Rory Holland
Justin Fischer, RiskScout.
Justin Fischer
How's it going, man?
Rory Holland
I was going to say welcome to Austin, but you're in Austin.
Justin Fischer
I'm kind of a native.
Rory Holland
Welcome to the Fintech House today.
Justin Fischer
Yeah, it's awesome.
Rory Holland
How's it going so far?
Justin Fischer
Good. I mean, awesome weather in Austin. Great conversations. It's good. What about you?
Rory Holland
Same, man. Fintech House has been impressive this year. There's just so much good stuff going on. I'm having a blast and meeting good people, and the folks who are watching us and listening to us now can't hear all the chaos here, but there are so many good people having great conversations. So, tell us about RiskScout.
Justin Fischer
I've been building bank software for 23 years now, mostly here in Austin, but for most of the U.S. market and a little bit international. And in 2019 or so, we identified a need for essentially financial crime software, right? A lot of people don't know that in 2019, the financial crime market in the U.S. was about 28 billion, OK? That's a reasonably sized market, just since the end of the pandemic. So in 2022, 60 billion.
Rory Holland
Whoa.
Justin Fischer
Massive jump, right? And a lot of that is fraud, sophistication, regulatory burden. So if you think about not JP Morgan, you know, big banks, we're talking about community banks and credit unions that are the 9,000 that are out there in the U.S., what do they do? Very similar to the cybersecurity problem. They've got to prevent money laundering. Right? They've got to do KYCKYB. They've got to understand their customer. They have to be able to ensure that elder abuse and things like this in the community aren't happening. But the sophistication level is very high from these criminals now and the regulatory burden is very high. So what do you do? Well, what we as technologists do is you turn to some kind of product or technology that can help you. But, unfortunately for financial institutions, it's not a very sexy space. We're actually here in the middle of fintech. And fintech is great, but who's building solutions for banks and credit unions, something they can run internally? You know, they're not API-driven, unfortunately. We would love to get data and transit everything with APIs, but they don't do that typically. And it's not their fault the data is not democratized, right? And so we set out from all of our experience, we have regulators from the OCC, from the Fed, we are BSA officers, Bank Secrecy Act officers, and we said, what would we do better? How would we make this an automated platform for financial institutions to essentially like a cyber security scanner like an antivirus but for financial crime for money laundering for these types of things so that you can go make that loan to that guy because you know he's doing legitimate business, even though sometimes his pattern is a little atypical, right?
Rory Holland
That's goto to be a very complex solution that you've built that's ever evolving because fraud is evolving, threats are evolving. Is that right?
Justin Fischer
It is, and you know, we like many companies leverage machine learning, right? But, you know, the interesting thing about machine learning, you're in the advertising marketing space, you're CMO, right? You probably realize there's a lot more sort of pomp and circumstance than there is real solutions, and we saw this with AI for a long time. And still, there's a push and pull with AI, right? In the machine learning world, what's often forgotten is I say, hey, I've got this new black box that's going to decide all these things for you. And you're going to go from knowing your community and getting maybe 10 to 12 alerts that you've got to go research. Now, in terms of an alert that's saying, hey, there may be something wrong here–you've got to go research it, you've got to go file with the government if it's something that's illegitimate, right? Now, every day you're getting a thousand. Right? It's a black box. So here's the issue, you're one person. Many times the BSA officer in most of these organizations is in their 60s, pretty close to retirement. They do most of the things with Excel. Now they're getting a thousand alerts, so what do they do? They can't keep up with it. And unlike some industries where you can kind of just package that up and say, well, I'm just going to go for the cream of the crop, the things that are most concerning. In the FFIC's eyes, the regulators eyes, you've got to look at everything because you might've just missed something. And so it becomes a real problem. So much so that a recent FDIC regulator got on stage and said, I don't want to see any more black boxes. Show me the glass box. Show me how you're coming to these decisions. Show me what you're doing. And it kind of comes back to human decision. Not advocating that. It's saying that generally you can ask a machine to dig a hole, but you need to know where that hole is going to be dug, what dirt you're moving, are there rocks? And so that's what we're missing a lot in the space, and so we look at this industry, very similar to my time in the rest of enterprise banking, as a place to to optimize, to be able to deliver software in one or two days after they sign a contract and turn that stuff on right away and then start working through progressive identification of illicit things.
Rory Holland
And how have the banks received this, I know how long sales cycles can be, banks can only move as fast as they can move, given certain reasons why that is. How has that been as far as the adoption for RiskScout? Are there some examples of where you've seen it really work well?
Justin Fischer
Yeah, in my previous life, I was an early guy at Q2 software. We were a huge IPO here in Austin. I did work with, I don't know, gosh, 4,000, 5,000 institutions, lots and lots of work. The biggest issues we had were, first and foremost, people were scared of the data center, right? Scared of moving their data to the cloud. They were scared to let other providers do that. And then what I think is the biggest challenge for financial institutions in the U.S. is that their data is walled off by big core companies, right? That's the Jack Henrys, the Fiservs, the FISs, and these guys built a business off of managing that data. So they're starting to open APIs, start to open up that information, but generally when you talk about if you want to come in and install a system that analyzes demographics, we've got to get that data from somewhere, right? And that's usually been the long tent pole. I will say in terms of institutions being interested in cloud technology, there's a lot more these days. There's a lot more interest in saying, oh, well, I can just turn this on. There's comfort with that. Probably, ironically, mostly thanks to Microsoft 365. Because a lot of them have migrated there and realized, oh, I can get my email in the cloud. So I think from our perspective, it's wildly different in the sense in my last enterprise life, it would take six to 12 months to sell a bank something. It takes six to 12 months to implement it. In our world, we actually have a product called Launch, which we understand we're the new guy on the block. So if you don't trust us, you don't have to… try it. We'll show you firsthand. So it's a reduced cost. I don't like to use the word trial because there's no expiration to it. Just start it, use it. If you really like it, then add more businesses to the platform. And so that's been wildly successful. Had an institution who was about a few weeks from their big exam, right? And they were able to jump on the system on the second day and they started to do their process, collect their information, run what's called an enhanced due diligence review, and do it right away. No big data migrations. Now, if you want to bring data over, the secret sauce for us is that we have direct communication with a lot of the cores and a lot of the data. And there's now middleware coming out. So we're starting to see more sort of data democracy if you will, right? Where we can get access to that and be able to support an institution. Because if you leave it up to them, unfortunately, I mean, gosh, half of my institutions have a consultant IT person that they have to call who's in another town. So, you know, and that's not just the little bitty banks, the big banks sometimes don't have that in-house.
