Fintech Displacement

Q1 trajectory - DORA's January 2025 application date prompted most large fintechs to expand ICT risk mandates into the CRO function; by Q1 2026 NCA supervisory letters were requiring documented ICT risk appetite statements signed by named senior risk executives, anchoring the role rather than displacing it.

Q2 trajectory - Active DORA enforcement from Q1 2026, including the Register of Information scrutiny and third-party concentration assessments, prompted boards to demand CROs with hybrid technology-and-risk profiles; traditional CROs lacking ICT fluency faced lateral reassignment or mandate contraction ahead of Q3.

Q3 catalyst - The Digital Omnibus ambiguity over EU AI Act high-risk deadlines (formal OJ publication outstanding as at Q3 2026) requires the CRO to own the compliance position decision; firms that treat the August 2026 nominal date as live and those banking on the December 2027 deferral require materially different risk postures, making CRO judgement - and accountability - central to board strategy.

Q1 trajectory - CASP MLRO demand accelerated through H2 2025 as MiCA registration timelines compressed; by Q1 2026 Lithuanian, Cypriot, and Irish NCAs were rejecting fit-and-proper applications lacking blockchain-specific AML experience, effectively bifurcating the MLRO market between traditional FSI-credentialled officers and crypto-native compliance professionals.

Q2 trajectory - FD Capital and finconduit data from May 2026 confirm vacancy durations for MLRO appointments at UK and EEA fintechs running at 6-12 months, with salary compression at the top of bands as firms bid competitively; the DORA ICT third-party compliance overlap is pushing MLROs into vendor risk territory previously owned by technology risk teams.

Q3 catalyst - EU AI Act Annex III obligations, if enforced from August 2026 under current law, require post-market monitoring and human oversight documentation for AI-based AML screening, adding a direct reporting burden to the MLRO function; simultaneously the FCA's June 2026 AI industry engagement signals similar accountability expectations in the UK, meaning dual-jurisdiction fintechs face stacked obligation sets.

Q1 trajectory - The role barely existed as a standalone function across European fintech before H2 2025; most firms delegated AI model risk to the CRO or CDO, with no dedicated P&L-independent accountability; following the EU AI Act's GPAI provider obligations (applied August 2025) a small cohort of larger fintechs began ring-fencing AI governance headcount.

Q2 trajectory - The Digital Omnibus provisional agreement in May 2026 created uncertainty about whether the August 2026 high-risk deadline was live, causing some firms to pause hiring while others accelerated, reasoning that proactive governance infrastructure would be required regardless of the final deferral outcome; FCA SM&CR personal liability considerations in the UK are an independent driver maintaining demand.

Q3 catalyst - The Director of AI Governance role is in active formation: firms subject to both EU AI Act (Annex III, credit and fraud AI) and DORA (AI-driven ICT incident classification tools) now face a compliance architecture that cannot be satisfied by CRO or CDO dual-hatting alone; expect Q3 to see the first wave of permanent mandate definitions and external search briefs for this role across tier-one European fintechs.

Q1 trajectory - EU AI Act conformity assessment requirements for high-risk AI embedded in consumer-facing fintech products (credit decisioning, robo-advice) began forcing CPOs to engage compliance teams at product architecture stage rather than at release; this redefined the CPO's operating model but did not eliminate demand for the function.

Q2 trajectory - DORA's operational resilience requirements are now surfacing in product design: CPOs at payment fintechs are being held accountable for third-party API dependency concentration in product stacks; boards are demanding CPOs who can articulate resilience trade-offs alongside feature velocity, materially changing hiring criteria.

Q3 catalyst - FCA outcomes-based AI review, if it produces guidance before year-end as signalled in June 2026, will require CPOs at UK fintechs to demonstrate that AI-powered product features were designed with consumer outcome testing built in; this is likely to accelerate the displacement of CPOs with pure product-growth backgrounds in favour of those with regulatory design literacy.

Q1 trajectory - The EU instant payments regulation (fully applicable from January 2025 for payment service providers) required fintechs to retrofit IBAN verification and fraud screening into real-time rails; Heads of Payments with scheme management and regulatory liaison credentials saw mandate expansion through H1 2025.

Q2 trajectory - AI-driven fraud detection systems now handling routing and screening decisions at scale are reducing the transactional judgement component of the Payments leadership role; the role is increasingly supervisory and vendor-governance-oriented rather than operationally hands-on, with consequent pressure on traditional payments executives without AI literacy.

Q3 catalyst - DORA's ICT third-party oversight requirements apply directly to payment scheme connectivity and cloud-hosted payment processing; Heads of Payments at EU-regulated fintechs are being drawn into DORA compliance workstreams that sit outside their traditional remit, creating a mandate stretch that either elevates or marginalises incumbents depending on their adaptability.

Q1 trajectory - DORA's ICT risk management requirements placed the CTO formally within the regulatory accountability chain for the first time at many fintechs; NCAs reviewing Register of Information submissions in Q1 2026 were naming the CTO or equivalent as the expected signatory on third-party concentration assessments.

Q2 trajectory - The EU AI Act GPAI and high-risk model documentation obligations - irrespective of the Digital Omnibus deferral status - require the CTO to maintain technical documentation demonstrating AI system architecture, data governance lineage, and human oversight mechanisms; this is a net mandate expansion but one requiring significant upskilling in regulatory documentation disciplines.

Q3 catalyst - FCA's long-term AI review and SM&CR personal liability architecture mean UK fintech CTOs face a dual burden: internal AI governance documentation and external regulatory accountability; the August 2026 period is likely to produce the first formal FCA supervisory engagements specifically targeting CTO-owned AI infrastructure, setting precedent that will redefine the role's risk profile across the sector.

Q1 trajectory - EU AI Act Annex III obligations for high-risk AI systems include data governance requirements - training data relevance, representativeness, and bias testing - that land directly on the CDO function; by Q1 2026 CDOs at fintechs with credit scoring and fraud AI were building dedicated AI data quality frameworks separate from existing data governance programmes.

Q2 trajectory - DORA data classification and ICT asset register requirements are pulling CDOs into operational resilience workstreams; the overlap between data governance (CDO) and ICT risk (CTO/CRO) is producing board-level debates about mandate boundaries, with some fintechs consolidating into a combined Chief Data and Technology Officer role.

Q3 catalyst - The Digital Omnibus uncertainty means CDOs must maintain August 2026-ready documentation postures for EU AI Act high-risk data obligations while simultaneously preparing for possible December 2027 re-scoping; firms that defer preparation risk supervisory disadvantage if OJ publication confirms the earlier date; the CDO's capacity to hold this ambiguity and advise the board accordingly is the defining Q3 capability test.