In this episode, Bob and Amy explore the growing compliance challenges confronting organizations in today’s cloud-driven environment. Businesses now operate within an increasingly unpredictable regulatory landscape shaped by evolving data privacy requirements and stringent cybersecurity frameworks such as NIS2 and DORA.

Traditional compliance approaches built around manual processes, spreadsheets, and periodic checklists are proving inadequate in fast-moving cloud ecosystems. These legacy methods struggle to keep pace with constantly changing infrastructures, often resulting in costly inefficiencies, human error, and critical blind spots that can expose organizations to regulatory penalties, operational disruptions, and cyber threats.

To strengthen resilience and maintain control, many organizations are moving toward a model of continuous assurance that integrates automation directly into everyday operations. Through the adoption of compliance-as-code practices and advanced governance, risk, and compliance platforms, companies can continuously monitor controls, automate evidence collection, and gain real-time visibility across hybrid and multi-cloud environments.

This evolution marks a fundamental shift in how compliance is managed. Rather than being treated as a reactive exercise focused on audits and remediation, automated governance enables compliance to become a strategic capability that enhances trust, supports agility, and improves long-term business resilience.

Please let us know your thoughts by leaving a comment in the link below. We would love to hear from you.

Leave a comment

Subscribe now

Introduction: The High-Stakes Balancing Act

There was a time—not long ago—when compliance felt like preparing for a yearly exam. You studied your controls, cleaned your documentation, and hoped the auditor would be satisfied. Then the cloud arrived, and with it, a brutal truth: the exam never ends.

Imagine a modern enterprise as a city built on shifting sands. Servers are no longer static structures; they are ephemeral, spun up and torn down in seconds. Policies are no longer documents; they are API calls. In this environment, the old tools—manual checklists, static reports, and above all, spreadsheets—have become relics of a slower age.

This is the Compliance Conundrum: how do you govern what refuses to stand still?

The stakes are not theoretical. When crises like Log4Shell hit, organizations discovered an uncomfortable divide. Those relying on manual inventories scrambled for weeks just to understand their exposure. Others, armed with automated visibility, responded in hours. The difference wasn’t just operational—it was existential.

Compliance today is no longer about passing audits. It is about preserving trust, protecting brand equity, and maintaining the velocity required to compete. The shift from periodic assurance to continuous assurance is not an upgrade. It is a survival mechanism.

The Spreadsheet Trap: A Familiar Tool Turned Silent Threat

The spreadsheet once symbolized control. Rows and columns gave the illusion of order, a neat representation of risk in a chaotic world. But in the cloud era, that illusion has turned dangerous.

Spreadsheets are static snapshots in a dynamic reality. They capture what was, not what is. And worse, they often capture it incorrectly. With studies showing that nearly 90% of spreadsheets contain errors, the margin for hidden risk is staggering. A single misaligned formula or overlooked row can obscure a vulnerability that no one sees—until it’s exploited.

This creates what might be called “compliance drift.” An organization may begin the year fully aligned with regulatory requirements, only to drift silently out of compliance as configurations change. By the time a quarterly review uncovers the gap, the exposure has already lingered for months.

Here lies the paradox: the more diligently an organization updates its spreadsheets, the more confident it becomes—yet that confidence is often misplaced. The tool designed to reduce uncertainty becomes the very source of it.

Inversion helps clarify the danger. The question is no longer, “How do we improve our spreadsheets?” but rather, “Why are we still relying on them at all?”

The 185-Update-a-Day Reality: When Human Capacity Breaks

If the spreadsheet is the wrong tool, the deeper issue is scale.

Regulation has become a firehose. Financial institutions now face, on average, 185 regulatory updates per day. Each update carries implications: new reporting requirements, revised controls, or entirely new compliance frameworks. From Europe’s evolving cybersecurity mandates to rapidly expanding privacy laws across U.S. states, the terrain shifts constantly.

The traditional response—hire more compliance staff—has reached its limits. You cannot scale human cognition indefinitely. Analysts drown in documentation, spending the majority of their time chasing evidence, updating files, and interpreting dense regulatory language.

Meanwhile, regulators themselves are evolving. Through “SupTech,” they increasingly deploy artificial intelligence to scan systems, detect anomalies, and identify non-compliance at machine speed. The asymmetry is stark: machines auditing humans who rely on manual processes.

This creates a strategic imbalance. If your auditor uses AI and you use spreadsheets, the outcome is predetermined.

An analogy may help: attempting to manage modern compliance manually is like trying to control air traffic with handwritten notes. The complexity has simply outgrown the method.

Compliance-as-Code: Rewriting Governance from the Inside Out

If the problem is velocity and scale, the solution must operate at the same speed.

Enter Compliance-as-Code (CaC), a concept that reframes compliance not as documentation, but as execution. Instead of describing what should happen, organizations encode rules into the very systems that enforce them.

This represents a profound shift—often described as “shifting left.” Compliance is no longer a checkpoint at the end of a process; it is embedded at the beginning.

Infrastructure-as-Code ensures that environments are built from pre-approved templates, eliminating misconfigurations before they occur. Policy-as-Code translates legal and regulatory requirements into machine-readable rules that automatically block non-compliant actions. Continuous testing replaces periodic reviews, scanning systems in real time.

The result is a Unified Control Framework—an elegant idea with powerful implications. A single automated control can satisfy multiple regulatory requirements simultaneously. “Map once, comply many” becomes not just a slogan, but an operational reality.

There is also a human transformation embedded in this shift. The emergence of the “GRC Engineer” reflects a new hybrid skill set—one that bridges legal interpretation and technical implementation. Compliance is no longer owned solely by auditors or lawyers; it becomes a shared responsibility embedded in engineering culture.

Here, a paradox emerges: by making compliance invisible—built into the system—you make it more powerful than ever.

The Hidden Math: Why Non-Compliance Costs More Than You Think

The case for automation is not just operational; it is financial.

Studies consistently show that the cost of non-compliance significantly exceeds the cost of maintaining compliance. This gap is not merely due to fines. It includes reputational damage, operational disruption, lost customer trust, and the cascading effects of regulatory scrutiny.

Consider the analogy of maintenance versus failure. Maintaining a bridge is expensive, but allowing it to collapse is catastrophic. Compliance operates on the same principle.

Organizations that embrace automation report tangible gains. Evidence collection—once a labor-intensive process—shrinks dramatically. Audit timelines compress. Legal reviews accelerate as AI tools identify non-compliant clauses in contracts within minutes rather than hours.

More subtly, automation removes friction. Compliance shifts from being a bottleneck—the infamous “Department of No”—to becoming an enabler of innovation. When controls are embedded and continuously validated, organizations can move faster with greater confidence.

This reframing is critical. Compliance is not a cost center; it is a force multiplier.

The New Iron Curtain: When Data Meets Geography

As if speed and scale were not enough, compliance now faces a geopolitical dimension.

Data flows freely across borders, but regulations do not. Countries increasingly assert control over data generated within their jurisdictions, creating a fragmented landscape of data sovereignty laws. The result is a “New Iron Curtain”—not of ideology, but of information governance.

This creates conflicts that are not easily resolved. One jurisdiction may require data to remain local, while another demands access under national security laws. Multinational organizations find themselves navigating contradictions embedded in law.

Manual approaches cannot handle this complexity. Automated solutions become essential.

Geo-fencing ensures that sensitive data remains within designated boundaries. Automated tagging tracks the origin and classification of data in real time. Encryption, combined with local key management, allows data to move while ensuring it remains inaccessible outside authorized jurisdictions.

The analogy here is that of a passport system for data—every piece of information carries its identity, permissions, and restrictions wherever it travels.

Yet, even this solution introduces a paradox. The more global your infrastructure becomes, the more local your compliance obligations grow.

Conclusion: From Burden to Blueprint

The death of the spreadsheet is not a technological story; it is a philosophical one.

It marks the end of compliance as a retrospective exercise and the beginning of compliance as a living system. In this new paradigm, automation handles scale, speed, and repetition, while humans provide context, judgment, and accountability.

Looking ahead, the trajectory is clear. AI will not just enforce compliance; it will predict risk. Systems will identify patterns that precede misconduct, enabling organizations to act before violations occur. Compliance will evolve from reactive defense to proactive intelligence.

But technology alone is not enough. The most resilient organizations will be those that integrate automation with culture—where compliance is not imposed, but embedded; not feared, but understood.

The question, then, is not whether the spreadsheet is dead. It is whether organizations are ready to let it go.

MY MUSINGS

I find myself both impressed and uneasy with where this is heading.

On one hand, the logic is undeniable. You cannot fight machine-speed problems with human-speed tools. Automation feels less like a choice and more like gravity—inescapable. And yet, there is something profoundly human about the old way. The spreadsheet, flawed as it is, represents visibility, tangibility, and control.

So I wonder:

Are we trading understanding for efficiency?
When compliance becomes code, who truly “owns” it?
Do executives gain confidence—or lose visibility—when systems become too complex to interpret?

There is also a deeper question about dependency. If regulators and organizations both rely on AI, do we risk creating a closed loop—machines policing machines, with humans reduced to overseers who may not fully grasp the system’s inner workings?

And perhaps the most provocative inversion of all:

What if the real risk is not failing compliance—but outsourcing it entirely?

I would be very interested in your perspective.
Is automation the ultimate safeguard—or the beginning of a new kind of blind spot?

Leave a comment

Subscribe now

We were warned, but we didn’t listen.

First came the computer, promising to liberate the mind from drudgery. It did the calculations, stored the information, and organised our chaos. Slowly, quietly, we stopped remembering phone numbers; mental arithmetic became obsolete, and the ability to navigate without GPS atrophied. Convenience replaced competence.

Now, artificial intelligence has delivered the final blow.

Why bother learning, reasoning, or struggling with a problem when a machine can give you the answer in seconds? Why develop taste, judgement, or critical thinking when AI can write your essays, craft your emails, generate your ideas, and even create your art? We no longer use technology as a tool — we have outsourced our thinking to it.

The result is the rapid emergence of a new species: Homo idioticus.

Once-proud Homo sapiens — thinking man — is quietly devolving. Attention spans have collapsed. Memory is outsourced. Curiosity is dying. The muscle of human intelligence, once sharpened by effort and discomfort, is softening into mush. We are becoming eloquent parrots of machine-generated thoughts, confident in our “knowledge” while understanding almost nothing.

The tragedy is not that machines are getting smarter. The tragedy is that humans are choosing to become stupider in return.

We traded wisdom for convenience, depth for speed, and genuine intelligence for the illusion of it. The computer began the process. AI is finishing it.

And the worst part? Most people don’t even realise what they’ve lost – because recognising it would require the very intelligence they’ve surrendered.

Leave a comment

Subscribe now

Introduction: A Transaction That Felt Like the Future

Imagine this: you’re buying a high-end laptop from an overseas seller. No bank delays, no foreign exchange fees, no paperwork—just a few clicks and a cryptocurrency payment zips across borders in minutes. It feels like the future has finally arrived.

But then, the unease creeps in. The price of the cryptocurrency you used spikes an hour later—you may have overpaid. Or worse, the seller disappears. There’s no bank to call, no dispute process, no safety net. What seemed like empowerment now feels like exposure.

Cryptocurrency payments promise freedom from traditional financial systems. Yet, like many revolutions, they replace old constraints with new uncertainties. The question is not whether crypto payments work, but whether users truly understand the risks they are taking.

Volatility: When Money Refuses to Sit Still

At the heart of cryptocurrency lies a paradox: it is designed to function as money yet behaves more like a speculative asset.

