How to run processes in FinTech amidst fierce regulations and competition?

Stephen

Hi, Graham! Good morning and welcome to our Devico Breakfast Bar! This is our series of conversations with CTOs and entrepreneurs. And we're delighted to have you here today. I guess before we kick off, it'd be great if you could tell us a bit about your role, your organization, and what's happening there at the moment.

Graham

Yeah, sure. So, Rvvup is a new payments company. It was founded by David Nunn, who was an ex-Braintree at PayPal company. My introduction to David was through a CTO network in London. They were looking for someone with a lot of experience working in API integrations. I started speaking around 2021 before the company was actually going properly. We got everything moving by about April time and started ramping up pretty quickly, like expanding out the team over that first year.

We managed to raise a reasonable amount of finance in that first year to help us kind of expand quite quickly. My initial plan was to take on a team of, smaller team of more senior people initially to get the first proof of concepts out the door and then start to expand out as we needed to cover more ground more quickly. My own background, I come from back-end development. A long time actually at this stage, over 20 years of sort of Java, Python, and DevOps development. I've worked as an interim CTO for a few years prior to this. And now this first kind of full-time CTO role that I've done.

Stephen

So it's very interesting, and I guess varied background that kind of brings you to where you are today. I had a look at your website, actually, and I was intrigued, particularly in the FinTech space, which is quite a competitive market space. And at one point I thought: "Wow, quite a crowded market space around your proposition." But could you tell us a little bit more deep dive around your organization, what you're currently working on, your product, and the kind of key problems it's trying to solve?

Graham

Yeah, sure. The key problem we're trying to solve is giving merchants more options in terms of payment methods to help them converse. That's, ultimately, the goal. We're getting to a point now where the consumers come along with expectations of different payment methods that they want on sites. They almost come with their preferred methods or certain brands that they recognize that they want to use. Our original plan was to focus on the older payment methods like credit cards, first of all, then newer methods like "Buy Now, Pay Later" schemes, which exploded during the pandemic, and also supports newer APIs like open banking API, which now brings banking into the payment fold. But also look forward at what mechanisms may come up in future, like crypto and central bank digital currencies, CBDCs.

We're initially targeting kind of small to medium enterprises who probably don't have their own development department or maybe have a relationship with a development agency. So we want to give them one integration and let them try different payment methods because our thesis is that for a long time, we've only had a few payment rails, like the main credit card payment rails; banking has never really been a payment option because the process of adding in account details is quite a clunky experience for anybody; and also that kind of push method doesn't really work very well in the e-commerce environment. Our expectation is there'll be more methods like we'll have more providers in BMPL, all the banks that will be doing open banking, but they do it to different levels.

It's meant to be a standard API. It's not always implemented the same way. And we actually expect there'll be more innovation from the banks themselves in terms of APIs, which probably won't be part of the Open Bank and SPEC. It just makes, whereas it's been quite stable landscape for a long time, it actually probably will fragment more future as more competitors are coming into this, and the banks start pushing much more to use them as a trusted payment option with biometrics and everything else rather than the old credit card schemes with 3DS and the like, which has never been a very comfortable e-commerce experience.

Stephen

Okay, very interesting. I was thinking more broadly as well about FinTech and the industry. What areas of FinTech are you particularly passionate about? What do you find intriguing at the moment?

Graham

More generally FinTtech. I mean, the big problems for us right now – it's very hard to start in FinTech because of the amount of regulation compared to other industries. So this is my first pure FinTech experience, and the one thing we have to get right out of the ground is security, privacy before you do anything. We have to spend quite a lot of time going through security questionnaires with our vendors trying to achieve different compliance standards like we're pushing very hard for ISO 27001 right now, Cyber Essentials Plus, we've been through recently, which at the time was a checkbox, now it's actually a reasonable amount of work to get through.

So that's actually one area where hopefully we'll start seeing a lot more innovation with AI. A lot of the problems there actually is checking what you have, like automatically scanning your current infrastructure and landscape. But also when it comes to doing background checks on companies like KYC, KYB, anti-money laundering checks, that's one area that is still quite a tricky thing. It quite triggers working. I'm hoping with the advance in AI, some of the examples there were, around fraud in particular, that will start seeing some sort of big jumps in the next year or so, which will make it a lot easier. It's been quite a tough experience getting our product to standards and getting through a lot of these processes.

Stephen

And I think you've alluded to it a couple of times when you were saying there about innovation and AI in FinTech. But is there a headline statement for you around what you might see as the future of FinTech as we go into the kind of next five years?

