payments are being developed.
Finnish banks have taken steps also towards open banking (such as Open OP and Nordea Open Banking) and many have initial APIs in place. In summer 2018, Danske Bank launched an account information service, and with it was the first Finnish bank to take a major leap towards new services offered under PSD2.
Are there any strong examples of disruption through fintech in your jurisdiction?
There has been a lot of discussion on possible disruption through fintech, but so far fintechs have not been willing or able to kill off traditional banks or other incumbent financial institutions in Finland. As described above and shown by various examples, most incumbent financial institutions trust in cooperation. Even though fintechs have scalability, banks do still have wide trust from their customers.