Protecting your fintech against cyber-crime

Large or small, no business is immune to the threat of cybercrime.  With ever-increasing reliance on technology, the consequences of a cyber-attack can range from temporary disruption of trading to complete financial failure. 

Cybercrime continues to evolve in terms of frequency, cost and complexity and the shift to homeworking brought about by the COVID-19 pandemic have seen cybercriminals further increase activity resulting in some disturbing statistics:

• In the first 6 months of 2020, there was a staggering 715% increase in ransomware attacks compared to the same period in 20191
• During the pandemic, there has been a reported 600% increase in malicious emails2
• A business is now 15 times more likely to have a cyber incident compared to a fire or theft3

Whilst more companies are starting to purchase Cyber Insurance, the take-up of cyber cover in the UK remains low. According to Hiscox’s 2020 Cyber Readiness Report, 58% of cyber-security professionals surveyed said their organisations purchased a cyber insurance policy””either as standalone or as an add-on to an existing policy””compared to 41% in 2019. 

Some common misconceptions around the need for Cyber Insurance include:

• Cybercriminals only target large companies 

Whilst cyber-attacks against high profile businesses such as British Airways and Travelex hit global headlines, small businesses are unfortunately not immune to cybercrime. 

Small businesses are often considered low hanging fruits by cyber criminals due to a lack of resources to invest in IT security and staff training. In 2019 46% of micro and small businesses experienced at least one cyberattack or breach4

• A traditional insurance programme affords adequate protection for the consequences of a cyber incident.  

Unfortunately, in most cases, this is not the case. Cyber Insurance has evolved specifically to provide protection against emerging risks not catered for by a traditional insurance policy.

•  IT security will provide adequate protection against cyber incident.

Whilst investment in IT security will inevitably make a company less vulnerable to cybercrime, increasingly sophisticated cybercriminals are capable of overcoming even the most robust of security systems

In addition, IT security cannot provide protection against the weakest link in any company’s security systems”“ human error. The UK Information Commissioner’s Office reported that the vast majority (90%) of UK cyber data breaches in 2019 were caused by human error5

The scope of cover provided under a cyber insurance policy may include (but is not limited to):

• Costs to recover and/or recreate lost data and restore computer systems following a security breach
• loss of revenue/profit increased cost of working and loss of future customers due to reputational damage following a cyber event
• Legal liability as a result of a breach of personal data /confidential information
• Inadvertent breach of intellectual property rights via cybermedia 
• Financial loss as a result of social engineering attacks such as phishing scams

Importantly, however, one of the most valuable and often overlooked benefits of a Cyber policy is the critical incident support services provided in the event of a cyber incident to help a policyholder navigate both the immediate aftermath and the longer-term consequences of a cyber attack.

Critical incident support services include:

• 24/7 access to IT forensics, data breach/legal experts and public relations advisers, to provide support in the event of an actual (or suspected) cyber incident
• Support in complying with data protection legislation and notification obligations following a data breach
• Access to specialist ransom and extortion advisers

For more information please contact garry.hill@pib-insurance.com

To the sprinters, the spoils!

The sheer complexity of data protection compliance can make it seem hard to get anywhere fast, but it is possible to get a lot done in a short timeframe, explains Wendy Spires, Consultant at data privacy tech company Trace.

As anyone experienced in this fiendishly complex area of compliance will tell you, data protection is an endurance sport which calls for organisations to stay on top of continually changing rules – and risks – that affect virtually every element of their operations. But while it certainly is a marathon, we’re increasingly seeing our client cover impressive amounts of ground via our “sprint” offering.

Organisations often split into two camps on their data protection today: those who view their GDPR programme as a “one and done” effort which can safely be consigned to the mists of 2018 and those more correctly see compliance as a continual process, but who are frequently daunted by about taking those first next steps.

At Trace, we pride ourselves on being both technically and commercially aware, so that our clients can leverage best practice in data compliance as a competitive advantage. But that also extends to seeing how clients can most fruitfully work with us. For start-ups and scale-ups, dedicating huge amounts of time and resources to data compliance isn’t always option, yet they need quantifiable results, fast. Enter our sprint offering.

Like many of our clients, smartKYC is at the cutting edge of technology as a provider of intelligence monitoring solutions which utilise AI. Also like others, it works in a hotly contested field. Maintaining the highest quality compliance is non-negotiable, but so too are staying ahead of competitive pressures and making data protection really work for the business.

Full steam ahead

By delivering a highly focused, yet flexible sprint programme, Trace was able to showcase the full benefits of our model and bench strength. And it was full steam ahead right from the start.

Our initial data protection audit was enriched by a deep-dive discovery session with management to confirm and lift up new areas to tackle to form a roadmap for the next year. This laid out, we then set about key tasks for the near term.

