The Revolution Of Embedded Finance with Kenneth Kunin, SVP, Enterprise Technology Office at FIS

(Intro Narrator at 00:00:03) Hello, my friends. Today we're talking to Kenneth, Senior Vice President of the Enterprise Technology Office at FIS, and we discuss the revolution of embedded finance, how to upskill a tech team, and why it's best to vary your career with other disciplines. All of this right here, right now on the Modern CTO Podcast.

(Joel Beasley at 00:00:31) This is the Modern CTO Podcast. So it's my full-time thing. We've been doing it for five years and 530-something episodes. So that's how I went from software developer to podcast person.

(Kenneth at 00:00:49) Wow. Yeah. Well, I also had a somewhat meandering path to where I am today. So I started out, interestingly enough, in marketing and finance back in the nineties working for a fintech based out of Montreal. So I'm Canadian—doesn't always come across—but I live in Montreal, but I work globally. So we were a small startup in the brokerage space. We were essentially making like E-Trade-like websites for the Canadian banks. I graduated out of school, this was my second job, and I was essentially doing marketing for this fintech. And we were bought by a large American company, SunGard, where I spent fifteen years. And in 2016 I joined FIS when SunGard was bought by FIS. But I drifted from marketing over to product management and then product management into engineering, which is where I am today. So today I run what we call our Enterprise Technology Office or ETO, and essentially my group looks after all of the common plumbing of FIS. So if you think about all the services that a multi-product portfolio would need so that we don't duplicate them again and again and again, that's what my group provides. So anything from identity management to API gateways, event streaming platforms.

(Joel Beasley at 00:02:19) Payments, right?

(Kenneth at 00:02:20) Well, the payments group would use my capabilities. So I don't focus on a particular line of business, a particular financial domain. I deliver services to the lines of business that then service the different financial domains. I'm kind of the plumbing underneath the company.

(Joel Beasley at 00:02:38) Yeah, that's what I meant because if you have a company that has a bunch of apps, they'll typically start to extract the things. So one of the first things often to get extracted because it makes the most sense is the payment system, right? Because handling payments across multiple applications can be centralized pretty easily.

(Kenneth at 00:02:55) So it's interesting that you say that because that's what FIS does. Right? So FIS is a payments provider to websites.

(Joel Beasley at 00:03:09) Oh, very cool. So you're like, use us instead of building it yourself?

(Kenneth at 00:03:13) Well, we do, but we provide those services to the market. So people always ask me, what do I do? And I always say, well, I'm in fintech, and they assume that I work for a startup. But no, we're one of the largest fintech providers in the world. 95% of the world's banks use our technology. We manage 50% of the world's wealth on our systems. We handle about $13 trillion annually. So we're the rails that underpin the financial system. Somewhere along the way you've touched one of our systems. I think virtually everybody in the world at some point has touched one of our systems. So that includes everything from banking to brokerage, to insurance, to treasury systems, to merchant services, payments. And so we provide those services to the market. So someone building a website or building an app would use our payment APIs to process their payments.

(Joel Beasley at 00:04:09) Well, I'll give you after the show, I'll give you my account numbers and maybe some fractions can be added.

(Kenneth at 00:04:12) I have them right here.

(Joel Beasley at 00:04:13) Some fractions can be added.

(Kenneth at 00:04:16) You have some pretty catchy transactions. We will have to talk about that after the show.

(Joel Beasley at 00:04:20) Right, right. Do you identify suspicious transactions? Is that something you guys do?

(Kenneth at 00:04:25) We do. Yeah, we've got fraud detection systems, AI-driven systems that look at patterns and identify suspicious activity. So when you go to your bank, when your bank sends you an alert saying somebody tried to use your credit card or this transaction looks pretty suspicious, that comes from some of our fraud systems.

(Joel Beasley at 00:04:44) Oh, there's actually a ton of fraud now that will use that as their in. Right? I get emails all the time from Facebook that's like, your marketing campaign has stopped. And I look at the domain, I'm like, this isn't from Facebook. It looks super legit. Sometimes they'll even use third-party services so that it's coming through some software that you would pay for to send email, so it looks more legitimate.

