Fintech for an SME finance lead: the risks segment by segment, and what to check before signing

A payments platform offers your firm an advance: a fixed fee, repaid as a fixed share of the sales that pass through the platform. That is how PayPal's 10-K, its annual report filed with the US Securities and Exchange Commission, describes PayPal Working Capital for small and medium-sized businesses (PayPal Holdings, Inc., 2026, pp. 7, 100). Suppose you are the finance lead of a small or medium-sized enterprise (SME) and must answer within the week. Is this a payment service, a loan, or both? This post sorts fintech into six segments, pairs each with the risks that public sources describe, and ends with checks to run before you sign. It endorses no product.

What are the fintech segments, and who drew them this way?

This site's library splits the fintech ecosystem into six segments: digital payments, lending and crowdfunding, insurtech, regtech, blockchain and crypto-assets, and AI and data. The library records Philippon (2016) as the origin, but his paper only gives examples: cryptocurrencies and blockchain, digital advice and trading, AI and machine learning, peer-to-peer lending, equity crowdfunding, mobile payments (Philippon, 2016, p. 3). The six-way split is the library's grouping.

The Financial Stability Board (FSB) sorts by function: payments, clearing and settlement; deposits, lending and capital raising; insurance; investment management; market support (Financial Stability Board, 2017, p. 8). I find that split more useful for an SME finance lead, because your questions are who holds the money, who scores the credit and who absorbs the loss. The FSB defines fintech as technology-enabled innovation in financial services that could result in new business models, applications, processes or products (Financial Stability Board, 2017, p. 7).

What are the risks of each segment, and what should I check?

Payments and lending touch an SME's cash flow directly and have the most evidence in what I read. The other four segments have thinner sources; the right-hand column is my own judgement, not a finding of the sources.

In 2017 the FSB concluded that fintech posed no compelling financial stability risk (Financial Stability Board, 2017, p. 1) and that activity was small but growing fast (Financial Stability Board, 2017, p. 16). That is the view of an authority watching the whole system. For one SME, a cut credit line or a frozen wallet is a firm-level risk: small for the system, large for your cash flow (my inference).

What does PayPal Working Capital show about how a payments platform lends to SMEs?

According to the 10-K, PayPal ties the loan to the sales a business runs through PayPal. A business takes a loan or a cash advance (depending on country) for a fixed fee; the amount is a percentage of its annual payment volume processed by PayPal, and the fee reflects the overall credit assessment of the business (PayPal Holdings, Inc., 2026, pp. 7, 100). Repayment is a fixed percentage of future PayPal volume. The general requirement is that at least 10% of the original amount plus the fee is repaid every 90 days, and the percentage is set so that repayment is generally expected within 9 to 12 months (PayPal Holdings, Inc., 2026, p. 100).

In the US the filing says the product runs under an agreement with a state-chartered industrial bank, and PayPal itself says that if its partner bank's ability or willingness to lend were terminated or interrupted, its ability to offer the product could be interrupted or limited (PayPal Holdings, Inc., 2026, p. 22). The filing also warns that its risk models may not accurately predict the creditworthiness of a merchant (PayPal Holdings, Inc., 2026, p. 22). The allowance for credit losses on its merchant loans, advances and fees receivable (covering PayPal Working Capital and PayPal Business Loan) rose from $113 million to $170 million in 2025; the filing attributes the rise to growth of the portfolio and to a decline in credit quality, primarily from modifications to acceptable risk parameters in 2024, which included broadened eligibility (PayPal Holdings, Inc., 2026, p. 101).

A hypothetical example; every number is mine. The 10-K gives no fee levels, so do not read the 6% below as PayPal's price. A firm takes a 500 million dong advance with a fixed 6% fee (30 million), repaid in equal monthly amounts. I compute the monthly internal rate of return and multiply by 12:

With the same fee, fast sales mean fast repayment and a higher effective price. This is my arithmetic on the mechanism the 10-K describes, assuming equal instalments; on a real contract, repayments follow daily sales. For the working-capital side of this problem, see profit but no cash and the map of start-up funding sources.

What has platform-data credit scoring actually shown?

Two papers from the Bank for International Settlements (BIS) show that platform-data scores predicted better in two specific datasets. Frost and co-authors (2019) studied Mercado Libre in Argentina: on the credit bureau alone, 30% of the target audience would be rated "high risk" and excluded; loss rates (loans more than 30 days past due relative to origination volume) under the internal rating range from 0.0% to 10.2%, against 0.7% to 2.8% under the bureau rating, and the authors say it remains to be verified over a full cycle (Frost et al., 2019, p. 17). Borrowers who used credit saw the value of products sold in the following year grow by 75 to 79 percentage points more than non-users (Frost et al., 2019, p. 22), but the authors do not demonstrate causality: credit may simply have gone to firms with better prospects (Frost et al., 2019, p. 7).

Gambacorta and co-authors (2019) use personal loans, not SME loans, from an anonymous Chinese fintech between May and September 2017 (Gambacorta et al., 2019, p. 8). The machine-learning model reached an AUROC of 0.639 (0.5 is random guessing, 1 is perfect), against 0.594 for a model using bank-style information (Gambacorta et al., 2019, p. 13); after the November 2017 regulatory shock, the machine-learning model also predicted better (Gambacorta et al., 2019, p. 5). The advantage narrows as the borrower's banking relationship gets longer (Gambacorta et al., 2019, p. 5). My inference is that an SME with a long bank history gains least, but the sample is not SMEs, so that is a hypothesis.