Rory Holland
Yeah. What are some of the biggest challenges when you think about what you're trying to do with RiskScout now? And whether that's implementation or adoption, or I assume folks are listening to you, but maybe not. What does that sales process look like? What are some of the biggest challenges you guys have?
Justin Fischer
I think the biggest challenge for us, and I don't blame financial institutions, I blame anybody with a new vendor, is they've been overpromised and underdelivered so much. So it's like, OK, here's another company, says they do anti money laundering, but the reality is most of those institutions are in fintech. And that's fine. There's nothing wrong with being a fintech-specific AML solution, but you generally don't have the full suite. When I talk about the full suite, Rory, it's customer communication tools, it's KYCKYB. It is transaction monitoring, risk scoring, regulatory filing. That's a suite of tools that a financial institution has to have. If you're Lincoln Savings Bank, Cross River, Chase, yeah, you've got a team of developers. You go call those APIs when you want, right? But if you're every other institution, you know, if it's an API-based solution that you've got to glue together the pieces, it's probably not happening. So I think the biggest first step is just saying, hey, we are just like you. We come from the community, we are bankers and technologists and BSA officers and regulators. You know, in the regulatory world, there's a lot of subjectivity. You know, there's a reg, but they don't tell you exactly how to execute it.
Rory Holland
Sure.
Justin Fischer
Right? And so just walking into an institution, we get a lot of success just saying, there's a concept called CTRs, it's cash transaction reports. You've probably seen this in the movies: $10,000 or more. You ever watch Ozarks? It's actually a really true kind of money laundering pattern set. They did their research. You know, there's a CTR process. Sometimes, we walk in and a bank's filing 100 CTRs in a week, and they're tiny. That's not likely to be effective and they're probably not doing it right. So the first thing we do is we come in, and we could put software to solve something like that. The first thing we do is have a conversation about risk levels and mitigation. Probably similar to your business as a consultant in advertising, what are you trying to achieve? Like where are you trying to go before I try to throw technology at you or put you on SEO tell me tell me what you're trying to do, right? And that's a big part of our success is that we are kind of a blanket around the institution to help them understand where their risk is. They want to go into a new market, they want to just solve the current market and then how to do that. Take that and then automate that.
Rory Holland
OK, so are you guys doing custom work at all? Or is it more modifying the software to reflect the needs of that particular institution? So there's variances.
Justin Fischer
It's the latter. I built a lot of custom software in my time, so we built configurable software. So if you're familiar with no code, we've built a lot of no code workflows that allows us to build workflows from a sort of support person perspective instead of a developer. So recently I had an institution, they looked at everything and they said, hey, this is great, but I have a really big problem with loans. And I said, OK, tell me about your loan problem. In Florida, I have a bunch of aircraft loans, and I get DEA subpoenas.
Rory Holland
Yup.
Justin Fischer
OK, that's an interesting use case, right? Didn't have to describe why he gets DA subpoenas. That's pretty obvious if you got an aircraft portfolio in Florida, right? But he needed to go verify the UBOs, the people who own these aircraft loans on a consistent basis. But there was no tool for him to do that. So we just took an existing workflow we had and we said, oh, let's just change it. Let's duplicate it, recreate it, takes an hour and we handed it to him and said, does this solve it? And it's wild because you could say, well, you could do something like that maybe with Google Forms or a cloud builder or SharePoint or something like that. Yeah, maybe. But there's a lack of being able to conceptualize that and deliver that. And then when you actually do have someone who is doing something they're not supposed to in that aircraft loan perspective, how do you file that? How do you take that information and quickly push a button and file that into what's called a suspicious activity report? You can't. You have to do all that manually. And so again, we go in and we're replacing spreadsheets and Word documents and all this process and I just can't say enough, Rory, like, there's so many CEOs that I talk to at events like this and they're like, oh, we're fine. We passed the last few exams. And then I talked to them six months later and their BSA officer of 30 years has retired and they're in Grand Rapids and they can't find another BSA officer. And they're trying to train someone, and it's very difficult. And so that can really put you behind. And then not to mention, what if you're here and you're wanting to work with, you know, one of the great lending companies or another fintech and that has a bunch of risk with it. Are you ready for it? Is a foundation in your house for compliance ready for building a whole other wing? Yeah. Well, let's take a look at what it looks like.
Rory Holland
So you help not only identify those issues, but foundationally from a compliance standpoint, you're protecting it so to speak and then putting those banks in a position to be able to do more expanding if they want to add on products and services or take on additional risk whatever it may be.
Justin Fischer
Yeah exactly, so we have a bank that came to us, I mean it's very common use case, they come to us CEO says I want to be a banking as a service sponsor so I want to sponsor this guy who's doing, you know, a chime kind of thing, right? OK, great, but their BSA officer, again, you know, long time history, overwhelmed, is like, I don't know how to say yes to that, right? I actually did a whole presentation at a last conference about saying we can't if as a BSA officer, we can do this if you help me automate. And so they almost always go to staff. Well, I need five more people then if you're going to try to do that. And then the cost, the economics don't work for the bank, right? And sometimes, and I won't mention the names, but you go look at the regulatory orders, the bank goes through with it anyways. And they kind of assume that the fintech will do the compliance. But if you're an institution and you're lending your accounts for banking services, it's your responsibility. And so a lot of times we'll look at that and go, well, here's a lot of manual work she's doing. We can take that away. And then here's what you need to do for the new project. And then here's how we can mitigate that. Here's how we can mitigate the risk and automate the work. And then they're like, wow, it's great. It works.
Rory Holland
Are there any types of banks, particular sizes, criteria that you like to work with, whether it's assets under management or anything else? Is it kind of community banks all the way up to regional banks?
Justin Fischer
Yes, you know it's funny a lot of my career was under a mentor, Hank Seal, he was the founder of Q2, founder of QUP, and he taught me very similar background. His family were cattle ranchers and he went to his dad and said how can I improve the ranch, the family business? He said go work at a bank because at our size we need capital and it was very similar to my family who are farmers. And the community bank is who we relied on to get new equipment and to do that. And so we have an affinity for community banks and credit unions. That's most of our institutions. I wouldn't say there's a hard and fast ceiling on that, but when an institution, probably over 10 billion says, hey, we want to work with RiskScout, they almost always want to cut everything up and pull APIs in different directions. And that's fine. If our system is going to solve that problem, I'm the first one to say, let's do it. If it's going to take us a different direction than having good RegTech software we can deliver to all the other institutions, then we will actually turn it down. It's something you don't see a lot in a startup land is actually turn down a customer because it's not right for us at that point. Our focus, you know, most banks and credit unions are under five billion, right. Nine thousand of them. Right. And so our focus is to deliver solutions to them in a cloud based way, quickly and easy. And not expensive, it's very affordable.
Rory Holland
Yeah. When you think about RiskScout and what I've learned about you today and reading about you guys, what things would you wish more people knew or is there one or two things that you wish more people knew about RiskScout that they might not?
Justin Fischer
Yeah, you know, look, I think the biggest thing for us is community. Like we believe, I was part of helping build some of the communities early on in Q2 and you know, those communities turned out to be the place where someone who is in a small town and has a question could get an answer without having to hire a consultant or just go without an answer and face a regulator. And so what we're really big on is community. My institutions know this. Actually, I'd love to tell you this. Over two dozen, they're all referenceable, 100%. Some of them are fanatically referenceable, but you can talk to any one of them you want. I don't have to just pet customers I send you. You can talk to them all. I think the biggest thing is community. Some of our institutions are in the cannabis world. It's a wild world. And they work with each other across even in the same states where they're, you mentioned this earlier about cooperation and collaboration versus competition, they do compete, but they see it as a bigger opportunity to serve the space, and it's a gray area in those worlds. And so we just want people to understand if you're a CEO of a West Texas bank, like my buddy out in West Texas, yeah, you're killing it in oil money, right and iIn lending, but your BSA is in trouble. You can lean on Risk Scout, right? We will be a tool for you. We'll be a community to help your junior BSA person come up to speed and automate these things so that you can grow. One of the things that was interesting in your previous interview, we sometimes use a TSA analogy, or a Clear analogy in our conversation, because I find that when I present to CEOs at institutions and board members, they very rarely know their own compliance process. So I describe it like the TSA. Do you want to walk into Austin Bergstrom and have 100 people in front of you? No shoes, wandering around with their bags, trying to figure out what's going on? Or do you want to work in an automated way, would actually Clear in TSA is more compliance done in a better way. And that's the way to think about RiskScout in the back of your bank. And so you probably know the old adage that slow is smooth, smooth is fast. That's what you should be thinking about with your reg tech and your financial crime is it's not just a back office spend. If you get this right, one of our institutions, 300 million in assets, added 40 million in one year using our tools. So you can go grow. And so when you bring that in, if you bring the BSA officer and you say, hey, how about growing? They pull their hair out. They're like, well, I can't get another person yet alone 10 more people. So I don't want to grow, right? And then you have the CEO say, well, I want to go do this as a new initiative, but so and so, you know, thinks were in risk and you have this, these two wolves fighting. Right. But what if you could, you could smooth that out, right. And make that fast and automated and reliable. If they leave, you have a business continuity practice. You're not worried about all that knowledge going out the door, you actually have a system that if you had an exam the day after your BSA officer left, you'd feel confident that you could pass it because it's there and not automated.
Rory Holland
That's big. So you have, did you say 2,000? How many banks are working with you guys?
Justin Fischer
Two dozen.
Rory Holland
Two dozen, I'm sorry. So the two dozen banks, I'm sure, would sing praises. Where do you guys want to go from here? When you think about the next stage of RiskScout, where are you heading from here?
Justin Fischer
So last year, Alloy Labs became an investor. We actually got, we had three really interesting investors. Castle Creek, which is another bank network, very big bank network. Alloy Labs, awesome bank, progressive bank network. And then IBAT, which is Independent Bankers of Texas. They're 120 year old, largest banking association in the country. We're their first investment. Very, very rare.
Rory Holland
Congratulations.
Justin Fischer
Thank you. So, 200 financial institutions are invested in us, either through indirect LPs or directly on the gap table. So that's first of all, very different than any you know, large vendor they're working with in terms of influence and sort of being aligned. Right. We are right about to release this new flagship product. We opened it's like two months from now, this full BSA AML system. It's a, if you're familiar with the product called Verifin, very similar to Verifin. So 500 million AR company, you know, doing well. We are a modern version of that. Right. We're focused on banks. We're not focused on fintechs and other, you know, types of genres purely on these banks in this space. And here's the interesting thing, Rory. About three weeks ago, we opened a founder program. It's a group, a community where people can share their ideas. And what we realized with 60 bankers who signed up in three weeks is that they didn't have a voice. They felt like, you ever struggled, I don't know if you've ever built your own software, but have you ever struggled with something and you're like, man, if I could build software, I would fix this problem, right? Well, amplify that times 100, and that's what the BSA officers sitting there thinking, right? So, in a way that they fixed it they opened a spreadsheet and tried to deal with it, right? Now we're an outlet for them to go, hey, we have this modern platform. Some of this we can just knock out in minutes. Some of it will roll out in the next two weeks. What do you want? And it's just been pouring in. And so that's the really exciting thing is to see how RiskScout can kind of do what Q2 did, which is come into a market where early on the nonbank VCs would say, you can't compete against the really large companies, the multinational core companies and international banking companies. And then you say, well, yeah, those are like a 1984 cruise ship. You can put paint on the Lido deck, but it's not going anywhere different, right? And so our technology is modern, it's easily deployable, and it's literally aligned and directly feeding off of the institution's problems. And we've got backing from not only those associations I mentioned earlier, but United Bankers Bank's, biggest banking bank in the world, 900 banks in their network, right? So this is feeding us directly to solve these problems. Again, nothing wrong with fintech. And we looked at that space for a while just to serve the RegTech space. There's some great players already in there. But who's serving the banks and credit unions now besides the old lethargic cruise ships, right?
