Financial services regulatory landscape in APAC: navigating the complexities and emerging trends

In 2025, the financial services landscape in the Asia-Pacific (APAC) region continues to experience rapid and structural change driven by complex and interconnected risks. These elements are fundamentally reshaping regulatory priorities across the region, prompting diverse responses from national authorities.

The region’s vast diversity can lead to regulatory fragmentation, requiring financial institutions to navigate a complex compliance environment. Firms operating across multiple jurisdictions in APAC must contend with varying national regulations, where addressing similar risks can differ considerably in detail, scope, and emphasis.

To manage these challenges effectively, these institutions need clear insights into the varying approaches taken by regulators and must invest strategically in agile governance and compliance frameworks that accommodate these differences.

This article explores some of the key risks currently faced by financial institutions in APAC, how regional regulators address them, and their impact on the financial sector.

“APAC’s financial sector is evolving fast — financial institutions that effectively integrate technological innovation, risk resilience, and sustainability into their core strategy will be best positioned to seize new opportunities while staying ahead of disruption.”

Rudi Lang, APAC Financial Services Sector Leader, Forvis Mazars Group

Interconnected risk factors in APAC

Similar to other regions, financial institutions in APAC face a rapidly transforming environment with increasingly complex and interconnected risks to manage. These include heightened geopolitical tensions, increasing economic volatility, fast-paced technological innovation accompanied by growing cybersecurity threats, more sophisticated anti-money laundering (AML) techniques, and increasing scrutiny around climate and sustainability.

While the core challenges faced in the region are relatively consistent between countries, national-level regulatory initiatives to address these risks can vary considerably. Recognising these variations is crucial for financial institutions seeking efficient compliance and effective strategic planning.

• Geopolitical uncertainty and economic volatility are significant concerns for regulators across the APAC region. In response, some countries implement stringent measures to manage currency volatility and trade disruptions, while other countries focus on maintaining market openness. Financial institutions must navigate these differing regulatory landscapes to manage liquidity, capital adequacy, and market exposure effectively. Global deregulatory pressures are also beginning to be felt, increasing fragmentation risk.
• Technological innovation and cybersecurity are common regulatory priorities region-wide, driven by the need to safeguard financial stability and consumer protection. However, regulators balance innovation against risk differently, impacting institutions’ operational and IT strategies.
• Financial crime prevention and anti-money laundering (AML) enforcement remain universally recognised priorities, with regulators widely adopting internationally accepted standards. However, practical enforcement varies considerably, complicating the management of financial crime risks across jurisdictions.
• Operational resilience and third-party risk management have gained prominence due to increased reliance on external providers and outsourcing arrangements. Regulatory approaches differ significantly, presenting complex challenges in managing consistent third-party relationships and business continuity planning.
• Climate change and sustainability have become critical areas for regulators, yet practices diverge due to varying national economic dependencies and environmental objectives. Financial institutions must align their sustainability and reporting frameworks to differing standards.

Geopolitical tensions and economic volatility

Geopolitical tensions and economic uncertainty will continue to shape APAC’s financial services sector in 2025. Ongoing US-China rivalry continues to generate volatility, disrupting markets and influencing strategic and regulatory shifts. Such tensions lead regulators to take decisive measures to insulate domestic markets from external pressures.

For financial institutions, the immediate consequence is heightened market unpredictability, complicating investment strategies and risk management.

Regulators across the region continue to prioritise measures that enhance market resilience. Markets such as Hong Kong and Singapore have seized upon regional instability to bolster their positions as stable financial hubs, tightening oversight around market conduct and systemic stability as part of broader efforts to enhance market resilience.

In some jurisdictions, such as India and Australia, banks continue to face increasing pressure to reinforce their capital buffers and liquidity profiles, as regulators demand them to demonstrate resilience against sudden capital flow reversals and sharp market swings. This raises compliance costs and operational complexity for cross-border institutions.

Other countries take a more competitive-driven approach. For example, South Korea, grappling with forex instability, has recently loosened rules for foreign exchange trading, inviting broader participation from foreign financial institutions to improve market depth. While these policies are beneficial in terms of raising market liquidity, these regulatory shifts also require banks to rapidly adapt trading strategies, risk frameworks, and operational setups.

Some major global banks in the APAC region have already begun pre-emptive operational restructuring, separating some of their eastern and western business units to isolate geopolitical risks and enhance efficiency. Such strategic repositioning is likely to become increasingly prevalent, reflecting the broader industry recognition that geopolitical tensions are not transient disruptions but long-term structural considerations.