Prices can swing wildly—sometimes by double digits within a single day. For buyers, this creates a peculiar dilemma: the cost of a purchase is not fixed but fluid. A decision made in the morning may feel like a mistake by the afternoon.

For merchants, the problem is even more acute. Accepting payment in crypto introduces uncertainty into revenue itself. A sale that appears profitable could shrink in value before it is converted into traditional currency.

Stablecoins attempt to resolve this instability by pegging their value to fiat currencies. Yet even these are not immune to disruption, as occasional “de-pegging” events remind users that stability in crypto is often engineered, not guaranteed.

Irreversibility: The Double-Edged Sword of Finality

Traditional payment systems are built around reversibility. Credit card disputes, chargebacks, and fraud protections act as safety valves when things go wrong.

Cryptocurrency eliminates these mechanisms entirely.

Once a transaction is confirmed, it is final. There is no undo button. A mistyped wallet address, a fraudulent seller, or a simple misunderstanding can result in permanent loss.

This irreversibility is often celebrated as a feature—removing intermediaries and preventing censorship. Yet it also shifts all responsibility onto the user. In crypto, control and accountability are inseparable.

Security: Absolute Ownership, Absolute Risk

“Not your keys, not your coins” has become a mantra in the crypto world. It captures a fundamental truth: true ownership comes from controlling your private keys.

But this ownership carries a burden. Lose your keys, and your funds are gone—forever. There is no recovery process, no customer support line, no institutional backup.

Even when users rely on exchanges or custodial services, risks remain. Hacks, phishing attacks, and platform breaches have led to billions in losses over the years. The very systems designed to safeguard assets can themselves become points of failure.

In this sense, cryptocurrency transforms security from a shared responsibility into a deeply personal one.

Fraud and Scams: A Playground for Deception

Wherever money flows, fraud follows. In the crypto ecosystem, it often moves faster and with greater sophistication.

Scammers exploit the irreversible nature of transactions and the relative anonymity of blockchain systems. Fake investment schemes, phishing websites, and elaborate social engineering attacks have become commonplace.

A particularly troubling development is the rise of highly coordinated scams—some involving emotional manipulation over weeks or months. Victims are persuaded to transfer funds in crypto precisely because those funds cannot be recovered.

The irony is striking: a system designed to eliminate trust in intermediaries often requires an even greater degree of trust between individuals.

Consumer Protection: Freedom Without a Safety Net

In traditional finance, layers of protection exist—banks, regulators, insurance schemes. These institutions may slow transactions, but they also provide recourse.

Cryptocurrency strips away these layers.

There is typically no insurance for wallet balances, no guaranteed protection against fraud, and no authority to mediate disputes. Users operate in a largely self-governed environment.

Advocates argue that this is the price of true financial sovereignty. Critics counter that it leaves individuals dangerously exposed, especially those without technical expertise.

Regulation: A Moving Target

The regulatory landscape for cryptocurrencies is fragmented and constantly evolving. What is permissible in one jurisdiction may be restricted—or even banned—in another.

For users, this creates uncertainty. A transaction that seems routine today could carry legal or tax implications tomorrow.

In many countries, using crypto for payments triggers taxable events, requiring users to calculate capital gains on every transaction. For merchants, compliance obligations can be complex and burdensome.

The promise of borderless finance collides with the reality of jurisdictional boundaries.

Privacy: Transparency Disguised as Anonymity

Cryptocurrencies are often described as anonymous. In reality, most operate on public blockchains where every transaction is recorded and visible.

While identities are not directly attached to wallet addresses, linking transactions to real-world individuals is often possible—especially when exchanges and payment processors are involved.

This creates a paradox: crypto offers both transparency and traceability, yet fosters a perception of privacy that may not hold under scrutiny.

Privacy-focused alternatives exist, but they frequently attract regulatory attention, adding another layer of risk.

Complexity: When Usability Becomes a Barrier

For all its innovation, cryptocurrency remains technically demanding.

Managing wallets, understanding transaction fees, navigating network congestion—these tasks introduce friction that can lead to costly mistakes.

Even simple actions, such as sending funds, require precision. A single error can result in irreversible loss.

Compared to the seamless experience of traditional payment systems, crypto often demands a level of competence that many users have yet to develop.

Counterarguments: The Case for Crypto Payments

Despite these risks, proponents of cryptocurrency payments present a compelling case.

They highlight lower transaction costs, especially for cross-border payments. They emphasize speed, accessibility, and the ability to operate outside traditional financial systems.

For individuals in regions with unstable currencies or limited banking access, crypto can offer a lifeline—a way to store and transfer value without relying on fragile institutions.

In this light, the risks of crypto are not flaws but trade-offs. What critics see as vulnerabilities, advocates see as the necessary consequences of decentralization.

Conclusion: A Tool, Not a Panacea

Cryptocurrency payments are neither inherently good nor inherently bad. They are a tool—powerful, flexible, and still evolving.

But like any powerful tool, they require understanding and caution.

The central reframe is this: crypto does not eliminate risk; it redistributes it. From institutions to individuals. From systems to users.

For some, this shift is liberating. For others, it is overwhelming.

The challenge is not simply to adopt new technology but to recognize the responsibilities that come with it.

MY MUSINGS

I find myself torn between admiration and concern.

On one hand, cryptocurrency represents a remarkable leap—a reimagining of how value can move across the world. It challenges entrenched systems and opens doors for innovation.

On the other hand, it feels like we’ve handed individuals a powerful financial instrument without fully equipping them to use it safely.

Are we overestimating the average user’s ability to manage these risks? Or are we underestimating how quickly people can adapt?

And perhaps the deeper question is this: should financial systems prioritize freedom or protection—or is that a false dichotomy?

I’d be very interested to hear your perspective. Would you feel comfortable using crypto for everyday payments? Or do the risks outweigh the benefits—for now?

Leave a comment

Subscribe now

The 30-Minute Financial Collapse

Ambar Nigrum spent 30 years mastering the nuances of finance. As a veteran accountant for several charities in Yogyakarta, Indonesia, she was the last person anyone expected to be duped by a digital parlor trick. But when a “government official” from the national tax office called, the psychological trap was already set. The caller hurried her along, creating a sense of administrative urgency that bypassed her professional skepticism.

Following a link, Nigrum downloaded what appeared to be an official government tax app. The setup took nearly half an hour. At the attacker’s suggestion, she even used her date of birth as one of the passwords—a detail she found strange, yet she complied under the pressure of the moment. It was a calculated, 30-minute grooming process designed to lower her guard. By the time her friend at the actual tax office confirmed the link was a fraud, it was too late.

In a frantic Google search, Nigrum watched her financial world evaporate. Two bank accounts were emptied instantly; a third was being drained as she watched. In total, 450 million rupiah ($26,500) vanished—funds meant to cover the salaries of ten staff members for an entire year. “How could someone like me, someone who has worked in finance for 30 years, fall for something like this?” she asked. “I felt so stupid.” Her story is no longer an outlier; it is the opening salvo in a new era of high-speed, automated digital predation.

From “Pig-Butchering” to the “Trojan” Sprint

The cybercrime industry has undergone a violent evolution. For years, the “pig-butchering” model reigned—a slow, labor-intensive process of grooming victims over months via romance or investment cons. The new “Trojan” schemes have abandoned the long game for a sprint. These attacks prioritize velocity, utilizing spyware to hijack a device’s contact list and turn the victim into an unwitting carrier.

The primary weapon is now speed. Once the malware is installed, the theft itself is no longer a conversation; it is an execution. In recent cases tracked by investigators, criminals moved a victim’s entire life savings through a labyrinth of accounts and out of reach in under 30 seconds. This isn’t just theft; it’s an infection. After the initial drain, criminals sell or barter the stolen data on the dark web, ensuring a recurring cycle of victimization for everyone in the original target’s network.

“It’s a much faster-moving attack than a traditional scam,” warns Jeremy Douglas of the United Nations Office on Drugs and Crime. “There’s potential for millions of devices to be infected.”

The Rise of “Malware-as-a-Service” (MaaS)

This level of sophistication no longer requires a master hacker. Since at least 2023, the dark web and Telegram have democratized high-end cybercrime through “Malware-as-a-Service.” Transnational criminal organizations now purchase “software clusters” from Chinese-speaking vendors, allowing them to deploy professional-grade spyware with a few clicks.

These software clusters are living organisms. They are constantly updated by their vendors to evade specific anti-virus signatures and security patches. The scale is staggering: security firm Infoblox tracked a surge in malicious internet queries using these clusters, jumping from 400,000 in March 2025 to over 1.8 million just one month later. These operations are currently targeting victims in more than 20 countries, operating in a shifting array of languages and impersonated local authorities.

The Dark Synergy of Biometrics and Authority

The “Trojan” machine gains entry by weaponizing the victim’s respect for authority. Criminals meticulously impersonate the Indonesian tax office, South African police, immigration officers in South Korea, and even staff at India’s Supreme Court.

The technical mechanism of the heist occurs during the “app setup” phase. While the victim thinks they are following routine security protocols, the malware is actually capturing their biometric data—facial recognition patterns and fingerprints. By tricking victims into granting wide-ranging permissions to microphones, cameras, and bank accounts, the attackers create a “critical vulnerability.” This biometric capture allows them to bypass two-factor authentication (2FA) entirely, authenticating massive wire transfers as if they were the account holder themselves.

The Human Cost of “Scam Inc”

The digital predation is fueled by a physical underworld of unimaginable brutality. These operations are headquartered in “industrial districts” across Southeast Asia, such as the notorious K99 Triumph City in Cambodia. These are not offices; they are fortified compounds protected by high walls, barbed wire, and armed guards.

Hieu Minh Ngo, a Vietnamese cybersecurity specialist who has successfully infiltrated these systems, reveals a workforce powered by human trafficking. Multilingual graduates are lured by the promise of call-center jobs, only to be held captive and forced to scam under threat of violence. Whistleblowers who failed to meet daily extortion targets reported being beaten, electrocuted, and starved.

This is a global business on an industrial scale. While a single group can steal more than $500,000 in a single day from one country alone, the total industry is estimated to generate over $500 billion annually—rivaling the global illegal drug trade in both profit and carnage.

AI and the Looming Western Expansion

The “Scam Inc” model is currently in a state of rapid mutation. Criminals are now integrating AI chatbots to manage initial victim outreach and deepfake voice tools to make impersonations indistinguishable from reality. Renée Burton of Infoblox warns that the threat is expanding beyond bank accounts; attackers are now stealing private photos and communications specifically for extortion.

While nations like Turkey and Thailand have been recent hotspots, the enterprise is looking toward wealthier horizons. Jeremy Douglas is “very, very sure” that we will see the European Union on the target map within the next year. As these groups perfect their methods in developing nations, they are preparing to pivot toward more “secure” Western markets, utilizing AI to evade the facial-recognition systems that currently act as the last line of defense for EU and US banks.

Conclusion: A Borderless Epidemic

We are witnessing the rise of a borderless digital epidemic that local law enforcement is fundamentally unequipped to stop. In countries like Cambodia and Myanmar, the online fraud industry is woven into the social fabric, where business and political elites profit from massive kickbacks.

The “Trojan” machine thrives on this protection. Even when a local cell is raided or a low-level operator is arrested, the core leadership remains untouched, shielded by corruption and the network’s anonymity. As “Scam Inc” becomes more integrated with deepfake technology and automated scripts, the question for the global public is no longer if you will be targeted, but if you are prepared for a threat that law enforcement literally cannot reach. Is your digital footprint a path for you, or a map for them?

MY MUSINGS

What strikes me most is not just the scale—though a $500 billion criminal ecosystem should command anyone’s attention—but the efficiency. We are no longer dealing with opportunistic fraud; this is engineered predation, optimized like a high-frequency trading system. Speed, automation, and psychological precision have replaced the old art of persuasion.

