Crypto and fintech firms have adopted automated decision-making faster than almost any other part of the financial services sector. Appropriateness assessments completed by algorithm. Fraud detection systems that flag transactions in real time. Customer segmentation models that determine which products are shown to which customers. Risk scoring systems that influence credit decisions or investment access.
Each of these is an automated decision – a decision made about an individual using personal data, without meaningful human review. And each of them may trigger specific obligations under UK GDPR Article 22 that most firms have not addressed.
This piece covers what Article 22 requires, where crypto firms are most exposed, and what needs to be in place. It is distinct from earlier GDPR pieces in this series — those covered lawful basis for onboarding and direct marketing consent. Article 22 is a separate provision with its own requirements and its own exposure profile.
What Article 22 Actually Says
Article 22 of UK GDPR gives individuals the right not to be subject to a decision based solely on automated processing — including profiling – which produces a legal or similarly significant effect on them, unless one of three conditions applies.
The three conditions are: the decision is necessary for the performance of a contract; the decision is authorised by law; or the individual has given explicit consent.
Where one of these conditions applies, the firm is still required to implement safeguards — including the right for the individual to obtain human intervention, to express their point of view, and to contest the decision.
The phrase “legal or similarly significant effect” is broader than it might first appear. The ICO’s guidance makes clear that it includes decisions that significantly affect an individual’s access to financial products or services, their financial circumstances, or their ability to participate in economic life. An automated appropriateness assessment that prevents a customer from accessing a crypto product has a similarly significant effect. An automated fraud flag that freezes a customer’s account has a similarly significant effect.
Where Crypto Firms Are Exposed
Appropriateness assessments. The FCA requires firms to complete appropriateness assessments before a retail customer can proceed with a crypto investment. Many firms have implemented these as fully automated systems — the customer answers questions, the system scores the responses, and a decision is produced without any human review. Where the decision is adverse — the customer fails and is prevented from investing — this is a solely automated decision with a similarly significant effect. Article 22 applies.
Fraud and transaction monitoring. Real-time fraud detection systems make automated decisions about individual transactions — flagging, delaying, or blocking them based on algorithmic analysis. Where a system automatically blocks a transaction or restricts a customer’s account without human review, this is a solely automated decision with significant financial consequences. Article 22 applies.
Customer segmentation and product targeting. Algorithmic segmentation — systems that determine which products are presented to which customers, what offers are made, what pricing applies — may produce similarly significant effects where the segmentation results in a customer being excluded from certain products or offered materially different terms.
Credit scoring and lending decisions. Crypto and fintech firms that offer lending, margin, or credit products and use automated credit scoring will typically be subject to Article 22 for the credit decision itself. This is an area where the ICO has been most active in financial services enforcement.
The Right to Human Intervention
Where Article 22 applies, the individual has the right to obtain human intervention in the decision, to express their point of view, and to contest the decision.
This is not a theoretical right. The firm must have a functioning mechanism through which it can be exercised. For a crypto firm running automated appropriateness assessments, this means a customer who fails must be able to request a human review of that decision, must be told how to do so, and must receive a genuine human review — not an automated re-run of the same assessment by a different name.
The failure mode the ICO finds most often is not that firms are unaware of the right — it is that no practical mechanism exists for exercising it. The website says “contact us if you have questions about your assessment” but there is no process behind that statement, no trained staff to conduct a review, and no documented outcome when one is requested.
Worth asking:
Do your automated appropriateness assessments include a disclosure to customers that the decision is automated, an explanation of the factors considered, and a clear mechanism for requesting human review of an adverse outcome? If not, Article 22 is not being met.
Transparency and the Right to Explanation
Article 22 requires that where automated decision-making is used, the individual must be informed of this fact, given meaningful information about the logic involved, and told about the likely consequences of such processing for them.
A general statement that “we use automated systems to process your data” does not satisfy the standard. The information must be meaningful enough that the individual can understand how the decision is being made and, where the decision affects them adversely, can assess whether to exercise their right to human intervention.
