Insights · Fintech & Financial Services · Insight · 30 September 2026

What survives a fintech risk sign-off, and what does not

A fintech purchase dies at risk sign-off rather than at the demo. This week gave that committee three reasons to discount vendor claims: a live extortion case at Revolut [1], two AI labs selling into regulated workflows at once [2], and a bank licensing withdrawal blamed on the absence of clear standards [5]. The read that survives is a peer's.

The meeting where a fintech deal dies

Every purchase in this category passes a committee that includes a compliance lead and a CISO, and the question they ask is not whether the product works. It is what happens when it fails, and who carries it. That is why a demo settles so little here. Look at what landed in front of that committee this week. Revolut disclosed that customer data was exposed in an email scam, and is now dealing with a hacker releasing samples of the stolen data and demanding payment [1]. The detail that travels through a risk review is not the breach. It is that the exposure came through an email scam, which is a control question every institution can ask itself about its own vendors within the hour. One incident at a well-known name resets the evidence bar for everyone selling into the same committee that month.

Two AI labs arrived in regulated finance in one week

Anthropic released Claude for Financial Advisors on Monday, integrating with BlackRock, Charles Schwab and Addepar, alongside Envestnet, iCapital and Wealthbox, to automate client meetings, portfolio analysis, financial modelling and post-meeting admin [2]. Days earlier OpenAI configured ChatGPT for investment bankers, partnering with LSEG, PitchBook and Daloopa to reach equity researchers on the capital markets side [2]. The split is clean: wealth advisory against capital markets. For a Head of Digital, the arrival of both in a single week creates a specific problem. Two vendors with comparable capability, both new to a regulated workflow, both with reference customers that are logos rather than deployments with history. The usual instrument for resolving that is a peer who already ran the procurement, and in this category those peers are few and their opinions carry weight.

When the rules themselves are the risk

Enova withdrew its applications to the OCC and the Federal Reserve to acquire Grasshopper Bank, with its chief executive pointing at the absence of clear standards for bank licensing and at political pressure [5]. That is a different class of problem from a breach. A committee can write a control for a vendor's security posture. It cannot write one for a regulator's discretion. What it does instead is discount any vendor claim that depends on a future approval, and lean harder on operators who have been through the process and will say what the timeline looked like. Meanwhile Fin.com came out of stealth with $20m for cross-border money movement across local rails, USD virtual accounts, Swift and stablecoin settlement [4], and GP Tech opened a US practice serving banks, broker-dealers and payment firms [3]. Both sell into this same committee.

Who a compliance lead will take a call from

Trust in this category concentrates in a small number of named operators, and for a reason worth being precise about. A compliance lead carries personal exposure to a bad sign-off in a way a marketing manager does not. They discount anyone whose incentive they cannot see, which rules out most vendor content by default. What they do act on is a named peer describing a procurement they survived, including the parts that went wrong. The commercial consequence for a vendor is that your best asset is a customer willing to be specific in public about an implementation, and that is earned in delivery rather than bought in a campaign. It also means a single credible voice in payments or risk is worth more here than a large audience in general technology.

What this looks like when you put a number on it

One closing note on measurement. Influential Partners exists to attach attribution to this: a creator's post through to the named accounts that engaged and the pipeline that followed. Two limits are worth stating alongside that, and they bind harder in regulated finance than anywhere else. Audience data is verifiable only where a paid boost returns demographics from the platform, aggregated and above a privacy threshold, never as named individuals. And the trail starts at a click, so a compliance lead who reads a post and raises it in a procurement meeting three weeks later leaves no record. Measured influence is a floor rather than a total, which is the honest way to present it to a CFO.