E167: What keeps payments players up at night?

Speaker A: This podcast is proudly produced by Strike, the autonomous FinCrime department.

Speaker B: The first thing that you have to do is break down the ivory tower that uh, you can see in many institutions, and especially I would say this has been a thing in the past, that compliance was a bit of an untouchable function and what they say is the law. If this is the way you operate, then you will have quite a hard time to make compliance work.

Speaker C: Welcome to the Laundry, the podcast connecting AML compliance and financial crime to the real world. Trying to map out cross border transactions across the EU is virtually an impossible task. They flow like water from one nation into the next. According to new figures from Money20 20, EMAEA accounts for 48% of cross border payments globally, just under half. So now put yourself in the position of assessing those billions of transactions moving at incredible speed for financial crime, risk and suspicious patterns. Sounds like a headache, right? I'm your host, Robin Laika, uh, solutions architect at Strice. And in this episode we're asking what keeps payment players up at night. We'll be discussing the big challenges that the payments industry throws up for compliance professionals. The solutions which really make a difference. And Weiss amla, uh, and all the industry drama in between too. To dive into this topic, I'm delighted to be joined by Rene Hofer, CCO and Branch Director Germany of Holvae. Welcome to the Laundry, Rene. Your team reached out to us directly with this episode topic and I'm very glad we can make this happen. Tell me about your role at Holvae.

Speaker B: Yeah, so my role at Holvi is uh, pretty much running the compliance, uh, and risk management functions. So what you probably would also tend to call the internal control of a financial institution. And uh, I'm looking after keeping our customers as well as our own company safe.

Speaker C: And you wear many hats, uh, including the beautiful one you have today. Not only your roles, but you have the annual advisory where you advise other fintechs on how to get this right as well.

Speaker B: That's right. I started this about four years ago. Uh, and to be fair, it is not like a large scale business running on the side. It's more of a small side project where I engage with people from the industry that I know, uh, where I try to help in the network a little bit, where I can and spare some hours mostly really to share lessons that I have already learned that can save others a bit of time.

Speaker C: Good. Let's dive into the discussions. Let's start by looking at some of the challenges that payment players face to kick things off why do you get up every day and do the work that you do?

Speaker B: So at Holvi, we're serving business customers. Um, we work with freelancers, we work with smaller and some larger businesses. And I think if we are looking at the banking industry on the consumer side, banking almost turned a bit into a lifestyle product over the past decade. Applications got very fancy, got connected to shopping experiences and whatnot. And at the same time, on the business banking side, um, I think there is still a bit of room to go. Uh, so especially smaller businesses, they tend to be, I would say, underbanked a little bit. The access to progressive products, um, is not yet as broad as it is on the consumer side. So what really keeps me up every day is knowing that I can help pushing this forward a bit, knowing that I can contribute to building products that hopefully resolves some hurdles for all of these small businesses so that they can actually focus on building their business and not focus on putting paperwork in place and doing endless reports and whatnot.

Speaker C: You mentioned building, uh, systems. So you joined halvi back in 2019. So you've been there for a minute. Uh, you had to scale and localize a very different system rather than inheriting a legacy system. Uh, what did that actually look like? And tell us a little bit about the challenges.

Speaker B: So back in 2019, when I joined Hovi, um, at this point Holvi was operating as a subsidiary of a large Spanish corporate bank. So, um, it was a little bit different to the typical fintech as you would imagine it. So there was not only regulators looking at us, but also our parent company looking at us. And in a compliance function, that means you, you really got a few things, uh, to do and to report and to get. Right? So, um, I would say the biggest challenge was that the regulatory expectations that you are facing are almost identical whether you are a large bank or if you're a small and lean team. Uh, so you have to navigate the same pool of tasks, the same pool of duties. This was probably the biggest challenge. Like, when I started, I was, I would say, maybe a bit too idealistic, trying to build the perfect framework that does it all, that has it all. And then, like, slowly but surely, you have to realize that it's not going to work. Like, you won't be able to do this with a couple of people. So the reality check was really, before building anything, uh, you got to understand your own business, you got to understand, uh, what you're trying to achieve and then build the priorities around that.

Speaker C: Yeah, I guess the idealistic part is Something that anyone that has entered a role with a certain level of enthusiasm and passion has actually stumbled into at some point. But tell us, like, on a detailed level, what went wrong first and how did you find out what went wrong?

