Fintech
Fintech risk examines how technology-enabled financial services change familiar risks rather than eliminate them. The PRM exam tests payments, digital lending, open banking/APIs, robo-advisory, crypto and DeFi, and the outsourcing arrangements that often sit behind them.
Core rules
- Apply the regulatory perimeter: activity, not branding, determines licensing and conduct obligations.
- Separate partner risk from vendor risk: a sponsor bank or broker-dealer can transmit liquidity, compliance, and reputational risk.
- Assess operational concentration in cloud, payment rails, identity, and API aggregators.
- Treat crypto assets as custody, market, liquidity, cyber, and AML risks-not just technology risk.
- Use customer outcome and conduct metrics alongside financial metrics.
Worked example
A digital wallet offers instant transfers through one sponsor bank and one cloud provider. During a sponsor-bank outage, customers cannot redeem balances, and the wallet’s own liquidity buffer is insufficient. The reasoning: the wallet has a settlement/liquidity risk and a third-party concentration risk, not merely an IT incident. Mitigants include a diversified sponsor arrangement, prefunded settlement accounts, tested manual reconciliation, clear customer disclosure, and an exit plan. The residual risk must be reflected in appetite and contingency funding.
Traps
- Calling all fintech risk “cyber risk.”
- Ignoring sponsor-bank failure or de-banking risk.
- Assuming smart contracts remove counterparty and oracle risk.
- Treating API aggregation as a pure technology dependency.
- Missing AML/KYC obligations in crypto and cross-border payments.