2024-2025 Global Regulatory Climate

A Report on Trends for Marketplaces and Payment Providers

As online fraud intensifies to an unprecedented level, fueled by advancements in AI and an increasingly globalized economy, regulators are determined to find ways to keep it in check. The global regulatory push underscores a unified goal: Ensuring consumer safety.

But how can this be accomplished?

Many regulators have chosen to focus on expanding accountability all along the chain in ecommerce, pulling in players that were previously impervious to the type of scrutiny that typical financial institutions face.

Lawmakers across the globe push for expanded accountability

The rise of marketplaces and social media shopping created a gold rush that many platforms jumped on. They saw an opportunity that would boost customer stickiness and carve out a heaping slice of the online market share.

After all, 52 cents out of every dollar is spent online, and based on 2024’s mashup of Black Friday/Cyber Monday, which had email inboxes overflowing with “BFCM” deals, online shopping is poised to overtake the annual ritual of standing in line in the wee hours for doorbuster deals – if it hasn’t already.

Social media platforms continue to maintain the position that they bear limited (if any) responsibility for illicit activity in their shopping areas. But with 40% of Facebook’s 3.07 billion monthly active users shopping on Facebook Marketplace, deniability is becoming less plausible.

Payments innovations drive the need for evolving regulation

The eager consumer uptake of Buy-now-pay-later (BNPL) and other payment innovations have also prompted the need for regulators to act, and act fast.

BNPL spending has surged, and it may put spenders at risk of overextending. The young, cash-poor “small basket” shoppers have made up the highest spending increase since BNPL became available. Without the typical consumer protection laws that govern credit cards and loans, this could have negative repercussions on a generation of consumers.

On Black Friday 2023, shoppers spent $16.6 billion through BNPL, a 42.5% increase from Black Friday 2022 ($11.64 billion). In the US alone, BNPL shoppers spent nearly fifty percent more on Black Friday than consumers using other payment methods.

BNPL usage did not slow down in 2024, with shoppers spending over $991 million on Cyber Monday alone.

Regulation precedes enforcement

Lawmakers have significantly ramped up their efforts. Regulations are designed to protect consumers from today’s sophisticated criminal networks, while keeping up with the innovations in purchasing and payments that consumers crave.

However, rules are not made in a vacuum – nor are they implemented in one. They are a framework created to guide behavior, and that framework includes enforcement. Over the past year, we have already seen this enforcement in the form of legal action such as changing designations, jurisdictional challenges, anti-money laundering actions, and fines.

Now, more than ever, ecommerce stakeholders must be aware of the regulations affecting them, and be prepared for increased requirements for compliance.

In the following pages, we will discuss new and ongoing regulations in the ecommerce space, highlighting potential impacts on marketplaces and payment providers, trending themes, examples of enforcement, and regional variations around the globe.

Now, more than ever, ecommerce stakeholders must be aware of the regulations affecting them, and be prepared for increased requirements for compliance.

Regulatory Landscape for Marketplaces

The regulatory landscape for online marketplaces is evolving rapidly across the globe. As they redouble their efforts to hold platforms accountable for the content and commercial activities they facilitate, lawmakers are essentially reimagining and redefining the platforms’ perceived position in the supply chain.

TikTok, for example, has been criticized for allowing its algorithms to promote harmful content and illicit products such as fake cosmetics, counterfeit perfumes, and unregulated prescription drugs, despite its official policy to ensure product safety and prevent user harm. This scrutiny has escalated to the point where TikTok is now facing a potential nationwide ban in the United States and Canada. Proponents of the ban have cited national security concerns over its data practices and the influence of its parent company, ByteDance, based in China.

This action represents a broader trend of lawmakers strengthening requirements for how online marketplaces and platforms handle user-generated content, user data, and commercial transactions.

The counterfeit products originating from Asian online marketplaces constitute a substantial share of the global trade in fake goods, an economic threat that cannot be ignored. And the potential impact on consumer safety underscores the problem even more. Therefore, regulators are developing creative strategies to tackle the influx of low-cost products entering domestic markets.

The groundswell of global regulation demonstrates a unified determination: holding platforms accountable for their role in digital commerce is an essential part of protecting people and the global economy.

