The Fintech Brief by Legal Nodes


"The Fintech Brief" by Iryna Kuzyk & the Legal Nodes team

A quick note from Iryna

The most interesting fintech story of the last two weeks isn't really about fintech. It's about AI agents becoming economic actors.

Visa, Mastercard and Ant are already working on how to identify an AI agent and verify what it's allowed to do. The question I'm more interested in comes after verification: who is responsible when an authorised agent makes the wrong decision?

That's the theme running through this edition and something we'll be discussing with fintech founders on September 23.

AI, Fintech & Digital Assets — Regulatory Signal


Here's what happened in fintech regulation and what we at Legal Nodes think matters.

In this edition:

📍AI agents are getting payment credentials. But who is liable when they get a transaction wrong?

📍Tokenised equities are moving from crypto experiment to market infrastructure.

📍The FCA crypto authorisation window opens this month. Are firms actually ready?

THE BIG ONE: AI agents are becoming identifiable financial actors

Visa, Mastercard and Ant International are working on a common “Know Your Agent” framework to let payment networks, wallets, AI platforms and marketplaces identify and verify AI agents acting for users.

The objective is not one universal approval system — each participant would retain its own risk and approval processes. The point is a common trust layer able to answer: which agent is this, who authorised it, and should I trust its authority to transact?

The card networks are building agentic-commerce infrastructure in parallel: Mastercard announced merchant infrastructure for AI-powered shopping on 9 September, while Visa's latest research found only 23% of surveyed U.S. consumers trust generative AI to handle payments on their behalf.

Why it matters

The conversation is moving beyond “can an AI make a payment?” — technically, that is being solved. The harder layer is identity, delegated authority and liability.

For financial institutions, PSPs and marketplaces, an agent transaction may eventually require verification of three things:

the identity of the underlying customer; the identity or provenance of the agent; and the scope of the authority delegated to it — in effect, a machine-readable form of agency law combined with payment authentication.

The unresolved question is what happens when an agent is properly authenticated, stays within its spending limits, and still makes the wrong transaction. Authentication proves authority, not intent.

DIGITAL ASSETS: The SEC wants transfer-agent rules to enter the blockchain era.


On 1 September, the SEC proposed the first substantive modernisation of its transfer-agent rules in decades.

The proposal expressly recognises electronic communications and blockchain technology in securities offerings and share transfers. The SEC says the existing framework, largely dating from the late 1970s and early 1980s, no longer reflects how transfer agents operate.

Why it matters

Less flashy than a new crypto exemption, but potentially more important for institutional tokenisation.

Tokenising a security does not remove the securities-law infrastructure around ownership records, transfers, corporate actions and investor protection. Hence the recurring practical question:

What is the legally authoritative ownership record — the blockchain, the transfer agent's register, or both?

A framework designed around electronic and blockchain-based transfer infrastructure could make it materially easier to integrate tokenised securities with conventional U.S. capital-market plumbing — and is another sign that U.S. regulators increasingly treat blockchain as infrastructure that can sit inside regulated securities markets rather than apart from them.

TOKENISATION: London Stock Exchange moves towards tokenised public equities


The London Stock Exchange announced on 1 September that it is assessing a UK tokenised equity structure, partnering with Payward to explore tokenised public-equity markets.

The model would preserve existing shareholder rights, protections and governance standards while using digital infrastructure for settlement and asset servicing, potentially through LSEG's Digital Securities Depository. Regulatory approval would still be required.

Why it matters

Tokenisation is splitting into two very different markets. One is crypto-native: issuers create tokens, then ask how securities regulation applies. The other is institution-led: regulated market infrastructure takes an existing security and asks how blockchain can improve issuance, settlement, distribution or collateral mobility.

The second model is gaining momentum. For RWA businesses, competitive advantage may increasingly come from legal architecture and distribution rather than merely putting an asset on-chain.

The question is no longer whether shares can be tokenised. It is:

Can tokenised shares retain legally robust ownership rights while becoming interoperable enough to benefit from digital-asset infrastructure?

UK CRYPTO: The FCA authorisation gateway is about to open

The FCA's new authorisation application period for regulated cryptoasset activities opens on 30 September 2026 and runs until 28 February 2027.

The regime itself is scheduled to commence on 25 October 2027. Firms conducting activities brought within the new FSMA perimeter will need the relevant FCA authorisation or permissions.

The FCA expects substantive applications, and has warned that pre-application engagement requires meaningful supporting information rather than a promise to provide it later.

Why it matters

For crypto businesses targeting the UK, “we will deal with licensing later” is becoming an expensive strategy. The key work now is not filing the application, but deciding:

which activities sit inside the new perimeter; which entity will conduct them; where governance and senior management sit; what stays outsourced; and whether the firm's capital, systems, safeguarding, AML, consumer-protection and operational-resilience framework can survive FCA scrutiny.

The application window lasts five months. Building an authorisable business model can take considerably longer.

PREDICTION MARKETS: Yes, you can insider-trade a prediction market

The CFTC has brought a useful enforcement case for anyone still inclined to treat prediction markets as another form of online betting.

On 28 August, the CFTC settled charges against a former White House teleprompter operator who used advance access to presidential speeches to trade event contracts relating to words or phrases the President would mention.

The CFTC found he had misappropriated material non-public information in breach of a duty of trust and confidence. He was ordered to disgorge approximately $107,539, pay a $65,000 civil penalty and accept a three-year trading ban.

Why it matters

Prediction markets create genuinely unusual market-abuse scenarios. The inside information need not concern a company's earnings or an acquisition: it might be a speech, political decision, sporting event or regulatory announcement that determines settlement of an event contract.

As these markets institutionalise, operators should expect market surveillance, MNPI controls, employee dealing policies and suspicious-activity monitoring to matter far more.

