The financial technology (FinTech) industry is an exciting and disruptive one. It has revolutionized the payment landscape, and continues to provide innovative solutions and alternate business models to meet changing customer demands. Some examples stemming from FinTech are the use of AI in financial services, e-ID to sign transactions and the use of blockchain technology in payment solutions. The introduction of PSD2 has also given FinTech companies a major opportunity to offer more services and compete with traditional banks on a whole new level. The future for FinTech is bright, but the industry does face some challenges that could potentially disrupt the industry.
In this blog post we will discuss two of the biggest challenges for FinTech startups, and what companies can do to solve them.
1: Existing and Emerging Security Standards and Regulations
Companies today not only face threats from cyber criminals when security protocols aren’t up to par, but also financial penalties from regulatory bodies. The increasing need and emergence of regulations reflects today’s society where our lives are lived online to a much greater extent and a lot of personal information is exchanged and collected. Standards and regulations create benchmarks for organizations to protect themselves from getting compromised and exposing their users’ personal information.
The GDPR that came into effect in 2018 forced companies in all industries to evaluate processes, routines, and even entire business models. The purpose of the GDPR is to extend and ensure the privacy rights of all EU/EEA citizens, specifying how personal data can be collected, managed and stored. The regulation enhances the privacy rights of data subjects, as well as specifies the security measures companies should have in place. Failure to comply with the regulation results in fines of up to 20 million Euros or 4% of total worldwide annual turnover from the previous year.
Another important security standard for the FinTech industry is PCI DSS (Payment Card Industry Security Standard).The PCI DSS lists information security standards for those who handle cardholder information and data. It has 12 requirements organized in six groups that companies have to meet, as outlined below:
1. Build and Maintain a Secure Network and Systems
2. Protect Cardholder Data
3. Maintain a Vulnerability Management Program
4. Implement Strong Access Control Measures
5. Regularly Monitor and Test Networks
6. Maintain an Information Security Policy
Failure to comply with PCI DSS can result in high monthly fines, up to $100,000 per month, and can damage your brand reputation beyond repair.
2: Data Security and Cyber Attacks
Regulations such as GDPR, PCI DSS and recent big data privacy scandals such as Facebook’s mishandling of personal data have heightened people’s awareness of data privacy. We want some kind of guarantee from companies that our data is handled securely.
This is particularly relevant for FinTech companies, as they handle critical information like payment card data. In the event of a cyber attack or data breach FinTech companies have more to lose. Cyber attacks on FinTech companies can put credit card data in the wrong hands and jeopardize your business and your reputation.
It is important that FinTech companies work from a ‘security by design’ and ‘privacy by design’ perspective when developing the application. Transparency is key, especially when handling sensitive data.
How to Overcome Security Challenges
What can FinTech startups do to ensure they meet all regulations and standards while maximizing data security and minimizing cyber attacks? We’ve dwindled it down into four key steps to get you started.
1: Make security a priority.
Prioritizing data security for your organization stems from the top down – ensure management teams support the significance of customer’s data and corporate objectives reflect this.
2: Follow industry best practices.
Review the most up to date regulations and evaluate your compliance levels. Analyze where your greatest risks lie. Where are the gaps and what are the most effective ways to get your organization up to par? This is for the benefit of protecting your most important asset – your customer’s personal information and trust, which rolls up into your brand.
3: Integrate Information Security Specialists.
IT teams and security specialists are key in hedging cyber security threats. The need for security testing your application and monitoring the latest cyber attack methods is critical. A Secure Code Review identifies security related flaws hidden in your code. A Penetration Test determines how deep a malicious attacker would be able to penetrate your environment. Adding these professionals to your team can be all the difference.
4: Consider using PCI DSS certified hosting.
Depending on your organization’s size it can get overwhelming and costly to monitor and upgrade security requirements. Consider partnering with a PCI DSS-certified platform solution like our team at Complior. Take away some stress, stay within budget and implement expertise to do the work for you while following industry best practices.
