Fintech 2026

FINLAND Law and Practice Contributed by: Olli Kiuru, Jere Lehtimäki and Essi Hietaoja, Waselius

Finnish Competition and Consumer Authority (FCCA) In conjunction with the Regional State Administrative Agencies, the FCCA has jurisdiction over business operations in which instant and consumer credit are being offered. According to the Act on the Finnish Competition and Consumer Authority, 661/2012 (the “FCCA Act”), the sphere of authority of the FCCA includes the implementation of competition and con - sumer policies and the protection of the consumer’s economic and legal position. Office of the Data Protection Ombudsman (ODPO) Although not specific to the financial sector, the fourth national supervisory authority is the ODPO, which supervises compliance with data protection legisla - tion – ie, the Finnish DPA and the GDPR. EU Supervisory Authorities Since Finland is a member of the EU, the European Supervisory Authorities (ESAs) also have jurisdiction. The ESAs consist of the European Banking Authority (EBA), the European Insurance and Occupational Pen - sions Authority (EIOPA) and the European Securities and Markets Authority (ESMA), which, together with the FIN-FSA, provide micro-prudential supervision. Whilst the ongoing supervision of financial institutions remains with the national supervisory authorities, the jurisdiction of the ESAs is enforced through level 2 or level 3 measures. Pursuant to Articles 10 and 15 of ESA Regulation (EU) No 1095/2010, the ESAs have the authority to develop level 2 measures by means of draft regulatory technical standards (RTS) and implementing technical standards (ITS). The draft RTS and ITS can be submit - ted to the Commission by the ESAs upon the approval of the board of supervisors of the respective ESA by way of a qualified majority. In accordance with Article 16 of the ESA Regulation, level 3 measures consist of guidelines and recommen - dations addressed to the competent authorities and financial institutions or financial market players by the ESAs. Similar to RTS and ITS, guidelines are to be approved by the board of supervisors of the respec - tive ESA by way of a qualified majority.

According to Article 16 (3) of the ESA Regulation, com - petent national authorities and financial institutions or financial market players must make every effort to comply with the guidelines. Both the guidelines and the recommendations are to be applied on a comply- or-explain basis, meaning that failure to adhere to said recommendation/guideline requires notifying the respective ESA and providing an explanation for non- compliance within two months of the issuance of the guideline or recommendation. Traditionally, Finland has implemented these EU guidelines quite effectively and to their full extent. The practical implementation is often done by a simple local guideline, where a reference is made to an EU- level guideline. This method gives the foreign fintech companies more comfort since they can rely on the fact that Finland has implemented the EU-level guide - lines correctly and without “gold plating”. 2.7 No-Action Letters Generally, Finnish regulators do not issue no-action letters. They provide guidance to financial market participants seeking clarity on how regulations apply to specific situations or business models, but these responses are usually non-binding. See also 2.5 Reg- ulatory Sandbox . 2.8 Outsourcing of Regulated Functions Regulated functions can be outsourced subject to certain conditions being satisfied. The provisions on outsourcing regulated functions are stipulated in the Regulations and guidelines 1/2012 issued by the FIN- FSA and the EBA Guidelines on outsourcing arrange - ments. Investment Services Investment firms, credit institutions and fund man - agement companies may outsource their authorised investment services only to entities that are licensed to engage in the practice of investment services. With regard to credit institutions and fund management companies, critical functions may only be outsourced where doing so does not materially interfere with risk management, internal supervision or the functioning of business operations.

270 CHAMBERS.COM

Powered by