(Kenneth at 00:05:07) Yeah. I mean, threat actors are getting far more sophisticated, especially as consumers start using more and more services. Right? Everybody has apps on their phone, everybody uses services. So we get messages bombarded, we're bombarded with them all day from various notifications, apps, emails, IMs. So the channels through which a threat actor can get to you today has grown exponentially, and they're getting quite sophisticated. Phishing attacks, spear phishing attacks—you have to be on your toes.

(Joel Beasley at 00:05:44) How do you determine fraud in several milliseconds? The detection happens relatively fast. When I process a transaction that does get denied, I mean, that happens almost the same speed as a transaction that goes through successfully. Right? How do you, in such a small amount of time, figure out that it's fraud or not?

(Kenneth at 00:06:04) Well, you've got some very powerful systems, big data platforms that are looking at data, that are looking at patterns, algorithms that are built to run very fast against large volumes of data. I mean, just like you go to Google and search and get back results instantaneously across billions of websites, we can process against billions of transactions and look at known patterns or even personalized patterns for you. Right? We know your activity, we know what type of transactions you make. If suddenly you start spending high volume, you start doing some odd transactions at jewelry stores—I don't know what you're into, right?

(Joel Beasley at 00:06:45) I'm into grills.

(Kenneth at 00:06:46) You do like a lot of bling, but yeah. But, you know, it'll flag it. And as you try to process that transaction, it's going to flag it in near real-time or real-time.

(Joel Beasley at 00:06:56) That's crazy. What's the hot topic right now in your space?

(Kenneth at 00:07:00) I would say it's what the industry's calling embedded finance.

(Joel Beasley at 00:07:04) What's that?

(Kenneth at 00:07:04) So if you think about banking traditionally, if you needed services, any type of financial services, you would go to a financial institution. Right? You would go to a bank and you'd go down the channel that that bank, or banks in general, built for you. Right? In the past you had to go to the branch and you had to sign papers if you wanted to take out a loan, for example, if you wanted to open a credit card, if you wanted to pay for things. Sometimes, especially in commercial, you sometimes had to go to the bank and do it if it was a large type of transaction. And so financial services was always separated from the rest of the economy. Right? It had its own channels to get their services. And what you're seeing now is financial services embedded in everyday life. Right? All the services that you consume as a consumer have financial services kind of baked in. So think about using ride sharing or ordering from a meal delivery service. If you book a cab on one of these ride-sharing apps, you pay for it right then and there, built into that app. Right? What you said at the beginning. Right? Using payment APIs to be able to process this stuff. So financial services are being embedded in day-to-day apps. And so to do that, it requires us to take a lot of these sort of monolithic banking systems that we've sold in the past and really decompose them into more granular services that can be consumed by fintechs building apps, retailers building ecommerce storefronts, just even companies doing B2B payments might embed some kind of financial services in their app. Buy now, pay later is something—if you think about it, if you've seen that, you go to a retailer and you buy a couch or you buy something—

(Joel Beasley at 00:09:01) Affirm, that's a big one.

(Kenneth at 00:09:03) Affirm, yeah, exactly, great. So what you're doing is essentially right at checkout, they're giving you a loan. Right? And that's embedded finance right there.

(Joel Beasley at 00:09:12) I did it.

(Kenneth at 00:09:13) Right in the experience, exactly.

(Joel Beasley at 00:09:15) Why don't I know the brand FIS as a consumer? I know Stripe, and you probably do a lot more than them and have a lot more services. But I know Stripe as a brand. Why don't I know FIS?

(Kenneth at 00:09:27) I think because for a lot of our history—and we've been around for over fifty years—we've been underneath the brands that you know. So our customers are the big banks and brokerage firms and insurance companies, and we're their service partner. We're the systems that power their business. And so I think for a lot of our history, we were sort of behind the scenes. Companies like Stripe and Square, they came out of Silicon Valley, they come out with their brand, they're more front and center to the consumer. But you might be familiar with Worldpay.

(Joel Beasley at 00:10:03) Yeah, oh yeah.

(Kenneth at 00:10:03) Yeah, so Worldpay is one of our brands. So our merchant services brand is Worldpay. So you may get on a terminal that you pay with your credit card with at a store or restaurant.

(Joel Beasley at 00:10:18) You know Regus, like the coworking space?

(Kenneth at 00:10:20) Yeah.

