By Biagio Bossone, Advisor Consultant to International Organisations, Governments Agencies and Financial Institutions
The financial world is undergoing a quiet but momentous shift. Behind the everyday ease of tapping phones or scanning QR (quick-response) codes to pay for groceries lies a sprawling web of digital infrastructure that now underpins economies and societies alike. These systems—retail payment rails, wallets, tokenised platforms—move money faster, cheaper and more inclusively than ever before. But while the technology races ahead, the oversight frameworks meant to safeguard users, ensure trust and promote resilience are lagging behind.
Retail financial market infrastructures (FMIs) now serve as the connective tissue between households, firms and governments. They channel social transfers, anchor digital identification systems and support entire ecosystems of digital finance. Yet many of these infrastructures are governed by inadequate standards. Not because regulators have been inattentive, but because the existing standards were crafted for a different world: a world of interbank settlements, large-value transactions and central counterparties.
What was once a peripheral concern is fast becoming a defining test of the global financial architecture. As retail systems scale and converge with tokenised assets, platform finance and cross-border applications, the absence of internationally harmonised oversight principles threatens to create blind spots—not only for consumer protection but also for financial integrity and systemic trust. It is time to mind the gap.
The rise of retail financial market infrastructures
Retail FMIs have evolved into digital public utilities. Real-time retail payment systems, mobile money networks, digital wallets, QR-code layers and e-money platforms now facilitate billions of transactions daily. Together they form the digital backbone of inclusive finance and economic participation—powering person-to-person transfers, digital commerce, government payments and small-business operations.
This transformation has deepened financial inclusion, expanded credit access and brought millions into the formal economy. But the systems enabling this progress are governed inconsistently across jurisdictions. Many operate through public-private partnerships or under licensing regimes with limited prudential or operational standards. In many jurisdictions, these systems fall under consumer-protection or telecommunications regulators, rather than financial authorities with explicit systemic oversight mandates—although this is evolving as their critical roles become more apparent.
Some countries have extended the Principles for Financial Market Infrastructures (PFMI) of the (Committee on Payments and Market Infrastructures-International Organization of Securities Commissions (CPMI-IOSCO) to certain retail platforms—particularly fast payment systems. But this remains the exception, not the rule. For the vast majority of retail FMIs, especially those involving non-bank actors or tokenised assets, there is no common framework defining expectations on governance, resilience or access.
The result is a growing patchwork: divergent rules on participation, inconsistent cybersecurity protocols, fragmented fraud mitigation and varying approaches to interoperability. This heterogeneity hampers innovation, weakens trust and exposes users to risks that transcend national borders.
Why the current standards are not enough
To be sure, the PFMI represent a landmark in global regulatory cooperation. Since their adoption in 2012, they have brought rigour to the oversight of systemically important infrastructures such as large-value payment systems, central securities depositories and central counterparties. But they were not designed with retail FMIs in mind. Their scope, assumptions and priorities reflect the logic of wholesale finance: managing liquidity, clearing credit exposures and ensuring settlement finality across financial institutions.
Retail FMIs pose a very different set of challenges. They process high volumes of low-value transactions, connect heterogeneous users and are deeply embedded in consumer experiences and merchant operations. Risks are not about large counterparty defaults but about fraud, service outages, data misuse, reputational cascades and access discrimination. While individually non-systemic, these systems can become critical in aggregate—especially when used for fiscal distribution, public infrastructure or cross-border remittances.
Critically, retail FMIs now intersect with technologies and actors that operate across jurisdictions: fintech (financial technology) firms offering global e-wallets, stablecoin arrangements bridging national currencies and mobile networks serving as financial intermediaries and platforms for the exchange of tokenised assets. Without shared principles, there is no consistent way to assess operational resilience, privacy safeguards or even systemic importance.
Playing devil’s advocate, one might argue that the issues facing retail FMIs—competition, consumer protection, conduct—are primarily local and therefore best left to national authorities. But this view underestimates both the scale and interconnectedness of the modern retail ecosystem. Several reasons justify international standards:
- Cross-border exposure is growing. Domestic instant payment systems such as Brazil’s PIX and India’s United Payments Interface (UPI)) are increasingly being linked across countries—for example, through bilateral arrangements like Thailand’s PromptPay-PayNow connection or multilateral initiatives such as Project Nexus. At the same time, digital wallets such as PayPal, Alipay and Revolut operate transnationally, while tokenised-value platforms can transmit risks instantaneously across borders.
- Local issues have global implications. Consumer access, digital ID integration and pricing transparency affect social stability and financial integrity at scale. Systemic risk can now emerge from reputational damage, cyberattacks or inclusion failures—none of which respect national boundaries.
- Tokenisation blurs the line between retail and wholesale. Retail FMIs increasingly interact with stablecoins, tokenised deposits and even central bank digital currencies (CBDCs), requiring coordinated oversight across legacy and next-generation infrastructures.
- Innovation requires predictable rules. Developers and investors need clear, internationally harmonised baselines to operate across markets. The absence of such standards increases compliance costs and inhibits scale.
The PFMI were never meant to cover these dimensions. Adapting them by analogy risks ignoring the unique architecture and public role of retail FMIs. What is needed is a complementary framework—not a substitute, but a tailored addition.
What a retail oversight framework should include
A fit-for-purpose framework should be anchored in the public-interest role played by retail FMIs. These systems are not just commercial networks—they are the pipes through which societies deliver basic economic rights. As such, they require standards that go beyond financial-risk management.
Key principles might include:
- Design for scale and resilience: Given their throughput and low-margin nature, retail FMIs should meet performance, uptime and disaster-recovery standards tailored to volume-based operations.
- Inclusive and affordable access: Oversight should assess whether an infrastructure promotes broad-based participation across demographic, geographic and institutional divides.
- Open architecture and fair competition: Standards must incentivise interoperability, prevent gatekeeping and level the playing field for new entrants—especially in platform-dominated environments.
- Eco-sustainability: As tokenised systems expand, energy consumption and environmental externalities must be monitored and minimised.
- Cross-border cooperation: Where retail FMIs serve users or partners across borders, expectations around know your customer/anti-money laundering, data flows and dispute resolution should be defined and harmonised.
- Digital and reputational resilience: Oversight should evaluate the capacity to prevent, detect and respond to cyberattacks, social engineering and viral disinformation—risks that can escalate quickly in digital retail environments.
This is not about micromanaging national models. Rather, it is about establishing minimum expectations for infrastructures that are already vital to public life. Such standards can enhance trust, reduce fragmentation and support safe innovation.
Conclusion: A call for global action
The Group of Twenty’s roadmap on cross-border payments and the Financial Stability Board’s work on crypto-assets are important milestones. But they do not fill the gap in global principles for retail FMIs. That task still awaits a concerted push.
A way forward would be for the CPMI—ideally in collaboration with the IOSCO, the World Bank, the International Monetary Fund and regional standard-setters—to launch a public consultation on oversight principles for retail FMIs. The aim would not be to duplicate the PFMI but to extend their spirit to domains where public-interest risks are high, but regulatory clarity is low.
Retail finance is no longer a local affair. Its infrastructure underpins the legitimacy of digital public services, the reach of fiscal tools and the everyday trust in modern money. A world-class architecture deserves world-class oversight.
It’s time to mind the gap—before it widens into a fault line.
Disclaimer: The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the views or positions of any of the institutions with which he is associated.