Graham

Yeah, I imagine a lot more of this will become sort of automated with AI. There's quite a lot of, the kind of support side of FinTechs, which can cause a huge amount of frustration for customers, for merchants. Like we've all had experiences, they don't hold with banks and that for a long time. It's in the bank's interest to let people self-serve. And AI can take that, can jump that whole experience on massively. Up until now, it's been, having worked in sort of big organizations previously. Lots of these processes are backed by manual swivel chair or kind of green screen processes.

Now with capacity to build that tooling much more quickly with a better user experience, so hopefully users will be able to self-serve and get answers more quickly to the problems they're having. Sometimes, in FinTech especially, you have to be almost deliberately opaque around when you're trying to deal with why you're not allowing somebody to do something. You don't want to give them the information of why. In fact, it's part of our compliance – we're not allowed to. But there are many cases where we can and should give them more information, let them know like why things are happening, or just explain to them, just remove that frustration of why fees have been assessed in a particular way or why funds have had to be paused for a period of time.

Stephen

Thank you. Really interesting context around the landscape that you're operating in. I think if we come back into your organization and be a bit more specific around some of the challenges or obstacles that you face in your role in trying to achieve your goals.

Graham

The biggest thing starting a payments company in 2021, it was just the table stakes are fairly high these days. There's just a lot you need to get out of the ground. I touched on the compliance side and just how you need to build a platform up. But also when you're competing with some of the big players in this market, there's just a lot of cover, a lot of ground you have to cover before you become a viable option to another two merchants. In the past, some competitors really pushed on having a very strong developer experience. So developers can just quickly get up and test and validate that a solution is viable for them. I think now it's kind of moved on into support.

Now, it's table stakes to have the developer experience, but now you need to have that next level of support experience. And that's where, again, AI comes into it. Like how can you answer questions for people when they are having problems? You can write as many API docs and guides as you can, but people always find another question to ask, another view on the same information. And that's where AI, just with its, you know, some of the new LLMs, will have the ability to, hopefully, translate our documentation, explain our documentation more easily to people.

Stephen

I mean, even with the advance of AI, and people talk about replacing roles and not needing as much talent, but I still think we're faced very much with a talent scarcity issue within many sectors, but particularly in yours. I just wondered what your thoughts are around the potential shortage of qualified experts in the space.

Graham

Yeah, it's an ongoing problem and will be a problem for quite a long time. For me, AI doesn't threaten those roles. We see it as a productivity enhancement that now people will be able to do more with same people. Like I do a reasonable bit with AI tools writing code, not on a critical path anymore, but like on internal tooling AI stuff, and you might go to now, would be to go to ChatGPT. We use a Copilot internally as well. It's nowhere near a point yet where you can just kind of define in prompts what you want something to do. You still get code back that is invalid. You need developers to be able to understand it. Actually, having that experience to do, like a decent code review, because I think you need to see that these tools have been almost like a junior coder right now.

You can't trust what they've given you, so you have to be able to understand what's happening, and validate it, and change it, and explain to it why it was wrong. But for mid-level or senior developers, it's an amazing boost to just be able to explain quickly what you want, get something back pretty much as you want and if you need to do some modifications, you can all see where it's potentially going wrong. Now there are tasks that we probably wouldn't have prioritized previously that may have taken maybe a couple of days, and it wasn't important enough to do, but when those things become like maybe a couple of hours work or most of morning's work, all of a sudden we can do these things and add in these features that we ordinarily would have passed on.

So yeah, I don't see it as being a threat. I just think what will happen is that now we'll be able to do more. There'll be greater expectations to do more. We'll expand that. We'll be able to expand that much more quickly than we had previously. So I think starting a company now, I think it's almost going to be two generations – it’s like going to be everything before AI and everything after AI. After AI: just companies will be able to get to achieve those table stakes much more quickly than previously, which again, should lead to sort of an explosion in companies because the hurdles to getting started are lower than they were.

Stephen

Okay. So it strikes me that you're saying that people still play a really important part in our capability model. How are you finding the market with regards to accessing that talent and those skills?

Graham

It's always tricky. I mean, we started in 2021, and through that year into probably halfway through 2022 it’s incredibly difficult to hire for a startup. We're competing with much bigger brands that people always want brands on the CVs ultimately. It's nice to work for a big brand. As soon as you say it, people recognize what you do. It was a very tricky market to get going in, and that's where working with Devico was really helpful to us to be able to tap into their pool of talents very quickly and get up and running. When you hear about the kind of headline layoffs in tech, when you've been through this, actually that doesn't really match what's happening in reality. That can be just a company letting go of a bunch of contractors or sometimes the people who let go aren't their top performers anyway, so it's not like suddenly a whole slew of red-hot talent on the market. So it's not necessarily getting easier to hire good people.

