Fintech business model regulation in Iraq often turns on a deceptively simple distinction: is the business supplying infrastructure to regulated institutions, or is it providing a financial service to the public? Infrastructure providers build the rails, software and connections that banks and licensed payment providers use. Financial service providers deal with customers, hold or move their money and take responsibility for the outcome of transactions. The two may look similar from a technical perspective, and many businesses combine elements of both, but the regulatory consequences are very different.
A business that is genuinely infrastructure may be able to operate under contracts with licensed institutions, subject to outsourcing and information security requirements imposed on those institutions. A business that is providing a financial service will usually need its own authorisation from the Central Bank of Iraq or another regulator, with capital, governance, safeguarding and consumer protection obligations. Defining the model accurately before regulatory review saves time and avoids a mismatch between the licence sought and the business actually conducted.
The Central Bank of Iraq Law No. 56 of 2004 gives the Central Bank authority over the payment system and its participants. The electronic payment services regulation issued in 2024, which replaced Regulation No. 3 of 2014, and Central Bank instructions govern the licensing of payment service providers and the outsourcing obligations of licensed institutions. The Banking Law No. 94 of 2004 reserves banking business to licensed banks. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 applies to entities that deal with customers or their funds, and the Iraqi Civil Code No. 40 of 1951 governs the contracts that allocate responsibility between participants.
Why the distinction matters in fintech business model regulation in Iraq
The distinction determines who the regulator holds accountable. Where a bank uses a technology company's platform to offer a payment service, the regulator will normally look to the bank as the service provider and expect the bank to manage the technology company as an outsourced supplier. Where the technology company itself offers the service to customers, collects their funds or decides whether transactions proceed, the regulator may view it as a provider in its own right.
The consequences flow into every part of the business: capital requirements, governance, reporting, data protection, complaint handling and liability for failed or fraudulent transactions. They also affect valuation and fundraising, because investors will want to know whether the business depends on a licence it does not yet hold.
Indicators of an infrastructure model
A business is more likely to be treated as infrastructure where several of the following features are present:
- No direct customer contract. End users contract with the bank or licensed provider, not with the technology company.
- No control of funds. Customer money never passes through accounts held or controlled by the technology company.
- Instructions originate with the licensed party. The technology executes instructions issued by the licensed institution rather than making its own decisions about transactions.
- Branding and disclosure. Customers are told clearly which licensed institution provides the service.
- Liability rests with the licensed party. The licensed institution bears responsibility to customers, with recourse against the supplier under contract.
Indicators of a financial service
Conversely, regulators will tend to view a business as providing a financial service where:
- It onboards customers. It collects identity information, accepts customers and sets the terms of their relationship.
- It holds or controls funds. Customer money passes through its accounts, even briefly.
- It sets limits and approves transactions. It decides whether payments proceed or are blocked.
- It charges customers directly. Fees are paid by end users to the business.
- It markets the service under its own name. Customers perceive the business as their provider.
Few businesses fall neatly into one category. The analysis should consider the overall substance rather than a single feature.
The role of settlement and fund flows
Settlement arrangements are often decisive. A model in which a technology company aggregates merchant payments in its own account and then pays merchants is functionally different from one in which the acquiring bank settles directly with merchants and the technology company merely transmits data. The first involves holding funds and creates exposure for merchants if the technology company fails. The second does not. Mapping who holds funds at each point, and for how long, is essential to the analysis.
Contractual architecture
Where a business intends to operate as infrastructure, its contracts must support that characterisation. Agreements with licensed institutions should make clear that the institution provides the regulated service, owns the customer relationship, retains control over key decisions and bears regulatory responsibility. The technology company's obligations should be framed as service levels, security standards and cooperation with audits and regulatory requests. Commercial contract advice in Iraq can help ensure that contracts reflect the intended allocation and survive regulatory scrutiny.
Contracts cannot, however, change the substance. If in practice the technology company decides which customers are accepted and controls fund flows, a contract describing it as a supplier will not prevent the regulator from treating it as a provider.
Hybrid models and phased strategies
Many fintech businesses start as infrastructure for licensed partners and later seek their own licence to offer services directly. Others operate both models simultaneously, supplying white-label technology to banks while offering their own branded product under a licence. Hybrid models require careful separation: different contracts, different customer disclosures and, often, different legal entities. Corporate advice in Iraq can assist in structuring separate entities where one business line is regulated and another is not.
Preparing for regulatory review
When presenting a model to the Central Bank, a business should provide a clear narrative supported by diagrams of customer relationships, fund flows, data flows and decision points. It should identify the licensed institutions involved, explain the contracts that govern the relationships and describe how customers are informed. Ambiguity in the presentation is likely to be resolved against the applicant, so precision matters.
Implications for licensed partners
Banks and licensed payment providers using third-party technology should also analyse the model. If the regulator concludes that their supplier is in fact providing a regulated service, the partner may be criticised for facilitating unlicensed activity. Partners should therefore satisfy themselves that the arrangement is properly structured, that they retain genuine control and that their outsourcing obligations are met.
Illustrative example. A technology company builds a merchant payment platform that allows small shops to accept QR code payments. In its first design, customer payments flow into the company's own bank account and are paid out to merchants weekly. Review identifies this as holding funds and providing a payment service. The company redesigns the model so that an acquiring bank contracts with merchants, receives payments into merchant settlement accounts and pays merchants directly, while the company provides the platform under an outsourcing agreement with the bank. The redesigned model is presented to the bank's regulator as part of the bank's outsourcing notification.
Key takeaways
- Fintech business model regulation in Iraq depends on whether the business supplies infrastructure or provides a financial service to customers.
- Control of customer funds, customer contracts and transaction decisions are the strongest indicators of a regulated service.
- Contracts must reflect, but cannot override, the substance of who does what.
- Licensed partners share the risk of misclassification and should verify the structure.
How Etihad Can Help?
Clarity on fintech business model regulation in Iraq allows founders, investors and licensed partners to choose the right regulatory path, structure contracts appropriately and present a credible case to the Central Bank of Iraq.
Etihad Law Firm advises technology companies, banks and payment providers on regulatory classification, partnership structures and outsourcing arrangements in Iraq. We help clients define their models precisely and align their documentation with regulatory expectations.