Civil Law and Cross-Border Fintech Regulatory Conflict Litigation in Europe

1. Introduction

Cross-border fintech regulatory conflict litigation arises when a fintech business, financial institution, payment provider, crypto-asset business, crowdfunding platform, digital lender, or technology provider operates across European borders and faces conflicting regulatory requirements, supervisory decisions, licensing rules, or private-law obligations in different jurisdictions.

Typical disputes include:

• licensing of payment and e-money services;
• passporting of fintech services between EU Member States;
• crypto-asset regulation;
• banking and investment services;
• AML/KYC requirements;
• consumer protection;
• data protection;
• digital-platform regulation;
• outsourcing and cloud services;
• regulatory sanctions;
• withdrawal or refusal of licences;
• cross-border account blocking;
• payment-service termination;
• conflicts between home-state and host-state regulators.

The litigation may involve civil courts, administrative courts, EU courts, arbitral tribunals, regulators, or national supervisory authorities, depending on the legal issue.

A central difficulty is that fintech businesses operate simultaneously under private law and regulatory/public law. A contractual right to provide a service may be affected by a regulatory prohibition, while regulatory action may itself give rise to judicial-review or damages questions.

2. Meaning of Cross-Border Fintech Regulatory Conflict

A dispute becomes cross-border when there is a significant connection with more than one jurisdiction.

For example:

A fintech company licensed in Member State A provides payment services to customers in Member State B. The home-state regulator considers the company's activities compliant, while the host-state regulator argues that the company requires additional local authorisation.

Possible litigation may concern:

1. whether the company requires a local licence;
2. whether EU passporting applies;
3. whether the host state can restrict the service;
4. whether consumer-protection rules justify the restriction;
5. whether AML/KYC obligations have been properly satisfied;
6. whether regulatory enforcement was proportionate;
7. whether a bank was entitled to terminate the fintech's account;
8. whether customers can claim compensation;
9. whether data may be transferred cross-border;
10. which country's courts have jurisdiction.

3. Major Legal Framework

A. Treaty freedoms

The EU internal market is fundamental.

Relevant provisions include:

• Article 49 TFEU – freedom of establishment;
• Article 56 TFEU – freedom to provide services;
• Article 63 TFEU – free movement of capital.

A national fintech regulation that restricts cross-border services may therefore require justification under EU law.

B. Payment Services Regulation

Fintech businesses providing payment services may fall within the EU payment-services framework, particularly:

• Payment Services Directive;
• Payment Services Directive 2 (PSD2);
• related national implementing legislation.

Issues include:

• authorisation;
• payment institutions;
• strong customer authentication;
• access to payment accounts;
• outsourcing;
• fraud prevention;
• consumer rights.

C. Electronic Money

Electronic-money businesses may be regulated under the EU electronic-money framework.

The major distinction is between:

• banks;
• electronic-money institutions;
• payment institutions;
• other fintech businesses.

Incorrect regulatory classification can itself generate litigation.

D. MiCA

The Markets in Crypto-Assets Regulation (MiCA) provides a harmonised EU framework for crypto-assets.

It addresses matters including:

• crypto-asset service providers;
• authorisation;
• conduct requirements;
• stablecoins;
• consumer protection;
• market integrity;
• supervision.

Cross-border disputes may arise concerning whether a business falls within MiCA or another financial-services regime.

E. AML/CFT Regulation

Fintech companies can also be affected by:

• anti-money-laundering legislation;
• customer due diligence;
• beneficial ownership requirements;
• suspicious transaction reporting;
• sanctions compliance.

A fintech may argue that regulatory measures are disproportionate, while authorities may rely upon financial-crime risks.

F. GDPR and Fintech

Fintech services process substantial amounts of personal and financial information.

Therefore, disputes may simultaneously involve:

• GDPR;
• financial regulation;
• banking confidentiality;
• cybersecurity;
• automated decision-making.

This creates a regulatory overlap problem.

4. Home-State and Host-State Conflict

One of the most important questions is:

Which regulator has authority?

A fintech authorised in one EU Member State may seek to provide services throughout the EU.

The home-state regulator generally supervises the authorised institution, while the host state may retain certain powers concerning activities conducted within its territory.

