The Connector Podcast - FinanceX #12 - Navigating the Convergence of Finance, Technology, and Glo...

Welcome to The Deep Dive. We're here to unpack some of the biggest shifts happening right now. And today, well, it's all about the financial world.

Which is just constantly moving, isn't it?

Yeah.

Especially with all the technology coming through.

Totally. It feels like you blink and something new has happened. So keeping informed, it's tough.

It really is. That's why we've pulled together quite a range of sources for this.

Yeah, we've got industry reports, regulatory stuff, even some firsthand accounts. The aim today is really to sift through it all.

Yeah, and pull out the key insights, right?

Right.

where tech rules and, you know, actual innovation collide in financial services.

Exactly. We want to make sense of why these big changes are happening, give some clarity.

Absolutely. And we've got some fascinating areas lined up.

We do. We're going to look at how Europe and Asia are sort of bridging the gap in financial innovation. Mm-hmm.

And this idea of a universal language for fighting financial crime, that sounds pretty significant.

It does. Plus, how lending to small and medium businesses is changing.

And we can't ignore new regulations like DORA, what that actually means on the ground.

Right. And how AI is being used strategically in regtech.

Plus that digital identity revolution, especially what's happening in India. It's quite a mix of perspectives we're drawing on.

Okay, let's kick off with that Europe-Asia connection then. It seems Asian finance firms are looking more towards Europe now, maybe less towards the US.

Yeah, that's a key insight coming through. There seems to be a strategic shift. Geopolitics, economic changes, they're pushing Asian institutions and fintechs to see Europe as, well, a more stable and strategically vital partner right now.

Okay, stability makes sense in the current climate. And there's a tech angle too, isn't there? Asia's often seen as super agile with digital stuff.

Precisely. Asia often leapfrogs older tech, right? So they have these very nimble, digitally native solutions.

Whereas Europe has the established regulatory frameworks, the risk management side.

Exactly. deep experience there. So you get this interesting complementarity, like Asia brings the cutting-edge tech, Europe brings the robust rulebook.

So it's combining speed with safety, in a way. The sources mentioned 3 main drivers for this collaboration working well. First one was economic stability in Europe, mentioning DORA.

Yes, Europe's relative economic stability is definitely a draw. And having clear rules like DORA, the Digital Operational Resilience Act, actually adds to that appeal. It gives a predictable environment to operate in.

Okay. And the second driver was that tech complementarity we just talked about, the innovation meets established rules idea.

Right. Asia's agility meets Europe's mature regulatory scene. It means new ideas can be tested and scaled within a, let's say, safer sandbox. You potentially get a more robust end product.

Makes sense. And the third reason, Europe moving towards a more unified fintech approach across the continent.

Yeah, that's crucial. Europe used to be quite fragmented, country by country. Now there's more of a push for a single market feel. That makes it much easier for firms, including those Asia to scale up across the region.

And technology adoption within Europe itself. There was that All In on AI report. Some interesting numbers there.

Oh, definitely. It found something like 82% of top European institutions have AI projects running.

Wow, 82%! What are they focusing on?

Mostly fraud detection, compliance, making sure they follow the rules, and automating tasks.

Yeah.

Banking is leading the charge, apparently, with around 60 initiatives.

And generative AI is popping up too.

Yeah, that's growing. Companies like Klarna, AXA, they're exploring what GenAI can do.

But it's not all smooth sailing, is it? There are hurdles in this Europe-Asia link-up. One mentioned was European firms needing to keep control over tech they outsource, again referencing DORA.

That's a big one. You use third-party tech, which is great for innovation, but you have to maintain oversight and control, especially for critical functions. DORA really hammers that home— manage your third-party risk.

And for the European fintechs themselves, the challenge is becoming truly pan-European, not just big in one country.

Exactly. Going from a national champion to a continent-wide player, that takes different strategy, different scale.

The sources mentioned a connector role being important here. What's that about?

Think of it as bridging the gaps. Someone or something that helps connect different markets, encourages collaboration, helps smooth out that pan-European growth. It's about making the whole system work together better.

And Europe could maybe learn from Asia's approach— things like sandboxes, public-private partnerships.

