Balancing Hyper Growth with Risk: Secrets to Scaling with Brex's COO and Alloy's CRO

Foreign.

Please welcome Brex COO Michael Tanenbaum and Alloy Co founder and CRO Laura Spiekerman.

I'm Michael. I am the Chief operating officer at Brex. I've been at the company for five years and previous to Brex, I worked at a company called SoFi where I was the Chief Revenue officer, which is what you are.

That's what I do. So I'm Laura Speakerman. I'm a co founder and Chief revenue officer at Alloy. Alloy is an identity decisioning platform that serves both banks and fintech companies to manage all of their identity needs, from KYC and AML to risk and fraud.

Yep. And Brex, just to cover it. We're a big sponsor here, so you probably know you can see my socks. We are a corporate credit card and expense management platform. So I'll try to speak in the microphone, but just want to say today that Laura and I are both really excited to be here. We have been mutual customers since 2017, which I think speaks very much to the nature of the SASTER conference and kind of what a lot of people are here to be, to be about and learn about, which is growing and scaling. So we met in 2017, I think.

I think we had coffee and you paid for it on a break, so.

Exactly. I showed that the card worked. And so we have both. We're both mutual customers. We've scaled with each other, which I think is a really nice, really nice story and definitely speaks to the conference. I'll let you talk about your conference experiences.

Yeah, I think we first came in 2015 or 2016, when it was still in New York. We were five people. We probably didn't even have a. I don't think we even could pay for a ticket at that point. So it's kind of really nice to come full circle when we've grown up a little bit. Not a lot, but a little bit. Yeah.

And I think. So what I've found, being at Brex and focusing obviously on growth, that's always the number one thing. But in the regulated space that we operate, we're a fintech and so we've got a number of risks. Laura and I are going to talk about those today, but I think over time risk really evolves and these constraints that you have, they don't go away, but they become, actually they change and they become more, more important over time, but they're also important at the outset. And so I think it's really important when you think about risk to think about how it evolves as you grow Right. So when you're an early stage company, back in the stage that Laura and I were talking about, some of you might be that stage in the audience. You really have to, you're just trying to make a business and you don't really have that much to protect, to be frank. And so risk management at the early stage company level is quite different then it's going to be as you get larger. And so just to give some examples from my time at Brex, really early on Brex, we were early to the corporate credit card space at that time. Marketo, which a lot of people know is a vendor that people use, they didn't offer credit. And so Brex kind of hacked the system to pre fund these Marketa accounts like a debit card without getting into too much of the details to make it so we could offer credit even though it didn't exist. Because as many of you all know in the US at least everybody wants a credit card. Debit card, at least from a company's perspective is not as desirable. And so we figured out a way to do that that was a little bit hacky and helped us launch and probably took some risks that needed to be taken in order for us to have a business. I think, you know, being frank with you, Laura, just even working with Alloy, that was a new vendor, you know, they weren't a known vendor by banks at that time.

We were like eight people, right?

I mean they weren't naturally, if you were going to bring in a big chief compliance officer from a company that's much larger, that person would probably say like, we're not going with this startup with four people in Oakland and four people in Brooklyn.

Right.

So it was quite, you know, even choosing you as a vendor was different, I think, and probably a risk that we were willing to take as an earlier company that we wouldn't today. Fast forward to today. You all probably are aware crypto accounts in particular became really hot at the end of last year and a lot of people were looking for Brex Cash, which is our bank account like product to offer crypto savings accounts with, you know, crypto yield. And a lot of pressure was put on me internally to approve that. And I didn't do it because I said nothing. I have nothing against crypto, I own crypto personally, but I thought for our customer base because we have this risk management brand to uphold, it wasn't the right thing. We didn't understand exactly the source of the yield and us recommending it put us at a lot of risk for doing that because, you know, Brex customers turn to us to be a trusted counterparty and they want to make sure that our products offer the safety and security they expect from our brand. And so that was an example where, you know, early on we had nothing to protect, but later we really did.

I think there's, we, we work so closely with, with early stage fintech companies in particular at the beginning when they are thinking about building their risk protocol, Appetite, tools, systems, etc. I think there's two primary types of risk that they have to be mindful of. One is fraud. And fraud grows as you scale, right. So it's not necessarily linear. I think we're seeing that today as it's like going completely out of control. But once you're getting fraud one, that's kind of a good thing, right? It means you're like on the map, right. It means maybe you're doing some marketing and you're attracting some attention to. You also want a little bit of fraud because you want to know what it looks like, you want to be able to control it, you want to learn from it, you want to sort of take note of which identities are doing what, what those profiles look like, etc. But the second kind of, you know, risk to be really thoughtful of in the early days is just compliance risk. So think about anti money laundering stuff like that, that's more binary. That's like you can get it, you can be breaking the law when you have zero customers, zero dollars, like nothing exciting going on, which sucks. It's a hard thing to deal with and it's expensive problem. I think the tides have turned a little bit and what's, what's encouraging about fintech in this moment at least I think is having a really good handle on compliance. So it doesn't mean like be, be you know, the biggest bank worth of compliance, but something that's appropriate can be an asset and it can get you the bank partnerships that you're looking for. We see this all the time when people come in really prepared with great compliance packages, right. They're going to zoom through that process and launch faster, get to revenue faster.