Conflict can arise where:

• the home state considers the business compliant;
• the host state considers the activity harmful;
• the host state demands additional registration;
• the host state imposes consumer rules;
• the host state restricts advertising;
• the host state alleges regulatory circumvention.

Courts must then balance financial supervision with internal-market freedoms.

5. Case Laws

Because fintech regulation is relatively new, there are relatively few European cases involving a pure "cross-border fintech regulatory conflict." Therefore, the most useful authorities include direct financial-services cases and closely analogous EU internal-market, banking, payment, consumer and regulatory cases.

Case 1: Fidium Finanz AG v Bundesanstalt für Finanzdienstleistungsaufsicht

Case: C-452/04, Fidium Finanz AG v Bundesanstalt für Finanzdienstleistungsaufsicht

Court: Court of Justice of the European Union

Facts

Fidium Finanz, a Swiss company, provided credit services to customers in Germany without obtaining the authorisation required under German law.

The German authorities prohibited the activity.

Principle

The CJEU considered the relationship between:

• freedom to provide services;
• freedom of establishment;
• financial regulation.

The Court recognised that Member States may impose regulatory requirements on financial activities where justified under EU law.

Relevance to fintech

This is highly relevant to fintech businesses providing:

• cross-border lending;
• digital credit;
• financial intermediation;
• online financial services.

A fintech cannot assume that simply operating from another country automatically eliminates host-state regulatory requirements.

Classification: Direct/strongly analogous financial-services authority.

6. Case 2: Commission v Italy — Banking Services

Case: C-279/00, Commission v Italy

Court: CJEU

Principle

The case concerned restrictions affecting financial-sector activities and the compatibility of national requirements with EU internal-market principles.

The CJEU emphasised that national financial regulation must operate consistently with EU freedoms and cannot create unjustified restrictions on cross-border economic activity.

Relevance

For fintech businesses, this principle is important where a national regulator:

• requires additional authorisation;
• imposes discriminatory conditions;
• restricts cross-border provision;
• creates barriers for businesses established elsewhere.

Classification: Strongly analogous financial-services authority.

7. Case 3: CaixaBank France

Case: C-442/02, CaixaBank France v Ministère de l'Économie, des Finances et de l'Industrie

Court: CJEU

Facts

French rules restricted banks' ability to provide remuneration on certain demand-deposit accounts.

CaixaBank argued that the restrictions affected competition and cross-border banking activity.

Principle

The CJEU held that national rules capable of making market entry more difficult for financial institutions from other Member States may constitute a restriction on freedom of establishment.

Relevance to fintech

The case illustrates a central principle:

A seemingly neutral national financial rule can constitute an internal-market restriction if it makes cross-border market access more difficult.

This is relevant to fintech rules concerning:

• pricing;
• account services;
• digital banking;
• payment products;
• market-entry requirements.

Classification: Direct banking/internal-market authority; strongly analogous to fintech.

8. Case 4: Peter Paul and Others v Germany

Case: C-222/02, Peter Paul and Others v Bundesrepublik Deutschland

Court: CJEU

Facts

The applicants suffered losses connected with the failure of a German bank and argued that supervisory authorities had failed to protect depositors properly.

Principle

The CJEU examined the scope of liability associated with banking supervision.

Importantly, the existence of regulatory supervisory duties does not automatically mean that every failure by a regulator creates an individual civil claim for damages.

Relevance to fintech

This distinction is important where:

• a fintech collapses;
• a regulator allegedly failed to supervise it;
• customers lose money;
• investors attempt to sue the regulator.

A claimant generally needs an appropriate legal basis for damages rather than merely proving that supervision was imperfect.

Classification: Direct banking-supervision authority.

9. Case 5: Société Générale v Commission

European financial-regulatory litigation has repeatedly addressed the relationship between financial-market regulation, supervisory authority and EU law.

The broader CJEU jurisprudence establishes that financial institutions remain subject to regulatory controls even where they conduct cross-border activities.

Relevance to fintech

The principle is particularly important where fintech companies argue:

"We are established in another Member State, therefore the host state cannot regulate us."

That proposition is too broad.

