As part of #StateStreetLive I was asked to answer the following question:

Whether it’s emerging technologies disrupting your business, political movements in your key markets or impending regulation for your industry, we all experience different kinds of risk. But risk can also mean opportunity. What risks do you see as an opportunity for your company’s future growth?

Risk, by definition, is always attached to reward. And yet we mitigate it, contain it, regulate it, and try to avoid it in banking – by definition, as banking is a bastion of conservatism (for good reason) in every vertical of the industry. Even investment banking is all about hedging risk, although it has a slightly higher appetite for it than your run-of-the-mill retail/corporate banking.

That’s a legitimate strategy for systemic stability, and has served for centuries. Anyway, insurance exists to stave off any significant losses and reinsurance is doubling down on making things whole. Or at least that was the theory before the financial crisis of 2008 where risk was the product, and hedging meant betting against reinsurance on low cost, suspiciously too-good-to-be-true subprime mortgage securities (a lesson in seriously wonky risk pricing if there ever was one). But this discussion is not about 2008, nor bad risk pricing. This is about risk as opportunity, something that a traditionally conservative industry (2008 being the exception that proves the rule) will ring-fence and price, but almost never take.

The risk of being a first mover in such a conservative industry is real: market share, stock prices, customer satisfaction, regulatory scrutiny, are all at – you guessed it – risk if an institution makes the first move to do something fundamentally new, or shifts their business model completely. And yet, there are certain business models where being the first mover practically guarantees winning the entire naturally monopolistic market. There are some of those models for which banking is ripe to adopt, and the first bank to do so will win. Win big.

What’s that model? It’s Identity-as-a-Service.

What is that you ask? Well, in the wake of PSD2’s mandate to authenticate every single transaction, that authentication is essentially a validation of the individual (or company) that maps to KYC requirements: it’s confirmation of individual identity. Layer on the requirement of GDPR’s privacy framework, the nuanced management of linking a person’s/corporation’s sensitive personal data to an authorized transaction, and we have the kernel of not just managing the transaction, nor the movement of money, but of managing identity and the privacy of that identity.

That’s just the foundation of this whole Identity-in-Banking business. Consider how technology legitimized the market’s demand for more personalized, bespoke products and services, because that technology makes hyper personalization possible. Know your customer now goes beyond the regulatory definition: it extends into product fit, product need, customer lifetime value, and meeting the customer where they are in the crucial moment of need. This level of individual insight into the customer’s need and behavior adds an existential dimension to customer identity. No longer are we dealing with a legal personhood status, we’re draping that personhood in other facets of identity that are contextual: biometric (security context), behavioral, psychometric, commercial and consumptive, geographic. And all these facets are dynamic, changing on the surface according to circumstance, but consistent at the core (personhood).

Considering how deep and wide the intelligence that informs identity is, keeping those insights private becomes crucial. That privacy is also becoming increasingly difficult to manage as we generate more and more digital data footprints. In the API marketplace that connects our social and legal identities to our bank accounts to our purchases to our movements to our interests (thanks internet search history!) to what we think about, talk about, and who we connect with in these overlapping networks and economies, who has access to that information, let alone who is capitalizing on that information matters, and is difficult at best to manage or control.

What is starting to matter more than ever is control over who has permission to access this (privacy controls) and that there is an appropriate commercial value exchange for that access. This commercial exchange is related to the fact that the highest value asset we have, the most rare and non-renewable resource we own is in fact our time and attention, not the amount of currency in our bank accounts. The more intel someone has on me, the more they can demand and capture my time and attention. I, and you, should be justly rewarded for how we spend our time. Right now we are being fleeced in the time/attention exchange, but the power is shifting to right this imbalance (thanks tech!).

In the very near future, those with the most control over their privacy will hold the most capital wealth. The definition of riches is changing: privacy constitutes wealth. Control over privacy will be worth a high premium.

The first institution who moves to manage that time/attention value exchange will set the market afire. Instead of being a custodian of money, the first mover who takes the risk of being a custodian of identity, permission, and monetization of dynamic contextual identity will win. This is especially true when it comes to managing complex corporate identities – the value add because of the complexity creates enormous value, and a brand new P&L statement.

Opportunity comes with shirking off a business model that has seen better days, one that is product and service oriented, one that still banks (pun totally intended) on fees and easily calculated margins. Being the first mover to a business model that shirks tradition, but capitalize on what makes us fundamentally us – while allowing the customer to also capitalize on who they are – is a risk. A big risk. But that first mover will capture, and hold within their grasp, enormous and exponentially growing opportunity to make the market of You, and Me, and We theirs and theirs alone.

The first custodian of privacy and identity will be the prime control valve of capital wealth. That opportunity more than merits the risk.