In this episode of the Connector Podcast, host Koen Vanderhoydonk interviews Marco, a co‑founder of Copla, about the company’s mission to simplify compliance for fintech and financial services firms. Marco explains that Copla grew out of the founders’ previous success with Paysolut (acquired by SumUp) and a recognition that compliance—especially across an expanding set of regulations such as DORA, NIS2, ISO 27001, SOC 2, PCI DSS, MiCA, and upcoming EU acts—was a major bottleneck for fast‑moving fintechs. Copla offers a SaaS compliance risk‑management platform that combines automated data collection, validation, and workflow with human experts (CISOs, compliance specialists) to guide customers through the compliance journey. The platform supports a “one‑stop‑shop” approach, handling vendor/third‑party risk via the Copla Registry (a SaaS replacement for the cumbersome DORA ICT third‑party Excel register), providing continuous audit‑readiness, and linking compliance to cybersecurity through scenario‑based simulations. Marco stresses the tension between agile fintech growth and heavy compliance demands, positioning Copla’s automation as off‑loading 70‑80 % of manual work while retaining human validation for the remainder. The conversation also covers Copla’s cautious AI adoption—using AI to verify evidence under strict guardrails—and its globally agnostic architecture that can ingest any compliance framework quickly. Looking ahead, Copla’s roadmap focuses on deeper vendor‑risk automation, broader risk‑management capabilities, and integrated awareness training, aiming to become the single platform for all compliance needs. Marco concludes with observations from the Digital Finance Summit (regulators, companies, vendors together) and invites listeners to contact Copla via their website.
Chapters
Welcome to the Connector Podcast, an ongoing conversation connecting fintechs, banks, and regulators worldwide. Join CEO and founder Koen Vanderhoydonk as you learn more about the latest available trends and solutions in the markets.
And here we are again for another podcast from DFS. And today I'm meeting my friends of Copla. I see them everywhere I go. So expectations are high. Marco, can you please explain what is Copla and what do you do at Copla?
Of course. First of all, thank you for having me here. So what do we do? Let me just kind of step back into past a little bit. What happened before Copla?
Please.
Founders had a very successful company before Copla that was called Paysolut. And that company was acquired by SumUp. So it was a pretty good success story. And during this period, they noticed a big, big challenge. in the world, and that's compliance, especially in fintech companies or finance companies, because they have to struggle with— they are struggling with compliance a lot. So that's how they decided to start a company called Copla. And what we do, we are a compliance risk management platform. We basically, in a nutshell, help companies get compliant with different compliance frameworks.
And when you talk about different compliance frameworks, what do you mean exactly? Can you give us some examples?
So it's, for example, now DORA is very current. Digital Operational Resilience Act. We have NIS 2. We have ISO 27001 or SOC 2 for our US friends. And those are some examples. Plus we have PCI DSS, MiCA, and so on. And more and more compliance frameworks are popping up. So you have the Cyber Resilience Act that is in the making in the EU. There is the AI Act. So a lot of things happening. But the good thing is not to kind of frighten everybody, that they all have the same foundation. So if you satisfy one compliance framework, you're pretty good, like 60, 70% when it comes to other frameworks.
And how do you guys then help? Is it pure technical or is there also like legal understanding or compliance understanding?
We combine automation and human support. So, but we have experts, CISOs, Chief Information Security Officers, compliance experts, that guide customers through compliance journey. So automation is one thing, and you have to have automation, of course. It speeds things up and it helps and so on. But at some point, you will reach a point where you don't understand something, you need some additional clarification, or you need somebody to do something for you. And this is the point where our experts jump in. And this is something that differentiates us from other companies such as Vantas, Dratas, Sprintos, or Scruts of the world.
Well, thinking about those frameworks, one thing that sort of pops in mind is DORA, and there is vendor risk, there's third-party risk. These are often challenges for companies growing. So how do you manage those risks particularly?
Vendor risk, yeah, as you said, it's very, very relevant and very, very, very important. And it's going to be more and more important because supply chains need to be secure. One company has perhaps dozens or hundreds of vendors, and they need to be secure in order to protect our infrastructure. And this is what DORA also transcribes, and this is what we are helping to solve with one part of our solution called Copla Registry that handles DORA ICT third-party register. So usually it's an Excel with like 15 tabs.