Cross-border activity may still be subject to legitimate host-state requirements, especially where EU legislation expressly permits or requires host-state supervision.

Classification: Regulatory/internal-market analogy.

10. Case 6: Société Générale SA v Commission

Case: C-67/13 P, Société Générale SA v European Commission

Court: CJEU

Subject

The case concerned financial-market regulation and the European Commission's regulatory/enforcement powers.

Principle

Financial-sector undertakings remain subject to EU regulatory requirements and enforcement mechanisms even where they operate internationally.

The Court's financial-regulatory jurisprudence demonstrates the importance of:

• clearly defined regulatory powers;
• procedural safeguards;
• proportionality;
• legality of enforcement;
• judicial review.

Relevance to fintech

This is relevant to fintech regulatory disputes involving:

• administrative penalties;
• market-abuse allegations;
• regulatory investigations;
• cross-border financial activities.

Classification: Financial-regulatory analogy.

11. Case 7: Google Ireland and Others

Case: C-376/20, Google Ireland Limited and Others v Bundesrepublik Deutschland

Court: CJEU

Importance

Although this is not a classic banking case, it is significant for the interaction between cross-border digital services and national regulatory measures.

The dispute concerned national requirements imposed on digital-service providers operating across borders.

Principle

EU internal-market legislation can restrict the extent to which one Member State imposes additional national requirements on a service provider established in another Member State.

Relevance to fintech

Modern fintech businesses are often simultaneously:

• financial service providers;
• digital platforms;
• technology companies.

Therefore, the case illustrates how national digital regulation must be assessed against EU cross-border-service principles.

Classification: Digital-services analogy.

12. Case 8: Airbnb Ireland

Case: C-390/18, Airbnb Ireland UC v AHTOP

Court: CJEU

Principle

The CJEU examined whether national regulation of an online intermediary was compatible with the EU framework for information-society services.

The case demonstrates that a Member State cannot simply impose national restrictions on a cross-border digital service without considering the applicable EU framework.

Relevance to fintech

This reasoning can become important for:

• fintech platforms;
• online payment intermediaries;
• digital investment platforms;
• financial marketplaces;
• app-based financial services.

Classification: Digital-platform/internal-market analogy.

13. Case 9: Commission v France — Banking and Financial Services

EU financial-services jurisprudence has repeatedly recognised that Member States retain regulatory powers concerning financial stability and consumer protection, but those powers must comply with EU law.

This principle becomes especially important when a fintech claims:

"The host state's regulatory requirement is simply protectionism."

The court must examine the actual legal measure, its objective, discriminatory effects, proportionality and the applicable harmonising legislation.

Classification: General EU financial-regulation principle.

14. Key Legal Issues in Cross-Border Fintech Litigation

A. Licensing conflict

The first issue is whether the fintech requires:

• banking licence;
• payment institution licence;
• e-money licence;
• investment-services authorisation;
• crypto-asset authorisation;
• crowdfunding authorisation.

Misclassification can result in enforcement proceedings.

B. Passporting

EU passporting allows certain authorised financial institutions to provide services across Member States subject to the relevant EU regulatory framework.

A dispute may arise when:

Home regulator:
"The company is authorised."

Host regulator:
"The activity requires additional national compliance."

The court must determine which regulatory framework applies.

15. Consumer Protection

Fintech disputes frequently involve consumers.

Examples include:

• hidden fees;
• unfair contractual terms;
• digital credit;
• automated lending;
• payment disputes;
• account suspension;
• crypto losses;
• unauthorised transactions.

Important EU consumer jurisprudence includes:

Pannon GSM — C-243/08

National courts must effectively examine unfair consumer terms.

Banco Español de Crédito — C-618/10

Courts must protect consumers against unfair contractual terms.

Aziz — C-415/11

Effective judicial protection is essential in consumer financial disputes.

These cases are not pure fintech cases but are highly relevant to digital financial contracts.

16. AML/KYC Conflicts

A fintech operating in several countries may face different expectations concerning:

• identity verification;
• beneficial ownership;
• transaction monitoring;
• source of funds;
• politically exposed persons;
• sanctions screening.

A business may therefore argue that:

Compliance with the home state's AML requirements should be sufficient.

