Andrew Barratt

The Bank of England’s recent decision to fine Vocalink Ltd for failing to meet operational resilience requirements is a clear signal of increasing regulatory scrutiny—and a timely reminder for the financial sector. This action underscores the importance of implementing robust frameworks aligned with the UK Operational Resilience Framework and the EU DORA regulation. It’s not just about compliance—it’s about protecting critical services that underpin the financial system. Kudos to the Bank of England for taking decisive leadership. This is a sign of things to come as both UK and EU regulators push for meaningful resilience, not just policy on paper. If your organisation is still approaching resilience as a checkbox exercise, now is the time to rethink your strategy. https://lnkd.in/eszGcB36

38

1 Comment

The UK’s new Failure to Prevent Fraud law just went live. My call: leadership teams can no longer treat fraud as a back-office issue; it’s now a board-level liability. ⚖️ UK banks reported over £1.2B in APP fraud losses last year. That number is the backdrop for why regulators moved. The new offence makes enterprises strictly liable if they can’t show “reasonable procedures” to prevent fraud across employees and associated persons. What I’m seeing in boardrooms: compliance leaders scrambling to bolt on point-solutions. That won’t work. Regulators will expect proof of risk assessments, ongoing monitoring, and controls that unify fraud and AML. At SEON, this is exactly why we’ve built a single, connected defense layer: so fraud signals, AML alerts, and audit trails reinforce each other in real time. The decision for me is clear: prevention has to be operational and defensible, not reactive. The takeaway: trust isn’t optional anymore. It’s enforceable. 🛡️

69

4 Comments

LDC-backed FSP has acquired Stratia Cyber, a provider of consultancy cyber security services. This acquisition will further enhance FSP's ability to deliver end-to-end cyber protection and defence for clients. Read more here: https://lnkd.in/eVrC4DgY #TrustedwithAmbition

30

1 Comment

RegTech Analyst news you can't afford to miss from yesterday - Why AML customer screening is vital for compliance - Day One Defense Models deliver rapid fraud prevention - Endpoint security startup Koi raises $48m funding - Cybersecurity firm Red Access bags $17m Series A funding - DeepDive AI platform boosts AML compliance efficiency Hawk Shana Leyva WorkFusion Jessica Cassady Amit Assaraf 🎏 David Pope

16

Fraud now accounts for over 40% of all crime in the UK, and much of it starts online. This article in The Times rightly highlights a growing imbalance: while banks are investing billions to tackle scams and protect consumers, many of the platforms where these scams originate are not yet sharing that responsibility. Fighting fraud can’t fall solely on those at the end of the attack chain. Responsibility must be distributed across the digital ecosystem – from financial institutions to tech platforms, telcos and regulators. That’s why regulation like the Online Safety Act matters. But with full enforcement still years away, businesses must ask themselves now: what role are we playing in building a safer digital environment? At GBG Plc, we believe effective trust and safety isn’t about box-ticking. It’s about joined-up thinking, shared accountability, and real-world outcomes. https://lnkd.in/gG-sNAmj

27

PSD3 is set to reshape the role of identity in European payments. Following recent commentary (https://lnkd.in/e2DF3ADf) from Adam Preis, MCIM, Global Strategist, Ping Identity, on the growing strategic importance of identity under PSD3, Konsentus' Brendan Jones, has shared a complementary perspective, examining the issue through the lens of third-party risk. In “PSD3 and the Expanding Identity Perimeter: Why Third-Party Risk Is Now Core to Compliance,” he explores a critical but often underemphasised point: Under PSD3, identity is not just about authenticating customers, it is about continuously verifying the legitimacy, authorisation and regulatory status of third parties at the exact moment of access or payment initiation. As liability frameworks tighten and “obstacle” provisions remain in place, banks must balance openness with defensible assurance. Real-time Third-Party Risk Management is becoming a core component of that control framework. Read the full article here: 🔗 https://lnkd.in/emVYsyBN #PSD3 #OpenBanking #ThirdPartyRisk #DigitalIdentity #BankingRegulation #OpenFinance

23

In this Top-Rated RSAC 2025 session,Barclays' Senan Moloney and ThreatFabric's Eward Driehuis highlight research on the importance of standardizing fraud attack definitions across crime phases. They introduce types of modern attacks, and how to mitigate them. Watch free with RSAC Membership. https://spr.ly/6041A0X6N

7

Credential Stuffing, Data Breaches and Accountability Last month, the UK ICO fined 23andMe £2.31 million after a 2023 breach exposed personal data from around 10 million users. Attackers used credential stuffing, reusing login credentials from previous breaches, to access 23andMe accounts. Security experts flagged weak security practices, such as the lack of mandatory multi-factor authentication. I agree that organisations that handle highly sensitive data, such as genetic profiles, must uphold the highest security standards. From this breach, it appears customers were happy to use the same username | password combination to protect names, locations, dates of birth, photos, ethnicity information, and genetic health predispositions as they were on other non-sensitive websites. This makes me think: at what point do individuals bear some accountability for securing their own digital identity? Cyber threat statistics suggest this attack type is not going away, with around 70-80% of attacks attributed to credential stuffing. Does this put an extra burden on companies to protect users, even when users may not want to protect themselves? If users persist in reusing passwords across platforms, ignoring MFA options, or neglecting basic protective steps, can we truly place all the blame on the company? I believe a shared responsibility model is essential. I also believe online security is getting easier with primary browser providers and password security applications making it much easier for people to create secure and unique passwords with little overhead. Yes, 23andMe had failures, but if we’re serious about cybersecurity, we must also push for stronger digital literacy and accountability at the individual level. Should companies always bear the full weight of breaches involving reused passwords? https://lnkd.in/eu2gNF-p #CyberSecurity #DataPrivacy #Accountability #Infosec #DigitalResponsibility