First among these was to get smartKYC up and running with the Trace privacy management platform, so that Records of Processing Activity and other key documentation were built ”“ and ready to be built further upon. We then drew on our internal auditing and accreditation expertise to tighten smartKYC’s infosec policies and procedures, while also advising on best practices in data retention, human resources, data transfers and more. We were even able to squeeze in some highly valuable work on data ethics and future developments on the technological side.

In short, we were able to get smartKYC’s data compliance programme in pretty good shape in a matter of just a few days ”“ and completely bust the myth that compliance has to be a gargantuan effort, and if you can’t do that then it’s best alone.

With the right focus and a team which understands your business quickly, we are proof that you can get a lot of mileage out of just a few days of support. The prize is staying on the pace on the pace of compliance without a huge commitment in time or costs. We say: to the sprinters, the spoils!

‘Aspiring Unicorns’ Supporting High Growth Tech Firms

Aspiring Unicorns, designed and delivered by leading law firm Addleshaw Goddard, provides high-growth tech businesses with access to crucial insights for supporting their business growth strategy.

The Aspiring Unicorns series comprises seven critical lessons for high-growth technology firms, sharing insight on key topics such as data and disputes to IP and investments. Delivered over the next coming months, the first instalment covers dispute revolution, providing businesses with useful steps on how to best avoid a dispute.

The Aspiring Unicorns series follows the recent announcement of the fifth cohort of UK tech companies to join the firm’s AG Elevate programme, a fast-track legal mentoring scheme for growing technology businesses. Across the UK, eleven companies were selected and will receive support and mentoring from specialist lawyers at Addleshaw Goddard.

David Anderson, a Corporate and Commercial Partner at Addleshaw Goddard who specialises in tech, said: “Following the success of our AG Elevate programme, and the continued growth across the UK tech industry, it felt like the perfect opportunity to launch the Aspiring Unicorns initiative.

“This series of content, revealed in instalments over the next few months, will provide accessible and crucial insight to high-growth tech businesses looking to scale up and strengthen their position within the market.

 Elvan Hussein, a Corporate Partner at Addleshaw Goddard, said “We’re encouraging high-growth tech firms and investors with a strong tech portfolio, to take full advantage of this fantastic resource.”

As part of the initiative, Addleshaw Goddard will host a number of related webinar sessions where chapters from the series will be discussed.

For more information about the Aspiring Unicorns programme, visit:  https://www.addleshawgoddard.com/en/insights/insights-briefings/2021/general/guide-aspiring-unicorns-supporting-high-growth-tech/

Not boring! Creative! And inclusive!

What does the future of fintech look like’ is a question we’ve been asking across the FinTech Scotland cluster all week. One very wise comment asked us to consider the question differently What should the future of fintech look like’?

From all the discussion so far, there are two comments that have struck a chord with me. It will not be boring’ and We need to teach the future’.

The range of possibilities is limitless and there’s no doubt the consensus so far is that it can help us advance the digital economy in a number of ways, all the while enabling financial inclusion and helping us drive towards our net zero goals.

It will not be boring! 

Enabling this future is a skilled workforce drawn from a broad talent pool and range of experiences. We have work to do to support the development of those skills but continuing to develop fintech for the future will need a team of creative artists and designers working with software developers, regulatory and legal expertise, who have access to cybersecurity expertise, data specialists, linguists, psychologists and more.

It provides a true opportunity for collaboration, partnership and change, and it creates an environment for innovation and creativity that builds trust through customer centred design with robust privacy and security.

The innovation will take us in different directions. We see new examples of that everyday especially when it comes to things like digital and crypto currencies, or the future of payments two key topics in the recent FinTech Scotland podcasts. 

We need to teach the future! 

As we think about the role of digital technology and FinTech for the future a broadly unanimous view is that our children are one step ahead and are already embracing it. Fictional digital currencies like Minecoins, Simoleons, Life Points, and others are well understood by the next generation.

As FinTech for the future develops, many of those contributing views want to see how it can deepen future generations understanding of financial services to build future personal financial resilience. Many more are hoping that we embrace the opportunity to encourage more girls, women, Black, Asian, Ethnic and other minorities into the industry.

The opportunity to excite and intrigue more of the next generation about fintech and technology is already here and the stories we tell now will help us build and teach our future.

Zumo, Leutheria, Nude, Sonik Pocket, Sustainably, Qpal, Guiide, Airfunders and Visible Capital are just a few of the Fintechs in the FinTech Scotland community that are shaping future stories to inspire us all.

If you have a view on What the future of FinTech should like like’ please get in touch. I’d love to hear it.

A new era of Competitive R&D tax credits?