Global regulatory overview

In June 2023, the United States implemented the Integrity, Notification, and Fairness in Online Retail Marketplaces (INFORM) Consumers Act, mandating online marketplaces to collect, verify, and disclose information about high-volume third-party sellers to curb the sale of counterfeit and stolen goods. Additionally, the Biden administration proposed closing the de minimis exemption, which allows imports valued under $800 to enter duty-free—a loophole frequently exploited by platforms to bypass tariffs.

With the election of President Donald Trump in November 2024, it is anticipated that these efforts will not only continue but potentially intensify. Historically, the Trump administration adopted a stringent stance on trade, particularly concerning China, implementing substantial tariffs on Chinese imports. Recent reports suggest that the incoming administration plans to further restrict the de minimis exemption to address trade imbalances and protect domestic industries.

In a similar context, the European Union’s Digital Services Act (DSA) enforces stringent obligations on online platforms to mitigate the dissemination of illegal goods and services. It requires platforms to implement mechanisms for users to report illicit content and mandates cooperation with "trusted flaggers." The EU is also scrutinizing Asian e-commerce platforms, considering measures like new taxes and administrative fees to address the surge of low-value parcels that often evade customs duties.

Enforcement Spotlight
Under the European Union's Digital Services Act (DSA), several online marketplaces were designated as Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) in 2024. These platforms, each exceeding 45 million monthly active users within the EU, are now required to comply with stricter DSA provisions, including enhanced content moderation, transparency in algorithms, and robust measures against illegal content and disinformation. Non-compliance can result in substantial fines, up to 6% of the platform's global annual revenue.

A notable case involves X (formerly Twitter), where the Commission, in December 2024, initiated formal infringement proceedings related to the platform's handling of illegal content and systemic risk assessments. This marked the first such action under the DSA, underscoring the EU's commitment to enforcing its digital regulations. The proceedings focus on X's compliance with obligations related to countering the dissemination of illegal content, particularly in the context of events like the Hamas terrorist attacks against Israel, and the platform's risk assessment and mitigation measures. X is now required to provide detailed information and cooperate with the Commission's investigation.

Another significant example is Chinese e-commerce platform Temu. After its designation as a VLOP in May 2024, the Commission launched an investigation in October due to concerns that Temu was not adequately preventing the sale of non-compliant and potentially dangerous products, as well as issues related to addictive design and transparency in recommendation systems. Temu expressed its commitment to cooperating fully with the investigation and is considering joining a European anti-counterfeit group to bolster its compliance efforts.

In the Asia-Pacific (APAC) region, China’s E-Commerce Law imposes comprehensive responsibilities on online marketplaces to prevent the sale of counterfeit goods and ensure consumer protection. Additionally, China has introduced regulations to combat unfair competition in the online sphere, targeting practices like price discrimination. In countries like Vietnam, authorities have mandated that online marketplace platforms register with the government or face blocking, addressing concerns over their impact on local markets and the sale of counterfeit products.

In Latin America (LATAM), regulations impacting online marketplaces are evolving to regulate e-commerce growth while protecting local industries and ensuring transparent operations. In Brazil, a 20% tax on international purchases (up to $50) was introduced to support local retailers against foreign e-commerce giants. Mexico has also tightened tax compliance for marketplace platforms, requiring VAT collection and registration with the Federal Taxpayers' Registry. In Argentina, the government increased duty-free import limits to $3,000 and exempted personal use imports up to $400 from tariffs, fostering trade liberalization.

Regulators worldwide are actively tackling the challenges brought on by the rapid expansion of e-commerce, especially on platforms with a high concentration of foreign sellers. As these frameworks continue to evolve, online platforms must adapt their operations to navigate varying regional requirements while maintaining the trust and safety of consumers.

This collective shift highlights a broader global consensus on the importance of responsible and transparent marketplace practices in fostering sustainable e-commerce growth.

Recent and pending regulations that can significantly impact marketplaces:

In this section, we will analyze the key recent and pending regulations that signal a surge of greater accountability for marketplaces:

European Union

The Digital Services Act (DSA) and Digital Markets Act (DMA) establish a unified regulatory framework across the EU to enhance user safety online and ensure fair competition in the digital market. The DSA focuses on protecting users' rights by imposing obligations on online intermediaries and platforms—such as social networks, contentsharing services, and online marketplaces—to manage illegal content, ensure transparency, and uphold accountability. The DMA targets "gatekeeper" platforms with significant market influence, setting rules to prevent unfair practices and promote a competitive digital environment. Not only do these designations impact the six gatekeepers and third-party companies using their core services, but the DMA is expected to have significant implications for the entire payments industry.

