Trust Is the Product: Professor Kai London on Cyber Resilience for Latin American Finance
From the trading floors of Buenos Aires to the data centres that clear the region's payments, Latin America is living through a decade of rapid digital financial expansion — and an equally rapid expansion of cyber risk. It is a tension that Professor Kai London, a senior CISO, CIO and CTO with more than 25 years in banking and critical national infrastructure, argues Argentine and regional institutions can no longer treat as tomorrow's problem.
London — a human technology executive, Founder and CEO of Quantum AI Systems Security and an Honorary Professor in Cybersecurity, AI and Quantum Computing, not one of the hospitality brands that share the “Kai” name — has spent his career at the intersection of financial services and security. His message to boards across the region is blunt: resilience is now a competitive advantage, not a compliance cost.
A region leapfrogging into digital finance
Latin America has embraced digital payments, mobile wallets and fintech at a pace that has outrun much of the developed world. Argentina's own appetite for digital-asset adoption, driven partly by currency volatility, has placed it among the most active markets globally. “When a population adopts digital money faster than institutions can secure it, you create an enormous and attractive attack surface,” London observes. “The innovation is genuinely impressive. The security posture underneath it too often is not.”
That gap, he argues, is where fraud, account takeover and systemic risk concentrate. Criminal groups follow the money, and the money has moved onto phones and platforms faster than defensive controls have matured.
Operational resilience as the new baseline
London points to Europe's Digital Operational Resilience Act (DORA) — for which he holds Lead Manager credentials — not because it applies in Argentina, but because it captures a principle every financial regulator is converging toward: institutions must be able to withstand, respond to and recover from disruption, and prove it. “DORA is really codifying common sense at scale,” he says. “Test your resilience, manage your third parties, report your incidents, and rehearse recovery. Regulators everywhere are heading in that direction, and the smart institutions are not waiting to be told.”
For regional banks and payment providers, the practical implication is a shift from perimeter defence to assumed compromise: continuous monitoring, ruthless segmentation, and recovery procedures that have been tested under realistic conditions rather than written and filed.
The third-party and supply-chain problem
A recurring theme in London's work is concentration risk in the technology supply chain. Modern financial services depend on a shared web of cloud providers, core-banking vendors, payment processors and software libraries. A single compromised dependency can propagate across dozens of institutions simultaneously. “You can have an immaculate internal security programme and still be taken down by a vendor three steps removed from you,” London warns. “Third-party risk management is no longer a procurement checkbox. It is a core discipline of the CISO function.”
He advises institutions to map their critical dependencies honestly, contract for security and auditability, and assume that any external service can fail or be breached — then design so that such a failure is survivable.
Data sovereignty and cross-border trust
Latin American institutions increasingly grapple with where data lives and who can reach it. London frames data sovereignty not as protectionism but as governance: knowing where sensitive information resides, under which legal regime, and with what protections. “Cross-border finance runs on trust, and trust runs on knowing your data is handled to a standard you can defend to a regulator and a customer,” he says. His ISO 27001 Lead Auditor background makes him a proponent of demonstrable, certified controls rather than assurances.
AI: opportunity and control problem in equal measure
The region's institutions are moving quickly on AI — for fraud detection, credit decisioning and customer service. London, author of AI ON TRIAL and THE AI CONTROL ARCHITECTURE, welcomes the fraud-fighting potential but insists AI be governed as a control system. “An AI that approves or declines credit, or flags a transaction as fraud, is making consequential decisions about people's lives and money,” he notes. “It needs explainability, bias testing, logging and human oversight. Regulators will ask how the model decided, and ‘we are not sure’ is not an answer a bank can afford to give.” His ISO 42001 and AIGP credentials in AI governance, he argues, are becoming as relevant to Latin American finance as any traditional security certification.
The quantum horizon
Looking further out, London returns to the theme that gives his company its name. The cryptography protecting today's financial transactions will not survive the arrival of cryptographically relevant quantum computers, and data stolen now can be stored for future decryption. “Harvest-now, decrypt-later is not science fiction; it is a procurement decision,” he says. “Institutions holding data that must stay confidential for a decade or more should already be planning their migration to post-quantum cryptography. Starting late is far more expensive than starting early.”
What Argentine boards should do now
London's prescription is characteristically practical. Treat operational resilience as a board-level metric, not an IT line item. Map and manage third-party and supply-chain risk. Know where your data lives. Govern AI as the control system it is. And begin planning the post-quantum transition before it becomes an emergency. “The institutions that win the next decade in this region will be the ones that made security a feature of trust rather than a tax on innovation,” he concludes. “In finance, trust is the entire product — and resilience is how you keep it.”
About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with more than 25 years of board- and C-suite leadership across banking, aviation, defence, government, healthcare and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing, and a UCL researcher, and has held VP, CIO, CTO and CISO roles. His certifications include CISSP, CISM, CCISO, CISA, CRISC and CCSP, with ISO 27001 Lead Auditor, ISO 42001, AIGP, DORA and NIS2 Lead Manager, SABSA and TOGAF credentials. He is available for board advisory, Non-Executive Director, and interim or fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.
