Cybersecurity and the Fintech Wave

Earlier this month, at Bank Director’s FinTech Day at Nasdaq’s MarketSite in New York City, I noted how many technology firms are developing strategies, practices and tools that will dramatically influence how banking gets done in the future. Concomitantly, I expressed an optimism that banks are learning from these new players, adapting their offerings and identifying opportunities to collaborate with new “digital-first” businesses.  Unfortunately, with great opportunity comes significant risk (and today’s post looks at a major one challenging bank CEOs and their boards). 

By Al Dominick, President & CEO, Bank Director

To grow your revenue, deposits, brand, market size and/or market share requires both strong leadership and business strategy.  Right now, there are a handful of banks developing niche vertical lines of business to compete with the largest institutions. For instance, East West Bancorp, EverBank Financial, First Republic Bank, Opus Bank, PacWest Bancorp, Signature Bank and Texas Capital Bancshares.

Just as compelling as each bank’s approach to growing their business is the idea that new competitors in direct and mobile banking will spur the digitalization of our industry.  I am a firm believer that through partnerships, acquisitions or direct investments, incumbents and upstarts alike have many real and distinct opportunities to grow and scale while improving the fabric of the financial community.

However, with myriad opportunities to leverage new technologies comes significant risk, a fact not lost on the bank executives and board members who responded to Bank Director’s 2016 Risk Practices Survey, sponsored by FIS.  For the second year running, they indicate that cybersecurity is their top risk concern.

More respondents (34 percent) say their boards are reviewing cybersecurity at every board meeting, compared to 18 percent in last year’s survey, indicating an enhanced focus on cybersecurity oversight. Additionally, more banks are now employing a chief information security officer (CISO), who is responsible for day-to-day management of cybersecurity.

However, the survey results also reveal that many banks still aren’t doing enough to protect themselves—and their customers. Less than 20 percent of respondents say their bank has experienced a data breach, but those who do are just as likely to represent a small institution as a large one, further proof that cybersecurity can no longer be discussed as only a “big bank” concern.

For those thinking about the intersection of fintechs and banks, take a look at our just-released 2016 Risk Practices Survey. This year, we examine risk governance trends at U.S. banks, including the role of the chief risk officer and how banks are addressing cybersecurity. The survey was completed in January by 161 independent directors, chief risk officers (CRO), chief executive officers (CEO) and other senior executives of U.S. banks with more than $500 million in assets.

Key Findings Include:

  • Sixty-two percent of respondents indicate their bank has used the cybersecurity assessment tool made available by the Federal Financial Institutions Examination Council, and have completed an assessment. However, only 39 percent have validated the results of the assessment, and only 18 percent have established board-approved triggers for update and reporting. FWIW, bank regulators have started to use the tool in exams, and some states are mandating its use.
  • Seventy-eight percent indicate that their bank employs a full-time CISO, up from 64 percent in last year’s survey.
  • The majority, at 62 percent, say the board primarily oversees cybersecurity within the risk or audit committee. Twenty-six percent govern cybersecurity within the technology committee.
  • Forty-five percent indicate that detecting malicious insider activity or threats is an area where the bank is least prepared for a cyberattack or data breach.
  • Just 35 percent test their bank’s cyber-incident management and response plan quarterly or annually.

Clearly, banks are increasingly relying on complex models to support economic, financial and compliance decision-making processes.  Considering the full board of a bank is ultimately responsible for understanding an institution’s key risks — and credibly challenging management’s assessment and response to those risks — I am pleased to share this year’s report as part of our commitment to providing timely & relevant information to the banking community.

18 Banks that Fintech Companies Need to Know

To build on last week’s piece (15 Banks and Fintechs Doing it Right), I put myself in the shoes of an early stage fintech company’s Founder.  Specifically, as someone with a new idea looking to develop meaningful financial relationships with regional and community banks in the United States.  With many exciting and creative fintech companies beginning to collaborate with traditional institutions, what follows is a list of 18 banks — all between $1Bn and $25Bn in size — that I think should attract the tech world’s interest.

By Al Dominick // @aldominick

Believe it or not, but bank CEOs and their teams are working hard to grow revenue, deposits, brand, market size and market share.  So a hypothetical situation to tee-up today’s column.

Imagine we developed a new, non-disruptive but potentially profit-enhancing software product (let’s put it in the “know-your-customer” sector since banks already spend money on this).  As the Founders, we want to approach banks that might be ready to do more than simply pilot our product.  While our first instinct would be to focus on recognizable names known for taking a technology-based, consumer-centric focus to banking, the low hanging fruit might be with CEOs and executive teams at publicly traded community banks — many of whom are above $1Bn in asset size and are just scratching the surface of developing meaningful fintech relationships.

With the idea that smaller banks can act faster to at least consider what we’re selling, we cull the field, knowing that as of June 1 of this year, the total number of FDIC-insured institutions equaled 6,404; within this universe, banks with assets greater than $1Bn totaled just 699.

So now we are focused on a manageable number of potential customers and can spend time getting smart on “who’s-doing-what” in this space.  Can we agree that we want to approach banks that share common characteristics; namely, strong financial performance that sets them apart from their peers and operations in strong local markets or big economic states?  Good, because assuming we are starting from scratch in this space, here are our top prospects (listed in no particular order with approximate asset size):

  1. Citizens Business Bank in California ($7.3Bn)
  2. Pinnacle Financial in Tennessee ($6Bn)
  3. Farmers & Merchants in California ($5.5Bn)
  4. Western Alliance in Arizona ($10Bn)
  5. Eagle Bank in DC ($5.2Bn)
  6. Prosperity in Texas ($21.5Bn)
  7. BankUnited in Florida ($19.2Bn)
  8. BofI “on the internet” ($5.2Bn)
  9. First NBC in Louisiana ($3.7Bn)
  10. Burke & Herbert in Virginia ($2.6Bn)
  11. Banner in Washington ($4.7Bn)
  12. Bank of Marin in California ($1.8Bn)
  13. Cardinal Bank in Virginia ($3.4Bn)
  14. State Bank in Georgia ($2.8Bn)
  15. TCF Financial in Minnesota ($19.3Bn)
  16. United Bank in Connecticut ($5.5Bn)
  17. Boston Private in Massachusetts ($6.8Bn)
  18. Opus Bank in California ($5.1Bn)

At a time when the concept of service is fast changing to reflect highly functional technology and “always-available” customer experiences, these eighteen banks — already successful in their own right — strike me as just the types to think about approaching.

##

*Now I’m not suggesting everyone pick up the phone and call each’s institutions CEO.  But If you are with a fintech thinking about partnerships and collaboration, you could do a whole heckuva lot worse than spending some time learning what makes all of these banks more than just financially strong and consumer relevant.

%d bloggers like this: