Fintech companies increasingly depend on processors, gateways, cloud platforms, and other outside providers to power their payment ecosystems. But outsourcing technology does not mean outsourcing responsibility.
Few fintech companies build every component of their payment infrastructure themselves. A growing platform may rely on a processor to move transactions, a gateway to connect systems, a cloud provider to host technology, and additional vendors for security, fraud prevention, and other specialized functions. These relationships allow businesses to scale quickly, but they also create an increasingly complex web of dependencies.
When multiple organizations participate in the same payment environment, responsibility for security and compliance can become fragmented. One provider may manage infrastructure, another may control a particular security function, and the fintech itself may retain responsibilities that are easy to overlook because an outside company performs much of the underlying work. The resulting challenge is not simply vendor management. It is understanding where responsibility begins and ends across an interconnected payment ecosystem.
“The assumption we want companies to get away from is that outsourcing a function means outsourcing accountability for it,” says Wes Shattler, a former Vice President at FIS who recently joined Payments Therapist as Senior Partner, PCI Services. “You need to understand exactly what your providers are responsible for, what remains your responsibility, and where those responsibilities are shared.”
Outsourcing Creates a Shared-Responsibility Problem
The issue is particularly significant for organizations subject to the Payment Card Industry Data Security Standard. PCI DSS recognizes that companies frequently rely on third-party service providers, but using those providers does not automatically remove the customer’s compliance responsibilities.
Organizations must maintain oversight of relevant third-party service-provider relationships and understand how applicable responsibilities are divided among the parties. A provider may be PCI DSS compliant for specific services without assuming responsibility for every requirement affecting its customer. Another vendor may perform a function capable of influencing the security of the cardholder data environment even though it does not directly store, process, or transmit payment account data.
For fintech executives, that means the important question is not simply whether a vendor is compliant. It is what the vendor’s compliance actually covers and what responsibilities remain with the company.
A cloud provider, for example, may maintain controls protecting its underlying infrastructure while the customer remains responsible for applications, access configurations, or other components operating within that environment. A payment provider may secure the portion of a transaction it processes while other elements remain the customer’s responsibility.
“That is where companies can get into trouble,” Shattler says. “Both sides may be doing exactly what they believe they are responsible for, but if nobody has mapped those responsibilities clearly, there can still be a gap between them.”
Fintech Growth Magnifies the Challenge
For an early-stage fintech company, the payment environment may initially be relatively straightforward. Growth changes that. New products introduce additional payment flows, geographic expansion can require new partners, technology teams add integrations, and individual vendors may themselves depend on other providers.
The infrastructure evolves incrementally, but the cumulative result can be significantly more complex than the environment the company originally designed. That makes third-party oversight an ongoing governance issue.
“When companies grow quickly, they naturally focus on building the product, serving customers, and getting the infrastructure in place to support that growth,” says Jason Kafer, Founder and CEO of Payments Therapist. “What can be harder is maintaining a complete picture of how all those relationships fit together and who owns each responsibility as the environment changes.”
Payments Therapist is a payments consultancy founded by Kafer. The company says it works with fintechs, independent software vendors, payment facilitators, and other organizations on payment infrastructure, technology, financial operations, compliance, fraud, and risk.
Its approach reflects a recurring challenge within the industry: a problem originating with one component of a payment environment can create consequences elsewhere in the business.
From Vendor Management to Dependency Management
Traditional vendor management often focuses on selecting providers, negotiating agreements, and periodically reviewing performance. Managing individual vendors is only part of the challenge. Modern payment environments also require visibility into the dependencies created across those relationships.
Businesses need to understand what services their providers perform, whether those services can affect the cardholder data environment, which compliance responsibilities providers have accepted, and which remain with the customer.
PCI DSS Requirement 12.8 addresses several elements of managing applicable third-party service-provider relationships, including written agreements, due diligence, monitoring providers’ PCI DSS compliance status at least annually, and maintaining information about how responsibilities are divided.
The framework illustrates why third-party risk cannot be delegated entirely to procurement or information technology. Legal teams may negotiate agreements, technology teams understand integrations, compliance professionals evaluate requirements, and operations personnel may manage the day-to-day relationship. Someone still needs visibility across all of them.
Payments Therapist says it has expanded its PCI capabilities to support that coordination. The firm recently added Shattler to its team and introduced PCI Governance as a Service, which it describes as an ongoing model intended to help organizations coordinate control ownership, third-party responsibilities, documentation, remediation, and other compliance activities as their businesses evolve.
“Governance gives you a mechanism for answering these questions before they become assessment problems,” Shattler says. “You want changes evaluated as they happen, responsibilities assigned clearly, and documentation maintained while people still understand why the decisions were made.”
What Executives Need to Know
For CEOs and COOs, effective third-party governance does not require becoming PCI specialists. It does require confidence that someone within the organization has a complete view of the payment environment.
Leadership should be able to determine which providers can affect payment security, how responsibilities are allocated, whether required evidence remains current, and who internally owns unresolved issues. Those questions become particularly important during rapid expansion, when a fintech company can add technology and vendors faster than it develops mature governance processes.
The risk is not necessarily that a provider has failed. It may simply be that everyone assumed another party was responsible.
The growth of fintech has been enabled in part by specialization. Companies no longer need to build every component of the financial infrastructure required to bring a product to market, allowing them to access sophisticated capabilities through specialized partners. The tradeoff is an environment in which responsibility is increasingly distributed across organizations.
For businesses operating within that ecosystem, the objective is not to eliminate third-party dependencies. It is to understand them.
“The goal is not to bring everything in-house,” Shattler says. “The goal is to make sure that when something is outsourced, everyone knows exactly what that means, who owns what, and how the organization maintains oversight.”
As payment environments become more interconnected, that clarity is becoming an essential component of effective governance.
