GRA · Fintech Nexus
Spatial financeWhere capital meets hazard, exposure and transition
Analysis and uncertainty
Fintech Nexus methods read technology risk in financial terms: dependency mapping of services and providers, outage and recovery analysis, model risk review for machine-learning credit and fraud models, and run dynamics for digital money. This page sets out what each method can show, and where public data stops.
Analysis and uncertainty in five parts.
The methods in use.
- 01Payment and financial market technologyDependency mapping of a payment chain · Liquidity stress simulationApplied here
- 02Distributed ledgers and digital assetsSettlement finality analysis · On-chain flow and reserve reconciliationApplied here
- 03Artificial intelligence and machine learningCredit and fraud model evaluation · Drift and challenger monitoringApplied here
- 04Cybersecurity and cryptographyThreat-led penetration testing · Supply chain and dependency analysisApplied here
- 05Digital identity and public digital systemsAssurance-level mapping · Remote proofing attack testing · Exclusion analysisApplied here
How fintech risk is studied at sector level.
| Method | Use |
|---|---|
| Dependency mapping | Service-to-provider graphs for concentration analysis |
| Incident data analysis | Outage and cyber incident reports in common formats such as the FSB FIRE format |
| Model governance review | Documentation of credit and fraud models against SR 26-2, PRA SS1/23 and the EU AI Act |
| Inclusion measurement | Account ownership and digital payment use from public survey data such as the Global Findex |
How the process runs.
Process explorer · Process
Analysis and uncertainty: Source to evidence record
10 steps·4 stages·2 gates
Process
Analysis and uncertainty: Source to evidence record
A source is registered and assessed, its record labelled and classified, and a Digital Evidence Passport carries provenance; a correction reaches every dependent record.
01 Intake
- 01Identify the sourceSource · The source stewardDiscovery is not ingestion. Source identification records the source class, steward, institutional role and jurisdiction.
- 03Register the sourceStepRegistration makes a discovered source a governed participant in the evidence lifecycle. It implies no endorsement or certification.
02 Assessment
- 04Jurisdiction and rights classificationGateRights classification identifies licence, consent, confidentiality and reuse limits. The result determines access and routing.
- 05Evidence quality assessmentStepQuality assessment decides whether a record is fit for a defined use. Quality is multidimensional and never a single score.
- 06Evidence labelStepEvery finding carries one of nine evidence labels. Missing data is shown as missing, never as zero.
03 Record
- 07Evidence classificationRecordClassification gives records lifecycle states, such as source-verified, public-safe or restricted. States can coexist and set evidence use.
- 08Source release and identifierRecord · NXS-GRX (canonical data, provenance and risk)A source release records rights, temporal coverage and source lineage. A UNI is allocated through a catalogue and never typed by hand.
- 09Digital Evidence PassportRecordThe passport records provenance, quality, rights, jurisdiction, permitted use and history, so evidence keeps its context when it travels.
04 Use and correction
- 02Correction reaches dependent recordsStep · NXS-GRX (canonical data, provenance and risk)A source correction propagates to dependent cuts and products without rewriting old results.
- 10Public-safe reviewGatePublic-safe review decides whether a record can be shared publicly. It is a distinct stage and is not validation.
Data protocols: evidence lifecycle · Data protocols: core data objects and evidence records · The Global Risks Index (NXS-GRX)Designed programme process, not a record of operation. No cycle has run and every programme is at service level R0. A gate is a programme decision, never a public-authority approval, certification or deployment authorisation. The data-protocol pages describe a design, not a running system.
What public data cannot show.
Firm-level incident and dependency data are mostly confidential to supervisors. Sector research therefore works from public incident reports, published outsourcing registers where they exist and modelled networks, and states that limit. Inclusion work continues at financial inclusion.
How uncertainty is reported.
- 01
State assumptions
Each analysis lists its assumptions and the data it depends on.
- 02
Quantify where possible
Ranges and confidence are reported alongside central estimates.
- 03
Validate and compare
Models are checked against observations and, where possible, against other models.
- 04
Publish limits
What an analysis cannot show is stated beside what it can.
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- FSB Cyber Lexicon and format for incident reporting exchange (FIRE)
- US interagency revised guidance on model risk management, SR 26-2 (April 2026), superseding SR 11-7
- EU AI Act (Regulation 2024/1689) as amended by the AI Omnibus, Regulation 2026/1744 (credit-scoring high-risk duties from 2 December 2027)
Questions and answers.
Are the methods open?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.