By Craig Adams

The fintech industry continues to experience rapid growth, much of which is being driven by a combination of legislative changes and increased consumer demand for improved online and mobile banking services. This is leading to an expected annual value increase for the fintech industry of over 20% between now and 2030. But at the same time, they face many risks, ranging from a highly competitive landscape and the need to stay ahead of technology advancements, to cost pressures and staffing concerns. 

Not only is the industry rapidly growing and changing, but individual firms are also evolving at speed. Given the dynamic nature of the environment in which they operate, this is to be expected: agility and speed-to-market are crucial. Nevertheless, rapid growth almost always leads to a range of changes and challenges as well. 

For example, as businesses grow and mature, they need to ensure they are managing risk properly and in a holistic manner – but the reality is that many fintech businesses, even though they are technologically advanced in terms of what they offer their clients, still lack adequate risk strategies and controls within their own businesses.

This is a dangerous position to be in. Non-compliance with regulatory regimes, cyber breaches due to poor IT risk management, and failure to provide customers with important business services due to poor vendor risk management can all attract heavy administrative, legal, and even criminal penalties. In short, any lack of risk oversight can have a significant negative impact at a later stage.

Poor processes lead to higher risk 

Many fintech compliance and risk challenges are rooted in overly siloed approaches to managing risk, which rely on time-consuming and error-prone manual processes. Such approaches can leave companies with an incomplete, out-of-date view of overall organisational risk that overlooks entire areas of vulnerability. Just some of the key areas that need to be carefully considered and addressed are as follows:

The risk of cybersecurity

The exponential growth of the fintech industry has made companies much more attractive to cyber criminals. Failure to adequately manage and contain cybersecurity risks (ranging from the continued use of Excel spreadsheets and shared drives to insufficient monitoring of external suppliers) puts fintech organisations at much greater risk of attack. 

Whether this leads to the loss of customer data, extortion attempts, or solely to expensive clean-up efforts, it’s important to be aware of and quantify the risk levels involved to protect against them effectively.

Third-party and vendor risk management and regulation

Third-party risk regulation is set to increase over the next few years, which will have a major impact on businesses everywhere. It’s important that firms minimise the impact of any potential disruption from critical parties. A lot of fintech companies outsource critical processes and services to external vendors, but this can lead to over-reliance on these parties.

Many jurisdictions are also changing requirements around the engagement of third and fourth parties, meaning fintechs will need to manage these changes and provide evidence of compliance with any new requirements announced.

Operational resilience

When disaster of any kind strikes, firms need to be able to respond quickly and ensure that their operations continue with as few hiccups as possible. Operational resilience for businesses therefore means having the ability to withstand adversity. 

The pandemic brought the issues of business continuity and operational resilience into sharp focus. During this crisis, those risk management and compliance programs that relied on manual processes or siloed systems displayed lower levels of operational resilience.

Earlier this year, the Bank of England’s Prudential Regulation Authority (PRA) wrote to chief executives of financial services companies setting out its “planned work for 2023”.  Operational Resilience is a dominant theme and there is no doubt that the regulators are going to get much tougher when it comes to the robustness of the impact tolerance numbers for critical services. That process involves identifying significant dependencies in the major banks with regards to third parties, and services being outsourced, particularly to cloud providers. 

Fintechs and financial services companies will need to prove that they can recover quickly and the suppliers they have can demonstrate to regulators that they have robust systems in place that can be quickly rebooted should they run into difficulties. 

Data governance risk

Data governance standards across the globe are rising. While many fintechs boast exceptional business data management, many cannot yet claim the same where their own risk management and compliance data is concerned.

Many regulators are asking for clear indications of who “owns” risk amongst other data governance questions. Businesses need to be able to answer such questions in the same way that they would answer them for their business data.

How ERM is improving risk management across the fintech industry

As previously mentioned, traditional risk management programs tend to operate in a siloed fashion, which makes it extremely difficult to track and manage so many different areas of risk in a comprehensive manner. However, a growing number of fintechs are starting to realise the benefits of switching to an Enterprise Risk Management (ERM) based approach. 

Most notably, ERM enables customers to assess all their risks through a single digital platform, forming one holistic, integrated view of risk across the entire business. From an organisational perspective, all risks are described, analysed, and managed in a consistent manner. This enables central libraries to be created, with each risk taxonomy in the library ensuring that there is one single, secure, auditable source of truth that can be relied upon for all risk questions.

Adopting such an ERM approach has many advantages. First and foremost, every identified risk across the business can be managed and reported in a consistent manner, which means data analytics can be carried out across all risk types simultaneously. This provides much greater visibility across the whole company, allowing management at all levels to move from a reactive risk approach to a more strategic one, which not only improves confidence but also allows for faster, more informed decision making as/when required. 

The time to implement ERM is now

Modern fintechs face an ever-growing range of risk, compliance, and audit challenges in a rapidly evolving operational environment. Managing these areas manually, in silos, simply isn’t an effective approach anymore. Implementing an ERM technology platform enables companies to manage these challenges in a more comprehensive, interconnected way, significantly improving risk and compliance management at every level of the organisation.

This article was originally published on 5 June 2023.

About the Author

Craig Adams has been with Protecht since 2020 as the Managing Director for EMEA to support the development of the company in this region. Craig has over 15 years’ leadership experience working with a number of SaaS vendors helping them scale and grow their EMEA business.