Definitely. Asia often has these quite dynamic, collaborative setups. Regulatory sandboxes let you test new ideas safely. Stronger links between government and industry can speed things up. Europe could potentially benefit from more of that.

Can we make this collaboration more real? There were specific examples given, right? Fintech, Web3.

Yeah, some good ones. Project Guardian, that's Singapore's MAS, And the European Investment Bank looking at DeFi for bonds. Pretty cutting edge.

DeFi for bonds?

Okay. Then there's R3 working with Japan's SBI Holdings on the Corda blockchain platform. And SWIFT testing central bank digital currencies, CBDCs, with the Hong Kong Monetary Authority for cross-border payments.

Those are definitely major projects. So wrapping this section up, Europe really could become a central hub for global financial innovation.

The potential is certainly there. It's well positioned.

Yeah.

But it needs that proactive engagement. building those partnerships, and really committing to both tech and resilience.

Right. Okay, let's switch gears. This idea of a universal language for financial crime, that sounds ambitious, but maybe really needed.

Oh, it's desperately needed. The scale of money laundering is just staggering. UN estimates put it somewhere between $800 billion and maybe $2 trillion a year.

$2 trillion? That's hard to even comprehend. And that fuels all sorts of awful stuff, presumably.

Exactly. It's the lifeblood of organized crime, terrorism financing, you name it.

So why haven't we had a universal way to talk about it before? What were the roadblocks?

Several things, really. Often a gap between the big ideas, the concepts, and what people actually do day-to-day in compliance.

Okay.

Plus, different banks, different regulators. They often had their own ways of defining risk, their own approaches. Very fragmented.

Siloed, almost.

Yeah. And a lot of the official reports on how criminals launder money, the typologies, they're written as text, not structured data. Hard for smaller firms, especially, to turn that into, like, practical detection rules.

That sounds incredibly inefficient. So, AML/TRX, this new initiative, aims to fix that. What is it, basically?

It's quite clever, actually. It's a free, open-source knowledge graph. Think of it like a structured map of how financial crime works.

A knowledge graph. Oh.

And it's inspired by cybersecurity, you know, the adversarial kill chain idea, mapping out attack stages.

Ah, right, to understand the process.

Exactly.

Yeah.

AML/TREX tries to do that for money laundering.

Yeah.

Create a standard, transparent way to describe the tactics, the techniques, everything. The goal is to unify the whole AML world.

And it's based on a lot of existing knowledge. Sources mention analyzing over 1,400 documents.

That's right. A huge analysis of public sources, FATF guidance, Egmont Group papers, regulatory reports. Gives it a solid foundation.

Can you break down the structure? How does it map things out? Sure.

It starts with tactics— the big goals, like getting dirty money into the system.

Okay.

Then techniques— the specific ways they do it, like structuring cash deposits below reporting limits or using shell companies.

That's good.

Then sub-techniques— even finer details. And crucially, indicators— the red flags you might actually see in the data, linked back to data sources like transaction logs or KYC info.

So it connects the high-level strategy to the low-level data points.

Precisely. And it also includes things like mitigations, what you can do about it, plus actors, risks, services and products involved, even the value instruments used like cash or crypto. It's pretty comprehensive.

What makes AMLTRIX special? What are its core principles?

Well, first, it is the first AML-specific knowledge graph like this. It consolidates info from key bodies like FATF. Big advantage. Second, because it's machine-readable, it bridges compliance know-how and tech. Think better AI training data, smarter detection.

Right. Computers can understand it.

Exactly. Third, it's free and collaborative— the community can help build and refine it. And lastly, it's applying proven ideas from fields like cyber to AML.

And it's getting noticed. Regulators like the Central Bank of Ireland, the BIS, they're interested.

Yes, that's a really positive sign. Getting attention from bodies like that suggests it has real potential. Being showcased at the BIS Innovation Hub Challenge is a big deal too.

Okay, so from that Global Framework Initiative, Let's zoom into the banks themselves. The FinCrime fighters, as the sources called them. It sounds like they're on the front lines of a constantly shifting battle.