Yeah, I mean I think compliance, it's one of those, for the most part it's kind of binary, like there's rules and you got to follow them. I think you don't want to comply yourself out of business. Right. So obviously you can't, you know, if you just focus on compliance all the time and I remind our risk teams about this all the time, it's like if we Take no risks, we have no business. So there's nothing to protect. Right. So that's an important lesson. But at the same time, I also have this kind of concept of the schmuck test, which I made up. And it basically means you ask yourself, do we look like a schmuck if we do this? And in compliance, you don't want to look like a schmuck. So I think if you're going to ask, if you're going to give money to somebody that's unknown, someone known on a sanctions list, that's an obvious no. And you're going to fail the schmuck test if you do that. So that, that actually gets to another concept, which is risk appetite. Do you want to talk a little bit about your. I think, well, let me actually just talk about risk appetite at Brexit and what it means. And I think you can talk a little bit about how you've hired executives into that appetite. But risk appetite is a really important point because it's something that exists in the ether a lot of times. And what I'm here to tell you is that to help yourself scale, which is why you're all here and grow, you want to actually put that appetite on paper and agree on it. And so your risk appetite, it's. It's kind of unknown a lot of times. And you'll start to observe what your risk appetite is based on the senior leaders in your company and how they react when risks are taken and things go wrong. And the value of actually clarifying and codifying your risk appetite, which is something that Coinbase did early and that's where I got it from. Not that I worked there, but I heard from people that work there that they did. This is enormously beneficial. Because if you do not agree upon what your risk appetite is as a company at Brex, we went as far as actually agreeing upon that with our board, which is an option, not a requirement. But if you don't do that, your risk appetite becomes all about whoever the executive or person or product manager is in charge, whatever their appetite is, that becomes the risk appetite.

So did you have your executive team, like, align on it, document and talk to me?

I drove the process in the sense that I had a sense for like, okay, this is the level of actual fraud losses, at which point we are not comfortable. This is the level of credit losses. This is the level of reputation risk, something we're going to get to in a bit that we're comfortable. This is the level of regulatory risk.

Right.

It's not Zero to your point. I mean taking zero risk is not effective and so but establishing what you're willing to take is effective and writing it out and agreeing on it makes so much of the conversation not about who's right and who's wrong, but what is it going to do to the pre approved and pre agreed upon appetite? And I know you've hired a bunch of executives into this methodology we've both.

Worked with because we work with a number of fintech companies obviously and I think we see people like you were on an executive team where you've had prior risk experience at so far in your case, you saw risk management, you saw the good, the bad, the ugly, the hard. And we see executive teams when they've had prior experience are just much better handling it. They are not binary. They're not saying like I don't give a shit at all about compliance. They're also not saying, you know, I want to take zero, zero risk ever. Everyone who's good is somewhere in between and has kind of scars to prove it. So the analogy we like is like you should have, if you're, if you're a risk professional at a startup, you should have been in a car accident and survived. Right? Like know what it's like to get beaten up a little bit. And then for hiring internally at Alloy, we think a lot about, we've hired former clients of ours. So our head of product came from Brad Parley Wing. She knows what it's like to build a really inherently risky product and can like really empathize. I think with all of our customers around, that inherent tension they have between growing the job, we're all here to do that. Investors demand out of us and being safe and being compliant and not totally getting wiped out. And so I think that empathy in the product sense actually goes a long way. The other profile we really like is former founders who've had to deal with that. So any fintech founder who's just had to manage that, who's gotten, who's had compliance over their shoulder, who's had to get a partner bank relationship, it's hard and there's nothing to really replace just experience. There's.

Yeah, no, I mean I think the comment that you make around having been in a car accident, I think it's a common, that's a common phrase in risk management. Not making light of car accidents obviously, but I think that the reason that people use that phrase is that it's very hard to have an appreciation for this if you haven't been through it. So I think if you are a first time founder and you're learning about these things for the first time, it's very important, important as Laura says, to bring on someone who has a different experience. So if we like, if we take myself for example at Brex, as Laura mentioned at SoFi, I had sort of seen the regulatory landscape evolve. In particular Obama administration, a lot of focus on cfpb. Right. The Consumer Financial Protection Bureau, that was a new thing. So dealing with new regulators. But also, you know, we took a lot of financial risk in the products that we built. And so I could take that perspective and talk about what had worked previously, what hadn't worked. And I think that that is the kind of car accident like experience that you want when you're talking about hiring someone into a specific risk appetite. And so that rather than have this tension though between someone who has experience and who doesn't, that's why that brings you back to the value of pre agreeing upon what is the appetite that you're willing to take.

Yeah. Know the risks you're taking. Yeah.

