Fintech companies face a wide range of regulatory bodies and rules including banking laws, consumer protection disclosure requirements, prohibitions on unfair, deceptive or abusive practices, and anti-money-laundering rules. Companies that operate internationally are subject to each country's financial regulations, as well as rules that force them to store citizens' data within that country.

Data localization makes it difficult, if not impossible for fintech to process data, according to the report, and does little to protect customers' privacy. Instead, ITIF asserts that data localization policies are the result of “misguided self-interest: By creating rules that advantage domestic firms over foreign firms, many countries believe they will build a stronger domestic tech industry or gain short-term economic value, such as jobs in domestic data centers.”

Finally, the process of getting a rule passed in the United States is itself too slow, as regulators have to propose a rule, allow for public comment and review those comments before issuing a final rule.

“These rules are often decided without regulators receiving real-world feedback about regulatory effects, and once decided, rules are rarely revisited. As one regulator explains, this process increases the pressure for regulators to get the rules right the first time to avoid 'protracted litigation over authority,' which further increases the time it takes to implement them,” the authors wrote.

ITIF recommended 10 principles policymakers should consider as they develop fintech regulations.

1. Support fintech transformation. Governments themselves should be early adopters of fintech to promote broader adoption, for example, allowing citizens to pay taxes and purchase hunting and fishing licenses on the same online platform, the report suggested.

Governments can also look to fintech solutions to improve reporting and data management. ITIF pointed to Estonia, which adopted blockchains earlier this year to secure patient health records.

Critically, governments should fund research and development for fintech solutions, including those to address cybersecurity. “Government investment in R&D played a key role in developing various technologies, such as smartphones and the internet,” according to the report. “Because early-phase technology research often proves concepts rather than creates commercially viable products and can exhibit significant spillovers, firms are likely to underinvest.”

2. Ensure regulations encourage innovation. Policymakers need to “draw clear boundaries and set priorities” for innovations that warrant a greater level of scrutiny, ITIF wrote. “The goal of this prioritization is to signal to the market that a company is not necessarily going to be subject to regulations just because it is tangentially related to fintech.”

3. Eliminate redundant regulations. Consumer disclosure and anti-money laundering are two areas where fintech firms may find themselves responding to multiple regulators. “Where there is a lot of overlap, policymakers should strive to coordinate and centralize these activities to streamline the process and reduce the regulatory burden on fintech companies.”

4. Regulate fintech at the national level. ITIF called for states to defer to national regulators regarding fintech, or to collaborate on a single approach.

5. Create incentives for fintech companies to protect consumers. Regulators can go too far and punish companies acting in good faith, the report noted, which could limit innovation if organizations spend more time and money on compliance than development. “To maximize its effectiveness and minimize any negative effects, any agency action should create a system of incentives that promotes desirable behavior and discourages undesirable behavior in a marketplace.”

Furthermore, regulators should consider whether a company acted intentionally or negligently in wrongdoing and whether customers were actually harmed before issuing enforcements, according to the report.

6. Create tech-neutral rules. Rules shouldn't favor one type of application more or less than another. “For example, virtual currency businesses often function similarly to mobile payment businesses and transfer services. Each of these types of businesses should function under similar rules,” according to the report.

7. Encourage a level playing field between incumbents and new entrants. Credit unions are held to rules that startups can avoid, the report claimed. Similar to rules that are tech-neutral, regulations should police companies that offer comparable products and services, regardless of their size or age, by similar rules.

8. Promote cybersecurity in fintech. Rather than setting prescriptive standards, ITIF recommended regulators create incentives for firms to improve their cybersecurity policies.

9. Support standards development and financial data interoperability. ITIF encouraged governments and the private sector to work together to standardize data that is shared and harmonize definitions.

“Though industry should lead standards development and harmonization, national governments can bring together disparate market players across different financial services industries, standards bodies, and encourage and promote interoperability across different types of financial data,” according to the report.

10. Promote harmonization of international regulations. Harmonization should also occur between different countries, ITIF wrote. Digital currencies and online marketplaces have already lowered barriers to trade between global users. Regulations regarding routing transactions, transparency, anti-money laundering, regulatory compliance and access to data for law enforcement should follow, according to the report.