Rory Holland
Yeah, and they need help. They definitely need help. And it's a space that we look at too, whether it's through Alloy Labs and his consortium or like what you're talking about, trying to get face to face with these leaders of these banks to help them compete and win in such a challenging market and with this ever evolving society and the way people are using money, sharing money, investing money. I'm curious where you think the next three to five years are gonna go from your perspective.
Justin Fischer
For us or the market?
Rory Holland
The market. And how RiskScout plays in that.
Justin Fischer
Yeah, you know, I think what was interesting about last year and the bank turmoil, another way to summarize it, is that regulatory technology, financial crime, and sort of just doing good business is now very highlighted, right? So unfortunately, I think this year we're going to see a lot more catch up from the regulators and a lot more orders, consent orders, and C&Ds. So we'll see that more, probably a lot more around fintech. In terms of where we go after that, I think you'll start to see more consolidation of institutions overall. But I think one thing that people get really wrapped up in a lot, I'm a technologist, so I'll put myself in this group, is that things like checks disappear, cash disappears, right? And I just don't think that that's the case for decades, right? And financial institutions are still gonna be places like you and I are small business owners. These community banks are where we're gonna go get our next loan. It's not gonna be Chase, it's not gonna be Bank of America, right? It's gonna be these small institutions that know what an SBA loan looks like, right? And so I think what we're going to see is a survival of the fittest in smaller banks. But I think we're going to see better technology that allows their data to open up. And they'll be able to decide what they want to do with that. Now, I've talked to a lot of our institutions. Some of them don't want to sponsor a Chime-like solution, a fintech kind of bank solution. They might want to build their own. I know a really big bank that wants to go build a military type USAA like system, right? Well, they can do that only if they can, you know, unlock their technology and their data. Right? And so I think we'll see a lot more of that, but I think we're going through a retraction on fintech a little bit, you know, in the sense that people are learning OK, wait, hold on a second. We have to make sure compliance is correct. We have to make sure this is an economically viable business. And that fintech, who may have the best technology, they may be upside down on their cap table now, right? There's a lot of issues that are even outside of how good is their solution, right? And so I think we'll see that that retraction, we'll see some new technology, you'll see middlewares, we'll see some things that open up financial services, but also think we're going to see nontraditional banks all over the place, the Apples of the world, right? You know, so it's going to be fascinating. And then, you know, I think, like in your other interview, we're going to see more universal ID systems. I mean, the IRS is now using ID.me, which is a pretty big step to be able to use a third party to validate who you are. The SSM model is broken, right? I can't give it to you, but that's the only way I can identify myself. If I go look up criminal data, I don't know how much you know about this, but if I go look up criminal data on you right now, there's no reporting based on social. So how do I even know it's you, Rory, versus Rory in Washington, DC? I don't know. It's just a broken process, right? So I think we'll see a lot of new technologies move forward there, right?
Rory Holland
Yeah.
Justin Fischer
And for RiskScout, I mean, real simple bread and butter is working with financial institutions. So we do BSA AML, which is the first step. And then a lot of our institutions are asking us for loan compliance modules. They're asking us for wire and ACH fraud. They're asking us for banking as a service, which we do, and cannabis, and any of these ancillary sort of pieces where they can go get deposits for lower costs. They can go start new lending programs without incurring all the risk. A real good analogy is you want to go buy a house, like the one we're in … a 1920s house in Austin. I'm sure you're going to hire a heck of a foundation engineer, inspector, and check everything. And that's a good way to think about, OK, you know a RiskScout can come in and help you check that foundation, make sure we're all strong. And then go do what you want to do, Airbnb, you want to make a mcmansion Rory, go for it, man. We want to support that vision, but you need to have a strong foundation.
Rory Holland
Yeah, it's such interesting stuff you guys are up to. OK, one last question. Something's been on my mind, and you've probably heard me through our conversation. We've had conversations here in the house this weekend just about trust. And trust in our society, I sense, is kind of at an all time low. I feel like in my lifetime at least, it feels like whether that's in the systems that govern our country or in the world or just, or in the financial system with what happened this time last year. I'm glad we're not talking about a bank failure this year. But trust in the financial system is at a low. What can we do, and whether that's me and you sitting here talking or the industry itself, do to build trust with the market about what we're doing and restore faith?
Justin Fischer
That's such a good question. I think the technologist in me wants to come out with a technical solution. But you know the reality, what I've learned from community banks and credit unions, is that shaking a hand and meeting you and talking to you, I just went in Leander, Texas where I'm at, it's just north Austin, just went to community breakfast with the local bank there. And you stand there for a second and look around and the branch manager's flipping pancakes and the head of the police department's there. When you have that level of connectivity and that understanding of people who are in your community, that to me is trust. So I have institutions who sometimes see technology as a disintermediary. It's true. It's a disintermediary. It's necessary. It will create convenience. But, how can we take that level of trust that they have, that understanding of the person from across the table, and let's say synthesize that, but recreate that or create a place where maybe it's a quick video conversation. Maybe it's some, you know, more in depth understanding of who that person is without making it feel like Big Brother, without me going, oh, I already know your second child's middle name, right? You know, how can we do it with more of that handshake kind of understanding that we used to have? And there are ways, right? And if we don't discard community banks and credit unions for, you know, for being cavemen in terms of the process, being so far back in technology, and look at actually the relationships they build and the way they do those things. And then we leverage technology to do that better. I think that's the answer.
Rory Holland
I love that. Yeah, and I think we all want to see community banks and credit unions succeed. We need them, I think as a society for whether we're local business people like us that want to know our bankers or other individuals, maybe the younger market that actually does have a desire to know the person or ask a question from a physical human being in person versus counting on just all digital. I think that's one of the challenges we have and how we can use technology to facilitate relationship. And I think the way you answered it's great. It's been fun man.
Justin Fischer
Yeah, man.
Rory Holland
Thanks so much, Justin. Appreciate you joining us.
Justin Fischer
Yeah, it was great.
Rory Holland
Hope you enjoy the rest of SX.
Justin Fischer
Yeah, we're off to happy hour.
Rory Holland
Happy hour. Thank you, brother.
Justin Fischer
Yeah. Thanks man.