And so I think with that, you know, one thing that we've also found in our jobs and roles is that risk appetite and risks are not just about financial and regulatory, although those are commonly discussed.

Yeah, yeah. And they escalate. You know, you might have someone on your team is dealing with the financial or the regulatory risks. Hopefully you've hired someone great. But maybe it's a consultant, whatever. This type of, these other types of risks are probably an executive team, founder, CEO, C CRO, whatever level type risk conversations to have. So reputational risk, brand risk. I know you, you guys have some kind of recent learnings around how you think about some of those risks, right?

Yeah. I mean it gets back to the, the kind of continuum or spectrum point around risk management which is that you know, when you're an early stage company and I remember when Brex was, a couple of people were just launching, you're just trying to get your name out there. Right. You don't have a brand to protect. You don't even have a brand. Right. And so at that point you're, you don't have to be so strategic and careful. And that starts to evolve as you get larger. And so if you're going to try to do some like take this conference, right. When Brex was really early, we might have done more things that are like stunts or you know, ways to get attention because we had to get our name out there. And then as you start to get bigger and you're like a big sponsor, you're going to do less because you don't need to do that. You're known for a brand and you move not into like super conservative mode but more into something to protect. And I think one of the, the biggest things that people miss a lot of times when they're talking about risk management and talking about brand is that you know your brand especially for fintechs is a big reason is very tied into your ability to manage risk. And I go back to the crypto example that I gave earlier, you know, and you see this with unraveling and you know it's, it's, we've seen it as, as especially in crypto recently as things have changed as people lose confidence in your company, it has a flywheel effect on your ability to do business and you start to lose customers, you lose confidence and then more customers drop. And so it can be this unraveling of a brand. And so you really need to be thinking about even if you're a marketing professional or not marketing, you want to be thinking like how can I protect this brand as a part of my risk management? And that. And that also extends to pr.

Yeah, we think a lot about bringing like in very practical terms sometimes it's our gc, our marketing communications lead and our VP of people in the same room to talk about something and the decision we're making a risk we're taking because it might affect all, all of those things might affect our team, it might reflect recruiting abilities, it might reflect legal. Right. There's all sorts of things. And so having that kind of trifecta of people plus the executive team is really important for what we're deciding. There are some risks I think are, are good. Right. Recent one for us we made the decision to extend reproductive rights benefits to our employees. So if you're in an abortion restricted state, you can access health care in other states and we'll cover the costs. Doesn't come without consequences for us. We have employees who may not like it, we have customers who may not like it. But it was important for us and has those costs that kind of like cost benefit analysis we had to do with those three parties plus the executive team lined up. And so I think you have to sort of think of what, what it's not always just a cost, it's always just a benefit. There's both. The other thing I would kind of say here is there's companies that build on their ability to manage certain types of risk. So Apple has built in a ton around data Privacy, for example, like, that's the thing we, as consumers, we all know is part of their brand.

Right. That's a good point.

Sort of turn it around and try to actually make it a strength of yours.

Right. And so I think if you, if you hear Laura say, like, if the way that you're going to respond to a crisis is get, you know, your people, team, your marketing and your compliance altogether legal, I think that's also the way you want to be proactive about your brand.

Right.

And so one of the things that we used to do and still do at Brexit, you think about, like, what are the two to three things you hope that people don't say about your company next quarter? And I think that kind of planning and that kind of strategy is it's a good way to be proactively defensive in the sense that you kind of think about, well, what could somebody say or what story could they write or what could be the problem heading into the next three months, and how am I going to proactively prevent that? And that is a really good way of managing your brand and reputation risk. And, and that that's something that scales over time. Obviously what you're doing really early, that's going to change versus as your company gets larger.

I like the idea of like writing the headline you don't want. I think especially in this moment where tech is like a little more under the spotlight than it's probably ever been, there's layoffs, right? Like, how many tech crunch articles are there about this? The CEO who totally fucked up a layoff. Right. That's like all we see right now. And so you think about these things that are while perfectly legal and potentially totally unintended bad consequences like that. That is real.

Yeah. Well, look, I think with that, we probably should go through takeaways from today.

Okay? Yeah. Like, if nothing else, risk changes as you grow. Sometimes it grows as you grow. Sometimes it just changes the nature of type of risk as you grow. Have. Have a team that is Will. The biggest thing is like, know your risk, Kyr. Know your risk. Know what you're taking on. Know what you're willing to take on. Not willing to take on your limits. Will should probably shift. I mean, I think your document exercise makes sense. You probably should do it every.

Right.

Six months.

Yeah, I think. Yeah, six months. I think you want to make sure that that's agreed upon by everybody. Make sure that it's written in a place that is accessible, doesn't have to be beautiful, and make sure that when you hire future people, they understand that that's the risk environment that they're coming into because that is going to help really set your company up and them.

Up for success, their career, they're potentially not like they should opt out if that's not right for them and totally on board.

So if this conversation has been interesting for you, feel free to continue it at the Brex booth or where you'll find me and Laura. And you can also visit ally.com thanks, Mike. All right. Thank you.

Guest.