The resulting regulatory divergence between countries forces banks and investment firms to deploy differentiated strategies tailored specifically to local contexts. This increases compliance and governance costs.

Financial institutions operating across the APAC region must now prioritise adaptability and resilience, embedding enhanced geopolitical risk assessments within their core strategies. Investment decisions, risk management frameworks, and operational models need increased sophistication, guided by detailed scenario planning.

Ultimately, institutions that can effectively navigate this fragmented regulatory landscape—by anticipating policy shifts while remaining agile—will be best positioned to sustain growth amid continuing geopolitical uncertainty.

Technological innovation and cybersecurity risks

Like most of the world, the APAC financial services sector is undergoing rapid technological transformation, embracing advancements such as artificial intelligence (AI), machine learning, and cloud computing to enhance operational efficiency and customer engagement. However, this digital evolution introduces heightened cybersecurity risks, compelling regulators and financial institutions to adapt swiftly.

The integration of AI and machine learning has already begun to revolutionise financial services, enabling personalised customer experiences and optimised decision-making processes. Some regulators, such as in China, are strongly promoting rapid innovation in AI development in the competitive race against the US. Other jurisdictions take a more measured approach. For example, last year the Reserve Bank of India (RBI) expressed concerns over financial stability risks associated with the growing use of AI, highlighting potential systemic issues arising from market concentration and the complexity of AI systems.​

A downside to rapid technological breakthroughs is that cyber threats have also escalated in their sophistication, with advanced persistent threats and ransomware attacks increasingly targeting financial institutions. The use of AI by cybercriminals has made scams, phishing and social engineering attacks more convincing, more sophisticated and harder to detect. A United Nations report revealed that cyber scammers in Southeast Asia stole up to $37 billion in 2023, utilising AI-driven crimes, including investment frauds. This figure is only expected to increase. More recently, there have been allegations that North Korea’s Lazarus Group orchestrated a significant hack on the cryptocurrency exchange Bybit, highlighting the growing threat of state-sponsored cybercrime.

Regulatory bodies across the APAC region are already implementing initiatives to address challenges posed by rapid technological advancements. For example, in Hong Kong, the government issued the Policy Statement on Responsible Application of Artificial Intelligence in the Financial Market in October 2024, urging financial institutions to balance innovation with risk management and emphasising human oversight. In India, the RBI plans to launch a pilot programme in 2025 that provides affordable local cloud data storage to financial firms, supports smaller institutions and aligns with the broader strategy for data localisation in the financial sector. Meanwhile, the Monetary Authority of Singapore (MAS) has been proactive in enhancing cybersecurity measures. In collaboration with the Association of Banks in Singapore, MAS announced that banks will progressively require customers to use SingPass face verification to prove their identities when setting up digital tokens, with the aim of protecting consumers from online scams.

Despite these efforts, challenges persist. A shortage of adequately trained cybersecurity professionals has left financial institutions in APAC increasingly vulnerable to cyberattacks. Experts emphasise the need for an industry-wide approach to ensure sufficient skilled personnel are available to protect banking services from cybercrime. 

Financial institutions must remain vigilant, investing in robust cybersecurity measures and talent development to navigate this evolving landscape effectively.

“With rapid digitalisation, APAC financial institutions must tackle rising cybersecurity risks and evolving financial crime threats. The winners will be those that embed smart compliance and resilient tech at the core of their strategy.”

Gregory Marchat, Group Head of Financial Services Advisory, Forvis Mazars in the UK

Financial crime and AML enforcement

Technological innovation plays a dual role in the financial sector. While it enhances AML compliance through tools like AI for improved monitoring and detection, it also opens new avenues for financial criminals. Rapid economic growth and technological advancements in APAC have created fertile ground for sophisticated financial crimes, compelling regulators and financial institutions to enhance vigilance and response strategies.

Recent trends show a surge in complex financial crime methodologies, including advanced money laundering techniques using digital platforms and cryptocurrencies to obscure illicit transactions. These developments underscore the need for financial institutions to continually update and strengthen their risk management programmes to address the evolving threat landscape.

Despite regulatory discrepancies and technical challenges, authorities across the APAC region are increasingly responding with heightened scrutiny and enforcement measures. In Singapore, for instance, efforts to combat money laundering have intensified through enhanced inter-agency data sharing, deregistering inactive companies, and encouraging businesses to report suspicious activities. This proactive stance follows significant money laundering scandals that have exposed vulnerabilities within the financial system.

More broadly, the Financial Action Task Force (FATF) has identified several jurisdictions in APAC with significant strategic deficiencies in their AML and CFT regimes. The FATF urges member countries to apply enhanced due diligence and, in severe cases, countermeasures to protect the international financial system from associated risks, with progress being observed in different countries.