Speaker B: I mean, I would say there's probably a few things that weren't wrong by definition, and then there were a few things that went wrong to my own standards. As I mentioned, I approached it a little bit on an idealistic level. Um, there are so many frameworks out there, so many golden rule books to put in place, and, um, I tried a little bit too much to go by the book. So, um, what you end up doing then is you throw large frameworks over a company that just gets confused by what the hell you want from them. And, um, at the same time, if you're not tailoring the processes that you are building, or if you do not make sure the policy that you're writing actually speaks your own business's language, then, uh, it just won't work. It won't find a point where it can start having effects. So at the end of the day, it might look great on paper and from the outside, but it's just a silo that doesn't do anything. And, um, I think I relatively quickly noticed that, okay, I need to redo this thing, uh, and I actually need to start going into the teams first and understand how they work, uh, what their challenges are so that, um, any kind of frameworks, rules, policies we are building rather contribute to these challenges, um, instead of putting additional hurdles in the way.

Speaker C: And a little bit about your customer base, uh, your customer base is entirely SMEs, freelancers, micro entrepreneurs. What does that risk profile actually look like compared to a retail or a corporate bank?

Speaker B: I would say it's actually not too different from a retail or corporate bank. Of course, especially as a digital first, uh, provider, you might attract those who are a little bit more tech savvy. You, uh, maybe get those companies where founders are anyways running, uh, software offerings themselves. So kind of meeting, um, on an eye level. But at the end of the day, I, um, mean it goes down to the industries that you're trying to work with, uh, who are your customer target groups. And these can be the same that corporate banks, uh, are serving or trying to serve. What might differ a little bit that corporate banks out there, I think oftentimes have maybe a bit of a higher domestic focus. So they are serving, uh, basically the clients in their home countries. And um, we at Holvi, similar to many others in the fintech space. We have a very international offering so we really serve customers cross border. We look at those company constellations that have people from all over the world involved where founders come together to make an idea happen, whether they are in Germany, in Austria, in Finland or anywhere entirely else. So I think that probably makes it a bit different that we have many countries uh, that come together uh, to do banking business.

Speaker C: And on that note, Halvi operates under a Finnish payment institution license. Right. But it serves customers across multiple European markets as you mentioned, including the German branch where you're situated, uh, under Buffin as well. Uh, so that's a pretty complex compliance picture for a company of your size. How do you manage the tension between those multiple regulatory cultures?

Speaker B: I can make it even a little bit more complex because as of this year we are even running an Austrian branch. So there is a third regulator in the game.

Speaker C: But uh, wait, there's more.

Speaker B: There is more, right? Yeah, I mean it is indeed a challenge to navigate these very distinct regulatory cultures. I would say, um, our home regulator in Finland, um, has quite a Nordic touch in how they operate. Whereas Bafin, which I mean it is very well known as one of the, let's say maybe stricter regulators, uh, also in the way they operate. So what we overall try to do and follow as a golden rule is we're building for the highest denominator. So we're basically depending on the topic that we're handling, we're looking at who has the strictest take on it and we try to satisfy that because if we do we naturally satisfy the other regulators as well. Of course there are always local nuances that you have to consider, but it's, it's typically a uh, well working approach because it allows us then to build processes and prepare teams in a way that you don't have fractured operations. So you don't do it that way for Germany and a completely different way for Finland. But uh, you can actually streamline your processes. Then of course there is the regulator on the other side who has an opinion on that approach. But uh, from my experience they appreciate also the work of other regulators. So if you really signal them that you're trying to get that right and uh, if you sometimes even translate what the other regulator thinks about it to them, uh, you end up having quite constructive eye level discussions. And here, uh, like a small fun story that I had not imagined that this would happen. Uh, when doing this you can end up sudden in an email thread that has regulators from three countries in it and you're discussing the same question between five people and then you really realize, okay, actually everyone here has the same mission. We're trying to keep the industry safe, we're trying to keep customers safe. Everyone wants something in that. So show that you're willing to invest and then in return you'll equally get uh, what you're looking for. So that if you make sure it's a win win situation, uh, then you can also navigate uh, these different cultures, uh, easily.

Speaker C: I'm very happy to hear that actually. Uh, from the outside it sometimes seems like you can see one regulator having a focus area or a thematic inspection on sanctions, while another regulator is focusing on auditing. So I was kind of just wondering how you deal with that. But it sounds like is actually something that's working quite well.