But here’s the uncomfortable question: are we, collectively, still thinking about this problem in outdated ways?

For decades, financial crime prevention has been built around the assumption that fraud is detectable through anomalies—unusual transactions, suspicious behavior, red flags. Yet in this new model, the criminal doesn’t bypass the system—they become the system. If biometric authentication, long seen as the gold standard, can be quietly harvested and replicated, then what exactly remains as a trusted layer of defense?

And another thought: why is the burden still so heavily placed on the individual?

We tell people to “be careful,” to “watch for suspicious links,” to “verify before clicking.” But Ambar Nigrum was not careless—she was outmaneuvered. When attacks are designed as tightly orchestrated psychological operations, backed by real-time data harvesting and AI-enhanced impersonation, is personal vigilance even a meaningful defense anymore?

Then there’s the geopolitical dimension. If this industry rivals the scale of the global drug trade, why isn’t it treated with the same urgency? Is it because the damage is diffused—thousands of smaller, invisible collapses rather than a single, dramatic event? Or because the infrastructure of this crime is entangled with legitimate economies and political interests in ways that make decisive action inconvenient?

And finally, a question that may be the most unsettling:

Are we approaching a point where trust itself—digital, financial, institutional—becomes the primary casualty?

If every call, every message, every authentication layer can be convincingly faked or hijacked, then the system doesn’t just have a security problem—it has a credibility problem.

I’d be very interested in your thoughts:

• Do you believe current banking security models are fundamentally outdated?

• Should liability shift more toward institutions rather than individuals?

• And perhaps most importantly—what would a next-generation defense even look like in a world where identity itself can be cloned?

Curious to hear where you land on this.

Leave a comment

Subscribe now

Bob and Amy unpack and discuss the details of the latest financial scam based on MaaS (Malware as a Service). The alarming expansion of a sophisticated global spyware industry that utilizes rapid, automated “Trojan” attacks to defraud victims. These transnational criminal organizations operate via a “malware-as-a-service” model, purchasing advanced tools to impersonate government entities and harvest biometric and financial data. Beyond the massive economic theft, the industry is fueled by a human trafficking crisis, where captives are forced to conduct scams under the threat of physical violence. While these groups currently target developing nations, they are increasingly integrating artificial intelligence and deepfake technology to penetrate more secure Western markets. Systemic corruption and technological evolution have made this interconnected digital epidemic incredibly difficult for international authorities to dismantle.

Please let us know your thoughts by leaving a comment in the link below. We would love to hear from you.

Leave a comment

Subscribe now

Introduction: The Dangerous Comfort of Familiar Words

In today’s financial discourse, certain words are repeated so often they begin to feel understood. “Stablecoins.” “CBDCs.” “Tokenised deposits.” They roll off the tongue in boardrooms, policy panels, and fintech webinars with an air of authority. Yet beneath that confidence lies something more troubling: a widespread, almost casual misunderstanding.

This is not a harmless confusion. It is a dangerous one.

Because these are not simply different technologies. They are different forms of money. And misunderstanding money has never ended well.

At first glance, all three appear deceptively similar—digital representations of value moving seamlessly across modern infrastructure. Faster payments. Programmable features. Frictionless settlement. It feels like progress wrapped in code.

But that is the illusion.

The deeper truth is far more consequential: stablecoins, central bank digital currencies, and tokenised deposits are three fundamentally different answers to a single, enduring question—who do you trust to issue money?

This is not a technical distinction. It is a philosophical fault line.

Reframing the Debate: This Is Not About Technology

Let’s begin with a necessary reframe.

This is not about blockchain versus traditional systems.
It is not about speed, efficiency, or programmability.

Those are implementation details.

This is about trust architecture.

In other words, when you hold a unit of digital money, you are not just holding value—you are holding a claim on someone. And the identity of that “someone” defines everything: the risk you bear, the protections you enjoy, and the system you implicitly support.

Seen through this lens, the apparent complexity dissolves into something clearer—and more unsettling.

Stablecoins: The Return of Private Money

There is something almost nostalgic about stablecoins.

Long before central banks monopolized currency issuance, money was often a private affair—banknotes issued by commercial banks, backed (sometimes loosely) by reserves. Stability was a matter of trust, not law.

Stablecoins revive that model in digital form.

Consider USDC or Tether. They promise stability by pegging their value to fiat currencies, typically the US dollar. But crucially, they are not dollars. They are representations of dollars—claims on reserves held by private entities.

Here, trust is outsourced to the issuer.

If the reserves are sound, transparent, and liquid, the system works. If they are not, confidence can evaporate with alarming speed. The history of finance offers no shortage of such episodes.

The Inversion: Stability That Depends on Fragility

Stablecoins invert a core assumption about money.

They promise stability—but depend on confidence.
They appear simple—but conceal layered risk.
They feel modern—but echo pre-central banking fragility.

Critics argue that stablecoins are inherently unstable in stress conditions. A “run” on a stablecoin is not theoretical—it is structurally embedded. If enough holders seek redemption simultaneously, the system is tested in real time.

Proponents counter that transparency, over-collateralization, and regulatory oversight can mitigate these risks. They see stablecoins as engines of innovation—particularly in cross-border payments, decentralized finance, and financial inclusion.

Both views hold truth. And that is precisely the problem.

CBDCs: The State Reasserts Control

If stablecoins represent a return to private money, Central Bank Digital Currencies represent the opposite: the reassertion of sovereign authority.

Take the Digital Yuan or the proposed Digital Euro. These are not experiments in innovation alone. They are strategic instruments.

CBDCs are, at their core, digital cash—direct liabilities of the central bank.

This changes everything.

When you hold a CBDC, you are not exposed to a commercial bank or a private issuer. You are holding a claim on the state itself. In nominal terms, that is as close to risk-free as money gets.

The Paradox: Maximum Safety, Maximum Concern

Here lies the paradox.

CBDCs offer the highest level of monetary safety—yet provoke the deepest societal concerns.

Why?

Because trust in the state is not purely financial. It is political.

CBDCs open the door to unprecedented visibility into financial transactions. Even if designed with privacy safeguards, the potential for surveillance—real or perceived—cannot be ignored.

Supporters argue that CBDCs enhance financial inclusion, reduce systemic risk, and strengthen monetary policy transmission. They see them as a natural evolution in a digital economy.

Skeptics see something else: the possibility of programmable money that could be controlled, restricted, or even weaponized.

Again, both perspectives are valid. And again, the tension is unavoidable.

Tokenised Deposits: Evolution, Not Revolution

Lost in the noise of innovation is a quieter, more pragmatic development: tokenised deposits.

They do not promise to reinvent money. They aim to modernize it.

A tokenised deposit is simply a bank deposit—like the balance in your current account—represented in token form, often on a distributed ledger. It moves faster. It settles instantly. It can be programmed.

But fundamentally, it is unchanged.

It remains a liability of a commercial bank.

The Analogy: Same Wine, New Bottle—or Something More?

One might think of tokenised deposits as old wine in a new bottle. The substance is familiar; the container is different.

But that analogy is only partially accurate.

Because the new “bottle” changes how the wine can be used.

Tokenised deposits can enable atomic settlement, smart contract integration, and 24/7 financial operations. They bridge traditional banking and emerging digital ecosystems without dismantling either.

The Counterargument: Incrementalism as Risk

Critics argue that tokenised deposits are too conservative. By preserving the existing banking model, they may fail to capture the transformative potential of digital finance.

Supporters respond that this is precisely their strength. Financial systems are not social media platforms—they cannot afford reckless disruption.

In this view, tokenised deposits represent a disciplined evolution rather than a speculative revolution.

Three Models of Trust: The Hidden Architecture

Strip away the technology, and what remains is stark.

Stablecoins are trust in private issuers.
CBDCs are trust in the state.
Tokenised deposits are trust in banks.

This is the real architecture.

And it reveals something profound: the future of money is not a technical competition. It is a contest between different institutional models of trust.

Inversion: What If We Are Asking the Wrong Question?

Much of the current debate asks: Which of these will win?

That may be the wrong question.

A more useful one might be: What combination of these minimizes systemic risk while maximizing innovation?

Because a world dominated entirely by any one of these forms carries its own dangers:

• A stablecoin-dominated system risks fragmentation and instability.

• A CBDC-dominated system risks centralization and overreach.

• A tokenised deposit-dominated system risks stagnation and missed opportunity.

Each solves a problem—and creates another.

Where This Is Heading: The Hybrid Reality

The most plausible future is not ideological purity, but pragmatic coexistence.

CBDCs may serve as the anchor of trust, providing a risk-free foundation.

Tokenised deposits may remain the core of financial intermediation, preserving the role of banks.

Stablecoins may act as the innovation frontier, particularly in global and decentralized contexts.

But coexistence does not mean harmony.

Tensions will intensify:

Regulators will scrutinize stablecoins as they scale.
Banks will resist CBDCs that threaten disintermediation.
Innovators will challenge incumbents who move too slowly.

This is not a stable equilibrium. It is a dynamic one.

Conclusion: Same Destination, Different Consequences

It is tempting to reduce stablecoins, CBDCs, and tokenised deposits to a single narrative: digital money is the future.

That is true—but incomplete.

Because not all digital money is created equal.

Stablecoins are privately issued promises.
CBDCs are state-backed certainty.
Tokenised deposits are familiar liabilities, reimagined.

They may all enable faster payments, programmable transactions, and new financial models. But they carry profoundly different implications for risk, control, and trust.

And that is the point most often missed.

The future of money is not just about how it moves.
It is about who stands behind it when it matters most.

MY MUSINGS

I find it remarkable—and somewhat unsettling—how casually these terms are used in professional circles. We speak of “digital money” as if it were a single, coherent concept. It is not.

What concerns me most is not that people disagree. Disagreement is healthy. It is that many do not fully grasp what they are advocating for.

If you support stablecoins, are you comfortable with a partial return to private money?
If you support CBDCs, have you fully considered the implications of state visibility into transactions?
If you favor tokenised deposits, are you confident that incremental change is sufficient in a rapidly evolving world?

And perhaps the most important question of all:

Are we designing the future of money deliberately—or drifting into it?

I would be very interested in your views.

Where do you stand on this emerging triad of digital money?
Do you see convergence—or conflict?
And, ultimately, who should we trust to issue money in the digital age?

Leave a comment

Subscribe now

Introduction: The End of the Old Limits

For most of modern history, banking resembled a carefully engineered machine—powerful, yes, but constrained. Growth required branches, people, and capital in a tightly coupled relationship. If you wanted more revenue, you hired more staff. If you wanted scale, you built more infrastructure. Banking, in other words, was physical at its core.

That era is ending.

What we are witnessing in 2026 is not a technological upgrade but a conceptual rupture. The emergence of generative AI, agentic systems, and digital assets has severed the historical link between capacity and constraint. Banking is becoming unconstrained—freed from the linear logic that has governed it since the Renaissance.

But revolutions do not arrive quietly. They arrive with paradoxes, tensions, and competing visions of the future.

The 10x Bank: Growth Without Gravity

Imagine a bank that doubles its assets without hiring a single additional analyst. That idea would have sounded absurd even five years ago. Today, it is becoming reality.

The “10x Bank” reframes growth itself. It is no longer about scale through accumulation—it is scale through orchestration.

Instead of armies of mid-level professionals, some banks are now beginning to rely on a small cadre of human strategists who direct vast ecosystems of AI agents. These agents perform everything from compliance checks to software development, operating continuously, consistently, and at negligible marginal cost.