These regulations entered into force in November 2022. Rules under the DMA began applying to designated "gatekeeper" platforms starting in May 2023. Designations under the DSA began in August 2023 for Very Large Online Platforms (VLOPs) and February 2024 for all other platforms and services.

The General Product Safety Regulation (GPSR), officially known as Regulation (EU) 2023/988, modernizes the region’s product safety framework to enhance consumer protection across all sales channels, including digital marketplaces. The regulation applies to all non-food consumer products in the EU market and serves as a safety net for products or risks not covered by other specific EU legislation. It imposes strict obligations on manufacturers, importers, distributors, and online marketplaces to ensure products are safe before being marketed, requiring safety assessments, traceability, and clear consumer safety information. The GPSR holds online platforms accountable for proactively ensuring the safety of products sold through their channels.

The regulation became applicable on December 13, 2024

United States

The Stopping Harmful Offers on Platforms by Screening Against Fakes in E-Commerce (SHOP SAFE) Act has seen renewed legislative activity in 2023 and 2024. If enacted, the SHOP SAFE Act will establish trademark infringement liability for e-commerce platforms when a third-party seller uses a counterfeit mark in connection with the sale of goods that implicate health and safety. Online platforms will be obligated to verify sellers and their products, take action against repeat counterfeiters, and enable brands to hold them accountable for lapses in due diligence.

As of December 2024, both the Senate and House versions of the SHOP SAFE Act are under committee review. The legislative process requires approval from both chambers of Congress and the President's signature for the Act to become law.

United Kingdom

Reporting Rules for Digital Platforms mandate that UK-based online marketplaces facilitating the sale of goods or services collect and verify information about sellers and report these details to HM Revenue & Customs (HMRC). It aims to enhance tax transparency and ensure proper tax compliance within the digital economy. Platforms are required to identify reportable sellers—those residing in the UK or other participating jurisdictions who actively supply goods or services—and gather specific data, including personal and financial information.

While the regulation became effective on January 1, 2024, annual reports must be submitted to HMRC by January 31, 2025

The Online Safety Act 2023 establishes a comprehensive regulatory framework aimed at enhancing online safety by imposing duties on social media companies and search services to protect users from illegal and harmful content. This bill also affects ancillary services that support the entities mentioned, such as those facilitating fund transfers to regulated platforms and companies. This includes payment service providers, payment processors, banks, acquirers, and even SaaS-based tech platforms or fintech companies, all of which will fall within its scope and be required to comply.

In August 2024, Ofcom announced its preparedness to enforce the Online Safety Act, with content safety provisions set to come into force in March 2025

Singapore

In June 2024, Singapore introduced the Code of Practice for E-Commerce Services under the Online Criminal Harms Act 2023 to combat scams and malicious cyber activities on online marketplaces. The Code requires designated platforms to implement seller verification measures using government-issued records, such as SingPass, to ensure authenticity and deter fraudulent activities. Platforms must also offer payment protection mechanisms, ensuring payments are released only after goods or services are delivered. Additionally, they are required to establish proactive systems to detect and address scams, provide accessible user reporting tools, and cooperate with law enforcement by retaining and sharing relevant data.

Implementation of the Code began on June 26, 2024, with full compliance expected by December 31, 2024, and some measures like payment protection deferred to 2025.

China

The Interim Provisions on Prohibiting Unfair Competition on the Internet aim to prevent and curb unfair competition in online activities. The provisions prohibit practices such as unauthorized use of business identifiers, false or misleading advertising, and the manipulation of rankings to mislead consumers. They also ban technological interference, such as traffic hijacking or malicious incompatibility, and the misuse of competitors' legally held data. Additionally, the rules address big data-enabled price discrimination, ensuring consumers are not unfairly treated based on their transaction history or profiles.

The interim provisions became effective on September 1, 2024

Regulatory Landscape for Acquiring Banks and Payment Providers

The regulatory landscape for acquiring banks and payment providers is evolving globally, with regions adopting distinct priorities to address technological advancements, financial stability, and consumer protection.