Like I said early on, we're focusing on more senior people rather than junior people cause that way we just get more quickly. I forgot to mention that we're remote only. So we don't have an office, we don't even meet in real life that often. So we need people who communicate well and can just almost self-start and self-motivate. So we can give them requirements, and they know pretty much what to do that we're not having to do a lot of explanation on the domain and the technology. But being able to work with Devico just means we can get people at that level in more quickly. The guys have a really good book of developers that we can, pool of developers that we can tap into.

Stephen

Thank you. And I'd like to come back to kind of working with Devico a bit later on. But you've kind of, I guess, led us into that conversation around IT outsourcing and partnering. And I know a lot of our listeners are kind of interested in that as a proposition, but often anxious sometimes about the best way to proceed. I just wonder how much of a role you believe an IT outsourcing partner can play and must play in helping businesses achieve their goals.

Graham

Yeah, I think it comes down to the company, obviously, and what software, what part software plays in that company. For us, we're a software company. It's all about creating software products. So it's really important that we internally have a really strong grasp of how everything works. That's why, again, with the way we hire, it's with a view to being able to use outsourcing companies to be able to do other pieces that are maybe off the critical path for us. There're some functions just aren't core that we don't do internally. We use SaaS tools a lot, like we don't run our own build servers, obviously. There’re quite a lot of things in the past that we would have self-hosted, especially on the developer toolchain, and all that stuff we try to offload.

So we're not kind of wasting time on that, and we're focusing on the infrastructure and application code that we really need. Because we're remote, it almost doesn't make any difference to us whether it's someone through Devico or someone that we're employing directly. We're all remote. So it's a matter of trying to get the right person to fit into our organization rather than just thinking of I need like 20 bums on seats for this project, and like just assigning a budget to that and forgetting about it. Like we're very closely involved, and the developers that come in are very closely involved in everything that we do. I think they join our dailies.

We see it very much as an extension of our team rather than just kind of hiving off a piece of functionality that we're not interested in developing on our main roadmap. For us, it's a kind of difference. Maybe not everybody's in the same experience. Sometimes some bigger companies will have that where they just need volume of people to get through stuff, and you can offload a whole section of work with, say, a PM on top and the different roles, like from front-end, back-end, QA in one go. But our model is very tech-focused. It really is about us understanding the tech, and owning that, and bringing people into us rather than giving it away to them.

Stephen

What would you say are some of the risks to manage with regards to working with an outsource partner?

Graham

I guess the first risk for us is just dealing with things like compliance and data security. When we take on people internally, we provide devices and everything else and deal with security that way. We have to develop different policies to work with external vendors and be very careful about how we allow them to work on the source code and commit to the code base. We do allow people to work on their own hardware, but we are very careful on what we accept back in. That's always a risk on the security side for us that giving it out to people who are just slightly outside the organization. We do try and treat people like they're internal rather than external. We don't do that kind of mentality that people just see us as this is the job I'm doing for three months or six months and leave that code base out of my laptop now for the next three years. We need them to take our security seriously.

So it's always a vulnerability when you're not providing the hardware, you can just take that stuff back from them in the end. Apart from that, though, there's always a risk in the remote model taken on anybody because people can interview very differently to how they'll perform day to day. Positively and negatively, some people can cross very well and then not work out very well. Whereas actually, the reverse is more often true that people don't interview well, they struggle maybe with code sharing during an interview process, which have to do when we're working remotely but could be great employees later. So there's potential we pass on good people. But again, for us, that's not actually that different to how we resource normally.

Stephen

I just wonder if you'd give us some insight into the kind of decision-making process that you went through as a business to decide to engage with an outsourcing company and what were the kind of steps you went through to make sure you chose the right partner.

Graham

Yeah, so there're certain things that we need to do. We provide plugins to e-commerce systems, for example. As part of our go-to-market strategy, the plan is to focus on smaller to medium-sized companies early on. And mainly because if you focus on a really big consumer or merchant early on, you can kind of get dragged into just fulfilling their roadmap rather than yours. So we're keen, we wanted to get some time working with smaller companies where we could define the process that we want and make sure the features that we're working on apply more generally rather than to a specific use case of a big merchant. That's fine for getting out of the ground, but the next thing then is we do need a breadth of coverage across different payment methods in different geographies.

