标签：#Fin

Four days left to save up to $190 on your pass to TechCrunch Founder Summit 2026 - the ultimate founder bootcamp - before Early Bird rates end on June 26 at 11:59 p.m. PT. Register here.

Most fintech breaches you read about involve a hacker, a vulnerability, and a headline. Most fintech losses I've actually seen up close involve none of those things. They involve someone who read the terms of a cashback offer more carefully than the product team did, found the one path through the workflow nobody had tested, and quietly walked away with money the system handed over willingly. That's the part standard security testing misses. A penetration test asks: can someone break in? Business logic testing asks a more uncomfortable question: what happens if someone uses every feature exactly as designed, just not exactly as intended ? In a country processing billions of UPI transactions a month, that second question matters just as much as the first — arguably more, because nobody needs a zero-day to abuse a referral program. Here's where that gap shows up most often in Indian fintech apps. Wallet Systems: Built for Speed, Tested for Function, Rarely Tested for Abuse A digital wallet sits at the intersection of multiple money-in paths — UPI, card, net banking, cashback credits — and at least one money-out path. Every intersection like that is a place where timing and assumptions can quietly fall apart. The classic version of this is a race condition: top up the wallet and spend from it in two near-simultaneous requests, and check whether the balance check happens before or after both transactions are committed. Done right, this should be impossible. Done wrong, a user can spend money that, technically, hadn't arrived yet — or spend the same balance twice. There's a quieter version of the same problem around refunds. If a refund is credited back to the wallet on a different timeline than the original debit was finalized, there's often a window where the balance briefly shows more than it should, and a fast enough user can act inside that window before reconciliation catches up. And then there's KYC tiering. Minimum-KYC wallets in India are deliberately capped at

FinOps X 2026 , terminó hace apenas una semana y concluyó con JR Storment, el Director Ejecutivo de la FinOps Foundation compartiendo uno de los anuncios más esperados, la presentación de Tokenomics Foundation . ¿Qué es? Es una iniciativa de la Linux Foundation, que busca establecer estándares abiertos, lineamientos referentes, y buenas prácticas de forma específica para el costo en Inteligencia Artificial y el uso de tokens, así como otros elementos relacionados con esta tecnología con el objetivo de guiar a las empresas y organizaciones a optimizar su consumo de IA y generar mejores resultados en el valor tecnológico. Algunas acciones: Visualización de los costos Atribución del valor Estandarización de procesos, entre ellos FOCUS La creación de esta iniciativa surge en un momento en el que la IA, se ha colocado como una de las tendencias más relevantes, desde LATAM y otras regiones, con diferentes niveles de desarrollo, y un nivel de diversidad complejo. De forma aparente el costo de la IA puede verse reflejado en los tokens, pero la realidad es que sólo es una parte de los que representa el costo de soluciones de IA, partiendo particularmente de la estructura de costos de estas tecnología, en lo global, podemos detectar 3: Costos del modelo : Engloban los costos del desarrollo e implementación del modelo Costos indirectos : Están relacionados con el funcionamiento de un modelo a nivel organizacional Costos asociados : Integran las erogaciones, relacionadas con las puesta en marcha del modelo, pero no directamente en él, por ejemplo, la infraestructura, y servicios relacionados Dentro de cada categoría de costos, los servicios y etapas del desarrollo de IA, son variados Los servicios y etapas de la creación de procesos de IA que están involucrados en cada categoría de costos, muestran la complejidad para la creación de valor en estas iniciativas. Durante FinOps X, tuvimos diferentes charlas relacionadas con IA, el principal reto: cómo monitorear, medir, e incremen