In the United States, changes are being driven by the implementation of rules under the Anti-Money Laundering Act of 2020 (AML Act), with new proposals designed to modernize AML programs. One of the central developments in 2024 was the Financial Enforcement Network’s (FinCEN) push to strengthen AML/CFT programs across financial institutions. Proposed regulations require these programs to be risk-based, tailored to each institution's unique profile, and subject to periodic review.

However, domestic politics in the US can significantly influence financial regulation and enforcement, with shifts in administration bringing changes in policy priorities. Following the November 2024 election, the incoming administration is signaling a shift towards deregulation in the financial sector. Key appointments, such as Paul Atkins as Chair of the Securities and Exchange Commission (SEC), indicate a move towards lighter regulatory oversight, particularly in sectors like cryptocurrency. According to proponents, this approach is intended to foster innovation; however, it raises concerns about regulatory ambiguities and enforcement challenges.

In contrast, the United Kingdom and Europe are advancing comprehensive regulation around consumer protections. The UK emphasizes operational resilience and fair competition in payment systems, while the EU is implementing the 6th Anti-Money Laundering Directive (AMLD6) to expand liability for financial crimes and strengthen enforcement mechanisms. The directive emphasizes holding entities accountable for systemic AML breaches and introduces harsh penalties for non-compliance. Beyond AML, initiatives like the third Payment Services Directive (PSD3) aim to enhance payment security and consumer rights, addressing technological advancements to protect Europe’s payment system.

The Asia-Pacific (APAC) region is also prioritizing consumer protection and financial system integrity. Singapore has introduced rigorous licensing frameworks for payment providers, ensuring compliance with AML and counter-terrorism financing (CFT) standards, while Australia and others in the region are focusing on expanding the scope of AML compliance regimes to include more entities and ensuring consumer safety amid rapidly evolving payment ecosystems.

Meanwhile, Latin America (LATAM) is driving regulatory modernization to address the rapid adoption of digital payments. For example, open banking initiatives in Brazil and Mexico are meant to encourage innovation and promote competition among payment service providers while addressing systemic risks associated with financial inclusion efforts.

As these new rules are implemented, financial institutions must closely monitor the evolving regulatory framework, particularly as these changes will likely lead to increased compliance costs and a heightened focus on enforcement. Institutions will also need to stay engaged with card schemes given that non-compliance with card brand guidelines can result in fines or termination from accessing payment networks.

Payment providers must look to align their Acceptable Use Policies (AUPs) with card schemes rules, in addition to maintaining sufficient merchant monitoring and fraud detection mechanisms.

Recent and pending regulations that can significantly impact payment providers:

In this section, we will analyze key recent and pending regulations that payment providers should consider as they evaluate compliance processes:

United States

Notice of Proposed Rule Making (NPRM) to the Bank Secrecy Act, announced in June 2024, aim to enhance anti-money laundering and counter-terrorist financing (AML/CFT) programs across financial institutions, including payment providers. These proposed changes are designed to ensure that AML/CFT programs are effective, risk-based, and reasonably designed, aligning with mandates from the Anti-Money Laundering Act of 2020. Moreover, the proposed rules emphasize governance, requiring that AML/CFT programs be documented, approved by the board of directors, and overseen by senior management.

The public comment period for this proposed rule concluded on September 1, 2024. FinCEN has proposed that the final rule become effective six months after its issuance. Therefore, the exact compliance deadline will depend on the final rule's publication date, which has yet to be announced.

Enforcement Spotlight
In October 2024, Toronto-Dominion Bank (TD Bank) agreed to a historic settlement with US authorities, pleading guilty to conspiracy to commit money laundering and violations of the Bank Secrecy Act. The bank was fined over $3 billion, marking the largest penalty of its kind in U.S. history. Investigations revealed that, between 2014 and 2023, TD Bank's inadequate anti-money laundering controls allowed criminal organizations to launder more than $670 million through its systems. Notably, a Chinese drug trafficking group exploited these deficiencies to process over $470 million linked to illegal drug sales. As part of the settlement, TD Bank is subject to a three-year independent monitorship, a five-year probation period, and restrictions on the growth of its US retail operations. In response, TD Bank has initiated significant reforms to its compliance programs and has made several high-profile hires to strengthen its financial crimes risk management.