Absolutely. It's like a continuous arms race. The criminals get more sophisticated, using coordinated scams, synthetic identities— fake people, basically— social engineering, and now even GenAI deepfakes to trick people or systems. It's getting really advanced.

So, the bank teams can't just react anymore; they have to be proactive. Anticipating the next move.

Exactly. Defense now is all about being ahead of the game. Using AI and machine learning to scan for weird patterns, learn normal customer behavior, spot anomalies in real time, catching things before they blow up.

And generative AI— that's a weird one, isn't it? Helps the criminals but also helps the banks fight back.

It's fascinating, that dual use. Criminals use it for better phishing, realistic fakes, but banks are using it too.

How so?

Well, one source mentioned a big bank cutting case resolution time by 30% using GenAI. Another uses it to simulate attacks, find weak spots.

Wow.

And you combine GenAI with things like behavioral biometrics— how you type, how you move your mouse— and device intelligence, it becomes a powerful defense toolkit.

These FinCrime teams sound like they need a real mix of skills, not just finance people.

Definitely. You need data scientists, compliance experts who know the rules, cyber specialists, frontline analysts who see the trends first. And crucially, they need to work together seamlessly. Break down those silos, as Konrad Kropinski from Aon Bank emphasized.

And that collaboration has to go beyond just one bank's walls, right?

Oh, for sure. Criminals collaborate, so defenders have to as well. Sharing intel between banks, working with telcos on things like SIM swap fraud, plugging into vendor ecosystems for specialized tools.

Especially now with open banking and embedded finance, everything's connected.

Exactly. A good bank isn't just protecting itself; It's protecting the whole network it's part of.

Looking ahead, AI-built fake identities, deepfake videos— the threats seem quite sci-fi, almost. How do banks prepare?

It requires anticipating, simulating attacks, building resilience right into the systems. Things like scoring risk before a transaction happens, strong mutual authentication, continuous checks on identity during a session. Resilience by design, really.

Okay, let's shift focus again. Peer-to-peer lending . Sources talk about its potential higher returns, helping SMEs, but also big risks, especially with unlicensed platforms.

Yeah, P2P has grown a lot. It can be attractive, offering investors different options and giving smaller businesses much-needed funding outside traditional banks.

But the unlicensed ones— that's where the danger lies.

That's the main concern, yes. If a platform isn't licensed, it often lacks basic safeguards. No proper rules for handling your money, maybe weak, or no checks on borrowers, lack of transparency.

And if it goes wrong? If the platform misuses funds or just collapses?

Investors often have very little recourse. It's incredibly risky.

The stats from Latvia you mentioned seemed pretty stark.

They really were. Millions lost to fraud linked to unregulated entities, and the numbers are climbing. $5.6 million in 2023, already $2.7 million in the first half of 2024. It shows the real-world damage.

So, regulation isn't just red tape here; it's essential protection.

Absolutely. It sets standards for conduct, risk management, transparency. It builds a safer environment for everyone involved.

And strong anti-money laundering rules are part of that on regulated platforms— KYC and all that.

Definitely. Regulated platforms have to do proper customer due diligence , know who their customers are , monitor transactions, work with authorities.

Verifying identity, source of funds.

Exactly. Plus, things like sanctions screening, checking against lists of restricted individuals or entities— it's all part of the package.

Investor money is kept separate on licensed platforms.

That's a key protection. Client funds should be segregated from the platform's own money. Plus, traceable transactions, regular audits— it adds layers of security and accountability.

It's good to see the industry collaborating too, like that alliance in Latvia working on AML and investor protection.

Yeah, that kind of self-policing and standard-raising within the regulated sector is really positive. Builds trust.

So, the clear message for listeners is, stick to licensed platforms.

Pretty much. As Justine Bercova from Debitum Investments put it, you want peace of mind that your money is safe and compliant. Choosing licensed is the way to minimize risk and avoid accidentally funding illegal stuff.

Okay, let's talk DORR, the Digital Operational Resilience Act. Coming into force soon, big implications for tech providers serving finance.

Yes, January 17th, 2025 is the date. And it's a game-changer. It pulls ICT providers— information and communication technology suppliers— directly under the umbrella of EU financial regulation.