The Quest Begins (The "Why") Honestly, I was tired of staring at charts at 2 a.m., trying to catch that perfect entry while my coffee went cold. I’d set a manual alert, jump onto the exchange, click “buy”, and then second‑guess myself as the price slipped away. It felt like I was playing a never‑ending game of Whac‑A‑Mole, and I kept losing the mole. One night, after yet another missed opportunity, I thought: What if I could offload the repetitive bits to a script? Not a fancy AI that predicts the future—just a simple bot that watches the market, checks a condition, and places an order when the condition is met. If I could automate the boring part, I could focus on strategy, learning, and maybe even get some sleep. That was the dragon I wanted to slay: the exhaustion of manual trading. The Revelation (The Insight) The big “aha!” moment came when I realized I didn’t need to build a high‑frequency trading engine from scratch. There are solid, well‑tested libraries that handle the messy bits—authentication, rate limits, WebSocket connections—so I could concentrate on the logic. Using CCXT (a unified crypto exchange library) and a touch of asyncio , I could write a bot that: Connects to an exchange (I used Binance’s testnet so I wouldn’t lose real money). Polls the ticker for a symbol at a reasonable interval. Checks a simple condition—like “price > 20 % above the 20‑period moving average”. Places a market order if the condition holds, then waits for the next cycle. It felt like Neo dodging bullets in The Matrix when the bot finally executed a trade without crashing or getting rate‑limited. The relief was genuine: I could now let the code do the watching while I worked on the next idea. Wielding the Power (Code & Examples) The Struggle – A Naïve Loop My first attempt was a blocking while True loop with time.sleep . It looked harmless, but it had two nasty traps: Trap #1 – No error handling. A network hiccup would raise an exception and kill the whole script. Trap #2 – I

Over 60% of APAC finance leaders say AI-led automation is their top priority for 2026. For Indian businesses, that stat hides a quieter truth: most SMBs have no idea which automation to start with. They hear "AI for finance" and picture an enterprise suite with a six-figure licence fee. Wrong picture. I've built finance automations for CA firms, D2C brands, trading desks, family-run manufacturers, and a few fintech startups. The pattern is always the same. Five finance processes eat the most hours, hide the most errors, and respond best to a simple Python layer on top of whatever ledger you already use. This is the playbook. No enterprise suite. No subscriptions you don't need. Each automation is something I've shipped for real clients using Python, free APIs, and a ledger that's usually Tally or Zoho Books. 1. Bank Reconciliation — The Single Biggest Time Sink in Indian Finance Every finance team I meet has the same nightmare. Statements from three or four banks. Tally or Zoho on the other side. An Excel sheet in the middle. Eight hours a month — sometimes more — matching rows. A CA friend was losing two sleepless nights before every GST deadline on exactly this. We replaced it with a Python script that pulls statements from email attachments, categorizes transactions using keyword rules, cross-references entries with Tally, and flags only the mismatches in a clean Excel file. Eight hours dropped to fifteen minutes of review. "Tu 2 saal pehle kyu nahi mila?" (Why didn't I meet you two years ago?) If your team is still opening each bank statement manually, start here. It's the highest-ROI automation in Indian finance. I've written the full workflow in how a weekend Python script saved a CA firm 209 hours during ITR season . 2. Cash Application — Matching Payments to Invoices at Indian Speeds Globally, AI-driven cash application handles up to 90% of invoice matching without human touch. In India, it's harder — money arrives in more shapes than most tools expect: UPI,