Speaker B: It does, but of course you have a good point there. Regulators have their own roadmaps if you want. So uh, they have their priorities and for a good reason. I mean they regulate different markets and uh, there are political differences, there are economic differences between markets. So yes, they have slightly different agendas. Um, and that means uh, that you have basically served multiple roadmaps which in volume it can mean more work, but that's just part of the business. I think you can also understand it maybe as a healthy push. Uh, so for us it just means we have to be better, we have to do more. At the end of the day, as I said earlier, it is um, in everyone's interest and if we stay on top of what the individuals really need, it helps us just being more resilient

Speaker C: in the way we operate and following regulators. You always have the news and you can't be in this industry and not have seen the breaking news around.

Speaker D: Wise, a fintech is being accused of moving 500 million Euro of money across borders for drug trafficking, fraud and corruption. Wise is a fintech that does cross border money transfer and multi currency accounts. And they were founded in 2011 when the two founders became so frustrated with how expensive currency transfer for wise. Wise IPO'd in 2021 and they were celebrated because they proved that London could grow and sustain multi billion dollar unicorns. But the money laundering troubles started when Wise moved their listing from the London Stock Exchange to the Nasdaq in 2026. But around the same time, prosecutors in Belgium launched a probe after Wise came up in hundreds of criminal investigations. Law enforcement agencies across 30 different European countries were independently tracking drug networks, corrupt officials and fraud rings. And the digital money trail kept leading back to a Wise account. What happened was that after Brexit a lot of European fintechs were moving headquarters from London to Brussels, which overwhelmed Belgian regulators and meant that cases and cash were piling up. Tech Sec wise aren't banks themselves. They provide a tech layer on top of a partner bank and offer things like automated self onboarding, which criminal networks exploited using money mules or, or people that have clean records to open accounts and move small amounts of money. Obviously it's not like money was sitting in accounts titled crime, but Belgian prosecutors are arguing that there is this systemic non compliance failure to identify customers, their activities and their associations. Essentially the tech itself was built as a frictionless cross border highway that was so poorly policed that criminal organizations adopted it as their primary source of money movement.

Speaker C: When a story like this breaks, how do you react?

Speaker B: I mean to start with, of course, as you said, uh, we all heard the news and can follow it. So to start with, I think our colleagues at Wise, uh, have built like an immense product over the past decade and uh, they really opened doors for a lot of new products and providers out there. So I have immense respect for that.

Speaker C: Absolutely, fully understand and appreciate that. Uh, but when something like this breaks, does it make you like triple check your own processes?

Speaker B: I wouldn't say so. I, obviously I read it and I think through, okay, is this something that could happen to us? Is there maybe a weak spot that we should double check? But if you end up doing a panic audit, then I would say your framework was already weak at this point. So I would say we thoroughly discuss it and we try to understand also beyond headlines, what was really going on. But then at the end of the day, um, you got to move on with your own controls. And um, you're never immune to that. The moment you think you're immune to such an attack, you already lost the game. So carry on with your own business, with your own priorities, um, and just understand it as a reminder that the threats are real and they are happening to everyone. Whether it's a digital player or a corporate bank. Nobody, um, is immune to that.

Speaker C: So keep calm and carry on as they say in the uk. Uh, exactly. Okay, we'll be right back to talk about the solutions and the future of payment space. Don't go anywhere.

Speaker A: Imagine your compliance team as cooks in a high pressure professional kitchen.

Speaker C: International entity allergens, PEPs and sanctions do

Speaker B: not serve until verified. Yes sir.

Speaker A: Every new client is in order and the wall of tickets just keeps growing. Your team is working through it, they always are. But it grows faster than they can clear it. Stryce automates the routine cases, the low risk, predictable ones that follow a pattern your team already knows. Processed fast, consistently with a full audit trail without ever reaching an analytical. So the wall gets shorter and the cases that actually need human judgment get the attention they deserve. Manual fincran work ends with tries. Watch the full film link in the show. Notes.

Speaker C: Welcome back to the Laundry. A reminder that all laundry hosts are active on LinkedIn. So drop us a message if you want to discuss today's episode. We really like hearing from you. You we've talked about the challenges and stresses. Let's now look at solutions. Can you give us an example of a solution you've implemented recently which improved your work?

