{{brizy_dc_image_alt imageSrc=

Who Owns Customer Data in Embedded Finance?

(A Regulatory Perspective)

Embedded finance is often described as a distribution model—financial services delivered through non-financial platforms. In reality, it is also a data governance and regulatory accountability model.

As banks, fintechs, and platforms collaborate to deliver embedded payments, lending, and financial services, a critical question emerges:

Who owns customer data—and who is accountable when it is shared across ecosystems?

Regulators across jurisdictions are increasingly clear:

Data ownership in embedded finance is not implicit, technical, or commercial. It is legal, regulated, and enforceable.


The Core Principle: Ownership vs Accountability

In embedded finance, data is shared—but regulatory accountability is not transferred.

Across major jurisdictions, supervisors consistently apply one rule:

The licensed or regulated entity remains accountable for customer data, even when services are embedded into third-party platforms.

This distinction between data access, data control, and regulatory responsibility underpins all embedded finance regulation globally.


How Customer Data Is Governed in Embedded Finance

1. The Regulated Institution (Bank / Licensed Entity)

Typically acts as:

  • Primary Data Controller for regulated data
  • Accountable for:
  • KYC and CDD records
  • Transaction and account data
  • Fraud, AML, and sanctions decisions
  • Data retention, accuracy, and auditability

Even when a platform owns the customer interface, regulators treat the licensed entity as the party responsible for data integrity and lawful use.


2. The Embedded Finance Partner (Platform / Merchant / Fintech)

May:

  • Collect customer interaction and contextual data
  • Initiate transactions or workflows
  • Provide user journeys and experiences

But:

  • Does not automatically “own” regulated financial data
  • May act as:
  • A data processor
  • Or a joint controller, depending on purpose and decision-making authority

This distinction is heavily scrutinised in regulatory exams.


3. The Customer

Customers do not operationally own data—but they hold legal rights:

  • Consent
  • Access
  • Correction
  • Restriction
  • Portability (where applicable)

Embedded finance models must be designed around customer data rights, not platform convenience.


Jurisdiction-Specific Regulatory Expectations

🇪🇺 European Union (GDPR + PSD2 / Open Banking)

Key Regulatory Position

  • Banks and payment institutions are usually data controllers
  • Embedded platforms are often processors or joint controllers

What Regulators Expect

  • Clear controller/processor definitions (GDPR Articles 4 & 28)
  • Purpose limitation: data collected for payments cannot be reused for marketing without consent
  • Explicit customer consent for data sharing under PSD2/Open Banking
  • Strong data minimisation and access controls

Common Regulatory Finding

  • Platforms using transaction data beyond the authorised PSD2 scope


🇬🇧 United Kingdom (UK GDPR + Open Banking + FCA)

Key Regulatory Position

  • Accountability sits with the authorised firm, even if the customer never sees it

What Regulators Expect

  • Transparent customer disclosures
  • Clear explanation of:
  • Who provides the service
  • Who holds data
  • Who makes risk decisions
  • End-to-end data lineage for fraud and payment decisions

Regulatory Focus

  • Customer harm resulting from unclear responsibility between bank and platform


🇮🇳 India (DPDP Act + RBI Expectations)

Key Regulatory Position

  • Regulated entities (banks, NBFCs, PAs) remain data fiduciaries
  • Embedded partners are typically data processors

What Regulators Expect

  • Explicit customer consent for data sharing
  • Purpose-bound data usage under DPDP
  • RBI expectations on:
  • Outsourcing
  • Third-party risk
  • Data localisation (where applicable)

Key RBI Theme

  • Regulatory accountability cannot be outsourced, even in embedded models


🇺🇸 United States (GLBA, CFPB, State Regulators)

Key Regulatory Position

  • Financial institutions retain responsibility under GLBA
  • CFPB focuses on:
  • Consumer harm
  • Transparency
  • Unfair or deceptive practices

What Regulators Expect

  • Clear disclosures on data usage
  • Strong vendor and partner oversight
  • Demonstrable control over customer data used in decisions

Regulatory Risk

  • Enforcement actions where fintech partners misuse customer data


🇸🇬 Singapore (MAS + PDPA)

Key Regulatory Position

  • Licensed institutions remain accountable under MAS outsourcing guidelines
  • Data protection governed by PDPA

What Regulators Expect

  • Clear outsourcing arrangements
  • End-to-end accountability for:
  • Fraud decisions
  • AML outcomes
  • Customer complaints
  • Strong data governance and audit rights over partners

MAS Emphasis

  • Operational resilience and explainability across ecosystems


Why This Matters: The Hidden Risk in Embedded Finance

Many embedded finance failures originate from:

  • Unclear data ownership
  • Over-sharing data with platforms
  • Inability to explain fraud or credit decisions
  • Customers blaming banks for partner actions
  • Regulators holding the licensed entity responsible—regardless of contracts

Distribution scale without data governance becomes regulatory exposure.


Design Principles for Regulator-Ready Embedded Finance

Leading institutions:

  • Treat customer data as a regulated control asset
  • Share access, not ownership
  • Use API-based, logged, revocable data sharing
  • Preserve end-to-end data lineage
  • Design explainability across platforms
  • Align legal, risk, data, and technology teams early


Key Takeaway

In embedded finance, customer data is shared—but accountability is not.

Across the EU, UK, India, US, and Singapore, regulators consistently hold the licensed entity responsible for how customer data is used, protected, and explained.

Institutions that design embedded finance with clear data ownership, governed sharing, and regulatory-grade transparency can scale safely.

Those that do not risk turning ecosystem growth into supervisory scrutiny.


If you’d like, I can next:

  • Create a simple visual diagram showing data ownership vs access in embedded finance
  • Convert this into a short homepage insight
  • Add case studies of regulatory failures
  • Tailor it for a specific jurisdiction (RBI, FCA, MAS, CFPB)


Scroll to Top