Fintech leaders warn innovation outpaces cyber resilience

Executives across the fintech and cybersecurity sectors have warned that rapid digital innovation is outpacing progress in distribution infrastructure, non-financial risk and cyber resilience. Their comments, made as industry figures mark World FinTech Day, reflect an assessment of how far the sector has moved beyond consumer-facing apps.

Leaders in asset management, regulatory technology and cyber intelligence pointed to a widening gap between visible fintech products and the less visible systems that support them. They argued that the next phase of growth will depend on how well firms integrate traditional financial structures with emerging digital ecosystems while managing more complex operational and security threats.

Justin Christopher, Head of Asia at Calastone, said tokenisation is now central to conversations about the future of fund distribution. He described a market in which traditional products such as mutual funds and exchange traded funds gain new life through digital wrappers and infrastructure rather than being displaced outright.

"Tokenisation is becoming the next stage in the evolution of fund distribution. Though it will not yet replace ETFs or traditional funds, those vehicles will become accessible through digitally native channels, opening the door to new investors and new use cases. The real opportunity lies in making traditional investment products interoperable with emerging digital ecosystems, allowing asset managers to reach new investors without changing the underlying fund structures or operating models. For Asia, where capital markets are becoming increasingly digital and cross-border, interoperability will be critical. Successful firms will deliver that connectivity at scale, broadening distribution, expanding investor access and unlocking new opportunities across markets," said Christopher.

His comments reflect a wider debate in Asia over cross-border capital flows and the need for consistent infrastructure that can support both legacy and digital assets. Market participants across the region are testing tokenised funds and other digital instruments while regulators examine how existing frameworks apply.

While tokenisation and new apps draw attention, Corlytics executive Rash Phullar said the industry pays less public attention to the risk and control frameworks beneath these services. He highlighted non-financial risk disciplines that rarely feature in consumer marketing but have become central for boards and regulators.

"World FinTech Day tends to highlight the products end users see, new apps and new payment rails. What gets less attention is what sits behind them: solutions like non-financial risk quantification, risk controls self-assessment automation, continuous controls optimisation and trading venues risk management. Most institutions are still managing these with manual processes, subjectivity and fragmented data. That was never a sustainable option, and it matters now more than ever given increasing regulatory scrutiny, the complexity of the non-financial risk landscape and cost pressures. Closing that gap by developing practical end-to-end solutions leveraging data, technology and AI in partnership with industry is what we're focused on," said Phullar.

Non-financial risk spans issues such as conduct, operational resilience, model risk and technology failures. Supervisors in major markets have increased their focus on how banks and fintechs identify, quantify and monitor these exposures, as well as how they use data and automation across fragmented systems.

Cybersecurity specialists have issued similar warnings about the pace of change. Jack Alexander, Global Intelligence Lead at Quorum Cyber, said attackers have matched the industry's use of digital channels and faster payment mechanisms while firms face pressure to keep services running without interruption.

"FinTech is moving money faster than ever, but attackers have kept pace. UK Finance's latest data shows more than £1 billion stolen in 2025 through payment fraud, with cybercriminals increasingly using social engineering to trick people into authorising fraudulent payments. Banks are preventing more unauthorised payments, but that is pushing tactics to evolve: data exfiltration is now prioritised over traditional ransomware, stolen credentials are used to gain initial access, and third-party software and service providers are being targeted directly. FinTech firms face mounting regulatory scrutiny and cannot afford downtime, so resilience has to be built in, not bolted on. On World FinTech Day, the message is simple: cyber resilience is a core business function, and it has to keep pace with how fast the threats are changing," said Alexander.