Financial advisors have a dirty secret: they spend almost half their working hours not advising anyone. The culprit? Compliance documentation. After every client meeting, advisors must document what was discussed, what was recommended, whether those recommendations were suitable, and whether they followed FINRA and SEC rules — all in a format their CRM can ingest. A 45-minute meeting routinely generates 2 hours of paperwork. I built an open-source tool that does it in about 3 minutes. Here's exactly how — every architectural decision, every trade-off, and every line of code that matters. The Problem Is More Specific Than You Think When I started talking to advisory firms, I expected "meetings take too long" or "we need better CRM software." Instead, every compliance officer said the same thing: "We're not worried about the notes. We're worried about what's NOT in the notes." The real pain isn't documentation speed — it's the compliance gap. If a client says "I can't afford to lose this money" and the advisor recommends an aggressive growth fund, that's a FINRA 2111 suitability violation. But if the note-taker (usually the advisor, writing from memory hours later) forgets that quote? No record of the red flag. This changed my entire system design. It's not a transcription tool with formatting. It's a compliance engine that listens for mismatches. Architecture Four-stage pipeline: Audio → Transcription → Structured Extraction → Compliance Check → CRM Note (Whisper) (Claude via (Rule engine) (Formatter) OpenRouter) Stack: Python/FastAPI + React frontend + Whisper (local) + Claude via OpenRouter Two key design choices: Whisper runs locally. Advisory meetings contain PII and legally privileged information. Sending audio to third-party APIs isn't optional for most firms — it's a regulatory non-starter. Compliance engine is NOT an LLM. You can't have a probabilistic system making deterministic compliance judgments. The compliance check uses hardcoded rules against structur

(or: How I Turned My Laptop Into a Lightsaber for the Market) The Quest Begins (The “Why”) Ever stared at a blinking cursor at 2 a.m., wishing you could make your laptop do the heavy lifting while you chased dreams (or just caught up on sleep)? I was there, scrolling through Reddit’s r/investing, watching folks brag about “algo‑trading gains” while I was still manually refreshing Yahoo Finance like a peasant in a medieval market. One night, after yet another failed attempt to predict a stock’s move with gut feeling (spoiler: my gut is terrible at math), I remembered a line from The Matrix : “There is no spoon.” Turns out, there is no magic either—just code, data, and a healthy dose of stubbornness. I decided to slay the dragon of emotion‑driven trading and build a bot that could execute a simple strategy while I binge‑watched Stranger Things . Spoiler alert: the first version was a hot mess, but the journey taught me more about Python, APIs, and risk management than any textbook ever could. Let’s walk through that adventure together—code, pitfalls, and all the triumphant “I‑did‑it!” moments. The Revelation (The Insight) The big “aha!” moment came when I realized a trading bot isn’t some omniscient AI that predicts the future; it’s just a disciplined executor of rules you define. Think of it as Indiana Jones whip‑cracking through a booby‑trapped temple: you set the traps (your strategy), the bot avoids them (risk checks), and grabs the idol (profit) when the conditions are right. For my first bot I chose a mean‑reversion idea: if a stock’s price deviates too far from its 20‑day moving average, I bet it’ll snap back. It’s not flashy, but it’s easy to understand, back‑test, and implement. The magic happens in three simple steps: Fetch data – pull recent price bars from a free API (I used Alpha Vantage; you can swap for Polygon, IEX Cloud, etc.). Calculate the signal – compare the latest close to the moving average and compute a z‑score. Execute – if the z‑score crosses

For young people, the trend removes the stigma of being unmarried and alone, and recasts it as something to aim for, not avoid.

Fintech lenders should verify loan documents before underwriting starts. The first pass checks the...

Fintech lenders should verify loan documents before underwriting starts. The first pass checks the...

I was building a feature that needed to say something useful about a stock — not just print its P/E, but actually read the situation: is this cheap or expensive, what's the bull case, is the insider buying real or routine. I went looking for an API. Every finance API I found sold me raw data . Alpha Vantage, Twelve Data, Yahoo Finance, FMP — they'll hand you fundamentals, prices, filings, all of it. Great. Now I get to write the part that turns 40 metrics into "this looks expensive but the moat is widening." That's the part that's actually hard, and the part I didn't want to own forever. So I'd be wiring three data providers, normalizing their conflicting field names, writing and tuning the LLM prompts, handling the rate limits and the caching, and then maintaining all of it as the upstreams change. For a feature, not a product. What I wanted instead A single endpoint. Ticker in, analysis out — already synthesized, already structured. That's what I ended up building for myself and then put on RapidAPI: Agent Toolbelt — AI Stock Research API . It pulls live fundamentals from Polygon, Finnhub, and Financial Modeling Prep, then returns a Motley-Fool-style read as typed JSON. The numbers are in there too, but the point is the verdict and the reasoning. Here's a real stock-thesis response: { "verdict" : "bullish" , "oneLiner" : "Nvidia owns the essential infrastructure for the AI revolution with a defensible software moat." , "keyStrengths" : [ "~80%+ data center GPU market share" , "CUDA moat creates switching costs" , "42 buy / 5 hold / 1 sell analyst consensus" ], "keyRisks" : [ "36.9x P/E leaves no margin for error" , "Competition from AMD and custom silicon" ], "insiderRead" : "Two executives bought ~47k shares each — meaningful open-market purchases, not routine grants." , "dataSnapshot" : { "currentPrice" : 180.4 , "peRatio" : 36.9 , "marketCapBillions" : 4452.2 } } That's one HTTP call. No data-provider accounts, no prompt engineering, no normalization layer. The