The analogy is not industrial—it is orchestral. The modern banker is less a worker and more a conductor, coordinating thousands of invisible performers.

Yet not everyone is convinced. Critics argue that this model creates hidden fragility. If human oversight shrinks too far, do institutions risk becoming opaque, unmanageable, or dangerously dependent on systems they do not fully understand? Efficiency, in this sense, may come at the cost of resilience.

Agentic Money: When Capital Starts Thinking

Money has always been passive. It waited. It obeyed. It moved only when instructed.

That assumption is collapsing.

Agentic money introduces a profound inversion: capital that acts instead of waits. Funds can now optimize themselves—routing liquidity, seeking yield, and executing transactions autonomously within predefined rules.

Think of it less as cash and more as a self-driving vehicle. You set the destination, but the system determines the route in real time.

The benefits are obvious. Corporates already report dramatic gains in efficiency and cost reduction through programmable payments and automated treasury systems. Idle capital becomes a relic of the past.

But here lies the paradox: the more intelligent money becomes, the less visible its decision-making may be. Who is accountable when autonomous systems make suboptimal—or catastrophic—choices? The promise of optimization may collide with the reality of governance.

Vertical Compression: The Silent Takeover

Traditionally, banks owned the full stack of customer experience—from brand to execution. That vertical integration is now under threat.

External AI platforms and technology firms are inserting themselves between banks and their customers, capturing the interface and, increasingly, the relationship itself. This phenomenon—vertical compression—is subtle but profound.

Banks risk becoming invisible utilities: regulated engines operating behind the scenes while others own the customer experience.

The reframe here is stark: banks are not just competing with other banks anymore; they are competing with interfaces.

Defenders of the traditional model point to customer inertia. Many clients stay with their bank for years, even decades. But this loyalty is often passive, not emotional. When a superior AI-driven interface emerges—one that simplifies decisions, anticipates needs, and removes friction—that inertia may evaporate almost overnight.

The Siege of the $200 Trillion Balance Sheet

Previous waves of fintech disruption targeted payments—the “flow” of money. This was disruptive but not existential.

Today’s battle is different. It targets the “stock”—the deposits and loans that form the core of banking.

Stablecoins, decentralized finance, and private credit markets are constructing an alternative financial system, one that operates beyond traditional constraints. Transaction volumes on these new rails are approaching the scale of established global networks.

The analogy is not a skirmish at the gates—it is a siege of the fortress itself.

Some argue that banks’ regulatory advantages will ultimately protect them. Trust, capital requirements, and systemic importance are not easily replicated. Others counter that regulation is a double-edged sword: it provides stability but limits agility. In a world of unconstrained competitors, constraints can quickly become liabilities.

The Return of the Physical: A Paradox of Trust

In a digital-first world, one might expect physical bank branches to fade into irrelevance. The opposite is happening.

As AI-driven fraud and deepfakes proliferate, the physical branch is re-emerging as a sanctuary of trust—a place where reality can be verified. This is not a retreat into the past but a reinvention of purpose.

Branches are evolving into “life orchestration” hubs, offering high-value advisory services and complex financial guidance. At the same time, lightweight formats—such as pop-up service points—bring immediacy and convenience to everyday banking.

Here lies a powerful paradox: the more digital banking becomes, the more valuable physical presence becomes.

Sceptics question whether this resurgence is sustainable. Physical infrastructure is expensive, and digital-native generations may ultimately prefer virtual solutions. Yet current trends suggest a hybrid future—one where trust is anchored in the physical even as functionality migrates to the digital.

Competing Visions: Liberation or Loss of Control?

The narrative of unconstrained banking is not universally celebrated.

Optimists see liberation: a world where financial services are faster, cheaper, and more inclusive. Barriers fall, efficiency rises, and innovation accelerates.

Sceptics see something else: concentration of power in opaque systems, erosion of human judgement, and the potential destabilization of core financial structures. If banks lose control of customer relationships and balance sheets simultaneously, what remains of the traditional institution?

Both perspectives may be correct.

Conclusion: Banking’s Moment of Reinvention

Banking in 2026 stands at a crossroads reminiscent of the media industry’s shift to on-demand streaming. Constraints are dissolving, and with them, long-standing assumptions about how the industry operates.

The central question is no longer whether change is coming—it is whether institutions can adapt quickly enough to harness it.

Unconstrained banking offers extraordinary potential: exponential growth, intelligent capital, and seamless customer experiences. But it also introduces new risks, new dependencies, and new competitive dynamics.

The future will not belong to those who simply adopt technology. It will belong to those who understand its implications—and redesign their institutions accordingly.

MY MUSINGS

We often celebrate the removal of constraints as progress. But constraints, historically, have also provided discipline.

If banks can scale infinitely, what anchors their decision-making? If money can think, who ensures it thinks well? And if customer relationships migrate to external platforms, do banks risk becoming the “dumb pipes” of finance?

I am particularly struck by the paradox of trust. At the very moment we are building the most advanced digital systems in history, we are rediscovering the value of physical presence. That suggests something deeper: technology can enhance trust, but it cannot fully replace it.

Perhaps the real question is not whether banking becomes unconstrained—but whether it should.

Are we building a more efficient system, or a more fragile one?

And what happens when the intelligence we unleash begins to outpace the institutions designed to control it?

I would be very interested in your thoughts.

Leave a comment

Subscribe now

In this episode, Bob and Amy look at what banking leaders planning for the 2026 unconstrained era need to be aware of. This podcast is an action-orientated guide for banks to adopt new digital money strategies.

They look at the main trends for banking leaders to understand future industry shifts. How evolving consumer intent and agentic payments redefine the bank relationship. Practical steps for banks to begin their digital currency strategy. Understanding why banks must transition from a reactive status to becoming proactive market orchestrators.

Please let us know your thoughts by leaving a comment in the link below. We would love to hear from you.

Leave a comment

Subscribe now

In Western diplomatic circles, there is a perennial, almost desperate hunger for the “moderate”—the belief that our most intractable adversaries are just one “pragmatic” leader away from joining the rules-based international order. As we navigate the volatile landscape of April 2026, the headlines suggest we have finally arrived: a “New Syria” has emerged from the ashes, and a “post-Khamenei” Iran appears ready to talk.

However, for those of us who have spent decades in the souks and situation rooms of the Levant, these developments look less like a spring thaw and more like a masterclass in tactical deceit. There is a startling disconnect between the suits worn in Washington and the boots on the ground in Aleppo and Tehran. While the West bets on “Enlightenment rationalism", our adversaries are doubling down on a centuries-old strategic engine: taqiyya (tactical deceit).

1. Syria’s “Strong Leader” is a Wanted Man in a New Suit

The most jarring image of the past year remains the November 10, 2025, White House welcome for Syrian President Ahmed al-Sharaa. To hear the administration tell it, al-Sharaa is the “attractive, tough guy” and “strong leader” Syria needs to stabilize.

But the “insider” reality is far more cynical. Ahmed al-Sharaa is merely the polished rebrand of Abu Mohammed al-Jolani, the former leader of Jabhat al-Nusra—Al-Qaeda’s official branch in Syria. This is a man who once carried a $10 million U.S. bounty on his head and pledged fealty to Ayman al-Zawahiri. His “transformation” into a statesman is purely cosmetic. While he charms diplomats, his military remains an ideological hothouse. Just look at the recent footage of Brigade 60, a formal unit of his new national army, where soldiers were filmed chanting: “O my enemy [Israel], I’m coming after you!”

“There is a recurring pattern in Western policy toward the Middle East: the tendency to mistake tactical shifts for genuine ideological transformation. Leaders rebrand themselves, adopt more polished rhetoric and wardrobe, and present a moderate face to the outside world, while the underlying worldview remains unchanged.”

2. The “Moderate” Iranian Insider is a Military Junta in Disguise

The February 28, 2026, joint U.S.-Israeli strikes changed the Middle East forever by eliminating Supreme Leader Ali Khamenei. With his son and intended successor, Mojtaba, currently incapacitated or dead, the Western press has rushed to crown Parliamentary Speaker Mohammad Bagher Ghalibaf as the “moderate” savior of the regime.

This is a statistical and structural impossibility. We are witnessing a shift from “turbans” to “caps”—the theocracy has morphed into a literal military junta led by the Islamic Revolutionary Guard Corps (IRGC), with Ghalibaf as its civilian face. Ghalibaf is not a reformer; he is an enforcer who co-signed the orders to crush student protesters in 1999 and has spent his career leading “Death to America” chants in parliament.

Ghalibaf’s “Enforcer” Credentials:

• IRGC Architect: Former commander of the IRGC Air Force and a key figure in its regional expansion.

• National Police Chief: He led the brutal suppression of internal dissent.

• The “Yes Man” Trap: While the Trump administration views him as a pragmatist they can “work with", Ghalibaf cannot breathe without the approval of the IRGC high command.

3. Hamas Views Disarmament as a "Fantasy", Not a Framework

While the U.S. “Board of Peace” attempts to stabilize Gaza with talk of reconstruction and disarmament deadlines, Hamas is reading from a different script. In his April 5, 2026, speech, Hamas spokesman Abu Obaida didn’t just reject negotiations; he framed the current war as a “decisive phase” of a global jihad.

Hamas no longer distinguishes between Jerusalem and Washington, explicitly railing against the “Zionist-American assault". To Hamas, the war isn’t about borders or “two-state solutions”; it is an extension of the “Al-Aqsa Flood” involving a unified front of Iran, Lebanon, and Yemen.

“What the enemy failed to take from us through tanks and war, it will not be able to take through politics or at the negotiating table... Raising the issue of weapons in this blunt manner is nothing but an overt attempt to continue the genocide against our people.”

4. The NATO “Allies” Who Won’t Grant Airspace

The 2026 conflict has exposed a bitter truth: being a NATO ally does not mean being an ally in the fight against the Iranian axis. While the U.S. is treaty-bound to defend 31 nations, several key members have actively sabotaged American resupply efforts.

Formal NATO Allies vs. The Unofficial Ally:

• The Appeasers (France, Spain, Italy): These nations have flatly refused to allow American resupply flights to use their airspace. Their leaders, cowed by “red-green” domestic alliances of Marxists and Islamist voters, have opted for a moral abdication, treating the Iranian threat as “someone else’s job".

• The Reluctant (United Kingdom): Initially refused access to bases before eventually relenting under heavy pressure.

• The “Unofficial” Ally (Israel): With no formal treaty, Israel is the only nation “fighting side by side” with the U.S., providing unmatched intelligence and ground-level cooperation while sustaining continuous missile barrages.

5. The Press Pass as an “Operational Shield”

In 2026, the press pass has become the most effective flak jacket in the Hamas arsenal. The realization that Al-Jazeera serves as a 24/7 propaganda outlet for the IRGC axis is no longer a “fringe” theory—it is a documented reality. A study of identified Palestinian “journalists” killed in the conflict shows that over 59% were active members of terrorist organizations.

Take the case of Mohammed Wishah. Long championed by Al-Jazeera as a courageous reporter, a laptop seized from a Hamas base two years ago revealed his true identity: a senior commander in Hamas’s anti-tank missile array. Similarly, Anas al-Sharif was recently revealed to be a Hamas cell leader facilitated by the network. By masquerading as journalists, these operatives move freely and gather intelligence under the protection of international law, a cynical tactic that destroys the credibility of genuine war correspondence.

“The network has been operating as a propaganda outlet in the service of Hamas 24/7... The channel expresses unreserved support for Hamas, justifying the deadly attack, showing footage of it obtained from the body cams of the terrorists, and celebrating it as a victory.” — Yigal Carmon, MEMRI.

