Webinar: Accelerating FinTech in GRC
Experts from BARR Advisory and AWS joined Drata’s Chief Information Security Officer, Matt Hillary, to share insights on what makes FinTech GRC programs successful.
FinTech organizations face increasing pressure to build trust, ensure operational resilience, and manage risk with speed and precision. Governance, Risk, and Compliance (GRC) programs aren’t just a checkbox exercise—they’re the key to building trust, driving innovation, and enabling sustainable growth.
In our recent webinar, experts from BARR Advisory and AWS joined Drata’s Chief Information Security Officer, Matt Hillary, to share insights on what makes FinTech GRC programs successful, how to respond to rising expectations from customers and auditors, and why automation and cross-functional alignment are essential for long-term scalability.
GRC Has Become a Growth Enabler in FinTech
Historically, GRC programs were built reactively as companies matured. But for FinTech, that script has flipped.
“GRC used to follow growth. Now, it enables it.”
– Brad Thies, BARR Advisory
Brad emphasized that trust is now the currency of growth—especially when working with enterprise customers, banks, or regulators. Mature GRC programs signal operational readiness and risk awareness, and they’re increasingly a prerequisite for market access, investment, and partnership.
Regulatory Pressure is Mounting—and Globalizing
The panelists highlighted recent shifts like the SEC’s new cybersecurity disclosure rules, the EU’s DORA framework, and evolving expectations from regulators like the CFPB. FinTech companies must now demonstrate real-time oversight across a multi-regulatory landscape. As Sundeep Kamath from AWS pointed out, cloud infrastructure providers can help, but FinTech organizations are expected to own their compliance posture across the stack—especially when supporting customers with sophisticated risk programs.
FinTech GRC Comes With Unique Complexity
Unlike SaaS startups that typically map to a handful of frameworks, FinTech companies juggle overlapping requirements from frameworks like FFIEC, SOC 2, PCI DSS, and SOX, often layered on top of individual customer or partner expectations. This creates what Matt described as a “revolving door” of assessors and auditors—all expecting nuanced, evidence-backed answers.
Automation and Continuous Monitoring are the Cure for Audit Fatigue
Both panelists underscored the power of automation in reducing audit fatigue. Whether it’s embedding control testing into CI/CD pipelines or leveraging tools for real-time evidence collection, smart FinTech organizations are shifting from quarterly scrambles to operationalized, always-on compliance.
As Sundeep said, “Do once, use many.”
When Things Go Wrong, Curiosity Beats Defensiveness
Audits don’t always go smoothly—but how teams respond can make a big difference. Both Sundeep and Brad stressed the importance of root cause analysis (RCA), open collaboration with auditors, and treating setbacks as opportunities for growth rather than threats to reputation.
Defining a Mature GRC Program
So what does maturity actually look like in GRC for FinTech? According to Sundeep and Brad, it’s a combination of the following:
Fewer fire drills and fewer repeat findings
Strong cross-functional ownership and governance
Proactive risk and control mapping to business priorities
GRC metrics appearing on the same dashboards as growth and revenue KPIs
How to Take Action This Quarter
Whether you’re just starting to build your GRC function or scaling an existing program, our experts recommended the following next steps:
Evaluate your current state: Identify gaps and set short-term roadmaps.
Treat GRC like a product: Build a backlog, assign ownership, and track progress.
Align GRC with business goals: Frame compliance in terms of trust, uptime, and revenue.
The FinTech space moves fast—but that doesn’t mean GRC has to be reactive. With the right strategy, tooling, and mindset, compliance can become a competitive advantage and a key pillar of long-term success. As Matt shared in closing, Drata is here to support that journey—from risk and compliance automation to trust management.
Watch the full webinar on demand here.