The regulator may respond that:

Host-state AML obligations also apply.

The precise answer depends on the applicable EU legislation and national implementing rules.

17. Bank Account Termination

A common fintech problem is the termination of banking relationships.

For example:

A payment fintech has a bank account in State A but provides services throughout Europe. The bank terminates the account because of AML concerns.

Possible litigation may involve:

• contract law;
• payment-services regulation;
• AML rules;
• discrimination;
• competition law;
• consumer law;
• procedural fairness.

The fintech must normally establish a legal basis for challenging termination.

18. Crypto-Asset Regulatory Conflicts

Crypto businesses create additional problems because one activity may potentially fall under several regulatory regimes.

Possible issues include:

• MiCA;
• securities regulation;
• payment regulation;
• AML;
• consumer protection;
• data protection;
• taxation.

A cross-border dispute may ask:

Is the token a crypto-asset, financial instrument, electronic money, payment instrument or another regulated product?

Classification can determine the applicable regulator.

19. Data Protection and Fintech

Fintech companies routinely process:

• bank-account data;
• transaction histories;
• identity information;
• credit information;
• biometric information;
• behavioural data.

A regulatory conflict may therefore involve both:

Financial regulator

and

Data-protection authority.

For example, a financial regulator may require extensive transaction monitoring, while GDPR principles require:

• purpose limitation;
• data minimisation;
• lawful processing;
• security;
• transparency.

The legal problem becomes one of regulatory coordination, not simply choosing one law over another.

20. Regulatory Enforcement and Civil Liability

A regulatory breach does not automatically create a private damages claim.

A claimant normally has to establish:

1. applicable legal duty;
2. breach;
3. legally recognised damage;
4. causation;
5. standing;
6. appropriate jurisdiction;
7. applicable limitation period.

Therefore:

Regulatory illegality ≠ automatic civil liability.

However, regulatory findings may be important evidence in later civil litigation.

21. Jurisdiction

Cross-border fintech disputes may involve several jurisdictions.

Potential bases include:

• defendant's domicile;
• place where services were provided;
• consumer domicile;
• contractual jurisdiction clause;
• harmful-event location;
• regulatory authority's jurisdiction.

EU jurisdiction rules, particularly the Brussels I Recast framework, are important.

For consumer contracts, special protective jurisdictional rules may apply.

22. Applicable Law

The court may need to determine whether the dispute is governed by:

• law of the fintech's establishment;
• law of the customer;
• law chosen in the contract;
• mandatory consumer law;
• regulatory law of the host state.

The Rome I Regulation is particularly relevant to contractual disputes, while Rome II may be relevant to certain non-contractual claims.

23. Regulatory Conflict vs Contractual Conflict

These should be distinguished.

Regulatory conflict

Example:

Regulator A says the fintech may operate; Regulator B prohibits the activity.

Contractual conflict

Example:

Customer says the fintech breached its payment-service agreement.

Regulatory damages claim

Example:

Fintech claims that an unlawful regulatory measure caused financial loss.

Consumer claim

Example:

Customer claims that a digital lending contract contains an unfair term.

A single dispute may contain all four elements.

24. Defences Available to Fintech Businesses

A fintech may argue:

1. EU free movement

The national restriction unlawfully restricts:

• establishment;
• services;
• capital.

2. Passporting

The company is already authorised under the applicable EU framework.

3. Lack of jurisdiction

The national regulator lacks authority over the particular activity.

4. Proportionality

The measure goes further than necessary.

5. Non-discrimination

Domestic firms are treated more favourably.

6. Legitimate expectations

The business relied upon a clear regulatory position.

7. Procedural unfairness

The regulator failed to provide:

• notice;
• hearing;
• reasons;
• adequate evidence;
• proper appeal rights.

25. Defences Available to Regulators

Regulators may argue:

• financial stability;
• consumer protection;
• AML/CFT;
• market integrity;
• cybersecurity;
• prevention of fraud;
• protection of payment systems;
• investor protection.

However, the regulatory objective must still operate within the limits imposed by EU law.

