Ten points to consider for understanding the risks of new-generation technologies and strategic relationships, and why the enterprise risk management agenda must expand accordingly.
One hope for transforming the capabilities of banks lies in the fintech community. In fact, that is more expectation than hope. Every major financial center has its fintech community. In London there is an important fintech innovation program funded by the Financial Conduct Authority.
However, the complexity of using the start-up community as a transformation catalyst is often overlooked. That could leave risk managers in a kind of limbo. With leadership teams pushing for fintech engagement, risk managers may only have recourse to procurement, anti-money-laundering, and know-your-vendor systems as a means of making a strategic risk assessment.
In this article I will look at 10 issues and answers that risk managers must consider in order to lay a better foundation for screening a more fragmented supplier base.
Amidst the natural tendency to see fintech as an answer to structural innovation, regulators are also making a fintech revolution, of sorts, more likely. The Payment Services Directive PSD2 will give third parties access to customer account data in the EU, while complex regulations like MiFID 2 impose data management and recordkeeping requirements that are bound to lead to more outsourcing. This outsourcing in the past may have been taken up by large “body shops” such as Cognizant, but today the solutions are as likely to be baked in start-ups.
It needs to be borne in mind that catalyzing transformation in large enterprises in this way is really quite novel. We see bits of this, for example, in GE's attempt to stimulate a data and analysis ecosystem around Predix. Energy is a natural fit for this approach as sources of supply diversify. The maritime industry has just set sail on the same course. But I can recall no industry where the transformation of large enterprises, as well as industry-structure transformation, have been entrusted to start-ups.
There is an assumption that the trick can be pulled off by opening up APIs, or application programming interfaces, to bank assets (an objective of PSD2). While this will produce some changes, the bigger picture is that some companies became successful after closing their public APIs (Netflix is a good example). The most successful companies (Apple, Alibaba, Google) are very strategic about when to be, and when not to be, open. The defining characteristic is not the API strategy. It is IT excellence and aggressive IT innovation.
What are the risks and issues of these developments?
Micro outsourcing is a trend. On the upside there a strong movement towards what might be termed “micro-work” and “micro outsourcing.” Large enterprise IT systems are being disaggregated into micro-services, or small software packages that communicate through APIs. Micro-services open up the opportunity to outsource more, smaller, discrete tasks as opposed to buying into big solutions. However, it is early days in the development of micro outsourcing. It is not yet clear that the right management tools exist for it. But it does reflect much more aggressive IT innovation that finance houses need to match. The disaggregation of software involves very high levels of autonomy in the internal developer community; a far higher cadence of innovation and a higher likelihood that work will be outsourced to risk taking firms. Risk managers need to asses this development as part of digital transformation governance.
Small businesses fail frequently and for very good reasons. According to the Startup Genome Report, more than 90% of start-ups fail within three years. In the tech sector, over 70% fail because of premature growth. That could be interpreted as saying that the actual engagement of the start-up with a large bank is a threat to the start-up’s viability because invariably a bank’s purchasing needs would entail growth. The idea that growth is a company killer is a relatively new one. However, what we need to take on board is that scaling any opportunity, either in a start-up or the large enterprise, needs special management skills, loyalty and luck.
There is an information problem in finance. In those markets where we see rapid growth, there is substantial information about the needs of all sides to the market. The platform businesses that are starting to change the face of global trade (Alibaba, Amazon Business, to some extent Ariba, and various vertical platforms) succeed because information is transparent in their very make-up.
Financial companies expose very little about their purchasing intentions or their innovation needs. Conversely, they have very little information about the start-ups that could provide valuable services. Despite the presence of fintech databases, little is known about the true entrepreneurial competencies of fintech management. What would mark out one company as a sure-fire success and others as likely failures? These information gaps make it very difficult to achieve product-market fit, yet product-market fit is where the real dynamics of transformation will come from. Product-market fit means there is enough known about demand (the needs of banks and their customers) to stimulate it successfully and to accelerate supply (the potential of fintechs).
There is a misunderstanding about the dynamics of ecosystems in the financial industry. The finance sector is trying something entirely new. The examples we have of successful ecosystem development come from sectors like mobile, where apps communities grew extraordinarily quickly on the back of a huge expansion in the installed base of smartphones. There is no such expansion on the horizon in finance, other than with a completely alternative financial infrastructure. It is feasible, for example, that Alipay could secure 2 billion customers by 2026. Chat applications like WeChat suggest alternative financial structures will become very successful. The mainstream financial Industry today, however, is not in growth mode, nor is it innovating quickly in these new structures. It wants an ecosystem of start-ups to perform in a static market. To succeed, banks need to push themselves towards structural change, such as adopting the business platform model.