Justin Fischer, RiskScout.
Justin Fischer
How's it going, man?
Rory Holland
I was going to say welcome to Austin, but you're in Austin.
Justin Fischer
I'm kind of a native.
Rory Holland
Welcome to the Fintech House today.
Justin Fischer
Yeah, it's awesome.
Rory Holland
How's it going so far?
Justin Fischer
Good. I mean, awesome weather in Austin. Great conversations. It's good. What about you?
Rory Holland
Same, man. Fintech House has been impressive this year. There's just so much good stuff going on. I'm having a blast and meeting good people, and the folks who are watching us and listening to us now can't hear all the chaos here, but there are so many good people having great conversations. So, tell us about RiskScout.
Justin Fischer
I've been building bank software for 23 years now, mostly here in Austin, but for most of the U.S. market and a little bit international. And in 2019 or so, we identified a need for essentially financial crime software, right? A lot of people don't know that in 2019, the financial crime market in the U.S. was about 28 billion, OK? That's a reasonably sized market, just since the end of the pandemic. So in 2022, 60 billion.
Rory Holland
Whoa.
Justin Fischer
Massive jump, right? And a lot of that is fraud, sophistication, regulatory burden. So if you think about not JP Morgan, you know, big banks, we're talking about community banks and credit unions that are the 9,000 that are out there in the U.S., what do they do? Very similar to the cybersecurity problem. They've got to prevent money laundering. Right? They've got to do KYCKYB. They've got to understand their customer. They have to be able to ensure that elder abuse and things like this in the community aren't happening. But the sophistication level is very high from these criminals now and the regulatory burden is very high. So what do you do? Well, what we as technologists do is you turn to some kind of product or technology that can help you. But, unfortunately for financial institutions, it's not a very sexy space. We're actually here in the middle of fintech. And fintech is great, but who's building solutions for banks and credit unions, something they can run internally? You know, they're not API-driven, unfortunately. We would love to get data and transit everything with APIs, but they don't do that typically. And it's not their fault the data is not democratized, right? And so we set out from all of our experience, we have regulators from the OCC, from the Fed, we are BSA officers, Bank Secrecy Act officers, and we said, what would we do better? How would we make this an automated platform for financial institutions to essentially like a cyber security scanner like an antivirus but for financial crime for money laundering for these types of things so that you can go make that loan to that guy because you know he's doing legitimate business, even though sometimes his pattern is a little atypical, right?
Rory Holland
That's goto to be a very complex solution that you've built that's ever evolving because fraud is evolving, threats are evolving. Is that right?
Justin Fischer
It is, and you know, we like many companies leverage machine learning, right? But, you know, the interesting thing about machine learning, you're in the advertising marketing space, you're CMO, right? You probably realize there's a lot more sort of pomp and circumstance than there is real solutions, and we saw this with AI for a long time. And still, there's a push and pull with AI, right? In the machine learning world, what's often forgotten is I say, hey, I've got this new black box that's going to decide all these things for you. And you're going to go from knowing your community and getting maybe 10 to 12 alerts that you've got to go research. Now, in terms of an alert that's saying, hey, there may be something wrong here–you've got to go research it, you've got to go file with the government if it's something that's illegitimate, right? Now, every day you're getting a thousand. Right? It's a black box. So here's the issue, you're one person. Many times the BSA officer in most of these organizations is in their 60s, pretty close to retirement. They do most of the things with Excel. Now they're getting a thousand alerts, so what do they do? They can't keep up with it. And unlike some industries where you can kind of just package that up and say, well, I'm just going to go for the cream of the crop, the things that are most concerning. In the FFIC's eyes, the regulators eyes, you've got to look at everything because you might've just missed something. And so it becomes a real problem. So much so that a recent FDIC regulator got on stage and said, I don't want to see any more black boxes. Show me the glass box. Show me how you're coming to these decisions. Show me what you're doing. And it kind of comes back to human decision. Not advocating that. It's saying that generally you can ask a machine to dig a hole, but you need to know where that hole is going to be dug, what dirt you're moving, are there rocks? And so that's what we're missing a lot in the space, and so we look at this industry, very similar to my time in the rest of enterprise banking, as a place to to optimize, to be able to deliver software in one or two days after they sign a contract and turn that stuff on right away and then start working through progressive identification of illicit things.
Rory Holland
And how have the banks received this, I know how long sales cycles can be, banks can only move as fast as they can move, given certain reasons why that is. How has that been as far as the adoption for RiskScout? Are there some examples of where you've seen it really work well?
Justin Fischer
Yeah, in my previous life, I was an early guy at Q2 software. We were a huge IPO here in Austin. I did work with, I don't know, gosh, 4,000, 5,000 institutions, lots and lots of work. The biggest issues we had were, first and foremost, people were scared of the data center, right? Scared of moving their data to the cloud. They were scared to let other providers do that. And then what I think is the biggest challenge for financial institutions in the U.S. is that their data is walled off by big core companies, right? That's the Jack Henrys, the Fiservs, the FISs, and these guys built a business off of managing that data. So they're starting to open APIs, start to open up that information, but generally when you talk about if you want to come in and install a system that analyzes demographics, we've got to get that data from somewhere, right? And that's usually been the long tent pole. I will say in terms of institutions being interested in cloud technology, there's a lot more these days. There's a lot more interest in saying, oh, well, I can just turn this on. There's comfort with that. Probably, ironically, mostly thanks to Microsoft 365. Because a lot of them have migrated there and realized, oh, I can get my email in the cloud. So I think from our perspective, it's wildly different in the sense in my last enterprise life, it would take six to 12 months to sell a bank something. It takes six to 12 months to implement it. In our world, we actually have a product called Launch, which we understand we're the new guy on the block. So if you don't trust us, you don't have to… try it. We'll show you firsthand. So it's a reduced cost. I don't like to use the word trial because there's no expiration to it. Just start it, use it. If you really like it, then add more businesses to the platform. And so that's been wildly successful. Had an institution who was about a few weeks from their big exam, right? And they were able to jump on the system on the second day and they started to do their process, collect their information, run what's called an enhanced due diligence review, and do it right away. No big data migrations. Now, if you want to bring data over, the secret sauce for us is that we have direct communication with a lot of the cores and a lot of the data. And there's now middleware coming out. So we're starting to see more sort of data democracy if you will, right? Where we can get access to that and be able to support an institution. Because if you leave it up to them, unfortunately, I mean, gosh, half of my institutions have a consultant IT person that they have to call who's in another town. So, you know, and that's not just the little bitty banks, the big banks sometimes don't have that in-house.
