Written by Jean Lehmann, who delivers Redcliffe Training’s Digital and Emerging Fintech-Driven Banking Transformation course.
They are reshaping how institutions operate, how value is created, and more importantly, how risk accumulates and propagates.
Yet, if one steps back from the narrative of innovation, a different pattern emerges. The most consequential failures of the past five years have not been caused by technological inadequacy. They have been caused by systems that were not governable.
The
collapse of Wirecard in 2020, with €1.9 billion in unaccounted funds, was not the result of insufficient technological sophistication.
The destruction of approximately $40 billion during the
Terra/Luna collapse in 2022 did not stem from a lack of engineering capability. More recently, the Synapse intermediary failure in 2024, leading to frozen customer accounts across multiple fintech applications, was not a cyber incident in the conventional sense.
Each of these cases reveals the same underlying issue:
the absence of a coherent alignment between architecture, control and accountability. This is the defining challenge of
fintech-driven banking transformation.
Here is what you need to know about this emerging transformation.
From Institutions to Ecosystems: A Structural Redistribution of Risk
Traditional banking was built on vertically integrated models. Control, accountability and infrastructure were largely contained within the institution.
That model has now given way to something far more complex.
Banks increasingly operate as orchestrators of ecosystems composed of:
- Fintech interfaces
- Banking-as-a-Service providers
- Cloud platforms
- Payment infrastructures
This shift is often described as efficiency, scalability or innovation. It is more accurately understood as a redistribution of operational, financial and accountability risk across many actors within the ecosystem.
Regulators have already recognised this transformation.
The Bank of England, in its
Financial Stability Report (July 2023) and later supervisory communications, highlighted that over 70% of critical banking services rely on third-party providers. Particularly in cloud and data infrastructure, underscoring the systemic concentration risk created by outsourced technology dependencies.
The introduction of the
Digital Operational Resilience Act (DORA) formalises this reality by requiring institutions to map, test and track their entire network of dependencies. Not merely their internal systems.
Here is what this means in practice:
Operational, cyber, and third-party dependency risk no longer resides within the boundaries of the firm. It is dispersed across entities with different incentives, different capabilities and, crucially, different regulatory obligations.
Failures in these multi-party, technology-driven ecosystems rarely originate from a single point. They emerge from the interactions between components that were never designed to be governed as a whole.
Architecture as the New Control Layer
In this context of fintech-driven, multi-party banking ecosystems, architecture has become the primary mechanism through which control is exercised:
- Where is the ledger maintained?
- Who controls the reconciliation process?
- Which entity is responsible for safeguarding customer funds?
- How does information flow between systems, and who has visibility over it?
These are architectural questions, but they are also governance questions.
In practice, governing fintech-driven architectures requires institutions to define and keep control over a set of non-delegable control points, regardless of how functions are distributed across partners. These include, at a minimum:
Ledger Integrity and Reconciliation Authority
Ensuring that a single source of truth exists for customer balances and that reconciliation processes are not fragmented across multiple entities.
Safeguarding and Legal Ownership of Customer Funds
Particularly in Banking-as-a-Service and embedded finance structures, where funds may sit with partner banks while interfaces are controlled by third parties.
Incident Detection, Escalation and Decision Rights
This includes the authority to suspend transactions, restrict access or trigger recovery processes across the ecosystem.
Customer Outcome Accountability Under Conduct Frameworks
Including liability for errors, fraud or service disruption under regimes such as the UK Consumer Duty and Payment Services Regulations.
The
Synapse failure in April–May 2024 affected an estimated 100,000+ customer accounts and left between $85 million and $100 million in customer funds temporarily unreconciled or inaccessible across partner banks. It illustrates how fragmented fintech architectures can lead to a breakdown of control, reconciliation and accountability.
Customer-facing interfaces were operated by fintech firms, underlying funds held by partner banks, and transaction orchestration delegated to an intermediary layer. When that intermediary failed, no single participant retained end-to-end visibility or control over the system.
