Fintechs and Supervision: When the Audited Company Is Ahead of the Auditor

Why supervision often lags behind new financial technology

Fintechs, companies that offer financial services with new technology, have changed paying, saving, and borrowing within a few years. Many businesses use them daily: for card payments in the shop, for invoicing, for credit in online retail. Behind each of these services is a company that someone is supposed to supervise.

Supervision has a structural problem here. It examines companies whose technology changes faster than rules can be written and examiners trained. This article therefore asks: What happens when the audited company is technically ahead of the auditor, and how can oversight still be effective? To answer it, we first clarify a thinking model, then look at a documented case and the reforms that followed, weigh two readings, and transfer the result to your own business.

The Collingridge dilemma: too little knowledge early, too little influence late

In 1980, the British technology scholar David Collingridge described a dilemma that has borne his name ever since. While a technology is new, it is easy to steer, but nobody knows exactly what its consequences will be. Once the consequences are visible, the technology is so widespread that any correction becomes costly and laborious. Regulators must therefore act either under ignorance or with diminished effect.

Ahern (2025) describes in a scholarly article how this produces a widening gap between innovation and regulation in the EU. She also uses the term pacing problem: technology sets the pace, rules follow. The result, she argues, is often regulation that is either too strict or too lax, rarely just right. A second problem she names is regulatory arbitrage: companies locate where the rules are least burdensome.

An analogy makes the situation tangible. Imagine a driving examiner who has to test candidates in a car whose controls he has never learned himself. He can check whether the candidate stops at a red light. Whether the driver-assistance system is working properly at that moment, he cannot judge.

The figures do not show inaction but the dilemma. Ahern (2025) points out that before 2017, supervisors worldwide considered blockchain applications too immature to regulate. Only the wave of token sales made the need for action visible.

What a documented case shows about supervisory gaps

The collapse of the payment services company Wirecard in June 2020 is the best-known case in Germany. The company had a banking subsidiary supervised by BaFin, Germany's Federal Financial Supervisory Authority. The group itself, however, counted as a technology company and was not subject to direct financial supervision. Bloomberg described this in 2020 as a blind spot: a company that acts like a bank but isn't one (Comfort and Drozdiak 2020).

In addition, responsibility for reviewing financial statements was split. First a private body, the Financial Reporting Enforcement Panel (DPR), examined them; only then could BaFin step in. Money laundering at companies outside the financial sector fell to regional authorities (Comfort and Jennen 2020). In February 2019, BaFin temporarily banned new short positions in the share and filed a criminal complaint against journalists. The article Chronicle of an accounting scandal recounts the sequence. The criminal proceedings have not been concluded; the presumption of innocence applies to everyone involved.

After 2020, BaFin also took a tougher line with other fintechs. In 2024, Bloomberg reported sanctions against about a dozen companies, including the neobank N26 and the banking-as-a-service provider Solaris, and that the supervisor intended to ease some growth caps after the firms' controls had improved (Comfort 2024).

Two readings: a competence gap or a lack of independence?

Why did oversight fail to take hold for so long in the Wirecard case? Research discusses two explanations.

The second reading is captured by a term from regulation research: regulatory capture, the co-opting of a supervisor by the interests of those it is supposed to supervise. Buttigieg, Witzel, and Zimmermann (2023) distinguish between hard capture through corruption or collusion and soft capture through political and institutional conditions. Drawing on the findings of the German Bundestag's committee of inquiry and a review by the European Securities and Markets Authority (ESMA), they conclude that hard capture of BaFin cannot be proven. Its legal dependence on the finance ministry, however, created room for soft capture.

Alade (2025) adds a third view. Cases such as FTX, Wirecard, and Celsius show that conventional corporate governance reaches its limits at fintechs, because many decisions are embedded in algorithms and automated processes rather than resting with clearly identifiable individuals.

I do not see the two readings as opposites. A competence gap makes a supervisor more dependent on information from the supervised company, and a lack of distance prevents it from closing the gap with critical questions. It becomes dangerous where both coincide.

If you do not understand a technology, you must check all the more carefully who is explaining it to you.

How supervision can cope with the pace

Ahern (2025) argues for anticipatory regulation in three parts. Foresight: authorities systematically observe what is coming technically. Experimentation: in regulatory sandboxes, companies can test new offerings under supervision and with conditions. Learning: the authority evaluates what it learns and adjusts rules step by step.

The advantage of such experiments lies in rapid feedback with limited damage if something fails. The EU now uses sandboxes explicitly, for instance in the AI Act, which EU AI Act discusses. For crypto-assets, the MiCA Regulation has applied since the end of 2024, as described in Stablecoins and MiCA. Since January 2025, the EU Digital Operational Resilience Act, DORA for short, has also applied, requiring financial companies to take precautions against IT outages and cyberattacks.

The limit of these approaches is obvious. Sandboxes help with companies that want to cooperate with the supervisor. They do not protect against deception. That still requires independent audits, direct evidence, and a supervisor that follows up on uncomfortable tips.

What this means for your business

Every owner knows the supervisor's situation on a small scale. The payment provider, the IT service provider, or the employee who set up the inventory system knows more about their technology than you do. You are still supposed to check whether the money arrives, the data are correct, and the processes are secure. From this I derive the control-without-technology test: it asks which checks work without you having to understand the technology.

1. Check results, not procedures

   You do not need to know how a payment system calculates. But you can check whether reported sales match receipts in your own bank account, using access that does not run through the provider.

2. Look up authorization and supervision

   For payment and crypto service providers, check whether they hold a license. In Germany, BaFin maintains a public company database for this. Due diligence on business partners describes how to vet partners beyond that.

3. Write down dependencies

   Note which processes stop if a provider fails, and how long you can manage without it. What to do if your own IT is attacked is covered in Cyberattacks on small businesses.

4. Have explanations cross-checked

   If someone explains a technology to you from which they earn money, get a second opinion on important decisions. This is the same logic as with the independence of statutory auditors.

Tips from your own team belong here too. Employees often notice inconsistencies in systems first. Whistleblower protection describes how a business receives and protects such tips.

Transferability and limits

The Wirecard case was also a failure of responsibilities. A company that stood between technology and finance fell through a grid built for traditional banks. The reforms have narrowed this gap for listed companies. Whether they suffice for the next generation of business models cannot be said today. The Collingridge dilemma suggests that new gaps will arise.

The works cited have limits. Ahern (2025) argues from a legal perspective rather than with measurements, and Buttigieg and colleagues (2023) rely on a single case. Whether anticipatory regulation works measurably better has barely been studied, as Ahern herself acknowledges.

Conclusion: oversight needs distance, not just knowledge

To the guiding question: when the audited company is technically ahead of the auditor, the auditor becomes dependent on the audited company's explanations. The Collingridge dilemma explains why this situation is almost unavoidable with new financial technology. The Wirecard case shows that a competence gap becomes dangerous when distance is lacking at the same time. Effective oversight is still possible: with clear responsibilities, powers, supervised experiments, and above all evidence that does not pass through the audited party.

For your business, the most important step is simple: verify results through your own channels, even if you do not understand the technology behind them.

• For every payment and IT provider, note which processes depend on it.
• Look up your payment providers' authorization in BaFin's company database.
• Ensure your own read access to all business accounts, independent of the provider.
• Put a monthly comparison of reported sales and actual receipts in the calendar.