In Vietnam, what framework applies to SME borrowing via fintech, as of 3 November 2026?

There is one testing framework, and in the sources I read no peer-to-peer lender is named as admitted. Decree 94/2025/ND-CP (signed 29 April 2025), in force from 1 July 2025, lets firms test three kinds of solution: credit scoring, data sharing through open APIs, and peer-to-peer lending (Art. 1 and Art. 25 (Government of Vietnam, 2025)). Testing lasts at most two years and is domestic only (Art. 6). Borrowers can be Vietnamese legal entities other than credit institutions, or Vietnamese citizens; loan contracts run up to two years; and a peer-to-peer fintech may not be a foreign-invested enterprise (Arts 3 and 11). Being admitted to testing does not mean the firm already meets the legal business and investment conditions; a firm not yet approved must follow the existing rules on enterprises and investment (Art. 5).

Under Decision 2866/QĐ-NHNN (22 July 2025) the ceilings are VND 100 million outstanding per customer on one platform and no more than VND 400 million across all sandbox platforms (Báo điện tử Chính phủ, 2025). Thời báo Ngân hàng reported on 4 October 2026, summarising a Banking Academy report on innovation in finance and banking, that results after a little over a year were "relatively modest": credit scoring and open API had received two files, processed and returned; peer-to-peer had 13 of 16 valid files under appraisal (Thời báo Ngân hàng, 2026). Decree 382/2026/NĐ-CP (6 October 2026) changes how filings are sent, drops some documents from the dossier and amends the conditions for the legal representative or chief executive of a fintech company, as summarised by Báo điện tử Chính phủ, the Government's online newspaper (Báo điện tử Chính phủ, 2026); I have not read the decree text.

With ceilings of VND 100 million per platform and VND 400 million across all platforms, this framework cannot serve a funding need above VND 400 million, and a need above VND 100 million would have to be split across platforms. For a platform that calls itself peer-to-peer and is not on the sandbox list, I have no source saying whether that is lawful; ask a lawyer before sending money.

What five questions should you ask before signing with a fintech provider?

This list is my judgement, built on the risks the sources name above.

1. On paper, who is the lender or the holder of the money: a licensed bank, or the platform itself?
2. What is the annualised cost under two sales scenarios, strong and slow?
3. What lets them cut the limit, freeze a balance or re-score me, and with how much notice?
4. What data of mine enters the model, and if I leave, where do my limit, history and data go?
5. If the platform or its cloud provider fails or is attacked, where are my money and data? The FSB put third-party operational risk and cyber risk among its three priorities for international cooperation (Financial Stability Board, 2017, p. 30).

Going deeper: where do these sources come from, and what do they not show?

Philippon (2016) is a working paper of the US National Bureau of Economic Research (NBER), prepared for the 2016 BIS annual conference, and NBER states that working papers are not peer-reviewed (Philippon, 2016, p. 1). His argument: the unit cost of financial intermediation in the US has hovered around 2% for over a century, and IT progress has not reached end users (Philippon, 2016, p. 4); fintech can bring deep change but raises regulatory challenges (Philippon, 2016, p. 2). Limits: US data, nothing on SMEs, nothing on Vietnam.

The FSB (2017) says its analysis concentrates on conceivable benefits and risks, since probabilities cannot yet be gauged (Financial Stability Board, 2017, p. 7). Its figures are old: fintech credit was 1.4% of the stock of UK bank credit to consumers and SMEs at end-2016 (Financial Stability Board, 2017, p. 40). One co-author of Frost and co-authors is employed by Mercado Libre and holds an investment in it (Frost et al., 2019, p. 3). Gambacorta and co-authors use one anonymous firm and five months of lending data; they also note that the link between borrower characteristics and default may not be stable, so how machine learning performs under stress remains to be fully explored (Gambacorta et al., 2019, p. 15).

The Organisation for Economic Co-operation and Development (OECD) reports that the stock of SME loans in the Scoreboard countries fell 4.7% in 2023, mainly on the supply side and from bank concerns about default risk (OECD, 2025, p. 7). It asks countries to report SME loan volumes from fintech firms whenever available (OECD, 2025, p. 35). My sources do not give prices, approval rates or default rates for Vietnamese SMEs borrowing through fintech, and say nothing on insurance, compliance or crypto-assets in Vietnam. On the loan-versus-equity choice, see borrow or sell shares.

What did I read?

I read Philippon (2016), the Thời báo Ngân hàng article (4 October 2026) and the two Báo điện tử Chính phủ articles (18 September 2025 and 7 October 2026) in full. The FSB (2017) I read in part: the executive summary, sections 1 to 5, Annexes A to C closely and D to H quickly, through an automatic text conversion that shortened some long paragraphs; I cite only sentences I saw. Frost and co-authors (2019): the text through the conclusion, not the tables closely. Gambacorta and co-authors (2019): the first 21 pages, not the end. PayPal's 10-K: the business section, two risk-factor passages on credit and partners, and the note on merchant receivables, not the whole filing. OECD (2025): the executive summary, pages 7 to 11 and the recommendations in Annex A. Decree 94/2025: an unofficial English translation, about 300 of 787 lines plus keyword searches; I did not read the official Vietnamese text. Page numbers for the BIS, NBER and OECD papers are PDF page numbers; FSB page numbers are those printed in the report. I did not read later journal versions. Worth rechecking after 3 November 2026: the status of sandbox applications, the text of Decree 382/2026 and PayPal's newer filings.