How a fintech turns risks into numbers: Seven to start with

A fintech dashboard so often is such a happy place. Signups, volumes, conversion, approval speed, cost per acquisition — everything a growth company and its investors want to see. Now ask a different kind of question. How many of this week's transaction-monitoring alerts are still unresolved? What share of today's onboarding attempts came from high-risk jurisdictions? How long has the manual-review queue been growing? Those numbers exist. They live in the same systems that feed the dashboard. Too often, they never reach the screen the board looks at.

Risk managers call them key risk indicators, KRIs: the small set of numbers that show where risk is building before it becomes an incident. Growth metrics describe what the company earned. Risk indicators warn what it is quietly accumulating. A board that sees only the first kind is driving by the rear-view mirror.

Every board has also met the officer who works without these numbers. Everything is dangerous: the new segment, the corridor, the product launch. The classic version is a whole region declared untouchable — these clients are risky, let us not take them. There is a quiet economics behind that no. For the officer, a no is free: nothing to build, nothing to monitor, nothing to own. A yes means designing thresholds, watching the flows and responsibility for the result. So no gets said, the board stops listening, and risk advice earns the reputation of the colleague who bans the fireplace because houses burn.

What the officer can do is put the risk in the language the board already reads: here is the share of onboarding attempts from that region, here is the threshold, here is what monitoring costs. The conversation shifts from "I do not want these clients" to "we can take them, and this is what taking them safely requires" — and the board gets to make an informed decision instead of overruling an adjective.

No universal list

Nobody can hand you the right KRIs, and there is a structural reason: the decisive indicators are specific to your product, your clients and your corridors. A card issuer, a crypto platform and a BNPL lender share a few generic metrics — fraud losses, complaints, uptime — but the indicators that actually warn them differ materially. Choosing your own is the real work, and in my experience it is work most scaling companies have not done, because reporting routines rarely keep up with a fast-changing risk profile. Supervisory expectations keep pushing in one direction here, from governance guidelines to DORA-style resilience rules: performance indicators are not supposed to float free of the risk picture behind them.

Here is what the choice looks like in practice, in two examples.

Take one threat: applicants connected to high-risk jurisdictions — as defined by your own country-risk methodology — keep probing your onboarding. The indicator is the share of such attempts among all requests, measured weekly from your own funnel. A threshold joins it, set by your business model and legal perimeter, above which escalation starts. The indicator tracks attempts, which you want to see early and in full. Tolerance for confirmed sanctioned exposure is zero — that number has no threshold.

Now the uncomfortable one, a composite example. Imagine a transaction-monitoring setup where 39% of alerts sit in an unresolved backlog. Volumes doubled over the year; the review team did not. The products work, payments flow, the growth dashboard is green. Companies can live near numbers like this for a long time — until an audit, a banking partner's review or a supervisor finds it first. Put that number on the board's screen and it triggers a decision while it is still a staffing problem: someone asks why it grew from 20 to 39, and the answer costs a hiring plan. Keep it below board level and the same number comes back later in a remediation letter.

Keep the register honest, keep the set small

To make indicators like these work, two disciplines matter — the same ones I run in practice at Blackcat and teach at LRMA sessions. The first is a register with no unexplained omissions. Lean teams love deleting "irrelevant" threats: a crypto platform with no lending book sees little classic credit risk, so why list it? Because a register with missing threats is the one reviewers distrust — when they ask why your catalogue is so short, there is no good answer. The working practice is to keep the threat and score it honestly: in the methodology I use, anything occurring in under 2% of cases scores minimal on likelihood, while impact is always assessed separately — a rare event can still be a severe one. The threat stays visible, justified, and ready to be re-scored the day your product mix changes.

The second discipline is rotation. Keep the indicator set small and yours: a board that receives 40 metrics reads none of them. When a threat is beaten — the suspicious-attempts share has sat near zero for a year — move its indicator out of the board pack while operational monitoring continues, so board attention follows the risk that is growing now, not the one already solved.

Seven numbers to start with

This is not a universal list; it is a starter set of board-level signals, to be adapted to your model:

• unresolved transaction-monitoring and AML alerts, aged over 7, 14 and 30 days
• share of onboarding attempts from high-risk jurisdictions, with your escalation threshold
• potential sanctions matches, confirmed matches, and the false-positive rate behind them
• fraud losses as a share of transaction volume, by product
• chargeback and dispute rates, trended
• platform downtime minutes and the failed-transaction rate, monthly
• concentration: the share of flows passing through your single largest banking partner, processor or corridor

Each line needs three things attached: the trend, the threshold at which management must escalate, and a named owner. A number without an owner is scenery. And the set deserves one framing sentence the first time it reaches the boardroom: these indicators are not meant to slow growth down. They show which growth is safe — a company that can see its own backlog can scale with far fewer blind spots than one that cannot.

Why did banks get this discipline first? Decades of regulation forced the habit on them. A fintech board sees growth numbers because that is what the company was built to produce; risk visibility has to be installed deliberately, in the fintechs I hear about it usually happens right after the first uncomfortable audit. Companies that install it earlier tend to buy themselves fewer surprises: calmer banking partner reviews, shorter audits, easier licence conversations.

And for the optimists planning to insure their way past all of this — one last number to weigh. A payment company can, in theory, insure against its own platform going down. The insurer may even pay. The customers will still leave, because insurance returns money and does not return business.

About Blackcat
Blackcat is a European fintech platform that combines everyday financial services — EUR IBAN accounts, SEPA transfers, cards, free internal account-to-account money transfers, cashback and bonuses — in a single multi-wallet application.

Fiat services are powered by Papaya Ltd, an Electronic Money Institution authorised and regulated by the Malta Financial Services Authority and a direct SEPA participant. Registration number C55146. Client funds are safeguarded in accordance with applicable legislation. Funds held in e-money accounts are not covered by the Depositor Compensation Scheme. You can get more information about terms and conditions on the website blackcat.app. The bonus payment is a part of the loyalty program provided by Baltic Technology Solutions OU. Detailed terms and conditions can be found here.