Balancing Hyper Growth with Risk: Secrets to Scaling with Brex's COO and Alloy's CRO

Please welcome Brex COO Michael Tannenbaum and Alloy co-founder and CRO Laura Spiekermann.

I'm Michael. I am the chief operating officer at Brex. Uh, I've been at the company for 5 years, and previous to Brex, I worked at a company called SoFi, uh, where I was the chief revenue officer, which is what You are.

That's what I do. So I'm Laura Speakerman. I'm a co-founder and chief revenue officer at Alloy. Alloy is an identity decisioning platform that serves both banks and fintech companies to manage all of their identity needs from KYC and AML to risk and fraud.

Yep. And Brex, just to cover it, we're a big sponsor here, so you probably know, you can see my socks. We are a corporate credit card and expense management platform. So I'll try to speak in the microphone, but just want to say today that Laura and I are both really excited to be here. We have been mutual customers since 2017, which I think speaks very much to the nature of the SaaStr conference and kind of what a lot of people are here to be about and learn about, which is growing and scaling. So we met in 2017.

I think we had coffee and you paid for it on a Brex.

Exactly. I showed that the card worked. Yeah. So we have both— we're both mutual customers. We've scaled with each other, which I think is a really nice, really nice story and definitely speaks to the conference. I'll let you talk about your conference experiences.

Yeah, I think we first came in 2015 or 2016 when it was still in New York. We were 5 people. We probably didn't even have a— I don't think we even could pay for a ticket at that point. So it's kind of really nice to come full circle when we've grown up a little bit. Not a lot, but a little bit.

Yeah, and I think so what I've found being at Brex and focusing obviously on growth, that's always the number one thing. But in the regulated space that we operate, we're a fintech and so we've got a number of risks. Laura and I are going to talk about those today. But I think over time risk really evolves and these constraints that you have, they don't go away, but they become actually they change and they become more, more important over time. But they're also important at the outset. And so I think it's really important when you think about risk to think about how it evolves as you grow, right? So when you're an early-stage company back in the stage that Laura and I were talking about, some of you might be that stage in the audience. You really have to— you're just trying to make a business and you don't really have that much to protect, to be frank. And so risk management at the early-stage company level is quite different then it's going to be as you get larger. And so just to give some examples from my time at Brex, really early on, Brex, we were early to the corporate credit card space at that time. Marketo, which a lot of people know, is a vendor that people use. They didn't offer credit. And so Brex kind of hacked the system to pre-fund these Marketo accounts like a debit card without getting into too much of the details to make it so we could offer credit even though it didn't exist because As many of you all know, in the US at least, everybody wants a credit card. Debit card, at least from a company's perspective, is not as desirable. And so we figured out a way to do that that was a little bit hacky and helped us launch and probably took some risks that needed to be taken in order for us to have a business. I think, you know, being frank with you, Laura, just even working with Alloy, that was a new vendor. You know, they weren't a known vendor by banks at that time.

We were like 8 people, right?

I mean, they weren't naturally, you If you were going to bring in a big chief compliance officer from a company that's much larger, that person would probably say, like, "We're not going with this startup with 4 people in Oakland and 4 people in Brooklyn," right? So it was quite, you know, even choosing you as a vendor was different, I think, and probably a risk that we were willing to take as an earlier company that we wouldn't today. Fast forward to today, you all probably are aware crypto accounts in particular became really hot at the end of last year, and a lot of people were looking for Brex Cash, which is our bank account-like product, to offer crypto savings accounts with, you know, crypto yield. And a lot of pressure was put on me internally to approve that, and I didn't do it because I said nothing. I have nothing against crypto. I own crypto personally, but I thought for our customer base, because we have this risk management brand to uphold, it wasn't the right thing. We didn't understand know exactly the source of the yield and us recommending it put us at a lot of risk for doing that because, you know, Brex customers turn to us to be a trusted counterparty and they want to make sure that our products offer the safety and security they expect from our brand. And so that was an example where, you know, early on we had nothing to protect, but later we really did.

I think there's— we, we work so closely with, with early-stage fintech companies in particular, at the beginning when they are thinking about building their risk protocol, appetite, tools, systems, etc., I think there's two primary types of risk that they have to be mindful of. One is fraud, and fraud grows as you scale, right? So it's not necessarily linear. I think we're seeing that today as it's like going completely out of control. But once you're getting fraud, One, that's kind of a good thing, right? It means you're like on the map, right? It means maybe you're doing some marketing and you're attracting some attention to— you also want a little bit of fraud because you want to know what it looks like. You want to be able to control it. You want to learn from it. You want to sort of take note of which identities are doing what, what those profiles look like, etc. But the second kind of, you know, risk to be really thoughtful of in the early days is just compliance risk. So think about anti-money laundering. Stuff like that, that's more binary. That's like you can get it, you can be breaking the law when you have zero customers, zero dollars, like nothing exciting going on, which sucks. It's like it's a hard thing to deal with and it's expensive problem. I think the tides have turned a little bit. And what's, what's encouraging about fintech in this moment, at least I think, is having a really good handle on compliance. So it doesn't mean like be, be, you know, the biggest bank worth of compliance, but something that's appropriate can be an asset and it can get you the bank partnerships that you're looking for. We see this all the time when people come in really prepared with great compliance packages, right? They're going to zoom through that process and launch faster, get to revenue faster.