(Joel Beasley at 00:10:21) We've got a couple of Regus offices around the U.S., and when I pay them, they use Worldpay.

(Kenneth at 00:10:26) Yeah, yeah. It's one of the world's largest brands. I think we process about one-third of all payments around the world.

(Joel Beasley at 00:10:33) That is so cool. How many brands do they own that's like Worldpay?

(Kenneth at 00:10:38) I think from a consumer perspective, it's probably one of our top brands that you might know of.

(Joel Beasley at 00:10:45) In total. Like, what's the total portfolio number of things you guys have?

(Kenneth at 00:10:49) I'd have to pull someone in from marketing, but I mean, just knowing—I've been here twenty-three years—

(Joel Beasley at 00:10:54) Oh, wow.

(Kenneth at 00:10:55) Rough count. I mean, there's probably two, three dozen brands that we've acquired over the years. If you're in the financial services space, oftentimes I'll meet with people who work for banks or other financial institutions, and we'll have acquired a company that was big in a particular niche of financial services, and they'll know that brand. Right? Because that brand was the best-of-breed solution that was in the market for many years. And in many cases, they still know the system as that brand. But from a consumer perspective, I think the brand you probably know the best is Worldpay.

(Joel Beasley at 00:11:36) Oh, that's very cool. See, I'm glad I asked, right? Because I saw the size of you guys, and I was like, typically—after doing all of these shows—when I run into a company that's massive but I haven't personally heard of them, they usually own a portfolio of brands, and I'll know one of the brands that they own. But we kind of glossed over it. You've been there twenty-three years?

(Kenneth at 00:11:58) Twenty-three years, yeah. I started in the late nineties and started with that company in the brokerage space, got acquired by SunGard, was with them for about fifteen years, and then FIS now for six years.

(Joel Beasley at 00:12:13) Was SunGard one that had a portfolio of products too, or were they just a single product?

(Kenneth at 00:12:17) So SunGard was in the capital markets space. If you think about the financial industry, think Wall Street and Main Street. Right? Wall Street is the capital markets business. Right? It's brokerage, it's trading, pension funds, hedge funds, sort of the big money. And then Main Street is the retail banking. Right? It's you and me, it's mom-and-pop stores. So in a way, we used to joke when FIS bought SunGard, it was Main Street buying Wall Street. Very different cultures if you've ever been to Wall Street or you've been to Charlotte, North Carolina.

(Joel Beasley at 00:12:55) Oh, yeah.

(Kenneth at 00:12:55) So FIS today, if you look at our business, it's really three main segments. Right? We've got the banking business. Right? Core banking systems, retail banking, loan origination, and so on. You've got the capital markets business, which is, as I said, brokerage, trading, insurance. And then you've got the merchant solutions business, which is, think of it primarily as the Worldpay business. Right? It's merchant services.

(Joel Beasley at 00:13:25) And then you guys do for some local banks, you'll do interfaces. Like, you'll be the portal for a local bank. Do you have any tools like that?

(Kenneth at 00:13:33) Absolutely, yeah. We have a system called Digital One, and it's essentially the online banking front end.

(Joel Beasley at 00:13:39) Got it.

(Kenneth at 00:13:39) Right? But it's branded. Right? So, again, you don't see us. It doesn't say FIS on it. You'll see one of our customer brands, like a bank brand, but the website is ours. Right? And in some cases, the bank might build their own website but use our APIs.

(Joel Beasley at 00:13:54) Yeah.

(Kenneth at 00:13:55) Right? So our system is on the back end, but they've customized their own front end. In some cases, we've customized the front end for them. So there's different flavors. It ranges from the large banks, the JP Morgans of the world, down to regional banks and then community banks. So we service all three tiers.

(Joel Beasley at 00:14:16) So that's where I have heard of you guys, and I think I might have worked with one of your systems. I did a project about seven years ago on software for audit confirmations. I don't know if you're familiar with what that is. It's this process between the CPA—they're doing an audit, so they have to do confirmations of bank account balances, and there's all this paperwork and this legal process. And this team built the software that makes that easier for the local bank because bigger banks have whole departments, but local banks, it's like the manager going and doing these constantly. And this system helped automate it, and they needed it to be integrated into these portal providers, which would be something you guys do. Because I knew I had heard FIS somewhere in my life, but that's probably where it was.