And also different geos will have more popular e-commerce systems. So we need to be able to react to like how the consumer wants to pay and what e-commerce systems the merchants have. But some of that stuff isn't necessary. The core platform where we integrate payment methods and that is stuff that we only ever do internally. When it comes to adding in the integrations with e-commerce systems, that's less of a specialist role. So we can go to other companies who specialize, say, in e-commerce or to more general development organizations to do those implementations for us because they can see our APIs, and see the e-commerce APIs, and do the integration piece. So there's a reasonable volume of coverage.

Again, this kind of goes back to table stakes I mentioned. There's just certain coverage you have to have, and we can increase the breadth of some of that by outsourcing. It tends to be sort of work that you do upfront. It's a fairly big piece of work upfront, and then it just slips into fairly quiet maintenance work over future, the occasional bug fix or feature enhancement. Sometimes we need to expand out our resourcing for a while to add in a new integration. And then once it's there, we can support it with our internal resource.

Stephen

Okay, thank you. Give us any sense of any particular KPIs or SLAs you might focus on when you're working with an outsourcing vendor.

Graham

For us, we don't necessarily measure the vendor in that way because we measure the individual developers instead. Like the developers do become part of the existing team rather than having a piece of work they work on. So the developers will be kind of measured in the normal way in terms of how we assess all the people internally. It's an extension of our normal engineering management function. Again, that's because of how we work. It's not as we have some work, which kind of support work, where we can more easily measure that kind of stuff. We're very engineering-focused right now. It makes that kind of ability to SLA a little bit more difficult.

Stephen

And a final question before we talk a bit more detail about your relationship with Devico, who are one of your partners. What advice would you give to any CTO or organization that was kind of just on the edge of starting to consider IT outsourcing?

Graham

Well, again, I think there are different types of CTO. It's really ambiguous. It's not like some other kind of C-suite roles. You've got people who are very technical – like I come from a development background, I still write code a lot – to people who are a bit almost more like CIOs but still have the CTO name. For me, I think it comes down to the kind of business you have, like whether it's you're trying to build a relationship with a company where you, again, you need to know these people very well and be able to communicate very well with them, or is it just a non-critical, like maybe support function where you can just create the training materials, give the access you need to maybe some internal tooling, and then you can just outsource the whole thing. That's not where we are right now. And that's a model, I think, again, over time, AI will take a chunk of that kind of support work. But you really need to look at your model and see what works for the particular environment that you're in. I think it's something that will kind of change over time. But, for me, it's very much about extending the development team.

Stephen

Okay, thank you. I'd like to move into the final section of our discussion this morning, just into your relationship with Devico. And clearly, you’d have looked at a number of different partners. There're a lot of people in this space, but I'm initially curious around what are the specific reasons that led you to choose Devico as a partner.

Graham

So like I said, I've been in this industry for quite a long time. So I used to contract for a long time and then I did some interim CTO work for a private equity firm working on some portfolio company. I've had experience with a lot of different agencies in the past and I've worked on the agency side as well. So I get a feel for different agencies, what their kind of sweet spot is. I had worked with Devico previously. I just knew I could go like... I'd met Oleg previously on another role, and I knew for the kind of thing that we wanted to do – to expand out some of the engineering roles quickly – Devico was a good place to go.

Like we wanted people, we just elaborate time. We was remote. We cover a large area with people from India to Chicago. So a lot of time zones. But one thing we've really tried to do is narrow down the engineering focus to kind of plus or minus two hours of GMT. Because trying to work with engineers you need that kind of overlap time to sit down and really discuss things, especially when you're remote, you don't get that natural kind of dissemination of information. Everything has to be kind of planned. It has to be very deliberate. So you need overlap in time. And again, with Oleg being able to find us developers in that time zone really quickly, it’s been really useful for us.

Stephen

Is there a particular example where you've noticed a change or an improvement within your organization that's benefited from the partnership with Devico?

Graham

Yeah, so Oleg, he is like he can happily jump on calls with me occasionally and tell me what to do, give me advice on what kind of roles we should be filling, or how we should be doing stuff. So It has been useful. We started off with a developer-testing mentality that developers kind of test their own work, and we really emphasize that. So as a part of the merge request process, we're making sure that the test coverage is there for everything. Because the tests kind of show what else the developer is thinking about or not thinking about. And that works to a point. But as our coverage of different solutions increases, we need to start thinking more about QA.