Speaker B: Absolutely. I have an exciting example for that. Uh, so we on the compliance side of the team, we have recently wipe coded, a fully functional internal control tool. So basically a tool where we carry out our testing and auditing activities. And um, that's in itself of course exciting. It brings you a new tool, it opens new uh, ways of being more efficient in what you do. But what I especially like about it is like a few years back, who would have thought a compliance team would build their own tool from scratch? You would have ended up in a tech backlog, fighting for priorities. And now you can basically just build exactly what you want and free up, uh, capacities for other things. So, so that is quite exciting and I'm pretty proud of what the team has been doing with it so far. We are fairly early still in the project, but I, uh, would say first signals are confirming that this is going to make our lives much easier.

Speaker C: Yeah, I couldn't agree more. I find it so, uh, it's mind blowing on a daily basis. Me, I usually refer to myself as a certified village idiot, um, but perhaps with a bit more tech knowledge than the average village idiot. But you know, just last week I built an agent that can assess data completeness on a KYC profile and it will gauge whether or not it ends up if it resolves in a natural person, if it resolves in a company, if that path is complete. Just doing stuff like that, it's just mind blowing what you can build and so, so fast as well. Uh, okay, so in that sense maybe a good question is, uh, what's harder to make work nowadays? Is it technology or is it culture?

Speaker B: Culture, 100% culture technology. It got easier and easier. I just mentioned the example of, uh, compliance team Wipe coding things. Culture always involves people and it will always involve people changing habits or combining habits of different realities, um, is incredibly difficult and it requires so much discipline and this intrinsic willingness, um, to really change. So I think, especially in our field in compliance teams, aml, risk management, it is always such a challenge to demonstrate the value that you are trying to produce. Um, I think it's naturally, uh, people can understand your demands as an extra burden, as extra work. Um, and this is just something where cultural work and people work, uh, is really fundamental to make such a change happen.

Speaker C: And when you get that right, what does it look like? How is a corporate culture like that different in how they operate day to day?

Speaker B: I would say the first thing that you have to do is break down the ivory tower that, uh, you can see in many institutions. Um, and especially I would say this has been a thing in the past, that compliance was a bit of an untouchable function and what they say is the law. I think if this is the way you operate, then you will have quite a hard time to make compliance work. So break that down and don't understand yourself as any different from the rest of the teams. Work hand in hand, work on eye level, um, and try to put yourself into the shoes of the other teams. Um, really friction is healthy. So take these discussions, um, understand the concerns and then try to build with that. Um, like a risk culture is nothing that one person imposes on others, but it's something that you build up together.

Speaker C: Yeah. I always say, contrary to the expression, curiosity killed the cat. I think curiosity is the key element of making anything that we do actually work. We talked a little bit about the, uh, SME risk profile as well before the break. What does your transaction monitoring actually look like in practice? Seeing as your low value, high volume, typically one would say your biggest risk is in your low risk.

Speaker B: There's definitely something to it. I think the biggest misconception is maybe, uh, that payment volumes or number of payments are the pure indicators to how risky something is. Um, there is so much more to it. So, um, if we think about monitoring, if you just have a static system in place that looks at, oh, someone spent X amount in a month, um, then this is not really going to tell you about the true risk behind it. It of course can be a helpful indicator to categorize a little bit the volumes you're dealing with. But the real power is in behavioral monitoring. If there is this small freelancer who suddenly moves corporate level volumes out of a sudden why, or, um, if there is that SME that makes 10 times the monthly volumes, uh, compared than their industry peers, uh, are they really that successful or is there something off behind that, uh, so I strongly believe you have to look behind the surface. You really need to understand who's involved in an individual business to understand its risk. There are no such rules that work for everyone and that would make your monitoring effective.

Speaker C: I think it's a universal fact for everyone in this industry that AMLR is coming. So for payment players like yourself, is this going to offer more solutions or more challenges?

Speaker B: I'm more on the side of more solutions obviously. Like everyone is talking now about uh, Amla and uh, at the end of the day it has been on the horizon now for, for quite a while. So I hope everyone is a bit more advanced already in preparing for it. But if we really manage to get this harmonization, especially on a cross border basis, uh, in place, if we can manage to make AML requirements roughly the same in all EU countries, then this brings massive opportunities for a player like Holvi. That really means uh, we can suddenly run that one onboarding flow. We don't need seven versions of it to make it work everywhere, uh, which is of course a great opportunity because that means we can make it faster, we can make it simpler for the customer as well and it just makes it overall more seamless. Um, and um, of course at the same time for customers, for businesses out there, that really also means um, they will experience less friction in their banking. So uh, for them that's equally an opportunity of actually uh, strengthening their own business, which is in everyone's interest.