Conclusion: The Danger of the Half-Finished War

The overarching lesson of the 2026 landscape is the lethal danger of the “half-finished war". We have decapitated the Iranian leadership and destabilized the Syrian regime, but we are leaving the revolutionary structures intact.

This brings to mind the 1978 anecdote of Romanian dictator Nicolae Ceaușescu instructing Yasser Arafat on how to play the West: “You simply have to keep on pretending that you’ll break with terrorism... over, and over, and over.” Arafat listened, and he nearly walked away with a Nobel Peace Prize while the terror continued.

In a region where taqiyya (strategic deceit) is a recognized tool of survival, the West’s “Enlightenment rationalism” is its greatest weakness. We assume our enemies want stability and prosperity; they tell us, quite clearly, that they want martyrdom and expansion. As the Iranian regime regenerates from its ideological core and Al-Sharaa trades his fatigues for a Brioni suit, we must ask: Can we afford to keep betting on the “moderate” next in line, or is it finally time to demand structural transformation instead of a better-fitting suit?

Leave a comment

Subscribe now

Introduction

It is a quiet Tuesday morning in suburban England. An elderly woman writes out a cheque to pay her gardener—slowly, deliberately, with the confidence of habit. Across the Atlantic, a small business owner in the United States prints a batch of cheques to settle supplier invoices, preferring the paper trail over digital abstraction.

These scenes feel anachronistic in an era dominated by instant payments, mobile wallets, and real-time settlement systems. And yet, the paper cheque persists.

So the question is not simply whether cheques are declining—they clearly are. The real question is more provocative: does the paper cheque still have a future, or are we witnessing its prolonged and uneven demise?

The Long Goodbye That Never Quite Ends

The conventional narrative is straightforward: cheques are dying. In both the US and the UK, volumes have fallen sharply over the past two decades as electronic payments—from Faster Payments in the UK to ACH and card networks in the US—have taken centre stage.

But this is where the first reframe matters: the cheque is not disappearing; it is concentrating.

Rather than fading evenly across society, cheque usage is becoming more niche, more deliberate, and in some cases, more entrenched. Governments, large corporations, and digital-native consumers have largely moved on. Yet certain demographics and use cases remain stubbornly attached.

This creates a paradox. The cheque is both obsolete and indispensable—depending on where you stand.

Trust, Tangibility, and the Human Factor

To understand the cheque’s persistence, one must step beyond efficiency and into psychology.

A cheque is not just a payment instrument; it is a physical artifact of trust. It can be held, stored, copied, and—crucially—understood without intermediaries. For many individuals, particularly older populations in both the US and UK, this tangibility matters.

Digital payments, for all their speed, introduce layers of abstraction. Money moves invisibly, often irreversibly, through systems few truly understand. A cheque, by contrast, feels controllable. It can be post-dated, cancelled, or simply withheld.

Here lies an analogy: if digital payments are like sending an email, a cheque is like posting a signed letter. Slower, yes—but often perceived as more deliberate and secure.

Critics argue this perception is outdated, even dangerous, given the fraud risks associated with cheques. Yet perception often outweighs reality in financial behaviour.

The Business Case: Inefficiency with Benefits

From a purely economic perspective, cheques are inefficient. They are costly to process, prone to delays, and vulnerable to fraud. Banks in both the US and UK have invested heavily in digital alternatives precisely to eliminate these frictions.

And yet, businesses—especially small and mid-sized enterprises—continue to use them. Why?

Because inefficiency can sometimes serve a purpose.

Cheques introduce friction into the payment process, and that friction can be useful. It allows for timing control, cash flow management, and reconciliation in ways that instant payments do not easily replicate.

Here is the inversion: what if the very inefficiencies of cheques are the reason they survive?

In a world obsessed with speed, not every transaction benefits from immediacy. Some require pause, review, and intentional delay. Cheques provide that pause.

The UK: Managed Decline, Not Abrupt Death

In the UK, the trajectory of cheques has been one of managed decline. There was a moment in 2009 when plans were floated to abolish cheques entirely by 2018. The backlash was swift and decisive, particularly from vulnerable groups and small charities. The plan was ultimately abandoned.

Instead, the UK has adopted a more pragmatic approach. Cheque usage has been reduced through digitisation—such as remote cheque imaging—rather than outright elimination.

This reflects a broader recognition: financial inclusion sometimes requires preserving legacy systems.

For certain users, especially those less comfortable with digital tools, the cheque remains a lifeline rather than a relic.

The US: A Market That Refuses to Let Go

If the UK represents managed decline, the US represents stubborn persistence.

Cheque usage in the United States remains significantly higher than in most developed economies. Cultural factors, regulatory fragmentation, and the sheer scale of the financial system all contribute to this resilience.

Unlike the UK, where centralised systems enable coordinated change, the US operates more like a patchwork. Different industries, regions, and institutions move at different speeds.

This creates an environment where cheques continue to coexist with cutting-edge payment technologies.

Another reframe emerges: the future of payments is not linear—it is layered.

In the US, the cheque is not being replaced; it is being absorbed into a broader ecosystem where old and new coexist, sometimes uneasily.

Fraud, Risk, and the Dark Side of Paper

No discussion of cheques would be complete without addressing risk.

Cheque fraud remains a significant concern, particularly in the US, where incidents of mail theft and check washing have increased. The physical nature of cheques, once seen as a strength, is now a vulnerability in an increasingly digital threat landscape.

This introduces a paradox: the very features that make cheques trusted—physicality, visibility, permanence—also make them exploitable.

Digital systems are not immune to fraud, but they benefit from real-time monitoring, encryption, and adaptive defences. Cheques, by contrast, are static in a dynamic threat environment.

This raises a critical question: can a payment instrument designed for a slower, more analog world survive in a fast-evolving digital risk landscape?

The Generational Shift

Perhaps the most decisive factor in the cheque’s future is generational change.

Younger consumers in both the US and UK are not just reducing their use of cheques—they are bypassing them entirely. Many have never written one. For them, payments are mobile, instant, and integrated into everyday apps.

This is not merely a shift in preference; it is a shift in expectation.

To a younger user, waiting days for a cheque to clear feels as antiquated as dial-up internet. The cheque does not just compete with digital payments—it competes with a fundamentally different mindset.

And mindsets, once changed, rarely revert.

Conclusion: Evolution, Not Extinction

So, does the paper cheque have a future?

Yes—but not the one it once had.

The cheque is unlikely to disappear entirely in either the US or the UK in the near term. It will persist in niches where its unique characteristics—tangibility, control, familiarity—continue to provide value.

But its role will shrink, its relevance will narrow, and its risks will become harder to justify.

The cheque is not dying in a dramatic collapse. It is fading through gradual displacement, sustained by pockets of resistance and specific use cases.

In that sense, the cheque’s future is not about survival or extinction. It is about adaptation within a changing ecosystem.

Or, to reframe one final time: the cheque is no longer a mainstream payment method—it is a specialised tool in a digital world.

MY MUSINGS

I find the cheque’s persistence fascinating—not because of what it is, but because of what it represents.

It forces us to confront an uncomfortable truth: progress in financial systems is not purely technological; it is deeply human. Trust, habit, control—these do not evolve at the same pace as innovation.

But here’s the question that lingers:

Are we preserving cheques because they still serve a purpose—or because we are reluctant to let go of what they symbolise?

And more provocatively:

If we were designing a payment system from scratch today, would anything like the cheque even exist?

Or is it simply a legacy we continue to accommodate?

I suspect the answer lies somewhere in between.

What do you think? Are cheques a necessary bridge for inclusion and control—or an outdated compromise that delays progress?

Leave a comment

Subscribe now

Introduction

At 9:00 a.m., a customer checks their balance on a mobile app.
By 9:02, they initiate a payment through a digital wallet.
By 9:05, they apply for credit—without ever knowing which institution is behind it.

Nothing appears unusual. Everything works seamlessly. And yet, beneath this frictionless experience lies a growing tension that will define the next decade of financial services.

For years, the narrative has been simple: banks versus fintechs. Incumbents versus disruptors. Stability versus innovation. But this framing is becoming increasingly outdated. The real story is no longer about competition. It is about convergence—and the profound challenges that come with it.

Over the next ten years, banks and fintechs will not merely compete. They will collide, collaborate, and, in many cases, become indistinguishable from one another. And in that transformation lies both opportunity and risk.

From Competition to Convergence

For much of the past decade, fintechs positioned themselves as agile challengers, unburdened by legacy systems and regulatory inertia. Banks, in turn, leaned on their scale, trust, and balance sheets to maintain dominance.

On the one hand, fintechs excelled at customer experience—fast onboarding, intuitive interfaces, and seamless journeys. On the other, banks retained control over infrastructure, capital, and regulatory licenses.

That balance is shifting.

Fintechs are no longer just front-end innovators. Many are acquiring licenses, building balance sheets, and moving deeper into core banking functions. At the same time, banks are investing heavily in technology, partnering with fintechs, and embedding digital capabilities into their operations.

The result is a gradual blurring of roles. What was once a clear distinction is becoming a spectrum.

The challenge is no longer how to compete—but how to operate in a world where the lines of identity are fading.

The Illusion of Digital Transformation

Digital transformation has become the industry’s most frequently invoked solution. Yet, beneath the surface, its meaning often varies widely.

For some institutions, it is about migrating to the cloud. For others, it is about redesigning customer journeys. And for many, it is simply about keeping pace with competitors.

But what if digital transformation is not transformation at all?

What if it is merely digitization—layering new interfaces on top of old structures?

The distinction matters. Because while digitization improves efficiency, it does not fundamentally change how institutions operate. It does not resolve fragmentation, eliminate silos, or address deeply embedded process inefficiencies.

In many cases, it simply accelerates existing problems.

A faster system that processes flawed decisions more quickly does not reduce risk. It amplifies it.

The New Complexity of Risk

Risk in financial services has always been multifaceted. But over the next decade, its nature will evolve in ways that challenge traditional frameworks.

A single failed API call may seem insignificant. Yet, in a highly interconnected ecosystem, it can cascade across platforms, disrupt services, and erode trust within minutes.

What begins as a technical issue can quickly become a customer issue, a reputational issue, and ultimately a regulatory issue.

The more integrated systems become, the less isolated failures remain.

This is the paradox of modern finance: the more seamless the experience, the more complex the underlying risk.

Institutions are no longer managing discrete risks. They are managing networks of interdependencies—many of which are not fully visible.

Regulation: Constraint or Catalyst?

Regulation is often viewed as a constraint—something that slows innovation and imposes additional costs. For fintechs, it can feel like an obstacle to scaling. For banks, it is an ever-present burden.

And yet, regulation may become one of the defining competitive advantages of the next decade.

As fintechs grow and take on more systemic roles, they will face increasing regulatory scrutiny. Compliance will no longer be optional or peripheral. It will be central to their operating model.

At the same time, banks may find that their experience navigating regulatory environments becomes an asset rather than a liability.

The question is not whether regulation will increase—it will. The question is how institutions choose to respond.

Those that treat regulation as a checkbox exercise will struggle. Those that integrate it into their strategy may find it becomes a source of trust and differentiation.

The Data Dilemma

Data has long been described as the new currency of financial services. But like any currency, its value depends on how it is managed.

Banks possess vast amounts of historical data, but often struggle to leverage it effectively due to legacy systems and organizational silos. Fintechs, by contrast, are built around data-driven models but may lack depth and breadth.

As open banking and data-sharing frameworks expand, the competitive landscape will shift once again.

Access to data will become less of a differentiator. The ability to interpret and act on it will become critical.

But this introduces a new challenge: trust.