It's been useful running some stuff by Oleg and the guys at Devico. When you work in the agency capacity, you have the benefit of a greater sample size to see what works and what doesn't work. Sometimes when all you see is how you do things, it's sort of a trial and error. You can try something that doesn't work, you can write off that time, and waste that effort later. But it is good to get someone to say: "Look, I've seen this work. I've seen this many times. That pattern fails." And that's something that you only really get from people who've had that breadth of coverage rather than kind of the depth of working just one company for a long time.

Stephen

Okay. Are you able to share any insight as well around ultimately the impact on bottom line with regards to the partnership with Devico?

Graham

It's quite expensive for us to take people on in the way we do. We used to set up employee records schemes in different countries for different people. With Devico, it's easier for me to spin up another stream of work and get people involved in it more quickly. We have our agreement with Devico, and the quality of candidates that we get is always good. So we're not going to waste the time trying to manage that stuff ourselves. We did try some online schemes – I won't mention names – where developers can submit their CVs, and you can kind of choose who you want to interview, but it can be really time-consuming. We just get hundreds of applicants, and it's just too much. With Devico, we've got that kind of screening in place.

The guys have relationships with these guys, so they have seen them on different projects. It just saves us a lot of time. So there's two costs. There's probably three costs. There's the employee record setup costs. There's my time doing, like cutting down the number of interviews I have to do. And then there's the headline cost of the developers, like the New Yorkshire developers that slightly cheaper than if we were to resource the whole team here in London. Most of the company is in the UK, quite a few of us are in London. So we don't have an office here. But if we were to, the resource cost would be obviously way higher because then you're competing with the banks, not directly for, on day to day.

Stephen

One of the things we'd like to pride ourselves at Devico is actually going above and beyond sometimes and going that extra mile as a true partner. You have alluded to lots of strengths, but I just wondered is there a specific instance that you could recall where you think actually those guys went just a little bit further than the normal on this one.

Graham

So with Oleg, we have had some issues previously with some contractors, and Oleg has been able to get in there really quickly and sort things out for me, find replacements for things. Because, like I said in an interview, it's difficult when it's completely remote to how people actually behave when they start working with you. Often to the better, like I said, people often kind of struggle with the remote interviews. But like where it hasn't worked out, Oleg's been straight in there, on a call, talking through what the problems are, what we can do to resolve it, and sorting it out really quickly.

And again, he's been pushing us on how we should resource and test some of these things as well. Because as you get bigger, and the compliance requirements increase, like having that test resource is really useful. I come from very much the engineering part of it rather than the whole when it comes to the QA side. It's not something I've had a huge amount of exposure to, normally working on the platform below all this, where people aren't necessarily doing a lot of QA work. It's kind of binary down there: it either works or it doesn't. So yeah, it's been really useful getting his take on how we should be looking at resourcing these things in future.

Stephen

Okay. I think one of the most valuable aspects of these conversations we have with our clients is getting some insight into how we are adding value and getting the opportunity to get some feedback. I just wondered if you could kind of share with us some feedback around what we need to keep doing to ensure that we're delivering what we need or what you need from us.

Graham

I guess the difficulty with agencies, especially software development agencies, is trying to keep that sort of personal feel as you grow. I can jump on a call with Oleg very quickly, with fairly short notice. We meet occasionally as he goes on his travels to catch up with his different partners. Trying to scale that is difficult but I think it's important. Like going back to the whole AI thing, I think those kind of human relationships are going to be more important than they were in the future. And just feel that it is a relationship, and you're not just part of some massive agency's sales cycle that once you're in, and they've put some bums on seats for you, that's the last of the communication you have until it comes around to contacting or renegotiation.

We don't have internal resources. So in the past that we've done that hiring, interviewing ourselves, but with Devico kind of feel that we have a resource that can push us on what we should be doing and help us with that resourcing. And that's an important piece and something that I think, you guys, should really try hard to not lose. I think often when it comes to nearshoring to Eastern Europe a lot of the mentality is that it's just cheap, get more people in more quickly. And that's where Devico stands out as not just being that impersonal, that they're not just trying to get a team together and leave you. It has been a relationship for like a longer term, like how can we continue to meet your requirements rather than let's just get one project anyway.

Stephen

Yeah, that's a great point. Thanks for it. Thanks for adding that on as well. I appreciate it. I can't believe that 30 minutes has gone so quickly. Actually, it's been really interesting talking to you about your product, and your organization, and more importantly work with Devico. So great to meet you. Thanks for sharing your thoughts with us this morning and have a great rest of the day.

Graham

No problem. Likewise, Stephen. All the best! Have a good day!