Business
Banking on legacy – The risks posed by ‘stone age’ banking infrastructure
![](http://www.futuresparity.com/wp-content/uploads/2023/05/b-4.webp)
Source: Finance Derivative
By Andreas Wuchner, Angel Investor of Venari Security
Introduction
If you consider the most significant motivating factors behind cyber-attacks – the promise of large financial reward and the opportunity to cause maximum business and social disruption – it’s little wonder that banks and financial institutions are amongst the most inviting targets for would-be cyber criminals. In fact, according to IBM’s recent report, ‘banking and finance’ was the most attacked industry for the five years between 2015 and 2020 – surpassed only by threats to critical infrastructure in recent years. Successful attacks can provide aggressors with a mass of sensitive personal and financial information, and even access to people’s money itself. Furthermore, a suspension of withdrawals and deposits can cause huge social disruption and reputational damage.
As banks have reacted to years of new regulation and emerging technologies, they often operate with a hugely complicated and disparate technology estates. This provides malicious actors with a wealth of potential attack vectors. A small breach from anywhere in this network can have enormous consequences, and lead to entire systems being overrun. As such, it’s crucial that security teams operate with the highest-grade security possible, including ensuring the strongest level of encryption standards. Banks need to look beyond regulatory tick-box commitments and ensure they are taking proactive and preventative steps to monitor and combat malicious attacks across their entire network.
![](https://www.financederivative.com/wp-content/uploads/2023/05/Andreas-Headshot-150x150.png)
However, the ability to react to cyber-threats across a vast estate requires speed and flexibility to quickly react and update security protocols. The sheer volume of legacy infrastructure slows this process down considerably leaving many security teams in a vicious cycle.
The threat of legacy infrastructure
A sizeable proportion of the banking industry still maintains a reliance on systems first developed more than 40 years ago. In fact, many ‘core banking’ systems, like payments, loans, mortgages and the associated technologies, are still coded using COBOL (Common Business-Orientated Language), an otherwise defunct programming language that is older than the internet itself. In the UK and Europe, COBOL remains the ‘backbone of banking services,’ while in the USA, as much as 43% of banking systems are built on COBOL, meaning it underpins much of our financial system.
This presents a huge security risk. While code has been regularly updated over the years, these systems were built when security threats were far less sophisticated, less well-financed and the burden of data was far less pronounced. For several years, governments have pointed towards legacy systems, built using COBOL, as a major cybersecurity threat, incompatible with modern security best practices and solutions, including multi-factor authentication. For example, data from Kaspersky found that businesses with outdated technology are much more likely to have suffered a data breach (65%) than those who keep their technology updated (29%).
A further security consideration is the diminishing number of people who are trained in maintaining COBOL systems. Every year, experienced professionals exit the industry, making it increasingly difficult to service legacy technologies and creating significant delays in patching threats once they’re identified. This lack of supply of sufficiently trained experts, and the demand they face, makes any updates extremely expensive and time consuming.
Furthermore, legacy infrastructure is preventing the secure application of encryption, posing its own distinct cybersecurity and regulatory risks. Encryption is often heralded as a silver bullet solution for data privacy and has been a continuing area of focus for regulatory bodies in recent years. However, banks remain guilty of poor deployment, maintenance and management of encryption – using outdated protocols and inefficient methods of analysing and understanding network traffic. This, coupled with legacy ‘core banking’ systems that are incompatible with modern encryption techniques, equates to a regulatory and security headache for security teams.
Adopting a new mindset
The risks posed by legacy systems and the volume of cybersecurity threats facing banks, mean a concentrated re-think of overall cybersecurity strategy is needed to prevent breaches and ensure data is protected long-term. Traditionally, banks have taken an ‘outside-in’ view – dedicating capacity, finances and knowledge to dealing with threats that are existing, known and well publicised. However, to aid long-term security, this should be superseded by an ‘inside-out’ proactive approach, whereby security teams are cognisant of their own internal systems and where the key vulnerabilities are found. Once banks have a detailed view of the security risks posed by their legacy systems, and specifically what data is threatened, they can address flaws, update these systems and build a stronger overall security posture.
The secure path ahead
Many of our successful high-street banks today have centuries of experience in dealing with social, economic and regulatory upheaval. However, the rapid development and deployment of technology continues to present a unique challenge. Many ‘traditional’ banks have built a complex technology infrastructure through decades of adjustment to new legislation and emerging technologies. While serviceable in the past, fintech start-ups are pushing the long-term viability of these systems to the limit.
Challenger banks have the luxury of being built from the ground-up, prioritising convenient digital services and features, and modern security processes. As the user base of these banks increase, customers are increasingly expecting these features and security from their existing banks, meaning even more complexity added to legacy infrastructures. As outlined by Deloitte, existing firms simply aren’t positioned to support the rising expectation of the market, exposing banks to additional risk and liability.