For appropriateness assessments specifically, the transparency obligation means telling customers: that the outcome of the assessment is determined by an automated system; what factors the system considers; what the likely consequences of different outcomes are; and how they can request human review if they receive an adverse outcome.
What Needs to Be in Place
For each automated decision-making system a crypto firm operates, the compliance framework should address:
Identification. Has the firm identified which of its systems make automated decisions with legal or similarly significant effects? This requires mapping the firm’s automated systems against the Article 22 threshold.
Condition for processing. Where Article 22 applies, which of the three conditions is the firm relying on? For most crypto firms, the most likely conditions are contract necessity for decisions integral to the service — such as fraud detection — and explicit consent for profiling and segmentation. The condition relied on should be documented.
Safeguards. Where the condition is met, are the required safeguards in place? Is there a functioning mechanism for human intervention? Has the firm communicated to customers their right to contest automated decisions?
Transparency documentation. Are the privacy notice and pre-decision disclosures specific enough to satisfy the transparency obligation?
Data Protection Impact Assessment. The ICO expects a DPIA to have been completed for automated decision-making systems likely to result in a high risk to individuals. For most of the systems described in this piece — appropriateness assessments, fraud detection, credit scoring — a DPIA is required before the processing begins.
Final Thought
Automated decision-making is central to the operating model of most crypto and fintech firms. Article 22 does not prohibit it — it requires that where decisions with significant effects on individuals are made automatically, those individuals have rights, and firms have obligations to support the exercise of those rights.
Most crypto firms have not addressed Article 22 in a systematic way. The systems are in place; the compliance framework around them is not. As ICO enforcement attention in financial services increases, that gap is narrowing.
If you want to understand your firm’s Article 22 position, speak to our team.
Contact LHI Consulting for a free 30-minute consultation.
Book a free consultation
We help crypto and fintech firms assess their GDPR automated decision-making compliance — Article 22 mapping, DPIA completion, human intervention mechanisms and transparency documentation.
Email: info@lhiconsult.com | Phone: +44 203 319 5147 | Web: lhiconsult.com
This article is for general information purposes only and does not constitute legal or regulatory advice. LHI Consulting is a trading style of LHI Holdings Ltd, registered in England and Wales, No. 11496647.
FAQs
Does Article 22 apply to all automated systems, or only those that make final decisions?
Article 22 applies to decisions based solely on automated processing that produce a legal or similarly significant effect. The word “solely” is important — a decision that involves meaningful human review is not solely automated, even if supported by automated analysis. The key question is whether a human being with the authority and information to reach a different conclusion has genuinely reviewed the decision.
Our appropriateness assessment is automated but customers can always call us to discuss the outcome. Is that sufficient?
Not automatically. The right to human intervention requires a trained human being to conduct a genuine review — not a customer service call that explains the outcome without the authority to change it. The human reviewer must have the authority to reach a different conclusion.
We completed a DPIA when we first implemented our automated systems. Is that sufficient?
A DPIA should be kept under review and updated when the system, the data processed, or the risk profile changes materially. A DPIA completed at implementation and not reviewed since may not reflect the current state of the system or the ICO’s current expectations.
Does Article 22 apply to our fraud detection system if it flags transactions for human review rather than blocking them automatically?
If a human being makes the final decision about whether to block, the decision is not solely automated and Article 22 does not apply to the block itself. However, if the system automatically implements a temporary hold pending human review, that temporary restriction may itself be a solely automated decision with significant effects.
What is a DPIA and when is it required for automated decision-making?
A Data Protection Impact Assessment is a structured process for identifying and mitigating privacy risks. The ICO requires a DPIA before implementing processing likely to result in a high risk to individuals. Automated decision-making that produces legal or similarly significant effects — including appropriateness assessments, credit scoring, and fraud detection — is listed by the ICO as processing that is likely to require one.