Banks are avoiding modern platform strategies. The standout winners in today's markets are actually managing the structure of an industry or the restructuring of an economy. Alibaba, for example, has successfully adapted the rural Chinese economy to the opportunities afforded by global commerce and global delivery and has developed a suite of services in transaction banking.
In my view, banks need to build a platform strategy rather than an account management strategy. They need to think in terms of an economic development role in the changing global order. They need to think of managing hundreds of millions of accounts transacting globally at low cost. By ignoring these developments, banks limit the use they can make of the start-up ecosystem.
Solving the information problem. I said earlier there is too little information released into the public domain for the fintech-bank ecosystem strategy to work successfully. This is solvable. Colleagues and I at The Disruption House have created a scorecard for fintechs that documents over 80 entrepreneurial competencies. Conversely, a dozen banks have offered to be more open about what they are looking for in discrete areas of their business, such as capital markets. It is early days, but the beginning of a system of two-way information transparency and knowledge is evident. It could stimulate more appropriate innovation and help banks and advisors to mentor companies through their growth pains.
Developing ecosystem know-how (the AI example). Closely related to openness, the finance community needs to gain experience of how to build a new type of ecosystem that it can use for micro outsourcing. To make that concept more concrete, at the GARP Convention in March, I presented some work on the potential for developing an AI ecosystem.
There are 24 adoption steps shown in the diagram. In reality, there would be more, and there would be variations between projects. But taking the figure as a starting point, it is clear that many of the tasks here are not those that a bank will specialize in. Data normalization would be one. Hiring the right talent would be another. Exploring workflow so that it can be adapted to AI might be too specialized, but also too important to leave to internal staffers.
Traditionally, all 24 tasks could have been outsourced to one integrator. Today, however, it pays to think about micro outsourcing. Given that an AI project can be 24 months, it is foolhardy to wait for the consultancies to get the right level of experience.
A bank would be better placed if it uncovered seven to 10 specialist suppliers, many of them start-ups, that can create excellence in this area and become new long-term suppliers. This is one form of ecosystem development. It’s a good idea for a bank or group of banks to develop an AI ecosystem (or capital markets or FX, etc) that can be developed in this way. If those companies are also part of an information project (as under point 6), then there is a strong chance of accelerating structural innovation across the sector.
Risk managers and structural change oversight. A finding from a GARP survey of risk managers is that over 60% have no involvement in innovation management. In cases like AI, which stem from larger structural changes in the technology base of the economy, there is virtually no risk management oversight, and hence few organi\ations with plans to mitigate adoption risk. The lesson from the GARP data is that the risk function needs a disruption-planning framework that highlights the risks and opportunities that arise in changing market structures. That model needs to be predictive.
The 10-year journey of innovation. In earlier work, I have looked at the long journey to many forms of durable innovation. Where change is influenced by the high rate of innovation on the Internet, it is difficult to be programmatic. Nonetheless some of the great success stories of today are long-duration “overnight” successes.
Apple Computers began developing a personal digital assistant in the late 1980s. It became known as the Newton, launched in 1993 as the Message Pad, and was abandoned by 1998. A newer-version PDA was nonetheless under development in the early 2000s and emerged as the iPod. Apple had a much larger version ready for market by the mid-2000s (it eventually became the iPad). However, CEO Steve Jobs wanted to launch a new phone product first rather than risk further failure with PDAs. That was the iPhone, in 2007. On the back of that came the iPad in 2010, with an eye on a fully featured iPad 2 a year later. The iPad 2’s success had been 23 years in the making.
We are seeing something similar with the blockchain and related technologies. These are already eight years old. They are reminiscent of the Internet of Appliances, which debuted in 1996 and is now evolving as the Internet of Things (IoT). Are risk managers really conversant with these long-term patterns of innovation?
Combining micro and macro intelligence. In my view, risk managers need more know-how. They need to be modelling macro-disruptions like platforms and the new roles of enterprises (point 5). They need to know how innovation really works (point 9) but they also need to know about the risks and opportunities of accessing specific new skills through ecosystems and/or through micro outsourcing (points 1 and 7) and how to overcome the risks of dealing with start-ups (point 2). They need to know how to manage information gaps in ecosystem development (points 3 and 6).
In short, there needs to be a fuller agenda for enterprise risk management.