(Kenneth at 00:14:59) Yeah. So that's a great example of where you might use one of our APIs. One of the platforms I manage is called Code Connect. It's basically our API gateway. Right? So we have a developer portal where you could come and browse through the APIs, and you as a developer building audit software would need a quick way to access bank account balances. And so you'd use one of our REST APIs to pull that data in. And there's a developer experience that we provide that allows you to get your access key and make those calls, and we'll meter it and bill it based on the contract that you signed. So that's a great example of embedded finance. Right?

(Kenneth at 00:15:35) Right there, right? It's a software built for something completely different, but leveraging granular decomposed services from a core banking system to add value-added functionality to another app.

(Joel Beasley at 00:15:47) So why twenty-three years, and why not move on to something else?

(Kenneth at 00:15:51) You know, people ask me that all the time. A lot of my friends are always very surprised that I've stayed in one place, right? Most people rotate jobs every two, three years, maybe five years. My career has been very interesting. I haven't really done the same job for twenty-three years, right? In some ways the company changed around me and I got to do different things.

(Kenneth at 00:16:22) And so, you know, like I said, I started in marketing, I moved to product management, I moved to engineering. Over time, I kind of rose through the ranks and I inherited bigger engineering groups. And the vantage point that I have in the company, because I'm sort of these enterprise services, right, the central services that touch all areas of our business, I get to see and work with a lot of different products across different financial domains and different clients in different countries all around the world. So in some ways I consider myself very lucky, but, you know, I'm not just working for one product in one city, in one market niche, right?

(Kenneth at 00:17:08) I get to deal with the whole spectrum of financial services. And so it's, for me, it's just been a very interesting ride. I learn new things every day. The industry is constantly evolving. The pace of technology just keeps accelerating.

(Kenneth at 00:17:21) I mean, I was talking to somebody the other day and it used to be that, you know, we sort of did a technology turnover every three to five years, right? You replace some framework or replace some database or replace some key component in your application with a new framework or platform or whatever. And the pace seems to be accelerating. It seems like we're revisiting the technology choices we're making every 18 months and it seems to be getting faster and faster.

(Kenneth at 00:17:49) So it's an exciting industry. It's an exciting company, and I think we've got a lot of assets that just have a lot of opportunities in the evolving financial world. So for me, it's just been a good ride.

(Joel Beasley at 00:18:04) Yeah. Everything is speeding up. I talked with Parker Harris, who's one of the co-founders of Salesforce, and he had mentioned on the show something that blew me away. Apparently, more than one time a year, they rewrite their underlying infrastructure. I thought that was incredible pace.

(Kenneth at 00:18:21) More than one time a year? That's much faster than I can imagine. But, you know, you always have to be thinking of technical debt. You know, if you want to stay competitive and you want to continue to stay relevant in the market, you have to focus on your technical debt.

(Kenneth at 00:18:38) I think teams that focus too much on building new features and new features and new features, but never look at the underlying platform and never reassess the technology choices they've made and fix some of the debt they've created over time, you can only grow to a point and then you just hit a wall. And if you have a model where you can constantly invest in the underpinning of your application, then you create a sustainable product. And I think it's very important, something that I try to do in all my platforms and have done throughout my career.

(Joel Beasley at 00:19:13) When new styles—like, one day you woke up and everybody's like, monoliths suck—you know, these new things happen in the industry and these trends happen. And because you've been at the same place for twenty-three years, you've seen a lot of these come and go. You're obviously working on a very important software that has to have extraordinarily high uptime and work correctly the first time. When you see these trends, how have these trends come across your radar and then actually make it into production? How would that process go? If you think of one trend that has made it into production, how did it go from the moment you heard about it and you never knew about it till it was in production?

(Kenneth at 00:19:50) Well, you know, I think we tend to look at things in an isolated area first, sort of find something that fits whatever—let's say it's a new technology that's come out, a brand new platform, a new framework, a new way of doing things, like NoSQL databases, right? Everybody was on relational databases and then these NoSQL databases came out and you want to see what they can do. You start small, right? You start in one ancillary application that connects into your main application.

