Scroll through the most visited tech websites and one word that is sure to leap out is fintech. In the last five years, fintech has become synonymous with large funding rounds where the last year alone saw $132 billion in private funding.

With so much money sloshing around, as an entrepreneur, you could be forgiven for focussing heavily on product and growth, which makes sense.

But here is a scenario that we’ve seen come up more often than you think. A fintech firm is about to close a major partner where they will be solely responsible for the backend payments. The founder is already thinking of scaling, maybe another round of funding from a VC they’ve been speaking to for months. Things are looking up.

But here’s when the founder gets an email and is notified that the firm’s information security audits have thrown up a few worries and the deal will be put on hold until it’s sorted.

As a founder, put yourself in this scenario and ask yourself, could that be me?

When founders face such a quandary, the first thing founders tell us is that they too were caught by surprise, and now they are losing precious time and don’t know where to start and what are these heavy terms like ISO 27001:2013, SOC-2, PCI-DSS, PDPA, TRM and so on.

The proverbial panic button has been pressed.

What is a SOC 2 license?

What we always advise fintech founders working with us is that to reinforce your information security credentials, a good place to start would be by taking a look at your SOC 2 license.

To put it simply, your organization deals with a lot of data and your immediate concern is what can you do to safeguard this data. In this case, one of the most basic audits that can be done to understand where you stand on data security is to do a SOC 2 audit.

This audit was devised by the American Institute of Certified Public Accountants (AICPA), and just like a financial audit, an SOC 2 audit is unique for each organization.

Moreover, if you intend to work for reputed clients - think bluechip companies, the completion of a SOC-2 audit is critical

A Cautionary Tale for Founders

Upon reading this, you can be left scratching your head, ‘ I mean if it's a simple audit, why is there a problem?’ This is where the on-ground experience tells a different story. Thanks to a cutthroat market with no shortage of clients looking to integrate fintech as a solution, information security, invariably take a back seat.

In Konfirmity’s survey with fintech founders in India, three things we’ve seen founders trip upon are:

1. Founders tend to think of a SOC-2 audit too late in the game, and in several instances, it came via a flag from clients

2. Not having the right system architecture or toolkit that can help founders conduct a SOC-2 audit

3. A lack of in-house expertise to help combat the challenges thrown up by negative agents looking to profit from security breaches

In early 2021, researchers from IBM found that individuals from 17 countries and 537 firms had fallen victim to data-related cybercrime. Moreover, on average a data breach in 2021 cost a firm $4.24 million (~INR 3.5 Cr), which was almost 10% higher than the previous year.

Delaying, in this case, can not only harm your business financially but also wreck your credibility with clients who are taking data security more seriously than ever.

Remember: your product can be improved and tweaked but once your trust quotient is diluted, it’s not easily won back.

The Konfirmity Angle

What we’ve found is that once they know about the SOC-2 license, they will get it done but after that, they aren’t willing to invest time and resources to implement the framework and keep up with global information security standards.

This is where it is common practice to hire an information security service partner who can help you with all your security and privacy-related concerns, including overcoming any regulatory requirements.

One of our partners, Tazpay - a Singapore based B2B startup that helps SMBs manage cross-border retail - spoke about bringing us on board:

“We did not have info-sec expertise, since we are a fintech company with interest in both South East Asia and abroad. So, we were keen to partner with a firm that could help us stay on top of all our information security requirements. This is where Konfirmity has stepped in.

They started by helping us understand what it means to be compliant and certified, without drowning us in too many technicalities as that’s their expertise. Over time, and by working with Konfirmity, a common misconception in the market that we’ve come to realize is that everyone thinks they need to be compliant in the same way.

But in reality, every company needs to implement it differently according to its size, scale and type. Just like what we provide to our clients has no ‘one size fits all solution, information security has to be customized and often founders need to first understand what their firm needs.”

‍