The ITSM Practice: Elevating ITSM and IT Security Knowledge23 Des 2025

How to Build a GRC Framework for Fintech Startups

Learn how to build a solid GRC foundation for fintech growth in the EU. We break down governance, risk management, and compliance essentials to help startups scale, earn investor trust, and meet PSD2, GDPR, DORA, MiCA, AML expectations from day one.

In this episode, we answer to:

How do you set up an effective GRC framework for a fintech startup in the EU?

Why must European fintechs prioritize compliance, risk, and governance early to scale safely?

What roles, processes, and oversight are essential to meet PSD2, GDPR, DORA, AML requirements?

Resources Mentioned in this Episode:

European Central Bank (ECB) website, article "The PSD2 supports innovation and competition in retail payments … and enhances the security of payment transactions and the protection of consumer data.", link https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html?

Deloitte website, article "The Revised Payment Services Directive (PSD2)", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/research/psd2-revised-payment-services-directive.html?

European Parliament website, article "GDPR: Overview of the EU General Data Protection Regulation", link https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm?utm_source=chatgpt.com

German BaFin website, article "Prevention of money laundering and terrorist financing", link https://www.bafin.de/EN/Aufsicht/Geldwaeschepraevention/geldwaeschepraevention_node_en.html?

ESMA website, article "Official summary from authoritative EU sources: Digital Operational Resilience Act (DORA)", link https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora?

ESMA website, article "Official overview by the European Securities and Markets Authority (ESMA): Markets in Crypto-Assets Regulation (MiCA)", link https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/markets-crypto-assets-regulation-mica?utm_source=chatgpt.com

Connect with me on:

LinkedIn: https://www.linkedin.com/in/theitsmpractice/

Website: http://www.theitsmpractice.com

And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.

Credits:

Sound engineering by Alan Southgate - http://alsouthgate.co.uk/

Graphics by Yulia Kolodyazhnaya

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(159)

MSPs: Your AI Contracts Are Obsolete

AI is transforming Managed Service Providers (MSPs) from managing technology to managing AI behavior. This episode explains why traditional service design, governance, contracts, and risk models are n...

11 Aug 16min

DARE25: Why Defense Isn't Enough

Discover why traditional cybersecurity defense is no longer enough in the AI era. Luigi Ferri explores the DARE25 framework, dynamic risk management, governance, Purple Teaming, accountability, and ad...

4 Aug 9min

ISO 28000: Your Resilience, Their Budget

In this episode of the ITSM Practice Podcast, Luigi Ferri explores why supply chain resilience has become one of the biggest strategic challenges for Government Managed Service Providers (MSPs). Using...

28 Jul 13min

No SBOM, No Trust

Discover why the Software Bill of Materials (SBOM) is rapidly becoming a strategic necessity for Managed Service Providers (MSPs) and enterprise IT leaders. In this episode, Luigi Ferri explains how s...

21 Jul 19min

PSD3: Who Owns Trust?

PSD3 is more than a compliance requirement, it's a test of organisational maturity, security leadership, accountability, and decision-making. Discover how Enterprise Service Management, IT Service Man...

14 Jul 6min

The Hidden Cost of Untrusted Data

Why do organizations struggle to trust their operational data despite having plenty of it? In this episode of The ITSM Practice Podcast, Luigi Ferri explains the critical difference between data quali...

7 Jul 11min

ITIL 5 Foundation: Exam Success

Preparing for the ITIL 5 Foundation exam? Discover why successful candidates focus on understanding the ITIL Value System, Value Chain, Governance, AI Capability, Four Dimensions, and Service Lifecycl...

30 Jun 10min

PSD3: Governance Before Technology

In this episode, Luigi Ferri explores why organisations often take the wrong first step when preparing for PSD3 compliance. Rather than rushing into new tools, fraud platforms, or transformation progr...

23 Jun 7min