Sicurezza contro praticità nei servizi finanziari: trovare il giusto equilibrio

Although ensuring regulatory compliance is a challenging task in its own right, financial institutions and finanza integrata providers must clear yet another hurdle – providing customers with a seamless experience. What complicates matters is that seamlessness is not a one-size-fits-all proposition. For some customers it means fast access to services through an easy-to-use interface. For others it means having complete confidence in the security of their data and funds.

This is the core tension in the security vs convenience debate: the measures that make a platform more secure often add steps that make it less convenient, and the features that make it more convenient can reduce security. Neither can be ignored – but they do not have to be mutually exclusive.

This article explores the relationship between security and convenience in financial services, how to think about the trade-off, and practical approaches to achieving a workable balance – drawing on insights from Viktorija Mažūnė, Customer Experience Director at ConnectPay.

What is the relationship between security and convenience?

The relationship between security and convenience is often described as inversely proportional: the more secure a system is, the less convenient it tends to be, and vice versa. Every additional authentication step, document requirement, or verification check adds friction. Every friction point is a potential drop-off.

In financial services this tension is particularly acute. Regulatory requirements – KYC, AML, strong customer authentication under PSD2 – are non-negotiable. Businesses cannot simply trade away compliance for a smoother user experience. But they can make significant choices about how those requirements are implemented and communicated, which determines whether customers experience them as reasonable safeguards or unnecessary obstacles.

Multifactor authentication (MFA) is a good example of this balance. MFA significantly reduces the probability of unauthorised account access – but it also requires an extra step at login. Risk-based authentication addresses this by triggering MFA only when a risk signal is detected, preserving convenience for low-risk interactions while applying additional protection where it matters most. Similarly, Single Sign-On (SSO) reduces the burden of multiple passwords across systems while maintaining access security. Context-aware authentication and passwordless methods go further, providing stronger security while being more convenient than traditional password-based login.

The key insight is that security and convenience do not have to be binary opposites. The goal is to design systems where security measures feel natural, proportionate, and well-explained – rather than arbitrary or obstructive.

Why security must come first in financial services

As Viktorija Mažūnė, Customer Experience Director at ConnectPay, explains, the starting point for any financial institution or embedded finance provider should be security – and convenience should be built around it, not the other way around:

“This is very important. Not only because financial institutions must satisfy very high regulatory standards, but also because of the rise in cybercrime. You don’t want clients coming to you with complaints about questionable security they’ve been hearing from their own customers. And while it is true that putting security first typically involves making compromises with regards to convenience, there are steps you can take to find a good balance.”

This framing matters. The security vs convenience debate is often treated as a negotiation between two equal priorities. In financial services it is not – security is the foundation, and convenience is built on top of it. Strict security measures can slow down processes and create friction that affects user experience, but the alternative – a breach, a compliance failure, a fraud incident – is far more damaging to customer trust and business viability than a slightly slower onboarding flow.

That said, Viktorija is clear that the quantity of security measures required is more or less fixed by regulation. What is not fixed is their experiential quality – and that is where businesses have real room to improve:

“It’s like this. Prioritising security does involve putting several, let’s be honest, somewhat inconvenient measures in place. So there’s that. All the same, you can file off their sharper edges and distribute them differently, thereby achieving an excellent result.”

Balancing security and convenience in practice

There are several practical strategies that allow financial institutions and fintech platforms to achieve a better balance between security and convenience without compromising compliance.

Frame security requirements from the customer’s perspective

One of the most effective levers in the security vs convenience equation is communication. When businesses explain security requirements in terms of what the customer gains – rather than what the institution needs – compliance rates improve significantly.

As Viktorija explains: “Customers aren’t terribly interested in what you need. What they want from embedded finance is the same thing they want from a car – they want it to work and to have access to quality support if and when something goes wrong. But no car owner is ever going to say ‘I want to do paperwork, even when it’s not strictly required’. However, if you explain to customers how this will benefit them – and save them a headache in the future – they usually agree to do what you’re asking of them – and enthusiastically so. Is this part of convenience? I think so.”

This approach is particularly important during onboarding, where the compliance burden is heaviest. For smaller businesses that lack dedicated administrative teams, gathering and submitting documentation can be a genuine obstacle. Reframing it as something that protects them – rather than a box the platform needs to tick – changes the dynamic meaningfully.