The Government has long recognised that a competitive R&D tax credit scheme’ is an important driver of its objective for the UK to become a global leader in science and innovation. We know that many Fintech Businesses rely on R&D credits as a valuable funding mechanism for innovation so it is imperative that Fintech Businesses take note and engage with the recently launched government consultation which could bring the biggest reform of R&D credits since the SME scheme was introduced over 2 decades ago.  This is especially important in Scotland where the number of Fintech companies has grown from 26 (2018) to upwards of 155 in 2021. 

This is a once in a lifetime opportunity to bring the R&D regime up to date and ensure it is well targeted and globally competitive.  With over £200m in R&D tax credits claimed by businesses in Scotland, it is important that businesses engage with the consultation and share their insight on how the R&D regimes can be improved to help them invest in innovation.

The consultation is wide-ranging and it is clear that whilst there is no doubt that the government is fully committed to increasing UK R&D spending, in a backdrop of record government borrowing, the R&D regimes must provide value for money and be highly effective at encouraging investment in innovation. The focus of the consultation can be segmented into the following key areas where we’ve shared our initial thoughts on the relevance to Fintech businesses:

• Structure of the R&D regime – particularly whether the SME and large company R&D Expenditure Credit (RDEC) schemes be combined? 

Currently, there are two R&D regimes – the SME regime which offers high cash incentives (up to 33% of spend) and the RDEC regime (10% cash benefit) for those businesses which do not qualify for SME credits. The consultation suggests abolishing the SME scheme and a move to “RDEC for all with the key benefit of the RDEC regime over the SME credit being the ability to account for the credit above the line’ (i.e. improve profits). However, it is likely different rates would still be needed for different-sized businesses. 

Given the government’s commitment to encouraging investment in key high-tech industries, could this consultation also provide an opportunity to implement varying credit rates depending on the sector and activity being undertaken? Clearly, high-tech industries such as Fintech play a fundamental role in Scotland and could benefit from a regime that offers greater incentives for high tech innovation.

• Ensuring the UK R&D credit system is internationally competitive

The government has repeatedly stated its commitment to ensuring the UK is seen as a global leader in Research and Development, with the aim of increasing R&D expenditure to 2.4% of GDP by 2027. The latest consultation clearly demonstrates that the government sees the UK tax credit regime as part of its strategy to help encourage investment in UK innovation and as part of that, understands the importance of the UK R&D tax credit regime being globally competitive when businesses look to locate R&D functions. Scotland is becoming increasingly known for being one of the UK leading Fintech hubs and is routinely considered as a key location for R&D centres. For Scotland to continue to benefit from the positive cascade effect offered by such inbound investment, in an increasingly competitive world, it is important that the UK’s R&D regimes remain globally competitive.

• Review of R&D definition and Scope of eligible costs

The definition of R&D and eligible costs are the cornerstones of the R&D regime and compelling responses on these key areas have the potential to lead to fundamental changes in the R&D regime. This includes potential inclusion of Cloud Computing costs such as SaaS, IaaS, and PaaS as eligible expenditure, in addition to on-prem license costs used for R&D. Currently, the UK R&D regime is one of the most generous regimes in terms of allowing overseas expenditure to qualify under the externally provided worker rules. There has long been a debate about whether the inclusion of such costs really contributes to encouraging investment in UK R&D. However, the eligibility of such costs does mean the UK and Scotland is attractive for global businesses looking for an R&D Hub with its unique ecosystem of academia, technology, science and innovation infrastructure.

• The operational effectiveness of the regimes

Improving the administration of R&D credits including whether it should be part of the tax return filing and the role of agents in assisting R&D claimants is a key part of the consultation. With the significant increase in R&D claims over the last 5 years, it’s not surprising that the administration and review of claims have become a challenge for HMRC. And there are growing concerns within the Government that R&D tax reliefs are open to error and potential abuse. Whilst the more straightforward nature of the documentation requirements and lack of preapproval requirements’ makes the UK regime more vulnerable to abuse, there is a recognition that this approach makes it more attractive when compared to other global R&D regimes with extensive preapproval requirements. So any changes to the administration of the regime needs to be carefully balanced to ensure effective compliance alongside minimising the burden and uncertainty for claimants.

Likelihood of substantial changes to the regime?

The R&D regime is seen as one of the central pillars to the government’s commitment to encourage an increase in R&D spending. Therefore, whilst its existence is likely to remain, this consultation indicates significant changes are on the horizon. It is important that those claimants who rely on the valuable funding provided by the regimes engage with the consultation process. 

Survey

We want to make the most of this opportunity to help to shape the design to be internationally competitive and well targeted for the long term.

We are collating your views on the current R&D regime and potential changes to make it more effective as an incentive for businesses to invest in R&D in the UK.

To share your thoughts via our survey, please email me at neil.muir@pwc.com.