What’s more, it’s estimated that banks spend as much as 80% of their yearly IT budgets on the maintenance of legacy systems. While an immediate switch away from these systems is unrealistic, there is an opportunity to reduce wasted spend and divert spend towards modernisation efforts. However, while traditional banks may want to adapt quicker to technological advancements, they need to do so while continuing to minimise cyber risk and without jeopardising the security of their data or systems. This means placing cybersecurity at the heart of any modernisation efforts and maintaining a steady rate of change. As more of the technology estate begins to be modernised, the potential risks of regulatory non-compliance will also reduce.
Legacy systems need a considered update
Banking systems have heavily relied on legacy infrastructure for too long now, bringing difficulties in maintaining the highest-grade cybersecurity and in facilitating innovation. The risks presented by novel cybersecurity attack vectors and competition from new and emerging digital services offered by challenger banks are exacerbating these issues. As such, legacy systems need a managed modernisation in the long-term, facilitated in part by a managed redistribution of existing IT spend. However, to ensure long-term security overall, cybersecurity needs to be central to be at the very heart of modernisation efforts.
You may like
Business
Building Compliance into Business Culture is Essential in Fintech
![](http://www.futuresparity.com/wp-content/uploads/2023/10/b.jpg)
Source: Finance Derivative
Tetyana Golovata, Head of Regulatory Compliance at IFX Payments
Regulation plays a critical role in shaping the fintech landscape. From Consumer Duty and FCA annual risk reporting to APP fraud, the tectonic plates of the sector are shifting and whether you consider these regulations as benefiting or hindering the industry, businesses are struggling to keep up.
According to research by fraud prevention fintech Alloy, 93% of respondents said they found it challenging to meet compliance requirements, while in a new study by Davies a third of financial leaders (36%) said their firms had been penalised for compliance breaches in the year to June. With the FCA bringing in its operational resilience rules next March, it is more important than ever to ensure your company makes the grade on compliance.
Lessons from history
Traditionally, FX has struggled with the challenge of reporting in an ever-developing sector. As regulatory bodies catch up and raise the bar on compliance, responsible providers must help the industry navigate the changes and upcoming deadlines.
Fintechs and payments companies are entering uncharted waters – facing pressure to beat rivals by offering more innovative products. When regulators have struggled to keep up in the past, gaps in legislation haveallowed some opportunists to slip between the net, as seen in the collapse of FTX. Because of this, implementation and standardisation of the rules is necessary to ensure that innovation remains seen as a force for good, and to help identify and stamp out illegal activity.
Culture vs business
Culture has become a prominent factor in regulatory news, with cases of large fines and public censure relating to cultural issues. As the FCA’s COO Emily Shepperd, shrewdly observed in a speech to the finance industry, “Culture is what you do when no one is looking”.
Top-level commitment is crucial when it comes to organisational culture. Conduct and culture are closely intertwined, and culture is not merely a tick-box exercise. It is not defined by perks like snack bars or Friday pizzas; rather, it should be demonstrated in every aspect of the organisation, including processes, people, counterparties, and third parties.
In recent years, regulatory focus has shifted from ethics to culture, recognising its crucial role in building market reputation, ensuring compliance with rules and regulations, boosting client confidence, and retaining employees. The evolving regulatory landscape has significantly impacted e-money and payments firms, with regulations strengthening each year. Each regulation carries elements of culture, as seen in:
- Consumer duty: How do we treat our customers?
- Operational resilience: How can we recover and prevent disruptions to our customers?
- APP fraud: How do we protect our customers?
Key drivers of culture include implementing policies on remuneration, conflicts of interest, and whistleblowing, but for it to become embedded it must touch employees at every level.
This is showcased by senior stakeholders and heads of departments facilitating close relationships with colleagues across a company’s Sales, Operations, Tech and Product teams to build a collaborative environment.
Finance firms must recognise the trust bestowed on them by their customers and ensure the protection of their investments and data is paramount. Consumer Duty may have been a wake-up call for some companies, but progressive regulation must always be embraced and their requirements seen as a baseline rather than a hurdle.
Similarly, the strengthening of operational resilience rules and the upcoming APP fraud regulation in October are to be welcomed, increasing transparency for customers.
Compliance vs business
Following regulatory laws is often viewed as a financial and resource drain, but without proper compliance, companies are vulnerable to situations where vast amounts of money can be lost quickly.
A case in point is the proposed reimbursal requirement for APP fraud, which will mean payment firms could face having to pay compensation of up to £415,000 per case.
Complying not only safeguards the client and their money, but also the business itself. About nine in ten (88%) financial services firms have reported an increased compliance cost over the past five years, according to research from SteelEye. Embedding compliance earlier in business cultures can be beneficial in the long run, cutting the time and money needed to adapt to new regulations and preventing the stress of having to make wholesale changes rapidly.
