The regulatory perimeter is the boundary that marks which financial activities, products and firms fall inside the scope of financial regulation and which do not. Inside it, a firm generally needs authorisation, must meet rules on capital, conduct and reporting, and is overseen by a supervisor. Outside it, the same business may run with few or no financial-specific rules. Legislators set the perimeter, and regulators interpret it and watch its edges.
The perimeter is drawn mostly around activities, such as taking deposits, transmitting money or dealing in securities, rather than around company names, so the question is usually what a firm does. The idea is linked to, but not the same as, regulatory arbitrage, which is the deliberate structuring of a business to land on the lighter side of a rule or across a border.
Regulatory perimeter in plain terms
Think of a fenced playing field with a referee. Players on the field must follow the rules, wear the right kit and accept penalties. A game of the same sport in the car park next door has no referee at all. Nothing stops people from playing there, and some of the most exciting moves happen there, but if someone is hurt there is nobody to call a foul.
Finance has many such fields, and the fence is written into laws. When the rules inside become strict or costly, some play drifts out to the car park, where it can grow large before anyone notices. Regulators spend much of their time looking over the fence, asking whether the game outside has become big or risky enough that the fence should be moved.
How the perimeter is drawn
Most jurisdictions list regulated activities in statute and require a licence for anyone carrying them on as a business. In the United Kingdom, the Financial Services and Markets Act 2000 sets out regulated activities, and the Financial Conduct Authority publishes a Perimeter Guidance manual to help firms judge whether they are caught. In the United States the perimeter is split between federal and state law, so a firm may need a federal bank charter, a money transmitter license in each state, or registration with a securities regulator, depending on its activity. A licensable activity in one country may be an unlicensable activity in another, and exemptions, such as limited-network or agent arrangements, carve out further space.
Why activity migrates outside it
Banks inside the perimeter face capital, liquidity and deposit-protection rules. When those rules tighten, credit and funding can move to institutions that perform similar functions without the same requirements. This is the core of shadow banking, now usually called non-bank financial intermediation (NBFI), which includes money market funds, hedge funds, securitisation vehicles and private credit lenders. The Financial Stability Board has reported that such institutions hold close to half of global financial assets.
Activity can also start outside the perimeter simply because the law predates it. Early crypto-asset exchanges, peer-to-peer lenders and interest-free instalment credit all grew before rules were written for them. The risks are familiar: leverage, maturity mismatch and runs, without access to central bank support or deposit insurance. Because these firms are linked to banks through lending, funding and derivatives, stress outside the perimeter can quickly travel back inside it, which is why supervisors monitor the whole system rather than only the firms they license.
Moving the perimeter
After the 2008 financial crisis, which exposed large risks building outside bank regulation, several reforms widened the perimeter:
- The Dodd-Frank Act of 2010 created the Financial Stability Oversight Council, which can designate non-bank firms for Federal Reserve supervision; AIG, GE Capital, Prudential and MetLife were designated, and all of those designations had been rescinded or overturned by 2018.
- The European Union's Markets in Crypto-Assets Regulation (MiCA) brought crypto-asset issuers and service providers inside a single EU framework, fully applying from 30 December 2024.
- In the United Kingdom, third-party buy now, pay later credit, previously exempt, came under FCA regulation on 15 July 2026.
Regulators also use tools that sit at the edge of the line. A regulatory sandbox lets new firms test products under supervision before full authorisation, and the FCA has published regular perimeter reports listing areas where it has concerns but no powers.
Enforcement at the boundary
Firms that wrongly assume they sit outside the perimeter can face criminal or civil action. In the United States, operating without a required licence can amount to unlicensed money transmission, a federal offence. Elsewhere, regulators issue public warnings about unauthorised firms and can seek court orders to stop them trading.
The perimeter is also criticised from both directions. Some argue it is drawn too narrowly, letting risk build where supervisors cannot see it; others say widening it too quickly locks out new entrants and simply pushes activity to another jurisdiction or a new legal form. Most regulators now aim for "same activity, same risk, same rules", applying comparable requirements to any firm that performs a given function regardless of its legal label.