Calling something a “prediction market” does not make conventional market-integrity concepts disappear.

FINTECH: Revolut gets conditional approval for a U.S. national bank charter

The OCC approved Revolut's application to establish Revolut Bank US, National Association on 2 September. The approval is conditional and only one of several approvals the proposed insured bank requires.

It matters because Revolut has historically entered markets through a mix of licences, partnerships and local regulated entities rather than operating as a bank everywhere it offers services.

Why it matters

For mature fintechs, owning the regulated infrastructure is an economic question as much as a compliance one. Bank partnerships accelerate launch but create dependencies on sponsor-bank risk appetite, product approvals, economics and regulatory oversight.

At sufficient scale, becoming the regulated institution buys greater control over product design and unit economics — at the cost of substantially heavier capital, governance, prudential and supervisory obligations.

There is no universal “fintech → bank” trajectory, but Revolut is another reminder that licence architecture eventually becomes part of business-model architecture.

U.S. CRYPTO: Market-structure legislation enters another decisive phase

Crypto companies and banks are intensifying competing lobbying around U.S. digital-asset market-structure legislation ahead of a Senate procedural vote expected on 15 September.

The legislation seeks certainty on how digital assets are classified and how jurisdiction is allocated between federal regulators. Banks remain concerned about stablecoin competition for deposits; parts of the crypto industry argue that failing to legislate a market structure would prolong uncertainty.

Why it matters

The strategic question for crypto companies in the United States is changing. For much of the last decade it was:

How do we structure around regulatory uncertainty?

Increasingly it may become:

Which regulated category are we prepared to operate within?

That is a materially different structuring exercise. A clearer perimeter normally reduces legal uncertainty — and can also remove business models that depended on it.

AI: Financial regulators are starting to look beyond model risk

BIS General Manager Pablo Hernández de Cos warned this week that the scale of the AI investment boom itself may have financial-stability implications.

The concerns go beyond bias, explainability or model governance: debt-funded AI infrastructure investment, market concentration, elevated valuations, and the possibility that markets have priced in productivity gains that take longer to materialise than expected.

Separately, the United States and China are preparing bilateral discussions on AI safety, including risks from increasingly autonomous systems and AI-enabled cyber activity.

Why it matters

AI regulation is developing across three layers at once: models and their deployment; specific AI-enabled activities such as payments, lending or investment decisions; and, now emerging, AI as a source of systemic financial and operational risk.

For financial institutions, an “AI policy” sitting inside the technology function is unlikely to be sufficient for long. AI governance is becoming interconnected with operational resilience, outsourcing, cybersecurity, conduct risk, financial crime, model risk and board-level risk management.

ONE THING WE'RE WATCHING: Agentic finance

The emergence of “Know Your Agent” infrastructure may become one of the more consequential fintech developments of the next 12–24 months.

Once software agents can autonomously initiate economic activity, financial infrastructure needs a way to distinguish:

identity — who or what is interacting with the system;

authority — on whose behalf it acts and what it is permitted to do;

and accountability — who bears responsibility if the transaction is unauthorised, erroneous or harmful.

Payments are likely to be the first large-scale test. Investment management, DeFi, treasury management and autonomous B2B commerce will be harder.

This is also the topic of our upcoming Legal Nodes panel.

Reserve your place "When AI Agents Meet Financial Services: Who Is Responsible?"

📅 23 September 2026 | 5:00 PM EEST / 4:00 PM CEST | Online

👨‍💻 With Edwin Mata, CEO & Co-Founder of Brickken; Ross Kolodyazhnyi, Senior Vice President — AI & Crypto at Sokin; and Leslie Kivit, Co-Founder of Amadeus Protocol.

Register for the panel:👇

IN ONE MINUTE

If you only remember five things from this edition:

AI: Payment networks are beginning to build common infrastructure for identifying and authenticating AI agents.

Fintech: Revolut has moved one step closer to operating its own U.S. bank.

Digital assets: The SEC is explicitly redesigning transfer-agent regulation with blockchain-based securities infrastructure in mind.

Tokenisation: The London Stock Exchange is exploring tokenised public equities — a sign tokenisation is moving into regulated market infrastructure.

Compliance: Market-abuse rules follow the financial instrument, even when the underlying event looks more like a bet than a security.

—

Legal Nodes Regulatory Signal covers selected developments in AI, fintech, payments, digital assets and financial regulation. It is provided for general information only and is not legal, regulatory, tax or investment advice.

Legal Nodes Newsletter

Get emails from the Legal Nodes team.

Read more from Legal Nodes Newsletter

What happens when the wrong legal data reaches AI? A recent UK case gives a very practical answer. In UK v Secretary of State for the Home Department / Munir, the Upper Tribunal examined the use of generative AI by legal representatives. Among the issues raised was the fact that client letters and other confidential material had been uploaded into a public AI tool. The Tribunal warned that putting confidential documents into an open AI system could breach client confidentiality and result in...

When Legal AI starts taking action, governance has to catch up For the last few years, most Legal AI use cases have followed a familiar pattern: Ask a question → get an answer → review the output. But the market has already moved beyond that model. Three months ago, Anthropic introduced Claude Tag, allowing teams to bring Claude directly into Slack, give it access to selected tools and context, and delegate work to it much like they would to another team member. Last week, the same shift...

AI can monitor the regulation. Context tells it whether it matters to you. The Legal AI race is no longer just about who has the smartest model. For legal teams, the more important question is becoming: “ Does the AI understand enough about your business to actually do the work? A regulatory update is a good example. A model may be able to summarise what changed. But before Legal can advise Product, Operations or HR, someone still needs to determine: which entity or product is affected;...