This evolving landscape of financial crime in APAC necessitates a dynamic and proactive approach from both regulators and financial institutions. By strengthening internal controls, embracing technological advancements, and fostering collaborative information sharing, the financial sector can enhance its resilience against the multifaceted challenges of financial crime and AML enforcement.​

Operational resilience and third-party risk management

In 2025, operational resilience and third-party risk management have emerged as critical regulatory priorities across APAC’s financial sector, intensified by growing dependence on technology providers, fintech partnerships, and outsourcing arrangements. Financial institutions in the region now grapple with heightened expectations from regulators to ensure continuity of essential services amid increasing vulnerabilities from third-party relationships.

For example, the Monetary Authority of Singapore (MAS) has taken notable steps by reinforcing its guidelines on operational resilience, specifically targeting technology and outsourcing risks. On the back of this, in 2024 MAS conducted a business continuity exercise involving 20 key financial institutions from the banking, payments, securities, and insurance sectors to strengthen crisis management and operational resilience.

Similarly, the Hong Kong Monetary Authority (HKMA) has elevated third-party oversight, emphasising robust due diligence, regular audits, and clearly defined accountability structures in contracts with outsourced service providers. This was largely influenced by recent high-profile service disruptions involving major financial institutions, prompting the HKMA to advocate stronger internal governance and vendor risk assessment frameworks. In the last months, the HKMA has conducted industry sessions on mapping and testing and shared good practices for mapping interdependencies and scenario testing. It also shared best practices for managing cyber risk associated with third-party service providers.

In India, the Reserve Bank of India (RBI) has significantly strengthened its outsourcing guidelines in recent years, focusing heavily on data localisation and cybersecurity aspects. Foreign and domestic financial institutions operating in India must ensure critical data related to customer and financial operations remain domestically stored, a measure intended to protect against cybersecurity breaches but which also raises operational complexities for multinational institutions.

Australia’s regulator, the Australian Prudential Regulation Authority (APRA), has similarly advanced its operational resilience framework (final not yet in force), emphasising stringent third-party risk management and business continuity planning. Recent amendments to APRA’s prudential standards require institutions to integrate comprehensive third-party risk evaluations into their operational risk frameworks, driven by an increasing reliance on external technology providers.

For financial institutions, these evolving regulatory expectations demand heightened scrutiny of third-party relationships and enhanced governance processes. They must now invest significantly in technology solutions, risk assessments, and governance frameworks tailored specifically to manage vendor dependencies effectively. Cross-border institutions, in particular, face substantial challenges balancing varied jurisdictional requirements, necessitating a harmonised but flexible approach to compliance.

Ultimately, the enhanced regulatory focus on operational resilience across APAC underscores the imperative for financial institutions to not only respond swiftly to disruptions but proactively manage third-party relationships. Effective operational resilience frameworks are now fundamental to maintaining trust, operational continuity, and competitive advantage in a rapidly evolving digital landscape.

Climate change and sustainability

The impacts of climate change are a critical concern for APAC’s financial services sector. The region’s vulnerability to environmental risks has prompted governments, regulatory authorities and private entities to step up actions towards positive sustainability goals. These actions can be grouped into three categories: taxonomies, financial disclosures and financing.

Green, social or transition taxonomies help classify economic activities as sustainable or transitioning towards sustainability, Taxonomies play a critical role in directing capital flows towards sustainable and transitional activities and mitigating greenwashing risks. Nine countries in the APAC region, have developed or are in the process of developing sustainable finance taxonomies and ASEAN has developed a regional taxonomy.

There is significant alignment across these sustainability taxonomies; one area where there are clear differences however is sector coverage. Although differences may on the face of it pose additional compliance obligations for financial institutions; when identifying taxonomy-aligned investment opportunities these sector differences understandably reflect the distinct economic structures, stages of taxonomy development, and policy priorities in different APAC countries.

Four countries have, or are in the process of preparing, guidelines on transition finance to enhance uptake of that particular form of financing. This is not surprising given that transition investment is seen as being particularly acute in Asia; the region accounts for more than half of global carbon emissions.[1]

Clear and comprehensive climate disclosure requirements are important for companies to communicate their sustainability strategies and performance. This enables investors to assess the long-term viability and resilience of their investments. 19 APAC jurisdictions have climate-related disclosure regulations, of which 13 have already or are in the process of consulting on introducing the International Sustainability Standards Board (ISSB) aligned disclosure regulations. As London Stock Exchange research shows “ISSB regulations are coming fast to APAC.”