Customers are increasingly aware of how their data is used. Regulators are tightening requirements around privacy and security. And any breach—technical or ethical—can have far-reaching consequences.

The more data institutions collect, the greater their responsibility becomes.

Resilience in an Always-On World

Financial services are becoming an always-on industry. Customers expect instant access, real-time processing, and uninterrupted service.

This expectation leaves little room for failure.

In the past, downtime was inconvenient. In the future, it will be unacceptable.

But resilience is not simply about preventing outages. It is about the ability to absorb shocks, adapt to disruptions, and recover quickly.

And here lies another challenge.

As systems become more complex and interconnected, resilience becomes harder to achieve. Dependencies multiply. Failure points increase. And the margin for error narrows.

Institutions must rethink resilience not as a technical capability, but as an organizational mindset—one that spans technology, processes, and people.

The Human Factor

Amid all the focus on technology, it is easy to overlook the human dimension.

Yet, many of the challenges facing banks and fintechs are not purely technical. They are organizational and cultural.

Legacy institutions often struggle with agility—not because of technology, but because of entrenched processes and decision-making structures. Fintechs, on the other hand, may struggle with governance as they scale.

Talent becomes a critical factor. Not just in terms of technical skills, but in the ability to navigate complexity, manage risk, and think strategically.

The future will not be defined by technology alone. It will be shaped by how people use it, manage it, and govern it.

Conclusion

The next decade will not be defined by a simple battle between banks and fintechs.

It will be defined by convergence.

The distinction between the two will continue to blur, giving rise to hybrid models that combine elements of both. Innovation will accelerate. Complexity will increase. And risk will evolve in ways that challenge traditional thinking.

The institutions that succeed will not be those that move fastest or those that play it safest.

They will be those that understand the deeper dynamics at play—those that recognize that technology is only part of the equation, that risk is interconnected, and that trust remains the foundation of financial services.

In the end, the greatest challenge may not be adapting to change.

It may be understanding what is truly changing—and what is not.

MY MUSINGS

I find myself questioning whether we are still framing this evolution correctly.

Are banks really becoming fintechs? Or are fintechs becoming banks? Or is that distinction no longer meaningful?

We talk about digital transformation as if it were a destination. But is it, in reality, an ongoing state of adaptation—one that never quite settles?

And then there is risk. Are we genuinely improving our ability to manage it, or are we simply shifting it into areas that are less visible and harder to measure?

Perhaps the most uncomfortable question is this:
Are we building a financial system that is more resilient—or one that is simply more efficient until it fails?

I would be very interested to hear your thoughts.

Where do you see the biggest challenges emerging over the next decade?
And more importantly, do you believe the industry is asking the right questions?

Leave a comment

Subscribe now

Introduction

Fintech was once the disruptor. It promised speed over bureaucracy, access over exclusion, and innovation over inertia. For a time, it delivered. Startups scaled rapidly, investors poured in capital, and traditional financial institutions scrambled to respond.

But the narrative is shifting. Fintech is no longer just disrupting—it is being tested. What was once a story of boundless growth is now a story of constraints, contradictions, and hard realities. The question is no longer whether fintech can change finance. It is whether fintech can endure it.

The Funding Reality: From Abundance to Scrutiny

It’s not that capital has disappeared. It’s that it has become selective.

In the era of low interest rates, fintechs thrived on cheap money and bold promises. Growth mattered more than profitability. Scale was the strategy. Today, that equation has reversed. Investors are asking tougher questions: Where are the profits? Where is the resilience?

This is not a funding drought. It is a funding discipline. And many fintechs, built for expansion rather than sustainability, are struggling to adjust.

Regulation: From Afterthought to Obstacle Course

Fintech once operated in the margins of regulation. Now it sits squarely in the spotlight.

As fintechs take on roles traditionally held by banks—payments, lending, asset management—they inherit the same scrutiny. Compliance is no longer optional; it is existential. Licensing requirements, data protection laws, anti-money laundering obligations—these are not side issues. They are central to survival.

What was once a competitive advantage—speed—now collides with regulatory reality. Move fast and break things? Not in financial services.

Competition: Not Just Banks Anymore

It’s not that fintechs are competing with banks. It’s that they are competing with everyone.

Big Tech has entered finance. Incumbent banks have modernized. Even other fintechs are crowding the same niches. Payments, lending, digital wallets—these spaces are saturated.

The result is a paradox. Fintechs succeeded in proving the market opportunity. Now they must fight to defend it.

Differentiation is no longer about being digital. Everyone is digital. The challenge is being indispensable.

Trust: The Fragile Currency

It’s not that fintech lacks users. It’s that it must earn trust—continuously.

Financial services run on confidence. A single failure—an outage, a fraud incident, a data breach—can undo years of growth. Unlike other industries, trust in finance is not easily rebuilt.

Fintechs often position themselves as customer-centric alternatives. But that promise raises the bar. Users expect not just better experiences, but safer ones.

In finance, trust is not a feature. It is the product.

Conclusion

Fintech is no longer in its adolescence. It is entering adulthood.

The challenges it faces—funding discipline, regulatory pressure, intense competition, and the burden of trust—are not signs of failure. They are signs of maturation. The easy wins are gone. What remains is the hard work of building durable, resilient businesses.

Fintech set out to change finance. Now it must prove it can operate within it.

MY MUSINGS

I can’t help but wonder whether fintech’s biggest challenge is not external—but internal.

Did the industry mistake speed for strategy? Did it overestimate how different finance really is? Disruption is easy to talk about, but finance has always been a system built on stability, trust, and regulation. Perhaps fintech is not replacing that system—but being absorbed by it.

And maybe that’s not a bad thing.

The real opportunity might not lie in breaking finance, but in reshaping it—patiently, responsibly, and sustainably.

But that raises uncomfortable questions. Can fintech remain innovative while becoming compliant? Can it stay agile while building trust? Can it scale without losing its identity?

I’d be interested to hear your thoughts. Is fintech still a disruptor—or has it become just another part of the machine?

Leave a comment

Subscribe now

Introduction

At 10:14 a.m., a suspicious transaction is flagged.
By 10:15, patterns are cross-referenced across accounts, geographies, and devices.
By 10:16, a decision is made—accounts frozen, alerts triggered, exposure contained.

No human intervenes.

What appears to be speed is something more profound. What we are witnessing is not just automation. It is agency.

Agentic AI—systems capable of reasoning, planning, and executing multi-step workflows independently—are beginning to reshape how financial decisions are made. And in doing so, it challenges one of the industry’s most fundamental assumptions: that control must always reside with humans.

From Automation to Agency

For years, financial institutions have pursued automation. Processes were streamlined. Tasks were accelerated. Costs were reduced.

But this is not automation.

Automation follows instructions.
Agentic AI interprets objectives.

It’s not a faster process—it’s a different kind of actor.

This distinction matters. A rule-based fraud system flags anomalies based on predefined criteria. An agentic system investigates, contextualises, and acts. It doesn’t just detect risk. It responds to it.

The shift is subtle but profound.

The New Decision-Maker

Consider investment management.

Traditional models rely on human-defined strategies, supported by analytics and execution tools. Even algorithmic trading systems operate within tightly specified parameters.

Agentic AI changes the frame.

It’s not executing a strategy—it’s managing one.

Given an objective—optimize returns within a defined risk tolerance—an agentic system can analyze market conditions, rebalance portfolios, hedge exposures, and adapt dynamically. It can learn from outcomes and refine its approach.

This is not decision support.
It is decision delegation.

And with delegation comes a new set of questions: Who is accountable? Who understands the decision path? And what happens when the system’s reasoning cannot be easily explained?

Complexity Beneath Simplicity

On the surface, agentic systems promise simplicity—faster responses, reduced manual intervention, seamless workflows.

Beneath the surface, complexity grows.

A single decision may involve multiple data sources, probabilistic reasoning, and adaptive learning. The outcome may be optimal in context—but opaque in explanation.

The more capable the system, the harder it becomes to trace its logic.

This is the paradox: the smarter the machine, the less transparent the process.

And in financial services—where auditability, accountability, and trust are paramount—opacity is not a trivial concern.

Risk Reframed

Agentic AI is often positioned as a tool for reducing risk—detecting fraud faster, managing portfolios more effectively, identifying anomalies in real time.

But it’s not just reducing risk.
It’s redistributing it.

Operational risk shifts from process failure to model behaviour.

Conduct risk shifts from human judgement to machine reasoning.
Systemic risk may increase as similar models act in similar ways under stress.

What appears to be control may, in fact, be a different form of exposure.

The question is no longer whether decisions are made correctly. It is whether we understand how they are made—and whether we can intervene when needed.

Governance in the Age of Autonomy

If agentic systems are to operate independently, governance cannot remain an afterthought.

Traditional control frameworks assume human oversight at key decision points. But what happens when decisions occur faster than humans can react?

Governance must evolve from approval-based models to boundary-based models.

Instead of asking, “Did someone approve this decision?”
We may need to ask, “Was the system operating within acceptable limits?”

This requires new forms of monitoring, new definitions of accountability, and a willingness to rethink what control actually means.

Conclusion

Agentic AI represents a shift that goes beyond technology.

It is not just about doing things faster.
It is about deciding differently.

It’s not automation—it’s autonomy.

And as financial institutions begin to adopt these systems, they will face a fundamental choice: how much decision-making they are willing to delegate, and under what conditions.

Because in the end, the question is not whether machines can act.

It is whether we are prepared to live with the consequences when they do.

MY MUSINGS

I find this both fascinating and unsettling.

We have spent decades building frameworks around human decision-making—controls, oversight, accountability. Now we are introducing systems that challenge those very foundations.

Are we moving too quickly from assistance to autonomy?

And perhaps more importantly, do we fully understand the trade-offs?

If an agentic system makes a better decision than a human—but cannot fully explain it—do we accept it? Or do we reject it in favour of transparency?

There is also the question of concentration. If many institutions rely on similar models, are we creating a new form of systemic risk—one that reacts at machine speed?

I would be very interested in your perspective.

Where do you see the greatest opportunity for agentic AI in finance?
And where do you believe the greatest risks may lie?

Leave a comment

Subscribe now

Introduction

The payments landscape is often framed as a showdown between traditional banks and nimble fintech startups. It is portrayed as old versus new, slow versus fast, legacy versus innovation. But that framing misses the deeper truth. This is not a battle about technology. It is a battle about control.

Payments sit at the heart of the financial system. Whoever owns the payment experience owns the customer relationship. And whoever owns the customer relationship controls the future of financial services.

It’s Not About Speed. It’s About Ownership.

At first glance, fintechs appear to be winning because they are faster—instant transfers, seamless wallets, and invisible checkouts. Banks, by contrast, are often seen as clunky and slow.

But this is not about speed. It is about ownership of the interface.

Fintechs are not trying to move money faster. They are trying to position themselves between the customer and the bank. Every time a consumer pays through a digital wallet or a payment app, the bank fades into the background. The infrastructure remains, but the visibility disappears.

Banks still hold the deposits. But fintechs are capturing the experience. And in the digital economy, experience is power.

It’s Not About Innovation. It’s About Repackaging

Fintechs are often celebrated as innovators. And in some cases, they are. But much of what they offer is not fundamentally new. Payments still rely on the same underlying rails: card networks, clearing systems, and bank accounts.

This is not about creating new systems. It is about repackaging old ones.

Fintechs excel at turning complex, fragmented banking processes into simple, intuitive user journeys. They reduce friction, hide complexity, and create the illusion of something entirely new.

Banks, on the other hand, have struggled to translate their capabilities into compelling customer experiences. They have the engine, but fintechs have the dashboard.