(Kenneth at 00:20:19) You kind of get a feel for how it operates and then, you know, it kind of expands over time. You know, a couple years ago, we shifted from focusing on Java to JavaScript, right? So we started moving our applications, a lot of what my team is doing, from building Java to Node.js-type applications.

(Kenneth at 00:20:38) And we started small. We started with some kind of ancillary component. We built an app looking at modern practices like containerization, right? We containerized it. We scaled it out. And then we got a feel for that technology and we realized that we could do more with that technology, so we started moving other pieces over to it. So you start small and you just kind of grow it as time goes on. That concept of constantly refreshing your technology as new technology gets introduced—the ones that are successful make their way into other modules and other components and the ones that don't, you ring-fence it and then you replace it as part of the normal cycle.

(Joel Beasley at 00:21:19) Yeah. That makes sense. No, thank you for sharing. Whenever I find people that have a wealth of experience, like, my job is not to be smart. My job is just to find smart people and ask them questions that are valuable for the audience.

(Kenneth at 00:21:31) You know, one of the things that's very difficult today is upskilling your team, right? Because technology is changing so fast. The pace of technological change is moving much more rapidly. Moving teams, for example, that example I gave from Java to JavaScript, right? You've got large teams. They're used to one technology. They have to upskill very quickly. So that's a huge challenge that we have in my team, in other teams within FIS and I'm certain across the industry. One thing that we've done fairly successfully, not the only thing, but one thing that we've done is we have a what we call Innovate in 48. It's a hackathon, essentially.

(Kenneth at 00:22:10) It's been around for ten years. Actually, funny story, the CTO I was working with at the time, we originally called it a hackathon and he got very uncomfortable with the word hack. He said it sounded kind of malicious and changed the name. And so essentially it's a hackathon that we run every year. We do a regional round across the company.

(Kenneth at 00:22:30) So it's developers from different teams across the company. They form teams. Sometimes there's a theme, sometimes there's no theme, but, you know, we let them take—it usually occurs within one week. They get forty-eight hours. That's the Innovate in 48 to essentially pick a technology, play with it, get some experience with it, and get to upskill themselves on something that they wouldn't normally work with in their day-to-day job.

(Kenneth at 00:22:57) And, you know, sometimes we've built features for our products out of that program that have made their way to production. But I think more important is really getting the developers to learn something new. And that type of program, you know, when I talk to some of the developers and the participants, I realize that the skills they pick up—maybe not what they built becomes relevant—but the skills they pick up help us upskill them. And as we go through technology refreshes and we look at new things, they take those skills and they apply them to solving problems with them. And so I think that program has been great for us. It's quite popular in the company, and I think that's helped us handle that technology upskilling challenge.

(Joel Beasley at 00:23:45) So it's a double benefit. First, they might have an interesting innovation that you might actually apply, but second, the behaviors that they're exercising as they go through this benefit them and their work.

(Kenneth at 00:23:56) Exactly.

(Joel Beasley at 00:23:57) That's pretty cool. We talked with Eric from Arvig the other week. They're a telecom company. He's head of cybersecurity. He talked about threats, ransomware, how companies have to make tough decisions about whether they should pay to get their data back, all that type of stuff. Has that world ever come up in your world at all, specifically ransomware? Like, have you ever had to deal with ransomware specifically?

(Kenneth at 00:24:21) FIS as a company probably has. Me personally, no. I have dealt with a number of cybersecurity threats. You know, you can imagine being the front door to banks. We're quite the target.

(Joel Beasley at 00:24:34) You're a huge target.

(Kenneth at 00:24:35) Yeah. We are a huge target. One of the systems that I manage is our identity management system. So it's basically the login system to banks. And, you know, you enter your password, your OTP and all that.

(Kenneth at 00:24:48) Yeah. I mean, we're constantly being attacked. Every day there's something that's going on. It's a credential stuffing attack, a phishing attack, you name it. So we've got to stay on our toes. I remember one Christmas, we try not to do changes at Christmas. We try to keep everything quiet at Christmas, but I remember one Christmas, I was just on the phone for the entire week because we were getting hit with a cyber attack.

(Joel Beasley at 00:25:10) Got to get those Christmas presents, man.