Mm-hmm.
It's quite complex to fill out. There are some codes that you need to do. You need to repeat entries and it's easy to make a mistake. But we implemented that into a SaaS solution that helps you and speeds up things about 5 times. So you don't need to repeat the entries. It does data validation for you and it really makes your job easier. That's just one thing that we offer on top of our platform because we really want to help companies be like a one-stop shop for compliance. And if we can solve more of compliance issues for them, it means we're more helpful, means it's much better for us also.
What I really liked and probably would like to have a bit of clarification about is when I was reading one of your DORA blogs, you speak about tension between lean agile fintech teams and heavy compliance demands. What was the driver behind this statement?
Well, when you look at it, Every company, of course, wants business success. We are all here because of that. And fintech companies or startup companies, they want success fast. Somebody perhaps wants an exit, somebody wants some personal satisfaction and so on. And they are very much focused on that growth, very, very, very much focused as they should be. And then you get the compliance, which is complex, which is not so easy if you're not familiar with it. And that stops their growth. Basically, what we hear from a lot of customers that work with us is they said, we want to focus on growth. We don't want to focus on compliance. We're not compliance experts. That's why they need help. That's why they need a platform and an expert, let's say, in a certain sense, holding their hand. So this is something that we see a lot. And this is something that is, I would even say, crucial for a success of a startup or a fintech company. especially fintech companies, to make sure that compliance is handled in a proper way. Sometimes it's internal, of course. Sometimes you have founders that are compliance experts, and that's great, but even them need support from somebody externally to perhaps operationally help in some matters.
I think I hear between the lines that compliance is not a one-off, it's a continuous process. And you guys, I think, call it continuous audit readiness, and it relies heavily on automation. And I understand, but automation means also that you're receiving data from the outside world. So how does that link work?
Well, it's kind of a combination of automation and manual entries plus our experts. So through automation, you get to some certain degree of success when it comes to compliance. But then again, you have to do something on your own. You cannot A machine cannot do everything, or there is no external expert that can offload 100% of compliance tasks for you. But we can offload 70 to 80%, which is, if you can imagine, if somebody takes away 70, 80% of your work, that's a pretty good time saving. And this is where we can help to kind of optimize this process. And this is how we operate. You also mentioned that this continuous audit readiness.
Mm-hmm.
I think that's the Probably the crucial part here, like always-on compliance, where if you look at compliance as a one-off exercise, or you get to a point where you have a fire drill. So you have like 2, 3 months and you, it's all hands on deck. Let's satisfy the checkbox. It shouldn't be like that. Primarily because that's not the point. Compliance is not here to make our jobs or any company's job harder. It's to make those companies more secure.
It's about business continuity.
Exactly, exactly. And those compliance frameworks are improving year after year. As we see, we have like PSD2, we have SOC 2 and those kinds of iterations. They're not perfect, but they're improving. And by having this one compliance framework or having like foundational compliance, I would rather say, then you can really build on top of that. Some start with ISO 27001, for example. If you have that framework implemented, you're 60-70% there with DORA, with NIS2, and so on. Then you just have to build on top of that, and you will reach the stage where you're compliant at a click of a button.
Well, earlier you mentioned the role of a CISO, and a CISO goes hand in hand with cybersecurity. So what's the offering on cybersecurity?
In which sense? What do you mean?
Yeah. When I was actually going and diving into what you guys offer, I came across like near-zero disruption scenario-based simulations, all to do with cybersecurity. So how does that match up with what's happening in the compliance world?
Well, compliance is here to make companies more secure, to increase their cybersecurity. And compliance instates some rules that can really help companies increase their cybersecurity. increase their operational resilience, and help with their business continuity. And this is the link that we see between cybersecurity and compliance.
Makes sense. Well, you're here at an, obviously, a fintech event, and one of the themes is regulation, so I'm sure you find that very comfortable. Another one is AI. So how does that actually apply to Copla?