Yeah, I mean, I think compliance, it's one of those for the most part, it's kind of binary. Like there's rules and you gotta follow them. I think you don't wanna comply yourself out of business, right? So obviously you can't, you know, if you just focus on compliance all the time, and I remind our risk teams about this all the time, it's like if we take no risks, we have no business. So there's nothing to protect, right? So that's an important lesson. But at the same time, I also have this kind of concept of the schmuck test, which I made up, and it basically means you ask yourself, do we look like a schmuck if we do this? And in compliance, you don't want to look like a schmuck. So I think if you're going to ask, if you're going to give money to somebody that's a known, someone known on a sanctions list, that's an obvious no. And you're going to fail the schmuck test if you do that. So that, that actually gets to another concept, which is risk appetite. Do you want to talk a little bit about your— I think, well, Let me actually just talk about risk appetite at Brex and what it means. And I think you can talk a little bit about how you've hired executives into that appetite. But risk appetite is a really important point because it's something that exists in the ether a lot of times. And what I'm here to tell you is that to help yourself scale, which is why you're all here and grow, you want to actually put that appetite on paper and agree on it. And so your risk appetite It's, it's kind of unknown a lot of times. And you'll start to observe what your risk appetite is based on the senior leaders in your company and how they react when risks are taken and things go wrong. And the value of actually clarifying and codifying your risk appetite, which is something that Coinbase did early, and that's where I got it from. Not that I worked there, but I heard from people that worked there that they did this. Is enormously beneficial because if you do not agree upon what your risk appetite is as a company— at Brex, we went as far as actually agreeing upon that with our board, which is an option, not a requirement. But if you don't do that, your risk appetite becomes all about whoever the executive or person or product manager is in charge, whatever their appetite is, that becomes the risk appetite.

So did you have your executive team like align on it, document it?

And yes, I mean, I drove the process in the sense that I had a sense for for like, okay, this is the level of actual fraud losses at which point we are not comfortable. This is the level of credit losses. This is the level of reputation risk, something we're going to get to in a bit, that we're comfortable. This is the level of regulatory risk, right? It's not zero. To your point, I mean, taking zero risk is not effective. And so— but establishing what you're willing to take is effective and writing it out and agreeing on it. Makes so much of the conversation not about who's right and who's wrong, but what is it going to do to the pre-approved and pre-agreed upon appetite. And I know you've hired a bunch of executives into this methodology.

We've both worked with— because we work with a number of fintech companies, obviously. And I think we see people like you who are on the executive team where you've had prior risk experience at SoFi. In your case, you saw risk management, you saw the good, the bad, the ugly, the hard. And we see executive teams where when they've had prior experience are just much better at handling it. They are not binary. They're not saying like, I don't give a shit at all about compliance. They're also not saying, you know, I want to take zero, zero risk ever. Everyone who's good is somewhere in between and has kind of scars to prove it. So the analogy we like is like, you should have— if you're, if you're a risk professional at a startup, you should have been in a car accident and survived, right? Like, know what it's like to get beaten up a little bit. And then for hiring internally at Alloy, we think a lot about— we've hired former clients of ours. So our head of product came from Bread, Paralee Wang. She knows what it's like to build a really inherently risky product and can like really empathize, I think, with all of our customers around that inherent tension they have between growing, the job we're all here to do that investors demand out of us and being safe and being compliant and not totally getting wiped out. And so I think that empathy in the product sense actually goes a long way. The other profile we really like is former founders who've had to deal with that. So any fintech founder who's just had to manage that, who's gotten— who's had compliance over their shoulders, had to get a partner bank relationship. It's hard and there's nothing to really replace just experience there.

Yeah, no, I mean, I think the comment that you make around having been in a car accident, I think it's a common— that's a common phrase in risk management. Not making light of car accidents, obviously, but I think the, the reason that people use that phrase is that it's very hard to have an appreciation for this if you haven't been through it. So I think if you are a first-time founder and you're learning about these things for the first time, it's very important important, as Laura says, to bring on someone who has a different experience. So if we, if we take myself, for example, at Brex, as Laura mentioned, at SoFi, I had sort of seen the regulatory landscape evolve, in particular Obama administration, a lot of focus on CFPB, right, the Consumer Financial Protection Bureau. That was a new thing. So dealing with new regulators, but also, you know, we took a lot of financial risk in the products that we built. And so I could take that perspective and talk about what had worked previously, what hadn't worked. And I think that, that is the kind of car accident-like experience that you want when you're talking about hiring someone into a specific risk appetite. And so that rather than have this tension, though, between someone who has experience and who doesn't, that's why— that's, that brings you back to the value of pre-agreeing upon What is the appetite that you're willing to take?

Yeah. Know the risks you're taking. Yeah.

And so I think with that, you know, one thing that we've also found in our jobs and roles is that risk appetite and risk are not just about financial and regulatory, although those are commonly discussed.