(Kenneth at 00:25:12) Yeah. So, yeah, it's something we take very seriously at FIS. We have a whole cybersecurity team, a security operations center that monitors things minute by minute. You know, all the data that comes in from our systems get fed into this SOC system, we call it, or SIEM, S-I-E-M system. And, yeah, they're constantly—it's like a whole vigilance program to make sure that bad actors aren't getting in.

(Joel Beasley at 00:25:41) So my background, I told you, a software developer. My team's never got bigger than thirty, and, you know, we did one financial software. But for the most part, we just sort of, like, built it in an infancy stage for it, like, one specific chain of financial advisory firm. So I haven't had a ton of experience of how do you at scale with lots of employees and lots of team members, like a hundred-plus, managing access to data, right? So you've got this identity verification system, and there has to be some protocols and ways of protecting that information, but also allowing the developers to do their job. How do you balance all of that?

(Kenneth at 00:26:22) It's a good question. You know, I think there is a constant struggle between giving developers access to systems and controlling access to systems. I mean, we have a very careful separation between production systems and development systems, right? There's different rules. You know, there's firewalls and network segmentation that prevents you from moving data from one system to the other. Obviously, if you're dealing with production data, it's extremely sensitive. It's customer data. In other cases, financial data. It's a need-to-know basis only.

(Kenneth at 00:26:58) Yeah. So we have careful controls that allow, you know, only certain individuals to access certain data, certain portions of the database and so on. So we're contractually obligated in many ways to make sure that that data is not accessed by too many people. In development, we tend to use tools that obfuscate data. So if the developers need access to production data, because, you know, they have to do their testing or they have to develop against real data so that they can make sure that the features they're building are working correctly.

(Kenneth at 00:27:33) We have tools that obfuscate the data, right? So we take production data, we can change it in a way that erases people's real names and email addresses and things like that, but creates a database that looks like production. So that's something we employ in our development practices. Generally speaking, we do not let developers touch production. There's generally different teams that manage production data versus development.

(Kenneth at 00:27:57) And when a developer has to be brought in, if there's an issue in production, there are steps and approvals that need to happen for them to get temporary access.

(Joel Beasley at 00:28:06) Very cool. I didn't know if there was, like, a common framework or, like, a book for this is how you handle sensitive data at scale with permissioning or access allocation.

(Kenneth at 00:28:19) I think it's highly tailored to your particular business and your contracts, right? Because, you know, we have customers who have very clear rules about what data can be accessed. If you're dealing with, for example, health information, you know, you've got rules all over the world, like different countries even have different rules about data privacy and data security.

(Kenneth at 00:28:39) So you kind of have to tailor it to different jurisdictions, different types of applications, different types of data. So I don't know if there's one rule for any type of sensitive data. I think it really varies by industry and by region.

(Joel Beasley at 00:28:54) That makes sense. Dude, you've been really great. You've indulged all my curiosity. Okay. I want to do leadership advice. What's your best leadership advice that you've ever gotten?

(Kenneth at 00:29:06) Well, it's advice that I've gotten and that I still give to people. Try to vary your career. You know, people tend to want to take the linear, the fastest linear path to success, right? They want to rise through the corporate ladder. Especially in engineering, I find the best engineers are people who've done other disciplines, right? Spend some time in product management. Spend some time in marketing. Spend some time talking to clients.

(Kenneth at 00:29:35) Right? Whether you're in technical sales or some kind of client services position. The insight that you will get and the value of being able to understand how all those other disciplines touch the client and touch your software will make you a better engineer or architect or whatever it is you're doing in that technical discipline. So I always tell that to people. My staff will come up to me and say, you know, how do I get to be the next chief architect? Or how do I get to be the next development manager? And I always tell them, go do something else for a bit and come back to development. It'll make you a better person and a better developer.

(Joel Beasley at 00:30:15) I like that. Are you hiring currently?

(Kenneth at 00:30:18) We are. We're always hiring. We're always looking for good talent. We've got new markets we're venturing into all the time. So it requires people who think differently, people who have different skill sets. So yeah.

(Joel Beasley at 00:30:30) If some from our audience are interested, where would they go to learn more about that?

(Kenneth at 00:30:34) Fisglobal.com. Go to our careers section.

(Joel Beasley at 00:30:38) Excellent. Dude, we made a podcast. How do you feel?

(Kenneth at 00:30:42) I feel good.

(Joel Beasley at 00:30:44) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email, [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.