So, tech companies that maybe weren't directly regulated before now are?

If they provide key services to financial firms, yes. And those deemed critical ICT providers could even face direct supervision from the European supervisory authorities. That's new territory for many.

How does that change things for banks choosing tech vendors?

It adds new layers to vendor selection. It's not just about the tech specs or the price anymore. Banks now have to scrutinize a provider's transparency, their resilience capabilities, how they manage risk throughout their own supply chain.

So, the ICT providers have to constantly prove they're compliant. That could shake up the market.

It could well do. Providers who can't meet these standards might struggle. We could see some consolidation, favoring those who are demonstrably resilient and compliant.

Can you clarify what counts as an ICT service under DORA? And give some examples of how providers need to adapt.

Sure. Broadly, it's digital or data services using ICT systems. Excludes old-school phone lines. There are actually 19 specific types, S-Classes.

Okay. And adaptations?

Big ones include incident reporting. Providers need to help their bank clients meet their reporting deadlines for major incidents, sometimes within hours.

Tight deadlines.

Very. Also, the Register of Information. Providers have to supply detailed info about their services, subcontractors, where data is stored, etc.

Transparency.

Exactly. And resilience testing. Providers will have to participate in their clients' testing programs— think penetration tests, vulnerability scans— or run their own robust tests.

Sounds like it requires more than just ticking boxes. A real cultural shift within these tech companies.

Absolutely. Resilience needs to be baked into everything they do, part of the company culture, not just an add-on.

So, DORA raises the bar significantly, but for those ICT providers ready to step up, it could actually be an opportunity.

Precisely. If you embrace it, demonstrate that resilience, it becomes a competitive advantage. It builds trust with clients.

Let's pivot to AI in regtech. Lots of buzz, but how do businesses actually start using it smartly?

Yeah, it's easy to get lost in the hype. The key is a practical, user-focused approach. Remember, AI is basically about teaching computers to think like humans, finding patterns in data to make decisions. It's a tool, not magic.

And there are different kinds of AI being used in regtech.

Right. You've got predictive AI forecasting risk, flagging suspicious transactions.

Right.

Generative AI creating things like reports, policies, maybe even synthetic data for testing.

Like ChatGPT, but for compliance.

Sort of, yeah. And then agentic AI systems that can understand their environment and actually take action to manage risks. More autonomous.

AI obviously has strengths— processing huge amounts of data, spotting patterns, But limitations too.

Definitely. Its biggest strength is handling massive datasets far faster than humans. But it's only as good as the data it's trained on. Garbage in, garbage out. It can struggle with completely new situations it hasn't seen before. And the black box problem— not always knowing why it made a decision— is a real issue, especially in regulated areas where you need explainability.

So, AI will get smarter, more integrated, but ethics are crucial.

Hugely important. Transparency, fairness, avoiding bias, privacy, accountability, safety— these have to be front and center as AI becomes more powerful in regtech.

For a business thinking about AI and regtech, what's the very first step?

Understand your own needs. Seriously, ask: What are our biggest compliance headaches? Where are we inefficient? What are our long-term goals? How could existing tools be better? Don't start with the tech, start with the problem.

And before jumping to buy new AI tools, maybe look at what you already have.

Exactly. Maximize what you've got. Are there features in your current systems you're not using? Upgrades available? Can things be integrated better? Is more training needed? Squeeze the value out first.

Okay, but if you do decide you need a new AI tool, what should you consider?

Lots of things. How will it integrate with your existing systems? What about data quality and migration? Will you need to change your processes? What training is involved? And crucially, is it scalable? Will it grow with you?

And it's not set and forget, right? AI needs ongoing attention.

Absolutely not. You need continuous monitoring, checking its performance, recalibrating the models, testing, and always, always expert human oversight. AI is a powerful assistant, not a replacement for judgment.

That leads nicely into compliance foundations. The sources stress compliance isn't just a chore anymore; it's strategic for growth.

That's a huge mindset shift, but it's true. Regulations are expanding everywhere, but if you build smart compliance frameworks, it can actually enable growth.

How so?