39

1 Comment

We were referenced in a recent GBHackers article covering FvncBot, a newly identified Android banking malware that abuses accessibility services to capture keystrokes, deploy phishing overlays, and enable remote access. The analysis highlights how this threat operates and why it presents ongoing risk to mobile banking users: https://hubs.la/Q03YwDS40 #intel471 #cti #cybersecurity

17

📜 It’s Here – Improved Regulatory Compliance with Vulnerability Labels Unstructured feedback often contains subtle but urgent signs of vulnerability. These signals are easy to miss—but essential to act on. DataEQ’s new Vulnerability Labels help organisations meet the FCA’s Consumer Duty by identifying physical, psychological, social, and economic risk factors at scale. From product reviews to social media posts, the EQ Engine surfaces these signals in real time—so your teams can respond with care, and stay ahead of regulatory requirements. 🔎 Learn how we’re helping firms meet Consumer Duty obligations and support at-risk customers → https://lnkd.in/dRXrks8x

17

MDR sharpens visibility. Because resilient businesses need a clearer lens. In today’s cyber landscape, what you don’t see often matters more than what you do. Modern security teams face an overload of alerts. MDR steps in to give clarity where it matters most: - Filters noise so only real threats demand attention - Adds context to alerts for faster understanding - Guides action with expert-driven recommendations - Accelerates decisions when time is critical - Strengthens resilience by spotting what tools alone may miss MDR makes your defenses sharper, faster and more reliable. Graftronics is a Sophos MDR partner, transforming IT teams across organizations in multiple industries. Reach out to us for assessing MDR for your setup. - Vimesh Avlani Managed Detection & Response | Cyber Resilience | Trusted by Mid-Market CXOs

20

4 Comments

The FCA’s latest “Dear CEO” letter sounds a clear warning: financial crime risk in wealth management is rising and many firms aren’t ready. In this Financial Times article, our own Iain Armstrong breaks down what’s holding firms back (think: legacy systems, weak risk frameworks) and why smarter controls — including innovations like agentic AI — can turn compliance from a cost centre into a growth engine. Worth a read if you’re thinking long-term. https://okt.to/OKE4iU

10

🚨 New JMLSG guidance just got ministerial approval – and it's a signal of where AML is heading in the UK. https://lnkd.in/etfT5Yqp The updated guidance brings clarity to long-standing grey areas like: ✅ What constitutes a "material discrepancy" in beneficial ownership data – and what doesn't ✅ Risk-based onboarding in wholesale markets – including multi-party structures like subscription finance ✅ Digital ID standards – acknowledging that non-face-to-face doesn’t always mean higher risk 📘 As someone who’s seen both the pain and power of AML collaboration across Europe, this update reflects a mindset shift many of us have been pushing for: 👉 More proportionality 👉 More real-world practicality 👉 Less box-ticking, more impact Here’s the truth: Fraudsters don’t care about compliance checklists. And AML teams can’t fight modern threats with outdated definitions and siloed playbooks. 🧠 Whether you're managing onboarding risk, tackling mule networks, or trying to recover stolen funds, one thing is clear: AML needs to evolve together. This guidance is one step closer. 💬 Curious to hear from compliance leaders: How are you adapting to the updated JMLSG guidance? What do you think is still missing? #AML #FinancialCrime #RegTech #Compliance #JMLSG #FinTech #SalvBridge #IntelligenceSharing #KYB

16

6 Comments

Glasgow City Council announced on Wednesday being impacted by a cyber incident which it said was “disrupting a number of online services and which may have involved the theft of customer data.” The nature of the incident hasn’t been confirmed. It was uncovered by the council’s IT supplier CGI last week, “on servers managed by a third-party supplier,” according to the council’s statement. Day-to-day digital and online services have been disrupted by the council taking the affected servers offline. Its statement included an apology “for the anxiety and inconvenience this incident and the necessary response to it will undoubtedly cause.” #cybersecurity #CNI #Glasgow

17

Wales’ SecuraNova Secures Major Accreditation Milestone 🏴󠁧󠁢󠁷󠁬󠁳󠁿 A Welsh-founded security assurance specialist has completed a significant certification milestone, strengthening its ability to operate at enterprise scale. In a new article on the FinTech Wales website, we explore how SecuraNova, a FinTech Wales member based in South Wales, has achieved CE+, ISO 27001, ISO 9001, CREST Penetration Testing, and CREST Vulnerability Assessment accreditations. Together, these internationally recognised certifications reinforce SecuraNova’s commitment to: • Secure and consistent service delivery • Strong governance and risk management • Enterprise readiness in regulated environments • Scalable, high-quality security assurance Founder & CEO Nathan Jones described the milestone as: “A key step in SecuraNova’s journey from high-growth specialist to scalable, enterprise-ready security assurance provider.” As part of the Welsh fintech ecosystem, this achievement highlights the growing maturity and global capability of cybersecurity expertise across Wales. 📖 Read the full article: https://lnkd.in/e8g2PDp9 Follow FinTech Wales for the latest news from across the Welsh fintech ecosystem. #FinTechWales #WelshFintech #CyberSecurity #FintechNews #EnterpriseSecurity #Wales #Governance

22

2 Comments