Is rapid growth hurting FinTechs? A simple guide to start risk management!

FinTech is an incredible space to work in. Companies in this sector are at the forefront of financial innovation, whether that is brining investment opportunities to your every day individual, simplifying cross border payments, or building a new generation of decentralised financial infrastructure in Web3 - these companies are dynamic and exciting - grow fast, break things, learn, move on, grow some more.

The thing that nobody talks about though is that when you're scaling like a rocket, sometimes risk and security get left in the dust. It's not deliberate, it's just…growth is sexy. Risk? Well that's more the 'responsible adult' of the business world. Scaling up operations takes an all hands on deck mindset but treating risk and security as an unnecessary expense can leave you exposed to cyber attacks, regulatory fines, and reputational harm.

The challenges of scaling up

As any firm scales there is a natural increase in the complexity of the risk landscape. Here's why things get tricky:

More Data, More Risk	When handling increasing volumes of sensitive client data there’s more of a chance for things to simply go wrong, or to become a target for cyber criminals.
Evolving Threat Landscape	Bad actors are constantly increasing their capabilities with new attack methods and techniques.
3rd Parties	Every new piece of technology or vendor relationship introduces potential risks and makes the business more complex.
Regulatory burden	Expanding to different countries and geographies increases complexity of maintaining regulatory compliance. Particularly for regulated firms there are many reporting requirements in addition to pan-european regulations such as DORA.

Consequences of falling behind

Ignoring sounds security practices and risk management during scaling shouldn’t be an option. The consequences can be severe:

• Cyberattacks and data breaches which can cause significant financial harm and even destroy data and infrastructure

• Regulatory non compliance that will lead to fines and penalties and even lead to the regulator stoping you from operating

• Loss of trust from clients. B2C and B2B Clients are becoming increasingly more aware and conscious of these matters.

So how do you scale risk with growth?

Here's how to ensure your risk management program keeps pace without investing huge resources:

1. Document risks: Get all of the departments to start identifying and documenting their risks. A good starting point is: IF [Cause] THEN [Risk Event] LEADING TO [Consequence]

2. Assess and prioritise: Evaluate the likelihood and potential impact of each risk. Consider using a simple scoring system.

3. Document controls: For each risk, think about what controls you have in place and write them down. For example if you have an access management risk, you might have already got a strong password policy and technical controls such as MFA.

4. Determine risk appetite: Define the level of risk your company is willing to accept (Optional - but more advanced)

5. Decide on the 4Ts: Evaluate each risk against your risk appetite and choose to Treat, Transfer, Tolerate, or Terminate.

6. Assign ownership Make specific individuals responsible for managing each risk and its controls.

7. Monitor, Test, and Report: Monitor the risks regularly - has anything changed? Test the controls if you can make sure they are working how you expect and then set up a quarterly meeting with key leaders and report on any changes, testing or incidents.

8. Create a simple policy and framework: Write a simple policy that just sets out the approach and ensures all department heads start following this process.

9. Consider outsourcing expertise: If you lack in house resources, a trusted risk management partner can augment your team.

I appreciate this is a very simplified way of creating a risk framework, but especially for those companies at Series A or similar who are not yet ready to have dedicated resources, this just gets you to start thinking about risk and considering it in your decision making. It shows maturity and also means you have a baseline to keep building from as you grow.

Yes, it does take some effort and resource. But proactive risk management enables better decisions and builds trust.