Yeah. Yeah. And they escalate. You know, you might have someone on your team who's dealing with the financial or the regulatory risks. Hopefully you've hired someone great, but maybe it's a consultant, whatever. This type of— these other types of risks are probably an executive team, founder, CEO, CRO, whatever level type, you know, risk conversations to have. So reputational risk, brand risk. I know you guys have some kind of recent learnings around how you think about some of those risks, right?

Yeah. I mean, it gets back to the, the kind of continuum or spectrum point around risk management, which is that, you know, when you're an early stage company and I remember when Brex was a couple of people, We're just launching. You're just trying to get your name out there, right? You don't have a brand to protect. You don't even have a brand, right? And so at that point, you're— you don't have to be so strategic and careful. And that starts to evolve as you get larger. And so if you're going to try to do some— like, take this conference, right? When Brex was really early, we might have done more things that are like stunts or, you know, ways to get attention because we had to get our name out there. And then as you start to get bigger and you're like a, you know, big sponsor, you're going to do less because you don't need to do that. You're known for a brand and you move not into like super conservative mode, but more into something to protect. And I think one of the biggest things that people miss a lot of times when they're talking about risk management and talking about Brand is that, you know, your brand, especially for fintechs, is a big reason, is very tied into your ability to manage risk. And I go back to the crypto example that I gave earlier, you know, and you see this with unraveling of— and, you know, it's, it's, it's— we've seen it as, as especially in crypto recently, as things have changed, as people lose confidence in your company, it has a flywheel effect. On your ability to do business and you start to lose customers, you lose confidence, and then more customers drop. And so it can be this unraveling of a brand. And so you really need to be thinking about, even if you're a marketing professional or not marketing, you want to be thinking like, how can I protect this brand as a part of my risk management? And that, and that also extends to PR.

Yeah, we think a lot about bringing like in very practical terms. Sometimes it's our GC, our marketing communications lead, and our VP of People in the same room to talk about something and the decision we're making, a risk we're taking, because it might affect all, all of those things, might affect our team, it might affect recruiting abilities, it might affect legal, right? There's all sorts of things. And so having that kind of trifecta of people plus the executive team is really important for what we're deciding. There are some risks I think are, are good, right? A recent one for us We made the decision to extend reproductive rights benefits to our employees. So if you're in an abortion-restricted state, you can access healthcare in other states and we'll cover the costs. Doesn't come without consequences for us. We have employees who may not like it. We have customers who may not like it, but it was important for us and it, it has those costs, that kind of like cost-benefit analysis we had to do with those three parties plus the executive team. Team lined up. And so I think you have to sort of think of what's what. It's not always just a cost. It's always just a benefit. There's both. The other thing I would kind of say here is there's companies that build on their ability to manage certain types of risk. So Apple has built in a ton around data privacy, for example. Like, that's the thing we as consumers, we all know is part of their brand, right?

Yeah.

It's a good sort of turn it around and try to actually make it a a strength of yours, right?

And so I think if you, if you hear Laura say, like, if the way that you're going to respond to a crisis is get, you know, your people team, your marketing and your compliance altogether legal, I think that's also the way you want to be proactive about your brand. Right. And so one of the things that we used to do and still do at Brex is you think about like, what are the 2 to 3 things you hope that people don't say about your company? Next quarter. And I think that kind of planning and that kind of strategy is— it's a good way to be proactively defensive in the sense that you kind of think about, well, what could somebody say, or what story could they write, or what could be the problem heading into the next 3 months, and how am I going to proactively prevent that? And that is a really good way of managing your brand reputation risk. And that That's something that scales over time. Obviously what you're doing really early, that's going to change versus as your company gets larger.

I like the idea of like writing the headline you don't want. I think especially in this moment where tech is like a little more under the spotlight than it's probably ever been, there's layoffs, right? Like how many TechCrunch articles are there about this? The CEO who totally fucked up a layoff, right? That's like all we see right now. And so you think about these things that are for while perfectly legal and potentially totally unintended bad consequences like that, that is real.

Yeah. Well, look, I think with that, we probably should go through takeaways from today.

Okay. Yeah. Like, if nothing else, risk changes as you grow. Sometimes it grows as you grow. Sometimes it just changes the nature of type of risk as you grow. Have a team that is— the biggest thing is like know your risk, KYR. Know your risk, know what you're taking on, know what you're willing to take on, not willing to take on. Your limits will— should probably shift. I mean, I think your document exercise makes sense. You probably should do it every 6 months.

Yeah, I think— yeah, 6 months. I think you want to make sure that that's agreed upon by everybody, make sure that it's written in a place that is accessible, doesn't have to be beautiful, and make sure that when you hire future people, they understand that that's the risk environment that they're coming into because that is going to help really set your company up and them up for success.

And that's their career. They're potentially not— they should opt out if that's not right for them and get on board.

So if this conversation has been interesting for you, feel free to continue it at the Brex booth or where you'll find me and Laura, and you can also visit Alloy.com.

Thanks, Mike.

All right, thank you.