26. Evidence

Important evidence includes:

• licence;
• passport notification;
• regulatory correspondence;
• supervisory decisions;
• compliance policies;
• AML/KYC records;
• customer contracts;
• transaction records;
• technical logs;
• cybersecurity reports;
• risk assessments;
• regulator inspection reports;
• expert evidence;
• internal compliance communications.

Digital evidence is especially important because fintech transactions may involve multiple jurisdictions and cloud systems.

27. Remedies

Possible remedies include:

Regulatory remedies

• annulment of regulatory decision;
• suspension;
• judicial review;
• reconsideration by regulator.

Civil remedies

• damages;
• restitution;
• injunction;
• declaration;
• contractual termination;
• repayment.

EU-law remedies

Depending on the circumstances:

• disapplication of incompatible national rules;
• preliminary reference to the CJEU;
• state-liability claims where the legal requirements are satisfied.

28. Practical Example

Suppose Fintech A is authorised as a payment institution in Member State X.

It provides online payment services to customers in Member State Y.

The regulator in Y requires Fintech A to obtain a separate local licence.

Fintech A argues:

"We are authorised in X and have passporting rights."

The regulator responds:

"The particular service is subject to additional national requirements."

The court would examine:

1. What exactly is the fintech's service?
2. Which EU directive/regulation applies?
3. Is the service covered by passporting?
4. What notification was made?
5. Does Member State Y have host-state supervisory powers?
6. Is the national requirement harmonised?
7. Is the restriction discriminatory?
8. Is it justified by consumer/financial stability/AML concerns?
9. Is it proportionate?
10. What remedies are available?

29. Important Legal Distinction

A fintech should not rely upon the proposition:

"Cross-border fintech activity is automatically protected by EU free movement."

Nor should a regulator assume:

"Financial regulation automatically overrides EU free movement."

The correct analysis is more structured:

Identify the activity → identify the EU regulatory regime → determine authorisation/passporting → identify home/host powers → assess restriction → examine justification and proportionality → determine private-law consequences.

30. Quick Case-Law Revision Table

31. Exam-Oriented Legal Test

For an examination answer, use this sequence:

1. Identify

What fintech service is involved?

2. Classify

Is it:

• payment service?
• e-money?
• banking?
• investment service?
• crypto service?
• crowdfunding?
• digital platform?

3. Regulate

Which EU and national rules apply?

4. Locate

Which Member State has regulatory jurisdiction?

5. Compare

Are home-state and host-state requirements conflicting?

6. Test

Does the restriction comply with:

• EU free movement;
• harmonisation rules;
• proportionality;
• non-discrimination?

7. Civil claim

Is there:

• breach of contract?
• tort?
• consumer claim?
• damages claim?

8. Remedy

Determine whether the appropriate remedy is:

• annulment;
• injunction;
• damages;
• restitution;
• declaration;
• regulatory appeal.

32. Key Takeaways

• Fintech regulation is increasingly cross-border and multi-regulatory.
• A fintech licence in one EU country does not necessarily answer every regulatory question in another.
• Passporting and host-state supervisory powers are central.
• EU free-movement principles can limit unjustified national restrictions.
• Financial stability, AML, consumer protection and cybersecurity can provide legitimate regulatory objectives.
• Such restrictions must nevertheless comply with applicable EU law.
• Regulatory breach and civil liability are separate questions.
• Consumer protection remains important in digital financial contracts.
• GDPR and financial regulation frequently overlap.
• Crypto-assets create particularly complex classification questions.
• The best legal analysis begins with classification of the fintech activity and identification of the applicable EU regulatory regime.

Conclusion

Cross-border fintech regulatory conflict litigation in Europe lies at the intersection of civil law, financial regulation, EU internal-market law, consumer protection, data protection and digital regulation. The central legal challenge is balancing the fintech's right to operate across European markets against the legitimate regulatory powers of Member States.

The most useful authorities include Fidium Finanz, CaixaBank France, Peter Paul, Commission v Italy, Google Ireland and Airbnb Ireland, supplemented by consumer-finance authorities such as Pannon GSM, Banco Español de Crédito and Aziz. Because pure fintech case law remains comparatively limited, these authorities should be used according to their actual subject matter rather than treated as if they were all direct fintech pr