IaC tools built for single-team deployments fail structurally at 200 accounts because the failure modes are architectural, not configurational. Why 200 Accounts Is Where IaC Tools Break IaC tools built for single-team deployments fail structurally at 200 accounts because the failure modes are architectural, not configurational. Scale Threshold State Management Provider Auth Overhead Execution Time Impact ~10 accounts One backend bucket, one workspace; quirks are routable Not a meaningful bottleneck Sequential plan/apply is manageable ~50 accounts Sequential execution still viable; blast radius contained Per-account latency exists but tolerable Below threshold where parallelism is required 200+ accounts 200 separate plan operations per shared-module refactor 3-sec per-account auth × 200 = 10 min added per plan cycle Sequential Terraform applies measured at 4.1 hours end-to-end A 10-account environment forgives sloppy state management. One backend bucket, one workspace convention, one pipeline. Engineers learn the tool's quirks and route around them. At 200 accounts, those same quirks compound. Why the threshold is 200 State lock contention, cross-account provider authentication chains, and module resolution latency stack on top of each other. The result is not slower deploys. It is non-deterministic deploys, which is operationally worse. The specific threshold matters. Below roughly 50 accounts, most teams run plan and apply sequentially without parallelism because the blast radius of a runaway apply is contained. Above 200 accounts, sequential execution becomes untenable. We measured a 200-account org where sequential Terraform applies across all accounts took 4.1 hours end-to-end. That latency made emergency remediation impossible inside a standard incident window. Three compounding failure modes State file proliferation. Each account carries its own state file, and each state file is a consistency boundary. At 200 accounts, a single refactor touching a shared modu

Anthropic's popularity with business users is growing so well that the latest beef with the government might actually boost it, data from Ramp suggests.

TL;DR Provider invoices aggregate by model and billing period. They cannot tell you which team, product, or agent caused a cost spike. Request-level AI cost attribution links every API call to structured owner metadata (team, product, environment, trace ID) so investigations take minutes, not days. Three approaches exist: provider dashboard, gateway log enrichment, and application trace attribution. They differ sharply in setup cost and query granularity. Gateway log enrichment is the highest-leverage first step for most teams. It requires no changes to application code and covers all traffic behind the gateway. Real example: a platform team at a 60-person AI company discovered that 31% of their $18k/month spend came from a misconfigured retry loop in a background job, identified in under 20 minutes once request-level logs were searchable. Why Your Invoice Is Lying to You Your OpenAI invoice for last month shows $22,400. Your Anthropic invoice shows $6,800. Total: $29,200. Your CFO wants to know which business unit owns each line. You forward the invoices to your finance partner, who forwards them to three engineering managers, who reply with estimates that sum to $24,000 and do not match any real allocation. This is the standard state of LLM spend governance at companies between $5k and $50k per month in AI API costs. The invoices arrive, the spend is real, and attribution is a spreadsheet exercise done with guesses. The problem is structural. Provider billing aggregates by model and by billing period. It has no concept of your internal ownership model, your product boundaries, your tenant hierarchy, or your agent topology. A single gpt-4o line in your invoice might represent spend from a customer-facing chat feature, an internal summarization service, a nightly batch job, and three developers running experiments against production endpoints. You get one number. You have four or more owners. Request-level AI cost attribution is the practice of enriching every API c

African payments infrastructure company Flutterwave has hit a new valuation and landed blockchain company Ripple as investor and partner.