Rory Holland
Yeah. What are some of the biggest challenges when you think about what you're trying to do with RiskScout now? And whether that's implementation or adoption, or I assume folks are listening to you, but maybe not. What does that sales process look like? What are some of the biggest challenges you guys have?
Justin Fischer
I think the biggest challenge for us, and I don't blame financial institutions, I blame anybody with a new vendor, is they've been overpromised and underdelivered so much. So it's like, OK, here's another company, says they do anti money laundering, but the reality is most of those institutions are in fintech. And that's fine. There's nothing wrong with being a fintech-specific AML solution, but you generally don't have the full suite. When I talk about the full suite, Rory, it's customer communication tools, it's KYCKYB. It is transaction monitoring, risk scoring, regulatory filing. That's a suite of tools that a financial institution has to have. If you're Lincoln Savings Bank, Cross River, Chase, yeah, you've got a team of developers. You go call those APIs when you want, right? But if you're every other institution, you know, if it's an API-based solution that you've got to glue together the pieces, it's probably not happening. So I think the biggest first step is just saying, hey, we are just like you. We come from the community, we are bankers and technologists and BSA officers and regulators. You know, in the regulatory world, there's a lot of subjectivity. You know, there's a reg, but they don't tell you exactly how to execute it.
Rory Holland
Sure.
Justin Fischer
Right? And so just walking into an institution, we get a lot of success just saying, there's a concept called CTRs, it's cash transaction reports. You've probably seen this in the movies: $10,000 or more. You ever watch Ozarks? It's actually a really true kind of money laundering pattern set. They did their research. You know, there's a CTR process. Sometimes, we walk in and a bank's filing 100 CTRs in a week, and they're tiny. That's not likely to be effective and they're probably not doing it right. So the first thing we do is we come in, and we could put software to solve something like that. The first thing we do is have a conversation about risk levels and mitigation. Probably similar to your business as a consultant in advertising, what are you trying to achieve? Like where are you trying to go before I try to throw technology at you or put you on SEO tell me tell me what you're trying to do, right? And that's a big part of our success is that we are kind of a blanket around the institution to help them understand where their risk is. They want to go into a new market, they want to just solve the current market and then how to do that. Take that and then automate that.
Rory Holland
OK, so are you guys doing custom work at all? Or is it more modifying the software to reflect the needs of that particular institution? So there's variances.
Justin Fischer
It's the latter. I built a lot of custom software in my time, so we built configurable software. So if you're familiar with no code, we've built a lot of no code workflows that allows us to build workflows from a sort of support person perspective instead of a developer. So recently I had an institution, they looked at everything and they said, hey, this is great, but I have a really big problem with loans. And I said, OK, tell me about your loan problem. In Florida, I have a bunch of aircraft loans, and I get DEA subpoenas.
Rory Holland
Yup.
Justin Fischer
OK, that's an interesting use case, right? Didn't have to describe why he gets DA subpoenas. That's pretty obvious if you got an aircraft portfolio in Florida, right? But he needed to go verify the UBOs, the people who own these aircraft loans on a consistent basis. But there was no tool for him to do that. So we just took an existing workflow we had and we said, oh, let's just change it. Let's duplicate it, recreate it, takes an hour and we handed it to him and said, does this solve it? And it's wild because you could say, well, you could do something like that maybe with Google Forms or a cloud builder or SharePoint or something like that. Yeah, maybe. But there's a lack of being able to conceptualize that and deliver that. And then when you actually do have someone who is doing something they're not supposed to in that aircraft loan perspective, how do you file that? How do you take that information and quickly push a button and file that into what's called a suspicious activity report? You can't. You have to do all that manually. And so again, we go in and we're replacing spreadsheets and Word documents and all this process and I just can't say enough, Rory, like, there's so many CEOs that I talk to at events like this and they're like, oh, we're fine. We passed the last few exams. And then I talked to them six months later and their BSA officer of 30 years has retired and they're in Grand Rapids and they can't find another BSA officer. And they're trying to train someone, and it's very difficult. And so that can really put you behind. And then not to mention, what if you're here and you're wanting to work with, you know, one of the great lending companies or another fintech and that has a bunch of risk with it. Are you ready for it? Is a foundation in your house for compliance ready for building a whole other wing? Yeah. Well, let's take a look at what it looks like.
Rory Holland
So you help not only identify those issues, but foundationally from a compliance standpoint, you're protecting it so to speak and then putting those banks in a position to be able to do more expanding if they want to add on products and services or take on additional risk whatever it may be.
Justin Fischer
Yeah exactly, so we have a bank that came to us, I mean it's very common use case, they come to us CEO says I want to be a banking as a service sponsor so I want to sponsor this guy who's doing, you know, a chime kind of thing, right? OK, great, but their BSA officer, again, you know, long time history, overwhelmed, is like, I don't know how to say yes to that, right? I actually did a whole presentation at a last conference about saying we can't if as a BSA officer, we can do this if you help me automate. And so they almost always go to staff. Well, I need five more people then if you're going to try to do that. And then the cost, the economics don't work for the bank, right? And sometimes, and I won't mention the names, but you go look at the regulatory orders, the bank goes through with it anyways. And they kind of assume that the fintech will do the compliance. But if you're an institution and you're lending your accounts for banking services, it's your responsibility. And so a lot of times we'll look at that and go, well, here's a lot of manual work she's doing. We can take that away. And then here's what you need to do for the new project. And then here's how we can mitigate that. Here's how we can mitigate the risk and automate the work. And then they're like, wow, it's great. It works.
Rory Holland
Are there any types of banks, particular sizes, criteria that you like to work with, whether it's assets under management or anything else? Is it kind of community banks all the way up to regional banks?