Building a cross-business compliance culture
Compliance is a key principle at IFX, and we strive to be a champion in this area. In response to these challenges, the business restructured, establishing dedicated risk and regulatory departments, along with an internal audit function.
Regulatory compliance aims to support innovation by developing and using new tools, standards, and approaches to foster innovation and ensure product safety, efficacy, and quality. It has helped the firm to navigate the regulatory landscape while driving growth and maintaining high standards.
This organisational shift allowed each business line to own its own risk, with department partaking in tailored workshops designed to identify existing, new, and potential risk exposure. Shared responsibility for compliance is the only way to create a culture which values it. We see this as a great way for organisations to drive innovation while sticking to the rules.
Business
How AI virtual assistants are transforming education and training
![](http://www.futuresparity.com/wp-content/uploads/2023/03/b-5.jpg)
By Gregor Hofer, CEO and Co-founder at Rapport
What separates good doctors from excellent doctors, the type that might get five-star reviews if, like an Uber driver, their services were supported by a smartphone app?
Medical knowledge, expertise, and better outcomes are, of course, the most important factors. But – particularly when dealing with patients’ relatives, discussing risk assessment and imparting bad news – we shouldn’t underestimate the importance of bedside manner.
This might come naturally to some doctors but there are none for whom training isn’t useful, whether at medical school or on the job.
There will always be a place for real human interaction in this training, the type that involves role-play, with actors or colleagues playing out different scenarios that explore the most effective ways to handle difficult situations.
But what if this could be supplemented by more readily available and less resource-intensive experiences that simulate these training environments? And what if it could be applied across numerous sectors, industries and professions, of which there are a great many that could benefit from such an opportunity?
What might that mean for those instigating tricky conversations and, perhaps more importantly, those at the receiving end of them?
Advances in generative artificial intelligence – or GenAI – mean that these are no longer hypothetical questions.
There’s no limit to the type of person this technology could help, but we’ll review three – doctors, those working in corporate HR, and online students – to give a flavour of the benefits it brings.
Before we do, a quick word on how such applications work.
An overview of the technology
It all starts with data. With access to enough content, the type that you store and curate on your internal systems, large language models (LLMs) can be trained to find the most appropriate response to whatever user input they’re exposed to, whether in writing or spoken, and then you as a user can respond to that response, and so the cycle continues.
You’ll have experienced something similar using the likes of CharGPT, but because this is based on your own content, you’re more in control. (For simpler and more prescriptive scenarios, though, I’d add that with the best solutions, you can alternatively import predefined branching dialogue to keep your conversations on track.)
It doesn’t stop there, though; by tapping into a solution that’s supported by experts in linguistics and computer-aided animation, your colleagues can interact in real-time with avatars equipped with believable facial expressions, accurate lip-synching capabilities, natural gestures and the ability to detect emotions.
All of this adds to the user’s willing suspension of disbelief that they’re interacting with a real person, or AI avatar, thereby enhancing the effectiveness of their learning.
These innovations are reshaping how we approach learning and skill development in so many critical fields. We said we’d look at three. We’ll start by returning to medicine.
Medical training
AI assistants can supplement the way doctors are taught to break bad news to patients, one of the hardest things they’ll face in practice and, given its subjectivity, something that can’t easily be looked up in a textbook on anatomy or physiology.
As we said from the outset, this is easier for some doctors than others, but given the literal life-and-death nature of such conversations and the shattering impact that the death of a loved one can have on a relative, there’s always room to improve medics’ empathy and communication skills – which is exactly what this technology delivers.
By utilizing experiential AI tools, clinicians can better use their time, alleviate pressure, fatigue and burnout symptoms, and ultimately allow them to better serve their patients.
Corporate HR
In corporate HR, virtual assistants can significantly streamline and enhance the hiring and firing process, as well as any difficult conversation; whether it’s a tough review, a disciplinary hearing, letting down an employee about a promotion they’d applied for or any other scenario that might bring a bead of sweat to your forehead, it’s all about providing safe and cost-effective practice before doing it for real.
Tech research consulting firm Gartner recently found that more than three-quarters (76%) of HR leaders believe that if their organisation doesn’t adopt and implement AI solutions, such as generative AI, in the next 12 to 24 months, they’ll lag in organizational success compared to those that do, while 34% of HR leaders participating in their January benchmarking session said they were exploring potential use cases and opportunities when it came to generative AI.
If they do manage to adopt the right technology, the impact will be massive among those who deploy it wisely. After all, which company wouldn’t want to upskill its HR professionals in tangible soft skills such as empathy, communication, problem-solving, and conflict resolution in a controlled setting?
