Fintech and Internal Control: Balancing Innovation and Trust

Financial technologies make it possible to speed up operations, improve access to services, and create new models of customer engagement. However, as technological capabilities grow, so does the cost of mistakes.

Can traditional internal control, developed in the context of an industrial economy, meet the needs of digital businesses? This issue is especially important for banks: a significant portion of their resources is committed to customers, while their operations are also subject to requirements for risk management, information security, compliance, and anti-money laundering. An analysis of the experience of Russia’s top ten financial institutions shows considerable progress in this area, due in large part to the system of internal control established by the Central Bank of the Russian Federation.

Technology companies and fintech firms are characterized by the speed with which they develop and launch products. This very flexibility is one of the sources of their competitive advantage. But accelerating processes can conflict with traditional approval and control mechanisms. Experience shows that the gap between developers, operations teams, lawyers, finance professionals, and compliance specialists is particularly dangerous. If each group works in isolation, a technological solution may be effective from a product perspective while also creating significant operational or regulatory risks.

One response to this challenge is to develop the principles of DevOps, Agile, and CALMS, which call for closer collaboration between teams, automation, systems thinking, outcome measurement, and a corporate culture of cooperation. Risk culture is the most challenging element of this transformation: without it, technological tools and formal control procedures do not deliver the necessary results.

The next challenge is artificial intelligence. Its use creates new opportunities for banks and financial companies, but also brings risks related to cybersecurity, data quality, algorithmic bias, opaque decision-making, and the protection of confidential information.

The growing use of AI agents is particularly significant. These agents can not only provide information but also plan actions independently, use external tools, evaluate the results, and carry a task through to completion. This fundamentally changes the object of control: it is no longer enough to monitor only an employee’s actions or an individual transaction; organizations must also oversee the algorithm that makes decisions and carries out a sequence of actions.

Digital transformation, then, does not make internal control obsolete—on the contrary, it makes it more strategically important. The future of financial organizations does not depend on choosing between innovation and control, but on creating a governance system in which control is integrated into technological processes without hindering development.

For banks and fintech companies, the key question today is: how can they build a risk management system that preserves the pace of innovation without sacrificing accountability, transparency, and trust? To avoid this dilemma, they need to establish a well-balanced three lines of defense model, with a strong presence of experts across every area of the company’s operations. This is why the audit market is experiencing something of a professional renaissance—albeit with a new set of skills.

Author: Doctor of Economics, Professor at the Department of World Economy and International Finance, Faculty of International Economic Relations, Financial University under the Government of the Russian Federation, Igor Borisovich Turuev