Embedding Governance, Risk and Compliance into IT strategy: a strategic imperative

Written in collaboration with Carla Santos, a member of The Blog team.  As financial services continue to evolve, the need for innovative solutions has become paramount rather than a luxury. Yet, in their race to deliver cutting-edge digital services, financial institutions face a familiar tension: how to remain agile and …

Empowering banks through a business-led technological transformation

Leonard couldn’t lull himself into dreamland. His bedside clock kept reminding him of the unforgiving passage of time—it was now 5am—and he was getting more and more jittery. You see, later that day, his team would receive training on Artificial Intelligence (AI) and how to use it in their department. …

Cybersecurity Days: The five ideas that resonated the most with us

Recalling the saying, “It’s not a matter of ‘if,’ but a matter of ‘when’,”  when it comes to cybersecurity, isn’t pessimistic. On the contrary, it’s fairly realistic. Technology developments are a gale that is constantly changing not only how we live but also how we are. With great advancements come …

When the Financial Action Task Force (FATF) comes to town

Let’s talk about money laundering, baby.   We bet that got your attention. But being connected to money laundering in any way is not the kind of attention that individuals, businesses and— arguably more importantly — financial centres like Luxembourg want. At all.   There was a funny post on social media …

The GDPR, one year after

“Virtue is more feared than vice, because its excesses are not subject to regulation of conscience” stated Adam Smith. Aren’t laws, after all, trying to limit any potential excesses of our conscience? Innovation and regulation are bound to play the cat-and-mouse game. And you can easily figure who tries to …

Threat-Led Penetration Testing: lessons from advanced cyber resilience exercises in the financial sector 

Threat-Led Penetration Testing (TLPT) has become one of the most advanced cyber resilience exercises conducted in the financial sector. With the entry into application of the Digital Operational Resilience Act (DORA) in January 2025, these exercises now form part of the regulatory framework for certain financial institutions across the European Union.  TLPT represents a …

Scaling data reuse: Data Governance guardrails for a FAIR future

In an article we recently published in IT Nation, PwC data experts explored Luxembourg’s ambition under Accelerating digital sovereignty 2030, a national push to strengthen capabilities in data, AI. The direction is clear: digital sovereignty requires control, trust, and value creation from data.  But strategy alone does not create impact. It sets intent, not execution. Data must be …

Back to Top