Cybersecurity and digital transformation risk
Cybersecurity breaches and ransomware incidents are rising worldwide. The financial services industry (FSI) is the second-most impacted industry globally.73 The average cost of each breach in FSI is touching an all-time high of US$5.9 million.74 While AI innovations are bolstering cybersecurity, they are simultaneously being misused by cybercriminals. Some of the AI-enabled threats include:75
- AI deepfakes
- Adversarial AI tools like WormGPT and FraudGPT (also called AI-as-a-Service)
- Ransomware-as-a-Service
- Identity fraud
- Vishing (Voice Cloning-as-a-Service, or VCaaS)
Investment management firms are mitigating cyber risks by updating their security policies, training staff to identify possible AI-enabled cyber frauds, and modernizing systems to counter new threats.
Using AI and modernizing threat detection technology have allowed firms to respond faster and lower the cost of data breaches.76 D Commerce Bank drove digital transformation with AI-driven cybersecurity solutions and experienced a 50% drop in security alerts.77 As part of its digital transformation journey, Mercury Financial partnered with a leading cybersecurity vendor to work toward a goal of zero downtime due to ransomware or malware attacks.78
Investment managers are taking action to tackle cybersecurity threats such as AI model validation, model maintenance, data control, data quality, and retention issues.79 Internally, firms are focusing on role-specific upskilling and bringing different AI risk governance areas under a single AI leader.80 As AI continues to play a critical role, investment management firms such as AllianceBernstein and Morgan Stanley have created chief AI officer positions.81 This new position is being added to firms across industry to help manage AI and gen AI deployment, with a focus on improving efficiency and managing AI-related risks. These risks include those that come with AI deployed internally and AI deployed across the extended enterprise.
Evolving industry landscape and associated risks
In 2025, risks are expected to emerge through multiple sources. Growth in direct indexing solutions and separately managed accounts (SMAs) bring both strategic and financial risks to many investment management firms.82 By 2026, the AUM of direct indexing and SMA platforms is expected to reach US$825 billion and US$2.5 trillion, respectively.83 Utilization of these platforms has the potential to enable wealth managers to disintermediate investment managers. At a minimum, they could have the tendency to commoditize the pricing of portfolio management services, representing both strategic and financial risks in the FORRESTT framework.
The recent flurry of mergers and acquisitions serves to help manage this disintermediation risk. Investment management firms such as Morgan Stanley and BlackRock have acquired firms such as Parametric and Aperio to bolster their SMA capabilities.84 These acquisitions are intended to help with the vertical extension of product and service lines potentially increasing revenues and satisfying customer preferences while mitigating both strategic and financial risk.
Customer preferences and regulatory change are contributing to firms transforming their product lines from mutual funds to ETFs. Mutual fund-to-ETF conversions, initiated by Guinness Atkinson in March 2021, have seen more than US$60 billion in assets make the transition, including conversions by investment firms such as JPMorgan, Franklin Templeton, Fidelity, and Dimensional.85 Some of the potential benefits of ETF conversions over ETF launches are the ability to retain fund performance track record and brand recognition while lowering operational costs and enhancing tax efficiency for existing investors.86 There is operational risk associated with these conversions that some firms have been able to manage. Some of these operational risks include managing fractional shares, brokerage account requirements, and distribution channel differences such as corporate retirement plans (for example, 401[k]).87
Investment managers are spending more on alternative data as they reach out to technology partners to combine and analyze alternative data to fulfill their core mission to generate alpha.88 A staggering 98% of investment professionals surveyed say they recognize the critical role of alternative data in generating alpha.89 However, the digital transformation effort to harness this data is not a siloed endeavor. It often requires stakeholder collaboration across the organization to integrate diverse alternative data sets effectively.90 The successful implementation of a data strategy could hinge not just on acquiring the right data but on curating and synthesizing it to distill actionable insights.91 These projects carry risks associated with change management as well as extended enterprise and regulatory risk. The journey to incorporating alternative data is itself a strategic risk as those that fall behind are likely to be at an information disadvantage in the marketplace.
As traditional investment managers venture into the realm of private assets, they find themselves in direct competition with seasoned private equity firms.92 Firms such as Fidelity International and Manulife Investment Management are forming strategic partnerships and acquiring alternative investment management firms.93 However, the integration of traditional and alternative investment management poses its own set of challenges. Traditional investment managers typically operate under compensation structures, investment horizons, and decision-making processes that may vary from their alternative counterparts.94 For instance, traditional investment managers often focus on relatively liquid assets and may have compensation tied directly to short-term performance metrics. In contrast, alternative investment managers may take a longer-term perspective—one where the compensation structures reward long-term value creation and are often tied to the eventual success of the investment. Post-merger integration and resulting economies of scale may prove to be difficult to achieve due to the potentially incompatible cultures. Tempering financial expectations may prove to be the prudent path for these alternative and traditional manager mergers.
Environmental, social, and governance (ESG) factors pose a strategic risk to investment managers due to regulatory and client reporting uncertainties. Investment managers are facing significant challenges in ensuring data reliability and dealing with the uncertainties in measuring the outcomes of sustainability initiatives for their regulatory and client reporting.95 In order to help manage risk associated with data reliability, investment management firms can incorporate a detailed bottom-up proprietary analysis to support their internal ESG ratings. Investment managers are also likely to trust audited corporate disclosures along with their internal sustainability metrics.96 On the regulatory front, having detailed policies, procedures, and governance models that ensure compliance can potentially manage some of the regulatory and reputational risks with funds marketed with a sustainability-related mandate.