These regulatory pressures are driving financial institutions to improve their operational frameworks to identify, monitor and manage climate risks and underscore the critical need to enhance climate risk management strategies. Financial institutions must pursue significant capital investment in climate risk management and reporting systems to monitor and manage the increasing frequency and severity of climate events on their portfolios and inform future lending strategies. They need to invest significantly in advanced climate risk assessment tools and integrate comprehensive climate scenarios, such as those from the NGFS Phase V, into their risk management strategies. Additionally, banks must improve their data aggregation and reporting capabilities to meet stringent regulatory requirements.

The adoption of the global ISSB standards is also important for providing comparable investor information across different jurisdictions. Firms should see the increasing take-up by jurisdictions of a global baseline of sustainability-related disclosure standards as an opportunity to attract a wider pool of investors from outside the region.

Although recent geopolitical events may suggest that sustainability will drop down in firms’ priorities, the fact that the APAC region is particularly impacted by the effects of global warming[2] means that demand for financing in green and transition projects is only likely to grow. Annual financing needs just for climate adaptation projects is estimated to be between $102 billion and $431 billion. Nearly half of that is for coastal and river flood protection. This far exceeds the approximately $34 billion of tracked adaptation finance that was committed in the region in 2021–2022.[3] Considerable sums of transition financing will also be required to tackle hard-to-abate industrial sectors, retire particularly high greenhouse gas emitting infrastructure and shifting sectors to cleaner alternatives.

The developments in taxonomies and climate-related disclosure requirements highlight the strong regional shift that is taking place to ensure that sustainability is integrated into financial institutions financial and operational strategies. Financial institutions must recognise that aligning with environmental goals is both a regulatory requirement and a strategic financing imperative for long-term regional viability.

“Financial institutions that embed ESG into decision-making will drive long-term resilience, competitive advantage, and market trust.” 

Eleanor Wild, Assistant Manager- Sustainability Consulting, Forvis Mazars in Singapore

Implications of regulatory divergences on financial institutions operating regionally

Regulatory diversity across APAC can present substantial challenges for financial institutions operating regionally. Differing national regulations may increase operational complexity, raise compliance costs, and constrain the ability of firms to deploy consistent business strategies across markets.

To effectively navigate this environment, financial institutions can consider the following strategic actions:

• Modular compliance frameworks: Adopting flexible compliance structures that can swiftly adapt to jurisdiction-specific regulatory changes without compromising broader business efficiency.
• Enhanced local expertise: Strengthening in-country regulatory knowledge, allowing for early identification of regulatory shifts and proactive engagement with local authorities.
• Advanced regulatory technology (RegTech): Utilising automated compliance monitoring and analytics solutions to enhance accuracy, reduce manual workloads, and maintain transparency across jurisdictions.
• Robust risk scenario planning: Implementing scenario-based approaches to anticipate regulatory developments, enabling proactive management of compliance risks and operational impacts.
• Constructive regulatory engagement: Maintaining regular dialogue with local regulators to improve mutual understanding, positioning institutions as proactive, compliant, and committed to financial stability.

By embracing these targeted measures, institutions operating regionally can effectively manage regulatory complexity, enhancing resilience and strategic agility.

“The complex and fragmented APAC regulatory landscape requires international financial institutions to consider both global standards and local requirements. It is also about properly understanding the local nuances and regulatory intent, which starts with engaging proactively with the national supervisor.”

Eric Cloutier, Group Head of Banking Regulations/ Head of Global FS RegCentre, Forvis Mazars in the UK

Global regulatory influences and outlook

Looking ahead, APAC’s regulatory landscape will continue to be shaped by global developments, with similarities to EU, UK, and US regulations in areas like operational resilience, cybersecurity, data privacy, and ESG disclosures. However, the region’s diverse and local priorities make complete regulatory convergence unlikely. Regulators will continue to selectively integrate global practices to fit national objectives and local market conditions.

Financial institutions must maintain flexible compliance infrastructure that accommodate both international best practices and local requirements. Success will come to those who proactively manage complexity, invest in strategic compliance infrastructure, leverage technology, and maintain strong regulatory relationships. This proactive approach will ensure competitiveness in a dynamic and fragmented regulatory environment.

[1] Asia leads the way as transition finance seeks to plug the net-zero investment gap | Fidelity Hong Kong; [2] https://www.germanwatch.org/en/19777 – Global Climate Risk Index 2021; [3] Asia-Pacific Climate Report 2024: Catalyzing Finance and Policy Solution—Highlights