The result?
A temporary loss of access to customer funds and a systemic failure of accountability.
In both the Wirecard and Synapse cases, the failure was not technological but architectural. Control points either existed but were not effectively enforced, or were insufficiently defined and anchored within fragmented system architectures.
This type of fragmented control and accountability failure was the logical consequence of a system in which control had been distributed without being explicitly defined.
The lesson is straightforward, if uncomfortable:
governance cannot compensate for architectural ambiguity. If control points are not clearly anchored within the system design, they will not emerge through policy, contracts or oversight frameworks.
The Predictable Mechanics of Governance Failure
It is tempting to treat governance failures as idiosyncratic events. In reality, they follow consistent patterns.
Control is delegated without adequate compensating mechanisms. Reconciliation processes span multiple entities without a single source of truth. Accountability becomes diffuse, particularly when customer outcomes depend on interactions between banks, fintechs and infrastructure providers. Incentives diverge, with some actors optimising for growth while others retain regulatory liability.
These dynamics were visible in Wirecard, where third-party structures obscured the true location of funds. They reappeared in Synapse, where ledger fragmentation created uncertainty over customer balances. They are increasingly evident in open banking and embedded finance models, where responsibility for customer outcomes can become blurred across multiple layers of the ecosystem.
Complexity in itself is not problematic. Financial systems have always been complex.
What has changed is that ecosystem-level complexity across fintechs, banks and infrastructure providers is now
poorly bounded and insufficiently governed.
Payments Infrastructure as a Risk Transmission System
Nowhere is this redistribution of risk and control across interconnected systems more visible than in payments.
Historically, payment infrastructure was treated as a back-office utility. Today, it sits at the centre of supervisory scrutiny and operational risk.
The transition to instant payments removes the temporal buffers that once allowed for fraud detection and intervention. In the UK alone, authorised push payment (APP) fraud losses
reached approximately £459 million in 2023 according to UK Finance, illustrating how real-time payment rails materially increase the speed and scale at which financial harm can occur when controls are insufficient.
The introduction of the
UK’s mandatory APP fraud reimbursement regime (effective October 2024, under the Payment Systems Regulator framework) requires payment service providers to reimburse victims of authorised push payment fraud up to £85,000 per claim as a baseline, with liability shared between sending and receiving institutions. In practice, exposure can exceed this threshold through complaints escalation, including awards of up to £415,000 via the Financial Ombudsman Service, thereby translating payment control failures into immediate financial and regulatory consequences.
At the same time, the migration to ISO 20022 is increasing the granularity and interoperability of payment information while raising the complexity of reconciliation, data governance and real-time control across interconnected payment infrastructures.
Taken together, instant settlement, reimbursement liability and data standardisation increase both the financial exposure and the operational control requirements embedded in payment architectures.
For senior decision-makers, payment architecture choices can be evaluated through four interdependent dimensions:
control, liability, liquidity exposure and regulatory perimeter.
- Control: which entity has operational authority over transaction validation, execution and reversal
- Liability: how financial responsibility is allocated across sending and receiving institutions, particularly under reimbursement regimes such as the UK’s APP framework.
- Liquidity exposure: the extent to which instant settlement or prefunding requirements create balance sheet constraints or intraday liquidity risk
- Regulatory perimeter: how the chosen rail determines applicable regulatory obligations, including safeguarding, conduct and operational resilience requirements
Institutions that fail to integrate these parameters into architecture decisions effectively embed financial loss and regulatory exposure into their operating model.
Recent outages in UK banking systems have demonstrated that disruptions in payments infrastructure translate immediately into customer harm, regulatory attention and reputational damage.
There is no longer a separation between operational failure and conduct risk.
In such an environment, the selection of payment rails is not merely a technical decision. It determines liquidity exposure, fraud dynamics, third-party dependencies and ultimately the institution’s regulatory posture.