Unlike many of his tech industry peers who have cut thousands of jobs citing the need to restructure to make the most of AI, Robinhood's CEO Vlad Tenev conspicuously made no mention of AI in his note about layoffs.

Intro If you work with real-time financial tick data via WebSocket long connections, you’ve probably run into frustrating hidden issues: Connections show as online, but data stops flowing. Adding/removing trading symbols triggers connection storms. Minor network glitches break your data pipeline without obvious error logs. Today I’ll share a practical Python solution built around single-connection dynamic subscription and heartbeat timeout detection . We use alltick api as our example throughout this post. I’ll cover real production pain points, architecture, full runnable code, common bugs and optimization results. All code can be directly used in your projects. Real Production Pain Points & Background My team maintains real-time data pipelines for stocks, forex and cryptocurrencies. A core requirement is to add or remove monitored trading symbols on demand. At first, we created one independent WebSocket connection for each symbol. This simple approach caused a lot of problems in production: Bulk symbol updates create frequent connection creation and destruction, leading to reconnection storms and high network load. Ghost subscriptions: Data keeps coming even after you send an unsubscribe request. False-alive sockets: The connection status stays connected, but tick data stops completely. Your analysis logic runs on invalid data. We refactored the architecture to use one single persistent WebSocket connection for all symbols, plus an independent thread for heartbeat monitoring. After the upgrade, all hidden connection issues are gone, and the system runs stably under high-frequency data traffic. 4 Common WebSocket Issues in Fintech Let’s break down the most frequent problems when using WebSocket for financial streaming. 1. Connection Flood & Reconnection Storms Rebuilding connections every time you update symbols causes endless handshakes and closures. It wastes system resources and makes the entire data stream unstable. 2. Undetectable False-Alive Sockets Network j

Salesforce says it wants to use Fin's team and technology to improve Agentforce, its existing enterprise platform that businesses can use to build custom AI agents that automate tasks.

TL;DR OOMKill is a reporting artifact, not a root cause. By the time the kernel logs the kill event and your alerting pipeline fires, the service already degraded for every user who hit The Alert You See Is Not the Problem You Have OOMKill is a reporting artifact, not a root cause. By the time the kernel logs the kill event and your alerting pipeline fires, the service already degraded for every user who hit it in the preceding minutes. Operators page on the kill. The latency damage is already done. Aspect What Operators Observe What Actually Happens OOMKill event Alert fires; pod is restarted Kill is the kernel's final action after degradation is already complete Silent pressure window No alert fires; no dashboard turns red p99 latency climbs as allocator contention serializes parallel work Incident attribution Logged as "OOM, increased limit"; latency spike blamed on network or dependency Root cause (limit headroom erosion) goes unaddressed; pattern repeats Limit headroom over time No automated signal warns of erosion Gap between working set and limit shrinks as traffic grows or data shapes shift Recommended alert threshold Triggered at kill event Trigger at 80% headroom consumption before kernel involvement The mechanism works like this. Kubernetes memory limits define a hard ceiling enforced by the Linux kernel's cgroup subsystem. When a container's resident set size approaches that ceiling, the kernel does not wait. It begins refusing new memory allocations. Silent pressure window The application's allocator blocks, retries, or falls back to slower paths. Garbage collectors in JVM and Go runtimes trigger earlier and more aggressively because the heap has no room to grow. Each of these responses adds latency to in-flight requests before a single OOMKill event appears in your logs. The kill is the kernel's final action after the application has already been running degraded. Silent pressure window. The interval between first memory pressure and pod termination is

There’s something uniquely beautiful about old books. The smell of weathered paper, the texture of...