Justin Fischer
Yes, you know it's funny a lot of my career was under a mentor, Hank Seal, he was the founder of Q2, founder of QUP, and he taught me very similar background. His family were cattle ranchers and he went to his dad and said how can I improve the ranch, the family business? He said go work at a bank because at our size we need capital and it was very similar to my family who are farmers. And the community bank is who we relied on to get new equipment and to do that. And so we have an affinity for community banks and credit unions. That's most of our institutions. I wouldn't say there's a hard and fast ceiling on that, but when an institution, probably over 10 billion says, hey, we want to work with RiskScout, they almost always want to cut everything up and pull APIs in different directions. And that's fine. If our system is going to solve that problem, I'm the first one to say, let's do it. If it's going to take us a different direction than having good RegTech software we can deliver to all the other institutions, then we will actually turn it down. It's something you don't see a lot in a startup land is actually turn down a customer because it's not right for us at that point. Our focus, you know, most banks and credit unions are under five billion, right. Nine thousand of them. Right. And so our focus is to deliver solutions to them in a cloud based way, quickly and easy. And not expensive, it's very affordable.
Rory Holland
Yeah. When you think about RiskScout and what I've learned about you today and reading about you guys, what things would you wish more people knew or is there one or two things that you wish more people knew about RiskScout that they might not?
Justin Fischer
Yeah, you know, look, I think the biggest thing for us is community. Like we believe, I was part of helping build some of the communities early on in Q2 and you know, those communities turned out to be the place where someone who is in a small town and has a question could get an answer without having to hire a consultant or just go without an answer and face a regulator. And so what we're really big on is community. My institutions know this. Actually, I'd love to tell you this. Over two dozen, they're all referenceable, 100%. Some of them are fanatically referenceable, but you can talk to any one of them you want. I don't have to just pet customers I send you. You can talk to them all. I think the biggest thing is community. Some of our institutions are in the cannabis world. It's a wild world. And they work with each other across even in the same states where they're, you mentioned this earlier about cooperation and collaboration versus competition, they do compete, but they see it as a bigger opportunity to serve the space, and it's a gray area in those worlds. And so we just want people to understand if you're a CEO of a West Texas bank, like my buddy out in West Texas, yeah, you're killing it in oil money, right and iIn lending, but your BSA is in trouble. You can lean on Risk Scout, right? We will be a tool for you. We'll be a community to help your junior BSA person come up to speed and automate these things so that you can grow. One of the things that was interesting in your previous interview, we sometimes use a TSA analogy, or a Clear analogy in our conversation, because I find that when I present to CEOs at institutions and board members, they very rarely know their own compliance process. So I describe it like the TSA. Do you want to walk into Austin Bergstrom and have 100 people in front of you? No shoes, wandering around with their bags, trying to figure out what's going on? Or do you want to work in an automated way, would actually Clear in TSA is more compliance done in a better way. And that's the way to think about RiskScout in the back of your bank. And so you probably know the old adage that slow is smooth, smooth is fast. That's what you should be thinking about with your reg tech and your financial crime is it's not just a back office spend. If you get this right, one of our institutions, 300 million in assets, added 40 million in one year using our tools. So you can go grow. And so when you bring that in, if you bring the BSA officer and you say, hey, how about growing? They pull their hair out. They're like, well, I can't get another person yet alone 10 more people. So I don't want to grow, right? And then you have the CEO say, well, I want to go do this as a new initiative, but so and so, you know, thinks were in risk and you have this, these two wolves fighting. Right. But what if you could, you could smooth that out, right. And make that fast and automated and reliable. If they leave, you have a business continuity practice. You're not worried about all that knowledge going out the door, you actually have a system that if you had an exam the day after your BSA officer left, you'd feel confident that you could pass it because it's there and not automated.
Rory Holland
That's big. So you have, did you say 2,000? How many banks are working with you guys?
Justin Fischer
Two dozen.
Rory Holland
Two dozen, I'm sorry. So the two dozen banks, I'm sure, would sing praises. Where do you guys want to go from here? When you think about the next stage of RiskScout, where are you heading from here?
Justin Fischer
So last year, Alloy Labs became an investor. We actually got, we had three really interesting investors. Castle Creek, which is another bank network, very big bank network. Alloy Labs, awesome bank, progressive bank network. And then IBAT, which is Independent Bankers of Texas. They're 120 year old, largest banking association in the country. We're their first investment. Very, very rare.
Rory Holland
Congratulations.
Justin Fischer
Thank you. So, 200 financial institutions are invested in us, either through indirect LPs or directly on the gap table. So that's first of all, very different than any you know, large vendor they're working with in terms of influence and sort of being aligned. Right. We are right about to release this new flagship product. We opened it's like two months from now, this full BSA AML system. It's a, if you're familiar with the product called Verifin, very similar to Verifin. So 500 million AR company, you know, doing well. We are a modern version of that. Right. We're focused on banks. We're not focused on fintechs and other, you know, types of genres purely on these banks in this space. And here's the interesting thing, Rory. About three weeks ago, we opened a founder program. It's a group, a community where people can share their ideas. And what we realized with 60 bankers who signed up in three weeks is that they didn't have a voice. They felt like, you ever struggled, I don't know if you've ever built your own software, but have you ever struggled with something and you're like, man, if I could build software, I would fix this problem, right? Well, amplify that times 100, and that's what the BSA officers sitting there thinking, right? So, in a way that they fixed it they opened a spreadsheet and tried to deal with it, right? Now we're an outlet for them to go, hey, we have this modern platform. Some of this we can just knock out in minutes. Some of it will roll out in the next two weeks. What do you want? And it's just been pouring in. And so that's the really exciting thing is to see how RiskScout can kind of do what Q2 did, which is come into a market where early on the nonbank VCs would say, you can't compete against the really large companies, the multinational core companies and international banking companies. And then you say, well, yeah, those are like a 1984 cruise ship. You can put paint on the Lido deck, but it's not going anywhere different, right? And so our technology is modern, it's easily deployable, and it's literally aligned and directly feeding off of the institution's problems. And we've got backing from not only those associations I mentioned earlier, but United Bankers Bank's, biggest banking bank in the world, 900 banks in their network, right? So this is feeding us directly to solve these problems. Again, nothing wrong with fintech. And we looked at that space for a while just to serve the RegTech space. There's some great players already in there. But who's serving the banks and credit unions now besides the old lethargic cruise ships, right?