It can unlock new markets faster, speed up customer onboarding, reduce risks that could derail you, and build that vital trust with customers and regulators.

And customer due diligence, CDD, is the starting point— knowing your customer.

It's block number one. Understanding who you're dealing with. Verifying identity— KYC for individuals, KYB for businesses. And assessing risk, using a risk-based approach, so you focus effort where it's needed most. Tech can automate a lot of the verification now.

And it needs to be integrated, right? Not just onboarding, but ongoing monitoring, reporting.

Exactly. An integrated infrastructure is key. Risk scoring that updates, transaction monitoring looking for red flags, handling regulatory reporting, managing cases when issues arise. If separate tools for everything, it gets messy.

What are the downsides of fragmented tools?

Inefficiency, basically. Wasted effort, things falling through the cracks, higher compliance risk, and it just doesn't scale well as you grow.

The compliance tech market is changing fast too, with AI and machine learning coming in.

Oh yeah. We're seeing AI used for predictive risk models, better document verification, analyzing user behavior for anomalies, making reporting more dynamic. When you choose a vendor, you need one that's committed to keeping up with these changes.

So, compliance done right can actually be a business development tool.

Absolutely. Think about it. Faster time to market because your onboarding is smooth. Easier expansion into new regions because you have compliant processes. A stronger brand because you're seen as trustworthy. More operational resilience. It all helps you grow.

So, the message is, view compliance as a foundation for success, not just a cost.

That's it. Look for end-to-end platforms that can grow with you. Flexibility and good support are crucial.

Okay, let's talk about the LEI, the Legal Entity Identifier. Sources highlighted it as a tool against financial crime and for transparency. What is it for anyone unfamiliar?

Sure. The LEI is basically a unique 20-character code, like a global ID card for legal entities involved in financial transactions.

Like companies, funds, etc.?

Exactly. It came out of the 2008 crisis because regulators realized they couldn't easily see who was exposed to whom. The Financial Stability Board pushed for it, and GLEI oversees it globally. It's the only regulatory-mandated global ID system for entities.

It started as a regulatory thing, but now businesses see value in it too.

It's evolved. Initially driven by rules like Dodd-Frank and EOR, the whole no LEI, no trade idea. But now firms realize it helps efficiency. One standard ID simplifies things. It builds cross-border trust, helps make smarter decisions with reliable data.

And it's widely used. How many LEIs are out there?

Over 2.8 million globally now. And there are more than 300 regulations worldwide that either require or promote its use.

Wow. For what kinds of things?

All sorts. Payments, data standardization, KYC/KYB, credit checks, even ESG reporting now, and definitely sanctions screening.

How does it specifically help fight financial crime, especially in cross-border payments? That's a huge area.

Well, with cross-border payments projected to hit $250 trillion soon, fragmented ID systems are a big vulnerability. The LEI helps because it's global, the data is verified and updated, it's neutral, the data is free, it follows ISO standards, has quality checks, you can challenge data errors, and it's becoming interoperable with other IDs and business registries. Plus, big bodies like the FSB, BIS, FATF, Wolfsberg Group all support it. And countries like India and the UK are mandating it for certain payments.

And there's something called the Verifiable LEI, the VLEI. What's that?

That's the next step, really. It's a way to have digitally verifiable credentials for organizations and their representatives online. Think of it as bridging the trust gap in digital interactions.

So, it could make online KYC or sanctions checks much easier and more secure?

Potentially, yes. If regulators widely adopt it, it could streamline a lot of processes and cut costs while increasing trust.

Okay, finally, let's talk about India's digital KYC revolution. Sources called it a visionary blueprint. Sounds impressive.

It really is. India's been at the forefront of using digital identity to transform things like onboarding, compliance, but also financial inclusion and trust.

What's the foundation?

It's built on the JAM Trinity: Jan Dhan bank accounts for everyone, the Aadhaar unique ID system, and widespread mobile connectivity. Plus, what they call digital public infrastructure. The scale is massive— over half a billion Jan Dhan accounts, 1.35 billion Aadhaar IDs.

And that's had real impact, like on government payments?