It’s Not About Disruption. It’s About Dependency

The popular narrative suggests fintechs are disrupting banks. But the reality is more nuanced.

This is not disruption. It is dependency.

Most fintechs rely on banks for core functions: holding funds, accessing payment rails, and ensuring regulatory compliance. Without banks, many fintech business models would not exist.

At the same time, banks are becoming increasingly dependent on fintechs to stay relevant in the digital age. They need fintech partnerships to enhance user experience, accelerate innovation, and reach new customer segments.

What looks like a battle is, in many ways, a symbiotic relationship.

It’s Not About Winning. It’s About Positioning

So who will win? Banks or fintechs?

That is the wrong question.

This is not about winning. It is about positioning within the value chain.

Banks are repositioning themselves as infrastructure providers—secure, regulated, and capital-rich. Fintechs are positioning themselves as customer-facing platforms—agile, intuitive, and data-driven.

The real competition is not between banks and fintechs. It is between different visions of where value should reside: in the balance sheet or in the interface.

Conclusion

The payments “war” is less dramatic than it appears, but far more consequential. It is not a fight over who moves money faster. It is a struggle over who owns the customer, who controls the data, and who defines the future of finance.

In the end, the winners will not be those who cling to old models or chase every new trend. The winners will be those who understand the deeper shift: payments are no longer just a function. They are a gateway.

And whoever controls the gateway controls everything that follows.

Leave a comment

Subscribe now

Introduction

Governance, Risk, and Compliance (GRC) has long suffered from an image problem. For many executives, it is considered a necessary burden—an expensive framework designed primarily to keep regulators satisfied and avoid fines. But this view is increasingly outdated.

GRC is not about avoiding failure. It is about enabling better decisions.

In a world defined by regulatory complexity, cyber threats, and interconnected risks, organisations that treat GRC as a strategic capability—rather than a compliance obligation—are the ones that thrive. The difference lies in measurement. If you cannot measure your GRC performance, you cannot manage it. And if you cannot manage it, you cannot improve it.

This is where key performance indicators (KPIs) come in. But not all KPIs are created equal. The most effective GRC metrics don’t just track activity; they reveal insight. They don’t just confirm compliance; they drive resilience.

This article explores how organisations can measure what truly matters across the eight critical pillars of GRC—and, more importantly, how to reframe these metrics as tools for strategic advantage.

Governance: From Policy Enforcement to Cultural Integrity

Governance is often reduced to policy documentation and oversight structures. But governance is not about policies sitting on shelves. It is about behaviours that shape decisions.

Tracking policy compliance rates is not about checking boxes. It is about understanding whether your organisation’s stated values translate into real-world actions. Similarly, board oversight effectiveness is not about the frequency of meetings. It is about whether leadership is actively engaged in shaping risk outcomes.

Ethical violation rates, often treated as lagging indicators, should be reframed. They are not signs of failure. They are signals of transparency. An organisation that surfaces ethical issues is not weaker—it is more aware.

Governance, therefore, is not about control. It is about alignment.

Risk Management: From Identification to Foresight

Risk management frameworks traditionally emphasise identification and mitigation. But risk management is not about cataloguing threats. It is about anticipating impact.

Risk identification coverage is not just a percentage metric. It reflects how deeply risk awareness is embedded across the organisation. Are risks being identified only at the top, or across all business units?

Risk mitigation effectiveness should not be viewed as a static outcome. It is a dynamic indicator of how well your controls adapt to changing conditions. And residual risk is not a leftover problem. It is a conscious choice—an expression of risk appetite.

Risk management is not about eliminating uncertainty. It is about navigating it intelligently.

Compliance Management: From Obligation to Operational Discipline

Compliance is often considered the heart of GRC—and also its biggest burden. But compliance is not about regulation. It is about discipline.

Regulatory compliance rates are not merely indicators of adherence. They reflect the organisation’s ability to integrate external requirements into internal processes. Audit findings are not just gaps. They are opportunities for refinement.

Training completion metrics are frequently treated as administrative necessities. But they represent something deeper: organisational awareness. An employee who understands compliance obligations is not just compliant—they are empowered.

Compliance, then, is not about avoiding penalties. It is about embedding consistency.

Audit Management: From Inspection to Improvement

Audit functions are often perceived as watchdogs—necessary but disruptive. This perception misses the point.

Audit coverage ratios are not about completing a plan. They are about ensuring visibility across risk areas. Finding remediation time is not about speed alone. It is about responsiveness and accountability.

Repeat audit issues are particularly revealing. They are not just recurring problems. They are indicators of systemic weakness. If issues persist, the problem is not the control—it is the culture or the process behind it.

An audit is not about inspection. It is about continuous improvement.

Information Security: From Defense to Vigilance

In the digital age, information security has become a central pillar of GRC. Yet, many organisations still treat it as a technical function.

Security incident rates are not simply operational metrics. They reflect the organisation’s exposure landscape. Vulnerability patch compliance is not about ticking SLA boxes. It is about maintaining system integrity in real time.

Tracking data breach attempts offers a powerful reframe. These are not failures—they are evidence of threat activity. A high number of attempts does not necessarily mean weak defences; it may indicate strong detection capabilities.

Information security is not about building walls. It is about maintaining vigilance.

Incident & Issue Management: From Reaction to Learning

Incident management is often judged by speed—how quickly issues are contained and resolved. But speed alone is not enough.

Incident response time is not just a measure of efficiency. It reflects preparedness. Issue resolution rates are not just about closure. They indicate priorities and resource allocations.

Root cause analysis (RCA) completion is where true value lies. Without understanding the “why,” organisations are doomed to repeat the “what.”

Incident management is not about reacting quickly. It is about learning effectively.

Third-Party Risk Management: From Oversight to Ecosystem Trust

Modern organisations are deeply interconnected, relying on complex networks of vendors and partners. This makes third-party risk management (TPRM) critical.

Vendor risk assessment coverage is not just due diligence. It is visibility into your extended enterprise. Third-party compliance rates are not contractual obligations. They are trust indicators.

Tracking high-risk vendors is not about identifying weak links. It is about prioritising engagement and oversight.

TPRM is not about managing vendors. It is about securing your ecosystem.

Business Continuity & Resilience: From Recovery to Readiness

Resilience has become a defining capability in an uncertain world. Yet it is often misunderstood.

Business Impact Analysis (BIA) coverage is not a documentation exercise. It is a strategic mapping of critical operations. Recovery Time Objective (RTO) achievement is not just a technical target. It is a measure of organisational agility.

Contingency plan readiness goes beyond having plans in place. It requires testing, iteration, and adaptation.

Resilience is not about recovering from disruption. It is about being ready for it.

Conclusion

GRC is undergoing a quiet transformation. It is no longer sufficient to treat it as a defensive mechanism designed to avoid fines and satisfy regulators.

GRC is not a cost centre. It is a strategic enabler.

By focusing on the right KPIs across governance, risk, compliance, audit, security, incident management, third-party risk, and resilience, organisations can shift from reactive firefighting to proactive intelligence. These metrics do more than measure performance—they shape behaviour, inform decisions, and build trust.

The journey does not require perfection. It requires intention. Start small. Build a baseline. Refine over time.

Because in the end, what gets measured is not just what gets managed—it is what gets valued.

MY MUSINGS

I find myself wondering whether we have collectively underestimated the power of measurement in GRC.

Too often, metrics are treated as reporting tools—numbers to present to the board, dashboards to review quarterly. But what if they are something more? What if they are the language through which organisations understand themselves?

When we say “GRC is not about avoiding fines—it’s about enabling decisions”, are we truly acting on that belief? Or are we still designing metrics that reinforce the old narrative?

There is also a deeper question: are we measuring what is easy, or what actually matters?

It is far simpler to count audit findings than to assess cultural alignment. Easier to track training completion than to measure understanding. Yet the latter is where real risk—and real opportunity—resides.

And then there is the human dimension. Metrics influence behaviour. If we measure the wrong things, we incentivise the wrong actions. Are we confident that our KPIs are driving the behaviours we actually want?

I would be very interested to hear your perspective.

Which GRC metrics have you found most valuable in practice? Where do you see the biggest gaps? And do you believe GRC has truly evolved into a strategic function—or is it still fighting that perception battle?

Let’s continue the conversation.

Leave a comment

Subscribe now

Its success was no accident. It was built on three pillars: military dominance, institutional stability, and a steady outflow of currency to support commerce beyond Rome’s borders.

In many ways, this mirrors the modern role of the U.S. dollar.

Today, the dollar functions as the world’s primary reserve currency, enabling global trade and financial integration. Like Rome, the United States supplies liquidity to the world, often running persistent trade deficits as a result.

But Rome’s story did not end in stability.

Gradual currency debasement, coupled with weakening political institutions, eroded trust in the denarius. Over time, this undermined Rome’s economic influence and contributed to broader systemic decline.

This is where the parallel becomes more than academic.

In today’s environment, we see mounting pressures: political fragmentation, evolving geopolitical alignments, and questions about long-term fiscal and monetary discipline.

Yet unlike Rome’s era, the global system today lacks a viable alternative to the dollar.

This creates a uniquely fragile situation—one where the decline of the dominant currency could trigger not transition, but disorder.

The question is no longer whether history repeats itself.

It is whether we are paying attention when it rhymes.

#GlobalFinance #USDollar #EconomicHistory #Geopolitics #FinancialStability

Leave a comment

Subscribe now

In the high-stakes theater of modern finance, we have become masters at managing what we can measure. Boardrooms are well-versed in the precise mathematics of credit and market risk, viewing them as predictable variables in a controllable equation. Yet, there is a “silent disruptor” that refuses to be neatly boxed or fully quantified.

Operational risk—the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events—is the ghost in the machine. It is messy, human, and deeply interconnected. To navigate this complexity, we must return to a fundamental framework of inquiry. As Rudyard Kipling famously wrote: “I keep six honest serving-men / (They taught me all I knew); / Their names are What and Why and When / And Where and Who and How.”

In an era where banking and fintech are converging into a single, hyper-connected ecosystem, these six questions provide the essential mental map for leaders to move beyond the “efficiency trap” and toward genuine operational resilience.

1. The “What” and “Where”: The Non-Linearity of Digital Chaos

Operational risk is fundamentally about execution failure. In our legacy past, these were “back-office” problems—isolated errors in a ledger or a single faulty printer. Today, the “Where” has shifted. Risk now manifests across a digital-first landscape of cloud environments, microservices architectures, and interconnected APIs.

In this environment, failure is non-linear. The distance between a minor oversight and a systemic collapse has vanished. A minor coding error is no longer just a bug; it is a potential trigger for a cascade of outages. A single phishing email is not merely an IT nuisance; it is a gateway to widespread fraud.

“Operational risk is messy, human, technological, and deeply interconnected. It emerges not from a single source but from a web of processes, people, systems, and external events.”

The “Where” of risk is now pervasive, living in internal processes, human factors, third-party ecosystems, and the very customer interfaces that define a brand’s digital presence.

2. The “Why”: Trust as the Ultimate Collateral

Why does this matter more than the fluctuations of the market? Because financial institutions do not just trade in currency; they trade in trust. When the machinery fails, that trust erodes—often irreparably.

The source of institutional value is protected (or destroyed) across five dimensions:

• Financial: The immediate drain of fines, litigation, and remediation.

• Reputational: The damage to credibility, which remains the most valuable asset in finance.

• Regulatory: The intensified scrutiny from authorities who are shifting focus from simple “management” to “demonstrable resilience.”

• Strategic: The derailment of digital transformation efforts that are meant to provide a competitive edge.

• Systemic: The ripple effect where a single failure destabilizes the broader financial infrastructure.