Online education
AI-powered tools can hugely boost student engagement in remote learning environments, and the research suggests that it comes close to rivalling in-person experiences. When you consider the staff-to-student ratios common in most educational settings, this should be no surprise – think how many students can fit into a lecture hall (even if they don’t always turn up!).
But we’re not necessarily talking about formal education; this applies equally to any informal setting in which someone needs to improve their education in some way.
With this technology, you can invent new ways to educate your students – or staff – by transforming lessons into experiences, using interactive characters reflective of the subject. This means you can increase user satisfaction and performance without compromising on content.
Whatever the scenario and whatever the use case, the chances are that if you have the right content in sufficient quantities, you can tap it for interactions that would otherwise be lacking in uniqueness or prohibitively expensive.
With AI virtual assistants, everyone’s a winner.
Business
How GenAI is Shaping the Future of Compliance
![](http://www.futuresparity.com/wp-content/uploads/2023/04/b-5.jpg)
Gabe Hopkins, Chief Product Officer, Ripjar
Generative AI or GenAI uses complex algorithms to create content, including imagery, music, text, and video with amazing results. Less well known are some of the ways in which it can transform data processing and task performance. This groundbreaking technology not only saves time, effort, and money, but has become a game-changer in enhancing operational efficiency and fostering innovation across various sectors.
However, some industries like anti-financial crime compliance – have been slow to adopt new innovations like GenAI, predominantly due to concerns over potential risks. In fact, they can even see it as a risk in itself. Legal, Compliance and Privacy leaders rank rapid GenAI adoption as their top issue in the next two years, all while other, less risk-averse organisations enjoy the upside of implementing GenAI in their systems.
This delay means many compliance teams are not taking advantage of AI tools that could revolutionise their processes and help them save up to 200 hours annually per user.
Entering the New Era of GenAI in Compliance
Teams in largely regulated sectors like banking and fintech face enormous pressures. Their responsibilities include identifying risks, such as sanctioned individuals and entities, updating policies to keep up with ever-evolving regulations, and handling expansive datasets. The high volume of this data makes manual reviews exhausting and susceptible to errors, which can lead to financial and reputational damage.
One way to overcome these challenges is by leveraging GenAI. For example, false positives – where a risk is raised incorrectly or false negatives, where a real risk is not flagged, are common issues caused by trying to deal with very high volumes of alerts and risk matches. Implementing GenAI can reduce these inaccuracies, significantly enhancing the efficiency and effectiveness of customer and counter-party screenings.
In practical terms, GenAI can reinvent how compliance tasks are performed. For instance, in drafting Suspicious Activity Report (SAR) narratives, where analysts need to justify suspicions in transactions, GenAI can help automate this writing process, combining human oversight with artificial efficiency. Platforms using GenAI excel in summarising vast amounts of data— crucial for tasks like screening adverse media, where they assist in identifying potential risks linked to negative information about clients.
Understanding the Opportunities of GenAI and Overcoming Fears
For the compliance sector, it’s a crucial time to explore how to incorporate GenAI effectively and securely without undue risks. Dispelling fears about data misuse, the high costs of initial model setups, and the ‘black box’ nature of AI models are central to this transition. Teams are particularly cautious about sharing sensitive data and the hidden biases that AI might carry.
Yet, some strategies can counter these challenges. By choosing suitable models that ensure robust security and privacy and adjusting these models within a solid statistical framework, biases can be mitigated. However, organisations will need to turn to external expertise – whether data scientists or qualified vendors – to support them in training and correctly deploying AI tools.
The latest advancements in GenAI suggest that virtual analysts powered by this technology are achieving, and sometimes surpassing, human-level accuracy. Despite ongoing concerns, which may slow adoption rates, the evident potential benefits suggest a bright future for compliance teams using GenAI. These technological innovations promise not only to improve speed and efficiency but also to enhance the capability of teams to respond and adapt swiftly.
Embracing GenAI will not only significantly elevate the effectiveness of compliance operations but also safeguard organisations against potential pitfalls while maintaining trust and integrity in their industry practices.
![](http://www.futuresparity.com/wp-content/uploads/2023/10/b-80x80.jpg)
Building Compliance into Business Culture is Essential in Fintech
![](http://www.futuresparity.com/wp-content/uploads/2023/03/b-5-80x80.jpg)
How AI virtual assistants are transforming education and training
![](http://www.futuresparity.com/wp-content/uploads/2023/04/b-5-80x80.jpg)
How GenAI is Shaping the Future of Compliance
![](http://www.futuresparity.com/wp-content/uploads/2022/04/b-2-80x80.webp)
The Sustainability Carrot Could be More Powerful Than the Stick!
![](http://www.futuresparity.com/wp-content/uploads/2022/02/b-9-80x80.jpg)
Hybrid cloud adoption: why vendors are making the switch in 2022 and why you should too
![](http://www.futuresparity.com/wp-content/uploads/2021/11/b-3-80x80.jpg)