Huge impact. Over $28 trillion transferred directly to beneficiaries, saving the government around $3.48 trillion just by eliminating fake or duplicate recipients. Shows the power of accurate digital ID.

And KYC itself has been transformed. Video KYC, DigiLocker.

Completely. Video KYC took off, especially during the pandemic. Yeah. Big cost savings, up to 90%. DigiLocker lets people store and share verified digital documents. Billions of documents accessed, replacing paper.

Wow!

And Aadhaar face authentication is being used billions of times for contactless verification by hundreds of organizations.

And it's not just banking. DigiYatra for airports, eKYC Setu.

Exactly, it shows the versatility. DigiYatra cuts airport queues. eKYC Setu is like a single gateway for different authentication methods, again, cutting onboarding costs, improving fraud detection across sectors.

And other countries are noticing, taking inspiration.

Yes, countries in Asia, Africa, Latin America, are looking at similar models. The World Bank, UNDP are referencing India's approach. And India's also brought in data protection laws, the DPDPA Act, focusing on privacy.

So, what can the rest of the world learn from India's experience? Key principles?

A few things stand out: an infrastructure-first approach— build the digital rails first; using regulatory sandboxes to test innovations safely, like the RBI Innovation Hub; having a clear consent mechanism for data sharing. And promoting open APIs for interoperability.

So it's more than just tech; it's a governance approach, treating digital ID as a public good.

That seems to be the core idea. The big question now is how other countries can adapt and localize these principles for their own contexts.

Which brings us almost full circle to electronic IDs, EIDs. Sounds like the next wave after digital KYC.

Yeah, EIDs seem like the next step, though maybe still early days compared to things like liveness checks. But they promise streamlined onboarding, easier cross-border compliance, and importantly, better defense against AI-driven fraud.

That AI fraud threat keeps coming up. Deloitte predicted huge losses.

Billions, yeah. $40 billion in the U.S. by 2027 due to generative AI fraud. EIDs are seen as a stronger defense.

How are they stronger? More secure? Better privacy?

They're harder to fake than physical IDs. They help prove you're dealing with a real human online. And they can be more private— you only share the data needed for that specific interaction, and often the data stays locally on your device, not stored centrally in the cloud like scans of plastic IDs.

So, less risk of massive data breaches or misuse?

That's the idea. Plus, they're designed for cross-border use, like within the EU already. They're not just a digital copy of a plastic card; they're a new, more secure solution.

And the EU's eIDAS 2.0 law is pushing this forward, mandating acceptance by 2026.

That's a major driver. Regulated businesses in the EU will have to accept these digital wallets. It adds complexity initially, though, because different countries are rolling them out at different speeds, and there might be multiple providers. Businesses need to handle both old and new systems for a while.

Poland was mentioned as an early success story.

Yeah, they implemented a comprehensive eID system quite early, even before the EU mandate. And they've seen benefits. Faster onboarding, better fraud prevention, more customer trust— giving businesses there a bit of an edge. It shows what's possible.

So, the takeaway is embracing eIDs early is probably smart for businesses relying on KYC, especially with AI fraud growing.

It looks that way. For future-proofing against sophisticated fraud, strong IID verification seems like the best path forward right now.

Well, that was certainly a deep dive. We've covered so much ground, from global finance links to regulations like DORA, fighting in-crime, the rise of AI, and this whole It really highlights how interconnected everything is, doesn't it?

Global finance, tech advancements, the need for smart regulation, the evolving nature of crime, and how we prove who we are online— it all feeds into each other.

Definitely. And understanding these trends, it feels essential now, whether you're, you know, prepping for a meeting, just trying to stay current, or even if you're just curious about how the financial world is being reshaped.

And it was interesting seeing the different angles— Europe and Asia collaborating, India building this huge digital infrastructure, the push for universal standards like MLARIX and the LEI. Different approaches, but all driving change.

We really hope this exploration gave you some valuable takeaways and things to think about.

And maybe a final thought to leave you with: as tech races ahead, how do we strike that right balance? The balance between encouraging innovation, and ensuring we have the regulatory oversight needed for trust and security in this digital financial world. What role might you or your organization play in shaping that future?