Payments have become a primary channel through which risk is transmitted across the system. These architectural choices not only shape risk exposure; they determine product economics, including fee structures, fraud-related losses and capital allocation constraints.
Regulatory Convergence and the End of Siloed Compliance
At the same time, the regulatory landscape is undergoing a profound transformation.
Frameworks such as
DORA,
MiCA,
PSD3 and the
EU AI Act are often discussed independently. In practice, they form an interconnected set of obligations that span operational resilience, digital assets, payments, data governance and artificial intelligence.
What is emerging is a need for institutions to
prove system-wide coherence across operational resilience, payments, digital assets and AI governance in how they manage risk.
DORA requires mapping and testing of dependencies. MiCA introduces governance obligations for digital assets and stablecoins. PSD3 expands the scope of open banking into open finance, reshaping liability frameworks. The EU AI Act imposes enforceable requirements on the governance of high-risk AI systems.
These frameworks overlap. They intersect at the level of architecture.
Institutions that continue to approach them as separate compliance exercises will encounter fragmentation, duplication and supervisory challenge. Those that integrate them into a single, architecture-led governance model will be better positioned to demonstrate control.
Regulation is no longer an external constraint. It is an input into system design.
AI and the Compression of Risk Timelines
Artificial intelligence introduces a different, but equally structural, shift.
The significance of AI is not limited to the introduction of new forms of risk. It lies in the compression of time. Decisions that were previously made sequentially, subject to human oversight, are now executed at scale and in real time.
Errors propagate faster. Consequences materialise sooner.
In credit, fraud detection, trading and customer interaction, AI systems are already influencing core financial decisions. Under the EU AI Act, institutions must ensure that these systems are explainable, monitored and subject to independent oversight. This is not simply a technical requirement; it is a governance requirement.
The challenge is that governance frameworks were not designed for this speed.
The result is a growing mismatch between the pace at which decisions are made and the pace at which they can be overseen. The compression of decision-making timelines and the scaling of automated decisions in AI-driven systems create 'governance latency risk': the inability of control functions to respond within the time horizon in which risk is generated.
Operational Resilience as a Test of Governance Under Stress
Operational resilience frameworks in the UK and EU formalise what recent events have already demonstrated. Institutions must define impact tolerances, test severe but plausible scenarios, and show their ability to recover within predefined thresholds.
Cloud outages, cyber incidents and third-party failures have shown that disruption is rarely contained within a single institution. It propagates across interconnected systems.
This concentration is not theoretical: supervisory assessments by the Bank of England and the European Central Bank state that a small number of cloud providers account for the majority of critical banking workloads in Europe, creating potential single points of failure with system-wide impact in the event of disruption.
What determines the outcome in system-wide disruption scenarios involving cloud providers, payment rails, or third-party failures is not the absence of failure, but the quality of governance under stress:
- How quickly can an institution identify the source of the issue?
- How clearly are responsibilities defined?
- How effectively can it coordinate with third parties?
- How robust are its escalation and communication processes?
Cyber incidents, in particular, are no longer technical events. They are governance events with immediate regulatory, operational and reputational implications.
From Innovation to Defensibility
The cumulative effect of ecosystem fragmentation, regulatory convergence, real-time payment infrastructure and AI-driven decision-making is a shift in how to approach and understand fintech transformation.
It fails when architecture distributes control without clarity, when governance frameworks do not reflect actual system dependencies, and when regulatory requirements are treated as afterthoughts.
It succeeds when control points are explicitly defined, when architecture and governance are aligned, and when failure modes are anticipated and tested rather than discovered through crisis.
For senior leaders, the critical question is no longer whether their organisation is innovating sufficiently. It is whether the systems they are building can be defended, operationally, financially and regulatorily, under conditions of stress.
These structural challenges cannot be addressed through policy statements or incremental adjustments to existing frameworks. They require the ability to translate fintech-driven transformation into explicit architectural decisions, clearly defined control points and tested governance mechanisms.