Speaker C: And for someone like yourself and Holvi, what does your timeline look like between now and next summer?

Speaker B: I think if I'm thinking back, we started probably one and a half years ago already when the very initial consultations and draft papers came out. Not to run huge implementations, um, but rather to start understanding in what direction do we need to think. And um, our timeline now for the next 12 months, um, I would say is really um, putting those finished thoughts into place. So it's like the simple things of adjusting some of our policies. But I would say the biggest work now really goes into watching and participating. The AMLA is quite active right now with publishing consultations, actively getting feedback from participants in the market. That's something where we generally want to spend time with because at the end of the day, to an extent it is in our hands, uh, really, uh, how this exactly will work out. And uh, I do think that there is a genuine chance that we can influence a bit how this harmonization will

Speaker C: work in reality, both specifically to that, but also more generally in what you do, uh, what Keeps you motivated to find solutions. Solutions in this.

Speaker B: What keeps me motivated really is, um, I mean in very simple terms, if there are no payments, uh, if there is no cross border flow of money, then there is no economy. So what keeps me motivated is knowing that every product we build for customers, every process that we change and improve on our end internally is ultimately contributing to that. Uh, it removes roadblocks, it helps founders to get started with their business or to scale their business. And it maybe helps also to take away a bit the worries of those who have an idea but are too concerned of starting that idea. Uh, and yeah, knowing that I can help with that, with what we do at Holvi, um, is definitely, uh, quite a motivating factor that, that gets me out of bed.

Speaker C: I love that. It's a bit altruistic, isn't it, because people actually just expect payments to work. But there's a lot that happens behind the scenes to actually make these small businesses enable them to work across borders and get their day to day operations running.

Speaker B: Absolutely. I think before I entered the payment space, uh, I had no idea how many parties it takes to really bring €10 from Germany to Austria. Um, it is an impressive infrastructure and uh, someone has to maintain it and uh, someone especially has to make it better because it is also a very old infrastructure that exists for a long time already.

Speaker C: Okay, before we end this episode, we're going to dish out some quick fire questions for you. Are you ready?

Speaker B: I'm ready.

Speaker C: What's the one thing no one told you about working in compliance?

Speaker B: How much psychology is involved? I think people think this is all about legal texts, but um, it's maybe 20% legal texts and 80% empathy and negotiation.

Speaker C: Which is harder, building from scratch or inheriting legacy tech?

Speaker B: Inheriting. Building from scratch is a massive challenge, but untangling, uh, decades of technology or rigid data structures is something that can really, uh, stress you out a lot.

Speaker C: And do you think the payments industry is ready for Amla?

Speaker B: That's a very good question. Uh, ready? Honestly, I wouldn't say so. I think there is still quite a bit of panic out there and quite a few unknowns, but um, um, I'm confident that we'll eventually get there.

Speaker C: And lastly, what keeps a payment institution up at night?

Speaker B: The unknown unknowns. We talked about AI earlier. Um, and as much as it opens the doors for us, it also opens the doors for anyone who wants to harm you, with the difference that they don't follow the rules. So obviously they can be always a step ahead of you. And you got to make sure that you keep up in that race

Speaker C: that brings this spin of the Laundry to an end. Rene, thank you so much for joining me. Where can people find and connect with you?

Speaker B: They can find me of LinkedIn, of course. Just look for Renee Hofer. Uh, um, or check out our company profile holdi.

Speaker C: And thank you all for listening. If you've enjoyed this podcast, check out the back catalog of more than 160 episodes and follow the Laundry on your podcast platform of choice. Please share the podcast on your social media channels, tell a colleague to subscribe, maybe give us a five star rating. It really helps people to find us. Got an interesting topic to share, like Renee did? Reach out to us. Message me directly on LinkedIn or email laundry. AI, your host for this episode was me, Robin. Our producer was Matthew, our editor was Dominic, and our video was by Lois. The Laundry is proudly produced by Stryce, the autonomous fincrime department. Visit Strice AI for more information and see you next time.

Speaker B: Money makes the world go round.

Speaker C: M Bippity boop boppity beep.

Speaker A: This podcast is proudly produced by Strike, the autonomous fincrime department.