3. The “When”: The Paradox of “Business as Usual”

It is a common executive blind spot to assume that risk peaks only during high-stakes “events”—mergers, rapid scaling, or system upgrades. While these periods of transformation are indeed fertile ground for uncertainty, the most insidious risks are often condition-driven rather than event-driven.

Operational risk frequently thrives during routine operations. “Business as usual” breeds a dangerous complacency. When processes become mechanical and repetitive, the likelihood of human error or control failures increases. Whether an organization is in a phase of breakneck expansion where processes are strained or in a steady state where controls are ignored, the risk is ever-present. It simply changes its mask.

4. The “Who” and “How”: Responsibility as Culture, Not Department

Managing this risk is not a function to be outsourced to a compliance department; it is a culture of shared responsibility. Every individual within the firm acts as a “line of defense.” To move from theory to reality, the “How” of risk management—identification, assessment, and scenario analysis—must involve a broad spectrum of stakeholders:

• The Board and Senior Management: Setting the tone and integrating risk into strategic decisions.

• Business Units: Owning the risks inherent in daily execution.

• Risk, Compliance, and Technology Teams: Providing the frameworks and cybersecurity protections.

• Third Parties: Extending the risk perimeter to vendors and partners.

• Regulators: Influencing the landscape through evolving supervisory expectations.

5. Efficiency vs. Resilience: The Core Paradigm Shift

The central challenge for the modern fintech leader is the tension between speed and robustness. Many firms pride themselves on lean structures designed for maximum agility. However, efficiency without redundancy is a fragile achievement.

As we scale systems at record speed, we must ask if we are over-relying on automated technology to solve problems that are fundamentally human. Are we designing systems that can withstand a shock, or are we merely stripping away the “waste” that actually functions as a necessary buffer during a crisis?

“Are we designing systems that are robust—or merely efficient? Efficiency without resilience is a fragile achievement.”

Conclusion: Navigating the Intersection of Control and Chaos

Operational risk resides at the intersection of control and chaos. It refuses to be neatly boxed because it evolves as quickly as the technologies we deploy. By applying the “5W1H” framework—What, Why, When, Where, Who, and How—organizations can transform risk from a hidden vulnerability into a strategic pillar of resilience.

As we continue to build at the edge of innovation, we must confront a sobering question: Are we building genuine resilience, or are we simply accumulating hidden fragilities that will reveal themselves at the worst possible moment? In a world of increasing interdependence, the ability to navigate that uncertainty is the only true competitive advantage.

Leave a comment

Subscribe now

Introduction

By late March 2026, fintech is no longer defined by exuberant experimentation or hype-driven narratives. Instead, the sector is entering a more disciplined and consequential phase—one characterised by production-scale deployment, regulatory alignment, and infrastructure-level innovation.

The signals are clear. Venture capital funding into private fintechs rebounded by roughly 35% in 2025, but the nature of that investment has changed. Investors are now prioritising B2B platforms, sustainable revenue models, and demonstrable paths to profitability over speculative consumer applications. The era of “growth at all costs” is giving way to a more measured focus on resilience and long-term value creation.

This shift is not merely financial. It reflects a deeper transformation in how fintech is conceived, built, and deployed. Technologies that once lived in proof-of-concept environments — stablecoins, AI-driven automation, real-time payments — are now being embedded into real-world financial workflows. At the same time, regulatory frameworks are maturing, forcing discipline while enabling broader institutional adoption.

In short, 2026 is shaping up to be fintech’s “production year”.

Stablecoins and Digital Assets: From Speculation to Settlement

Perhaps the most striking evolution is the repositioning of stablecoins. Once viewed primarily as instruments for crypto trading, they are rapidly becoming foundational components of modern payment infrastructure.

The appeal is straightforward. Stablecoins offer the potential to bypass traditional correspondent banking rails, enabling near-instantaneous, low-cost cross-border transactions. For corporates managing global treasury operations, this represents a significant efficiency gain. For financial institutions, it opens up new pathways for settlement and liquidity management.

Recent developments underscore this shift. Large payment networks are exploring strategic acquisitions and partnerships in the stablecoin space, signalling a move toward institutional-grade infrastructure. At the same time, regulatory clarity—long a barrier to adoption—is beginning to emerge across key jurisdictions, encouraging enterprises to build and deploy stablecoin-based systems.

In parallel with this is the rise of “Tokenisation 2.0”. Real-world assets, from debt instruments to real estate, are increasingly being digitised and represented on blockchain-based platforms. This is not about speculative token trading; it is about reengineering how assets are issued, traded, and settled. The implications for capital efficiency and market accessibility are profound.

Agentic AI: The Rise of Autonomous Finance

Artificial intelligence in fintech is entering a new phase—one defined not by chatbots but by autonomy.

Agentic AI, capable of executing end-to-end processes with minimal human intervention, is beginning to reshape financial services. These systems can manage complex workflows such as payment execution, procurement, financial reconciliation, and even elements of investment decision-making.

The concept of the “financial co-pilot” is rapidly becoming a reality. Businesses are deploying AI-driven tools that can analyse cash flow, optimise treasury strategies, detect anomalies, and recommend actions in real time. In lending, AI-first models are enabling more dynamic credit assessment, incorporating a broader range of data sources and continuously updating risk profiles.

Fraud detection is also being transformed. Machine learning models are increasingly able to identify subtle behavioural patterns indicative of fraud, improving both speed and accuracy. However, the rise of AI-driven threats means that defensive capabilities must evolve just as quickly.

Despite these advances, full autonomy remains constrained by regulatory and risk considerations. Human oversight is not disappearing; rather, it is being redefined. The challenge for 2026 is to strike the right balance between automation and control.

Real-Time Payments and Programmable Money

The global payments landscape is undergoing a structural shift toward immediacy.

Real-time payment systems are expanding beyond domestic use cases into corporate treasury, payroll, and B2B transactions. What once took days—particularly in cross-border contexts—can increasingly be completed in minutes. This acceleration is not merely a convenience; it is a fundamental change in how liquidity is managed.

Equally transformative is the emergence of programmable money. Payments are no longer passive transfers of value; they are becoming dynamic instruments capable of executing predefined rules. Funds can be released upon the fulfilment of contractual conditions, enabling more efficient supply chain financing, automated compliance, and enhanced transparency.

Embedded finance continues to deepen this transformation. Financial services are being integrated directly into non-financial platforms, from e-commerce marketplaces to enterprise software systems. The result is a more seamless and contextual financial experience, where transactions occur naturally within broader digital ecosystems.

Cybersecurity, Fraud, and Digital Identity: The New Battleground

As fintech capabilities expand, so too does the threat landscape.

Fraudsters are leveraging advanced technologies, including AI, to launch increasingly sophisticated attacks. Traditional, siloed approaches to fraud prevention are proving inadequate. In response, fintech firms are adopting a more collaborative, ecosystem-driven approach—treating fraud prevention as a “team sport” involving multiple stakeholders and tools.

Digital identity is emerging as a critical line of defence. Verified identity frameworks, behavioural biometrics, and continuous authentication mechanisms are gaining traction as ways to ensure that users are who they claim to be. These solutions not only enhance security but also improve user experience by reducing friction.

Cybersecurity is no longer a back-office function; it is a core component of competitive strategy. Firms that can demonstrate robust, adaptive security capabilities are better positioned to win trust in an increasingly digital financial landscape.

B2B Fintech and the Rewiring of Financial Infrastructure

Another defining trend of 2026 is the shift toward B2B fintech and infrastructure plays.

Rather than competing for end consumers, many fintech firms are positioning themselves as enablers—providing the underlying rails for payments, treasury management, compliance, and data analytics. This reflects a recognition that the most enduring value may lie not in user interfaces, but in the systems that power them.

Some fintechs are also seeking full banking licences, aiming to reduce reliance on sponsor banks and gain greater control over their operations. This “stack reclamation” strategy allows firms to capture more value while navigating regulatory requirements more directly.

Meanwhile, capital markets are undergoing their own transformation. Innovation is extending beyond equities into areas such as private credit, debt issuance, and project finance. Asset management is becoming more data-driven and globally interconnected, with notable developments in regions like Asia-Pacific.

Prediction markets and alternative data sources are also beginning to influence how risk is assessed and priced, adding new dimensions to financial decision-making.

Regulation, Profitability, and the Maturing of Fintech

Underlying all these trends is a broader shift toward maturity.

Regulatory frameworks for digital assets, open finance, and data sharing are becoming more defined. While this imposes additional compliance burdens, it also provides the clarity needed for large-scale adoption. Real-time compliance tools are emerging to help firms navigate this increasingly complex landscape.

At the same time, the industry is placing greater emphasis on profitability and sustainability. The “funding winter” has forced a reassessment of business models, leading to a stronger focus on revenue generation, cost control, and operational efficiency.

Neobanks, once the poster children of fintech disruption, are also evolving. Some are pursuing public listings or full banking licences, while others are enhancing their offerings with AI-driven personal finance tools designed to deliver more actionable insights to users.

Conclusion

Fintech in 2026 is defined less by what it promises and more by what it delivers.

Stablecoins are becoming a settlement infrastructure. AI is moving from assistance to execution. Payments are becoming instantaneous and programmable. Cybersecurity and identity are central to trust. And beneath it all, a robust B2B infrastructure layer is taking shape.

This is not a retreat from innovation; it is its natural progression. The technologies that once captured headlines are now being embedded into the fabric of financial services. Regulation, once seen as a constraint, is becoming an enabler of scale.

The result is a fintech ecosystem that is more grounded, more resilient, and ultimately more impactful.

MY MUSINGS

I find myself wondering whether we are finally seeing fintech grow up—or simply entering a more subtle phase of its evolution.

The shift toward infrastructure and B2B models makes sense. It is where the real money, and arguably the real influence, resides. But does this come at the cost of the original fintech promise—to democratise finance for the end user? If innovation retreats into the plumbing, will consumers still feel its impact in meaningful ways?

The rise of agentic AI raises even more profound questions. How much decision-making are we comfortable delegating to machines, particularly in areas as sensitive as credit, investment, and fraud detection? And who is ultimately accountable when these systems fail?

Stablecoins and tokenisation are equally intriguing. They promise efficiency and inclusivity, but they also introduce new forms of systemic risk. Are regulators truly keeping pace, or are we once again building complexity faster than we can manage it?

Perhaps the most pressing question is this: has fintech solved its execution problem, or merely shifted it to a new layer of complexity?

I would be very interested to hear how others see this transition. Are we entering a golden age of practical fintech innovation, or simply trading one set of challenges for another?

Comments, please.

Leave a comment

Subscribe now

Banks today are navigating an increasingly complex technological landscape shaped by three dominant forces: artificial intelligence, cryptocurrency, and fraud. On paper, the strategies look bold. In practice, the results are far less convincing.

Drawing on insights from hundreds of industry executives, the report exposes a persistent execution gap. Many institutions are eager to embrace innovation, yet struggle to turn strategy into tangible outcomes. The vision is there—but delivery continues to lag.

Nowhere is this more evident than in the push to integrate generative AI into day-to-day operations. While enthusiasm is high, embedding these capabilities in a meaningful, scalable way remains a significant challenge. At the same time, fraud is evolving—particularly first-party fraud—forcing banks to rethink traditional controls and assumptions.

Meanwhile, tokenized deposits are quietly emerging as a potential new building block of the financial system, signaling change that is gradual but potentially transformative.

The message is clear: the era of talking about innovation is over. To remain competitive with fast-moving fintech players, banks must shift toward disciplined, data-driven execution.

The future of banking will not be defined by ideas alone—but by the ability to implement them.