When it comes to AI, we took a little bit cautious approach because we want to make sure that we implement AI in the right way. You see a lot of companies today that have AI, or at least have AI on their websites or promotional materials.
If not all of them. Yes.
But when it comes to compliance, there is no— nothing should be left to chance or some speculation. So we really need to make sure that AI can help us. AI currently, as we use it, it helps us verify compliance evidence to some extent, but we still have a human validating that to make sure that everything is as it should be. At some point, our platform will use AI in various use cases, including this one. But for now, we really want to make sure that everything is as it should be. So we decided not to rush with AI.
Fair point. I guess there's ways like guardrails and everything, but that's probably what you're talking about, I guess. Exactly.
That's one of the guardrails, let's say, we took now from this aspect. And then once we implement AI in a more, more use cases, we'll have more guardrails, of course.
Yeah. So you're AI ready, ready to go when, when it's valid?
Yes. We have a good use case for AI, which we use now to some extent, and we'll build on top of that.
Makes a lot of sense. Well, you guys are a European company, and European company comes with European legislation, although you mentioned a couple of legislations coming from abroad. How would you see yourself as a global player?
Compliance is not so different regardless of the region or a country. A foundational part of compliance would be risk management. And risk management for different compliance frameworks is very, very similar. You have some certain default settings that you need to satisfy. And on top of that, some things will be adapted depending on the geography or an industry or so on. So when we look at our solution, it's really industry and region agnostic. And we have the capability to upload any compliance framework to our solution within a very short period of time. So our platform is highly customizable when it comes to any region or industry. And that's something that we see as a really strong point of it.
And what do you see as your roadmap going forward as a company? You're a young company, rebranded recently. everywhere and present in the world, but how does future look like 2 to 3 years ahead?
We want to be a one-stop shop for all your compliance needs. Currently, we satisfy a lot of aspects of ICT compliance with our compliance automation, but we have 2 big focuses, focus points for next year. One is vendor risk and one is risk management. So this is something we want to automate more. But we never want to forget this human aspect. And we will always have some sort of human validation. Of course, that will reduce in time as you will have more automation, more AI, more integrations. But this is the area where we want to go. So to combine this compliance automation, vendor management, and risk management into one single solution. And also important to point out, we also within our platform, we have awareness training. And awareness training is a very important part of compliance. And you have a lot of companies out there, very successful companies doing only awareness training. But again, that's only awareness training. If we can do awareness training plus the other things that we mentioned, I think for any company that would be very good to have all of that in one solution.
Yeah, it's really the one-stop shop. Now you're here in Belgium, I believe, for the first time at the Digital Finance Summit. What are your findings so far?
Well, it looks very good. A lot of discussions, a lot of conversations, a lot of similar challenges when it comes to compliance. So we see that in any country in EU, but it's very interesting. And I like the fact that we have here, we have the regulators, we have the companies, we have the vendors. Everybody's at the same place. The event is great. It's not a huge event, which is, I think, a very good thing. So you can basically talk more or less with everybody here.
Yeah, it's pretty much a boutique event, as you could call it. Marco, one last question before we stop this or close this podcast. Where can people find you and who typically you would like— So one more question before we close the podcast. Where can people find you and who do you want to contact you?
If you have any issues with compliance, I'm sure that a lot of companies do. If DORA, MIKA, PCI DSS, ISO 27001. If those things are on your radar, contact us. If you already solved those things or to some extent, you can also contact us. Exactly. Because we can help you need to recertificate and so on. We can still automate some things that you probably did manually using Excel or so on. So in both those scenarios, we can help. If that's on your radar, then let us know.
And who and where can they contact you?
Well, the best thing would be to go to our website, www.koenvanderhoydonk.com. And they can reach out to us there.
Makes a lot of sense. Marco, thank you very much for joining me in this podcast. Thank you also to the audience and please stay tuned.
Thank you very much for having me.
More updates to come from DFS.
Thank you very much for having me.
Thanks for listening to another episode of the Connector Podcast. To connect and keep up to date with all the latest, head over to www.koenvanderhoydonk.com. Jointheconnector.com or hit subscribe via your podcast streaming platform.