Rory Holland
Yeah, and they need help. They definitely need help. And it's a space that we look at too, whether it's through Alloy Labs and his consortium or like what you're talking about, trying to get face to face with these leaders of these banks to help them compete and win in such a challenging market and with this ever evolving society and the way people are using money, sharing money, investing money. I'm curious where you think the next three to five years are gonna go from your perspective.
Justin Fischer
For us or the market?
Rory Holland
The market. And how RiskScout plays in that.
Justin Fischer
Yeah, you know, I think what was interesting about last year and the bank turmoil, another way to summarize it, is that regulatory technology, financial crime, and sort of just doing good business is now very highlighted, right? So unfortunately, I think this year we're going to see a lot more catch up from the regulators and a lot more orders, consent orders, and C&Ds. So we'll see that more, probably a lot more around fintech. In terms of where we go after that, I think you'll start to see more consolidation of institutions overall. But I think one thing that people get really wrapped up in a lot, I'm a technologist, so I'll put myself in this group, is that things like checks disappear, cash disappears, right? And I just don't think that that's the case for decades, right? And financial institutions are still gonna be places like you and I are small business owners. These community banks are where we're gonna go get our next loan. It's not gonna be Chase, it's not gonna be Bank of America, right? It's gonna be these small institutions that know what an SBA loan looks like, right? And so I think what we're going to see is a survival of the fittest in smaller banks. But I think we're going to see better technology that allows their data to open up. And they'll be able to decide what they want to do with that. Now, I've talked to a lot of our institutions. Some of them don't want to sponsor a Chime-like solution, a fintech kind of bank solution. They might want to build their own. I know a really big bank that wants to go build a military type USAA like system, right? Well, they can do that only if they can, you know, unlock their technology and their data. Right? And so I think we'll see a lot more of that, but I think we're going through a retraction on fintech a little bit, you know, in the sense that people are learning OK, wait, hold on a second. We have to make sure compliance is correct. We have to make sure this is an economically viable business. And that fintech, who may have the best technology, they may be upside down on their cap table now, right? There's a lot of issues that are even outside of how good is their solution, right? And so I think we'll see that that retraction, we'll see some new technology, you'll see middlewares, we'll see some things that open up financial services, but also think we're going to see nontraditional banks all over the place, the Apples of the world, right? You know, so it's going to be fascinating. And then, you know, I think, like in your other interview, we're going to see more universal ID systems. I mean, the IRS is now using ID.me, which is a pretty big step to be able to use a third party to validate who you are. The SSM model is broken, right? I can't give it to you, but that's the only way I can identify myself. If I go look up criminal data, I don't know how much you know about this, but if I go look up criminal data on you right now, there's no reporting based on social. So how do I even know it's you, Rory, versus Rory in Washington, DC? I don't know. It's just a broken process, right? So I think we'll see a lot of new technologies move forward there, right?
Rory Holland
Yeah.
Justin Fischer
And for RiskScout, I mean, real simple bread and butter is working with financial institutions. So we do BSA AML, which is the first step. And then a lot of our institutions are asking us for loan compliance modules. They're asking us for wire and ACH fraud. They're asking us for banking as a service, which we do, and cannabis, and any of these ancillary sort of pieces where they can go get deposits for lower costs. They can go start new lending programs without incurring all the risk. A real good analogy is you want to go buy a house, like the one we're in … a 1920s house in Austin. I'm sure you're going to hire a heck of a foundation engineer, inspector, and check everything. And that's a good way to think about, OK, you know a RiskScout can come in and help you check that foundation, make sure we're all strong. And then go do what you want to do, Airbnb, you want to make a mcmansion Rory, go for it, man. We want to support that vision, but you need to have a strong foundation.
Rory Holland
Yeah, it's such interesting stuff you guys are up to. OK, one last question. Something's been on my mind, and you've probably heard me through our conversation. We've had conversations here in the house this weekend just about trust. And trust in our society, I sense, is kind of at an all time low. I feel like in my lifetime at least, it feels like whether that's in the systems that govern our country or in the world or just, or in the financial system with what happened this time last year. I'm glad we're not talking about a bank failure this year. But trust in the financial system is at a low. What can we do, and whether that's me and you sitting here talking or the industry itself, do to build trust with the market about what we're doing and restore faith?
Justin Fischer
That's such a good question. I think the technologist in me wants to come out with a technical solution. But you know the reality, what I've learned from community banks and credit unions, is that shaking a hand and meeting you and talking to you, I just went in Leander, Texas where I'm at, it's just north Austin, just went to community breakfast with the local bank there. And you stand there for a second and look around and the branch manager's flipping pancakes and the head of the police department's there. When you have that level of connectivity and that understanding of people who are in your community, that to me is trust. So I have institutions who sometimes see technology as a disintermediary. It's true. It's a disintermediary. It's necessary. It will create convenience. But, how can we take that level of trust that they have, that understanding of the person from across the table, and let's say synthesize that, but recreate that or create a place where maybe it's a quick video conversation. Maybe it's some, you know, more in depth understanding of who that person is without making it feel like Big Brother, without me going, oh, I already know your second child's middle name, right? You know, how can we do it with more of that handshake kind of understanding that we used to have? And there are ways, right? And if we don't discard community banks and credit unions for, you know, for being cavemen in terms of the process, being so far back in technology, and look at actually the relationships they build and the way they do those things. And then we leverage technology to do that better. I think that's the answer.
Rory Holland
I love that. Yeah, and I think we all want to see community banks and credit unions succeed. We need them, I think as a society for whether we're local business people like us that want to know our bankers or other individuals, maybe the younger market that actually does have a desire to know the person or ask a question from a physical human being in person versus counting on just all digital. I think that's one of the challenges we have and how we can use technology to facilitate relationship. And I think the way you answered it's great. It's been fun man.
Justin Fischer
Yeah, man.
Rory Holland
Thanks so much, Justin. Appreciate you joining us.
Justin Fischer
Yeah, it was great.
Rory Holland
Hope you enjoy the rest of SX.
Justin Fischer
Yeah, we're off to happy hour.
Rory Holland
Happy hour. Thank you, brother.
Justin Fischer
Yeah. Thanks man.
