102 articles · Financial Services · page 3 of 6
Articles
Week of 12 February 2024
Convincing faces, unauthenticated seats: the Hong Kong deepfake was a meeting-identity failure
A video call full of familiar, fake faces persuaded one employee to send about US$25 million. The fraud beat a meeting, not a payment system. Banks need controls at the invitation, inside the meeting and at the handoff to money.
Week of 15 January 2024
Major incident, by formula: DORA’s first standards moved the call from judgment to data
DORA’s first standards, published in January 2024, turned the question of when a tech outage is serious enough to report into a calculation over clients, transactions, downtime, data and cost. Banks that couldn’t feed the numbers couldn’t classify in time.
Week of 13 November 2023
A credit union’s first report of a vendor breach may come from the attacker
In November 2023 a ransomware gang reported its own victim, MeridianLink, to the SEC. The vendor’s bank and credit union customers then faced their own notification deadlines with little more than an attacker’s boast and a vendor statement to go on.
Week of 6 November 2023
Three seats at ICBC’s ransomware attack, and the plan each one needed
Ransomware hit ICBC’s U.S. broker-dealer in November 2023, and Treasury trades still had to settle that day. Every firm in the market could have been sitting in any of three seats, and each seat needed its own plan, written well before the crisis.
Week of 16 October 2023
Free, measured and always on: the open banking interface the CFPB proposed and banks could not price
The CFPB’s October 2023 open banking proposal turned a bank’s data connection into a measured, always-on service it could not charge for. Banks and credit unions had to work out what they must deliver, what they could not recover, and what they still controlled.
Week of 11 September 2023
For banks, the MGM and Caesars intrusions were about the few accounts that run the identity platform
The September 2023 casino attacks began with phone calls to help desks and ended with control of identity systems. What mattered for banks was a handful of powerful accounts: how they are recovered, who may recover them, and how a takeover would be spotted.
Week of 21 August 2023
Triage for a rule that might not survive: the SEC’s private fund adviser package
The SEC’s private fund adviser rules, adopted in August 2023, were struck down ten months later. Firms that sorted the work into what investors would demand, what existing law already required and what only the rule required wasted very little.
Week of 7 August 2023
After Moody’s downgrades, regional bank technology had to argue in unit costs
Moody’s August 2023 downgrades confirmed that the spring’s bank stress would become a long earnings squeeze. Regional bank technology budgets now had to be defended in the CFO’s terms: cost per account, faster liquidity data, and vendor contracts priced for thinner margins.
Week of 17 July 2023
Why FedNow was a core-processor decision for community banks and credit unions
The Federal Reserve’s instant payment service went live in July 2023. For community banks and credit unions, joining depended on what their core processor could do in real time, all year round, and on fraud controls for payments that cannot be recalled.
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s hiring-tool law made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder first step was finding every tool that scores candidates, deciding which were covered, and naming an owner for each.
Week of 1 May 2023
First Republic’s white-glove service had no answer for an uninsured balance
First Republic’s clients stayed loyal until one question took over: was money above the insurance limit safe? In a confidence crisis, good service comes down to three things most banks lacked: seeing each client’s insured position, changing it fast and saying something specific.
Week of 13 March 2023
Three SEC cyber proposals, three audiences, one rule adopted
As banks failed in March 2023, the SEC proposed three cybersecurity measures on a single day, to little notice. Each served a different audience: the regulator, the customer and the market. Only the one protecting customers became law.
Week of 6 March 2023
SVB’s depositors learned their bank was an unassessed supplier
Silicon Valley Bank’s failure looked to most people like a banking story. For the companies that kept their cash there, it was something more familiar: a critical supplier collapsing, taking cash, payments and the services built on them down at once.
Week of 20 February 2023
Banks blocked ChatGPT over leaks; recordkeeping set the longer limit
Big banks restricted ChatGPT in 2023 over the headline worry of confidential data slipping out. Contracts fixed that within a year. The slower, harder limits came from duties to keep and supervise records and to explain decisions.
Week of 30 January 2023
ION’s outage exposed a vendor no board had on its critical list
Ransomware at ION’s cleared derivatives unit took the same back-office tool away from firms across the market on the same day. The risk sat with a specialist vendor few boards had heard of, and every firm has some.
Week of 16 January 2023
DORA’s two-year runway, measured in contract renewals
Europe’s DORA gave financial firms two years to get their technology houses in order, with no exemption for contracts already signed. The hardest part was rarely writing policies or running tests. It was the calendar for reopening agreements with technology providers.
Week of 2 January 2023
Few banks held crypto. Many held crypto deposits.
In January 2023, bank regulators warned about crypto. Most readers heard a verdict on whether banks could hold digital assets. The sharper warning concerned risk banks already carried through depositors, partners and customers, which most could not measure from their own data.
Week of 12 December 2022
FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run many of their own controls the same way.
Week of 7 November 2022
Who checked the people who moved FTX’s money
FTX’s banks, investors and partners had studied its growth. Few had asked three plain questions: who can move the money, who checks them, and whose money it is. Any financial institution can put those questions to every fast-growing counterparty.
Week of 24 October 2022
For credit unions, the 1033 outline was a question for the core processor
The CFPB’s first open banking outline kicked off a review aimed at small institutions. For community banks and credit unions, compliance would arrive as a product from their core and digital banking vendors, so the real decisions were about coverage, cost and contracts.