European financial institutions are reassessing the foundations of their security architecture, and independence from non-European providers is becoming a central question. In an interview at it-sa in Nuremberg, Dr. Claudio Marforio, co-founder and CEO of Zurich-based identity-security specialist Futurae, argued that digital sovereignty in the financial sector starts with identity management.
A changing mood in Nuremberg
Marforio sees a shift in how European companies, including many Mittelstand firms, view their technology dependencies. In IT security, the largest vendors have long come from the United States or Israel. Geopolitical tensions, however, have shown that partners of today may pursue different interests tomorrow. “Being independent from large players that could be friends today and could not be friends tomorrow is extremely important,” Marforio said. US solutions remain valid, he stressed; the point is to have European alternatives.
For financial services he prefers “independence” to “sovereignty”: how much of a bank’s security stack rests on platforms whose terms can change?
The platform dilemma
Anyone using a smartphone operates inside the ecosystem of Apple, Google or Microsoft, and these companies offer secure, usable authentication. “There’s nothing wrong with them,” Marforio said. The problem lies elsewhere: a bank that hands customer verification entirely to a third-party operating system also hands over part of its customer relationship. “You want to own the relationship to your customers,” he said, calling the outsourcing risky from a strategic, commercial and liability perspective.
According to Marforio, Futurae positions itself as a specialised vendor for financial services. It follows requirements set by the European Banking Authority and the EMVCo standard, and tracks regulatory change such as the step from PSD2 to PSD3.
Security versus usability
Security and usability have always been at odds, Marforio explained: “The most usable systems are typically not secure. The most secure systems are typically not very usable.” Futurae grew out of ETH Zurich research aimed at strong security without sacrificing usability.
Passkeys based on FIDO2 illustrate the tension. They cryptographically prevent phishing, but they rely on platform-specific solutions from Apple, Google and Microsoft. Users with older devices must fall back on less secure options. In banking, passkeys can authenticate a login but cannot yet confirm a transaction such as a card payment or a transfer.
Futurae therefore adds further methods, including push notifications, QR-code authentication and risk-based authentication using contextual signals, so that every customer can reach their bank. Such signals, for instance a user’s usual behaviour and location, raise security without extra steps. Users, Marforio noted, simply want to pay a bill, not think about security. The company is a member of the FIDO Alliance, where it says it pushes for financial-services requirements, and it helps customers move away from SMS one-time passwords, which it does not consider secure.
Deepfakes at the help desk
AI-generated voices are increasingly used against support hotlines to obtain MFA resets. Marforio says he now stays silent on calls from unknown numbers, since seconds of speech suffice to clone a voice. Futurae does not use biometrics of its own for this. Instead, it passes contextual information to the bank to show that, for example, a new device activation or a help-desk call takes place in a known, safe context. If an attacker impersonates a customer from a different place and without the usual interaction patterns, the anomaly becomes visible and the bank can block the operation. Marforio said the processing is designed to preserve privacy.
Compliance by design
Futurae offers a cloud-only service; on-premise deployment is not an option, which Marforio called an early hurdle that financial institutions now accept more widely. Measures he named: data is processed in transit and stored at rest within European jurisdiction, cryptography follows established standards with preparation for post-quantum threats, and customer tenants are technically separated. Staff access to customer data, his own included, requires internal approval that is logged and auditable.
Contractually, customers receive a DORA addendum or a GDPR agreement. Futurae acts as sub-processor, so a bank can pass on claims such as deletion or audit-log requests. Marforio noted that he is not a lawyer and that legal statements would be checked by the company’s legal team.
Build the bank, not the authentication
With AI coding tools, some institutions may be tempted to develop security functions themselves. Marforio advises against it: “If you’re a bank, focus on building the bank.” Authentication, transaction confirmation and fraud detection are hard problems, he said, and they change with regulation and with attackers alike.
Futurae’s new product, Trust Signals, passes contextual data directly to customers so they can feed it into existing fraud processes, with the aim of lowering fraud and false positives. “In the end, our goal is making the European ecosystem safer online whenever there is a digital operation,” Marforio said.
Dr. Dietmar Müller is an experienced IT journalist and editor-in-chief of Beyond Buzzwords. He has decades of expertise in the German and international IT markets, as well as extensive editorial experience at renowned publishing and media companies such as Springer, IDG, and CBS Interactive. Whether writing cross-media technical articles, conducting in-depth analyses, or conducting insightful interviews—whether at his desk or in direct dialogue with industry leaders—Dr. Dietmar Müller is right at home in the world of enterprise IT. His key areas of focus include enterprise IT and OT architectures, the cloud, ERP, MES, data centers, cybersecurity and compliance, industrial automation, and AI governance, among others.