Share the data, protect the data: contradictory EU rules affect banks
One rule encourages banks to share financial data while another requires them to protect it. As European regulations increasingly govern both financial services and the technology behind them, banks face a growing challenge: how to follow the rules while continuing to develop useful services for customers.
Imagine your bank wants to make it easier for you to share financial information with another service, such as an app that helps you manage your savings. Some European regulations encourage data sharing, while others require banks to protect personal information and carefully control how it is used. Balancing these demands can be complicated.
Researchers at the House of Innovation at the Stockholm School of Economics have examined how financial companies navigate this growing web of regulations. Their study, published in the Journal of Information Technology, draws on 44 major EU regulatory frameworks, 624 documents and interviews with 60 financial industry experts.
The challenge is not just the number of rules, but how they interact. Regulations designed for different purposes can create unexpected difficulties when banks and other financial services firms have to apply them to the same systems and processes.
“Companies need to make sure that different rules work together in the systems and processes they rely on every day. That becomes increasingly difficult as regulations evolve and technology itself comes under greater scrutiny,” says Åke Freij, Research Fellow at the House of Innovation at the Stockholm School of Economics.
When the technology banks rely on gets regulated
Banks have long used technology to meet regulatory requirements, from detecting suspicious transactions to protecting customer information. But increasingly, the systems they introduce to comply with one set of rules become subject to new rules themselves.
Artificial intelligence, cloud services and cybersecurity are among the areas receiving growing regulatory attention. Banks must therefore consider how their technology meets today's requirements as well as how it will adapt as regulations change.
The researchers identify three ways financial companies are responding.
First, banks rethink how they manage and govern data. Information that helps operations to prevent fraud might also be needed to develop new strategic services, while privacy regulations restrict how data can be shared and stored.
Second, companies design and implement technology that can adapt. Rather than building systems around today's requirements alone, they need to prepare for future regulatory changes. This is particularly challenging for established banks that rely on older IT systems.
Third, cooperation is becoming essential. Lawyers, technology specialists and business managers must increasingly work together, and understand each other, to interpret regulations and turn them into practical solutions.
What this means for customers
Keeping up with changing rules takes time, money and technical expertise. This can limit the resources financial companies have available to develop new services and improve the customer experience.
At the same time, regulations can encourage innovation. Requirements to share financial information, for example, can create opportunities for new digital services and give customers greater control over their finances.
The study does not suggest that fewer regulations are necessarily better. Instead, it highlights the importance of understanding how different rules interact.
For policymakers, this means looking beyond individual regulations and considering their combined effects. For businesses, it means treating compliance as part of long-term technology and business strategy.
Ultimately, the challenge is to ensure that rules designed to protect consumers and strengthen financial stability also leave room for innovation in financial services.
Read the full study (open access): The recursive relationship between technology and regulations: Managing landscape frictions in the financial services industry, published in the Journal of Information Technology (2026).
Authors
- Åke Freij, Research Fellow at the House of Innovation, Stockholm School of Economics
- Mickaël Buffart, Assistant Professor at the House of Innovation, Stockholm School of Economics
- Karl Wennberg, Professor and Barbara Bergström Chair in Educational Leadership and Excellence at the Department of Management and Organization, and Research Fellow at the House of Innovation, Stockholm School of Economics
Contact
Åke Freij
Research Fellow at the House of Innovation and Affiliated Researcher at the House of Governance and Public Policy
Email: ake.freij@hhs.se