Use risk-based and context-aware authentication

Applying the same level of security friction to every interaction is inefficient and unnecessary. Context-aware authentication triggers additional verification only when a risk signal is present – an unusual login location, a new device, an atypical transaction pattern. For low-risk interactions, the experience remains seamless. Security is heightened precisely where it is needed.

Risk-based authentication follows the same principle: MFA is required only when a risk is detected, rather than at every login. This preserves convenience for the majority of interactions while applying stronger controls where the threat is real.

Implement authentication tools that do both jobs

Several modern authentication approaches improve both security and convenience simultaneously:

• Passwordless authentication – eliminates the weakest link in credential security (the password itself) while being faster and easier for users than entering complex passwords. NIST now recommends changing passwords only when compromised, rather than on a fixed schedule – recognising that frequent mandatory changes often lead to poor security habits
• Biometric authentication – fingerprint and facial recognition are both faster than password entry and significantly more secure
• Single Sign-On (SSO) – reduces the number of credentials users must manage, lowering password fatigue while maintaining access security

Sequence compliance requirements intelligently

The timing and sequencing of compliance steps is one of the most underutilised tools in the convenience vs security balance. Viktorija explains the practical difference this makes:

“Having a user-friendly, well-integrated, and graphically attractive interface certainly helps with getting customers to submit the required information. But your options don’t just end there. For instance, if you’re working with large businesses that generate huge revenues, you should probably stick to onboarding them right away. On the other hand, if your client base mostly consists of smaller companies, you can ask relatively few of the mandatory questions first, and dole out the rest later, one by one, as your relationship develops.”

This progressive disclosure approach – collecting the minimum required information upfront and gathering additional data as the relationship develops – reduces the perceived burden at onboarding while still achieving full compliance over time.

What are the 5 D’s of security?

The 5 D’s of security is a framework commonly used in physical security that translates well to digital and financial security contexts. The five principles are:

1. Deter – discourage threats before they materialise through visible security signals, clear policies, and strong authentication requirements
2. Detect – identify threats and anomalies in real time through monitoring, transaction surveillance, and fraud detection systems
3. Delay – slow down potential attackers through layered security controls – MFA, step-up authentication, transaction limits – giving detection systems time to respond
4. Deny – prevent unauthorised access through access controls, KYC verification, sanctions screening, and AML monitoring
5. Defend – respond to and contain threats through incident response procedures, customer support, and rapid account protection measures

In financial services, each of these principles must be applied while minimising unnecessary friction for legitimate users – which is precisely what risk-based and context-aware security approaches are designed to achieve.

What are examples of convenience in financial services?

In financial services, convenience manifests across multiple touchpoints in the customer journey. Common examples include:

• One-click checkout – stored payment details that allow customers to complete purchases without re-entering card information
• Instant account opening – automated KYC that verifies identity in minutes rather than requiring in-branch visits or lengthy document submissions
• Mobile banking and digital wallets – access to account management, payments, and financial tools from a smartphone without visiting a branch or website
• Biometric login – replacing passwords with fingerprint or facial recognition for faster, easier authentication
• Real-time notifications – instant transaction alerts that give customers visibility without requiring them to log in and check manually
• Single Sign-On – access to multiple services with one set of credentials
• Automated recurring payments – subscriptions and regular bills managed automatically without requiring manual action each month

Each of these features reduces friction in the customer experience. The challenge for financial institutions is delivering them while maintaining the security standards that protect customers and satisfy regulators.

The balance between security and convenience at ConnectPay

At ConnectPay, the balance between protection and customer convenience is managed at the infrastructure level. By embedding KYC, AML monitoring, and compliance directly into the platform, ConnectPay removes the burden of compliance from client businesses while ensuring that security standards are consistently met across every customer interaction.

This means clients do not have to choose between a secure platform and a convenient one – both are built into the same infrastructure. The security measures that protect their customers are handled by ConnectPay’s licensed compliance systems; the customer experience is shaped by the client’s own interface and communication approach.

If you want to explore how ConnectPay manages the security and convenience balance for your platform, get in touch with our team.

FAQs: Security vs convenience