In practice, this approach means equipping decision-makers with tools to map ecosystem dependencies, identify where risk concentrates, define non-delegable control anchors and evaluate transformation choices against regulatory, operational and financial constraints. It also requires the ability to test these decisions under stress scenarios, including third-party failure, payment disruption, cyber incidents and AI-driven control breakdowns.
The purpose of an architecture-led approach to fintech-driven banking transformation is to structure change in a way that remains coherent, controllable and defensible under regulatory scrutiny.
Moving Forward With Fintech Governance and Banking Transformation
Fintech-driven transformation is not a layer of innovation added to existing banking models. It is a reconfiguration of the system itself.
Control boundaries are shifting. Accountability is becoming more diffuse. Risk is increasingly distributed across ecosystems that extend beyond the regulated entity.
Regulators have adapted to the systemic redistribution of risk across fintech ecosystems, third-party dependencies and real-time infrastructures. Institutions must do the same.
Adapting to this redistribution of enterprise-wide risk across fintech ecosystems, third-party dependencies, real-time infrastructures, and automated processes requires moving beyond simplified growth-oriented narratives of digital transformation towards a more disciplined approach grounded in architecture, governance and evidence.
This shift in mindset requires understanding not only individual risks but the interdependencies through which they propagate across interconnected systems.
The
Digital and Emerging Fintech-Driven Banking Transformation Course at Redcliffe Training goes beyond theory to give you practical, real-world strategies for staying ahead in the banking industry. You'll learn directly from an expert who's seen it all.
Ultimately, the ability to design systems that remain coherent, controllable and defensible under regulatory and operational scrutiny is becoming a defining capability for financial institutions. Functional fintech-driven banking systems are now a baseline expectation; the differentiator lies in architectures that perform reliably under stress and can demonstrate that performance with clarity and evidence.
FAQ
What is fintech governance?
Fintech governance refers to the frameworks, control structures and decision-making processes used to manage technology-driven financial systems. It ensures that innovation remains aligned with regulatory requirements, risk management standards and customer outcome obligations, while maintaining accountability across increasingly complex ecosystems.
Why is fintech governance becoming a critical issue for banks?
Fintech-driven transformation has redistributed risk across ecosystems involving banks, fintechs, cloud providers and payment infrastructures. As control boundaries become less clear, institutions must ensure governance remains effective across these interconnected systems. Governance choices now shape product economics, liability exposure and the scalability of fintech-driven business models. It is therefore not just a compliance function, but a core component of system design.
How does fintech architecture affect risk and accountability?
Architecture determines where control resides, how data flows, and who is accountable for key processes such as reconciliation, safeguarding and incident response. Poorly defined architectures can lead to fragmented control and unclear accountability, increasing operational, financial and regulatory exposure.
What are the main risks in embedded finance and BaaS models?
Key risks include fragmented ledger control, unclear safeguarding responsibility, misaligned incentives between partners and limited visibility across the transaction lifecycle. These risks often emerge not from individual failures, but from the interaction between multiple parties within the ecosystem.
How do regulations like DORA, MiCA and PSD3 impact fintech-driven banking?
These frameworks extend regulatory expectations across operational resilience, digital assets, payments and third-party dependencies. They require institutions to demonstrate system-wide oversight, including dependency mapping, stress testing and clear accountability structures across both internal systems and external partners.
How can institutions ensure fintech innovation remains commercially viable and defensible?
Institutions must integrate governance into system architecture from the outset. This involves defining non-delegable control points, aligning incentives across partners, and evaluating transformation decisions against regulatory, operational and financial constraints. Innovation becomes sustainable when it is both scalable and demonstrably controllable under stress.
Who should attend a fintech governance training programme?
Fintech governance is increasingly relevant for senior professionals across risk, compliance, technology, payments and transformation functions, as well as board members overseeing digital strategy. It is particularly critical for institutions operating embedded finance, platform-based models or AI-driven decision systems.