On November 21, 2024, the Consumer Financial Protection Bureau (CFPB) published a Final Rule on Federal Oversight of Popular Digital Payment Apps to Protect Personal Data, Reduce Fraud, and Stop Illegal “Debanking”. This regulation targets Big Tech and peer-to-peer platforms processing over 50 million transactions annually, aiming to ensure compliance with federal consumer financial laws. The CFPB's oversight will focus on protecting personal data, reducing fraud, and preventing illegal account closures, commonly referred to as "debanking." Given the evolving market for digital currencies, the CFPB also limited the rule's scope to count only transactions conducted in U.S. dollars.

The final rule will become effective 30 days after publication in the Federal Register

Final Rule 1033 of the Dodd-Frank Act mandates that financial institutions, including banks and credit unions, provide consumers and their authorized third parties with secure and reliable access to personal financial data upon request. This data includes information about transactions, costs, charges and usage related to consumer deposit accounts, credit cards and payment services. It also establishes obligations for third parties accessing consumer data, emphasizing privacy protections, and encourages the development of fair and inclusive industry standards.

Compliance deadlines are staggered based on institution size, with the largest institutions required to comply by April 1, 2026, and smaller institutions by April 1, 2030.

The Secure and Fair Enforcement Regulation (SAFE) Banking Act is a proposed US federal law aimed at protecting financial institutions that provide services to state-legal cannabis businesses from federal penalties. If enacted, the law would allow legal cannabis businesses to access traditional banking services, reducing reliance on cash transactions and enhancing financial transparency and security within the industry.

As of December 2024, the Act has progressed through several legislative stages but has not yet been enacted into law. The bill requires approval from both the Senate and the House, followed by the President's signature.

European Union

The Anti-Money Laundering and Anti-Terrorism Financing Package represents a significant overhaul of the EU’s regulatory framework to combat financial crimes more effectively. Key measures include the establishment of the Anti-Money Laundering Authority (AMLA), a new EU-level body based in Frankfurt, to directly supervise high-risk financial entities and coordinate national authorities. The package introduces a new AML regulation with standardized rules and enhanced transparency requirements for beneficial ownership. The 6th AML Directive (6AMLD) updates national obligations, focusing on supervision and financial intelligence units, and updates the list of predicate offenses – a crime which is a component of a larger crime generating monetary proceeds.

The new “AML Package” was formally adopted by the Council of the EU in May 2024

Canada

The Retail Payment Activities Act (RPAA) establishes a comprehensive supervisory framework for retail payment activities in Canada, mandating that payment service providers (PSPs)—including card networks, payment processors, and digital wallet operators—implement robust measures to manage operational risks, respond to incidents, and safeguard end-user funds. Under this framework, the Bank of Canada is designated as the supervisory authority responsible for overseeing PSPs to ensure the safety, reliability, and resilience of electronic payment functions. These requirements aim to bolster consumer confidence, promote innovation, and maintain the integrity of Canada’s payment ecosystem.

Effective November 16, 2024, PSPs must register with the Bank of Canada before conducting retail payment activities. From September 8, 2025, PSPs are required to submit annual reports to the Bank of Canada, detailing compliance with operational risk management, incident response, and fund safeguarding frameworks.

Australia

Reforms to the Payment Systems (Regulation) Act 1998 (PSRA) were announced by the Reserve Bank of Australia (RBA) in February 2024. Key recommendations include expanding the definitions of "payment system" and "participant" to encompass all entities involved in enabling payments, including fintech firms and digital wallet providers. The proposed reforms also grant government powers to address significant payment issues outside the jurisdiction of existing regulatory bodies and introduce court-enforceable undertakings to strengthen enforcement.

Specific compliance deadlines have not been established, as the legislative process is ongoing.

United Kingdom

The Digital Markets, Competition and Consumers Act 2024 is a landmark legislation to enhance competition and strengthen consumer protections, particularly among Payment Service Providers (PSPs) and other digital payment platforms with strategic market status (SMS). The Act also introduces significant reforms to consumer protection laws, including bans on subscription traps, fake reviews, and drip pricing, aiming to eliminate unfair practices and promote transparency.

The legislation is scheduled to come into force on January 1, 2025