Executive Summary
Welcome to the November 2026 issue of the Latest News in Financial #AdvisorTech – where we look at the big news, announcements, and underlying trends and developments that are emerging in the world of technology solutions for financial advisors!
This month's edition kicks off with the news that Orion has announced a new fee on technology vendors that access Orion data via integration, forcing providers to decide whether to eat the fee, raise their own prices, or stop integrating with Orion – and raising the question of whether other platforms will start charging their own data access fees and potentially trigger a wave of rising technology costs that could spread to advisors (and ultimately their clients).
From there, the latest highlights also feature a number of other interesting advisor technology announcements, including:
- Nevis has raised $70M in Series B funding as it builds its advisor AI 'operating system' – but despite the appeal of one system that can unite all of an advisor's disparate software tools (and solve the so-called 'swivel chair' problem), the fact that so many other providers are competing to be the hub of the advisor's tech stack (including ones like Jump and Hazel that already have a substantial head start in adoption) means that it could be hard for tools like Nevis to scale in a way that makes the math work for its investors
- BNY/Pershing has wound down its Wove platform, which was launched as a multi-custodial all-in-one wealth management platform three years ago – highlighting that while even though it might make business sense for an RIA custodian to build its own technology offering (as evidenced by the rise of Altruist in recent years), Wove might have suffered from trying to be everything to everyone instead of focusing on a narrow range of solutions for a broader set of advisors
- Milemarker has added a Model Context Protocol (MCP) server to its data warehousing solution, allowing advisory firms to plug their AI assistant of choice into their centralized firm data – but as AI tools increasingly become the main way that advisory firms interact with their firm data, and become integrated with a larger variety of advisor-specific software, it's worth wondering how much a centralized data warehouse is even needed (when off-the-shelf AI tools can just make the data connections to the advisor's other software themselves)?
Read the analysis about these announcements in this month's column, and a discussion of more trends in advisor technology, including:
- The state of Missouri has approved a rule declaring the practice of using credential-sharing technology (such as Pontera) to view and make trades in a client's held-away account to be an unethical business practice, further adding to the divided state regulatory landscape and highlighting the need for 401(k) plan providers themselves to provide more secure means of accessing client data
- The SEC announced its 2027 examination priorities, which notably include assessments of RIAs' ability to prepare for and respond to AI-driven deepfakes and phishing threats – suggesting that, as AI makes it easier for fraudsters to imitate a client's voice or even video image, advisory firms will need to step up their efforts to incorporate more secure multi-factor authentication (MFA) in their workflows for client money movement requests
And be certain to read to the end, where we have provided an update to our popular "Financial AdvisorTech Solutions Map" (and also added the changes to our AdvisorTech Directory) as well!
*To submit a request for inclusion or updates on the Financial Advisor FinTech Solutions Map and AdvisorTech Directory, please share information on the solution at the AdvisorTech Map submission form.
Authors:
Orion Announces New Integration Fees For Vendors, But Will Advisors End Up Paying The Cost?
The purpose of advisor technology is to make it easier for advisors to do their jobs by reducing the amount of time and effort they have to put into various tasks that they do. Most advisor technology tools on the market today perform that role primarily in two ways: Via the features and functions of the technology itself (e.g., the calculators and presenting tools embedded in financial planning software or the rebalancing and reporting functions in portfolio management platforms), as well as through their integrations with other tools to move data smoothly to and from different sources (typically to facilitate multi-system workflows). It's a lot easier to manage and get work done across a large and complex tech stack (as advisory firms increasingly must do as they expand the depth of their planning and/or the breadth of their services) when client data that lives in one system can be easily ported into other systems without the need to manually re-enter it each time.
Like any software feature, it costs technology providers money to build and maintain integrations, but they typically haven't charged anything extra for it – integration was simply another overhead cost to be managed and priced into the technology's SaaS fee for users. Notably, that was the case both for platforms like CRMs and portfolio management systems – where data primarily lives on the system and is more often “exported” to other providers – as well as for point software solutions that primarily make use of data that is “imported” from elsewhere. Because while data importers may derive more of their overall value from their ability to integrate into the advisor's core tech platforms, there's still value for the data exporters in integrating out to other providers as a way to differentiate from other platforms (e.g., having a bigger list of integration partners and/or more robust integration capabilities can help one portfolio management platform compete against the others by showing it has a better 'ecosystem' of integrations). And even providers who are overall data exporters will still need to occasionally import data from other systems, which gives them an incentive to be at least somewhat cooperative in sharing data out when you're partially reliant on other systems sharing their data back with you.
But still, the reality is that data exporters have some degree of leverage over data importers. Providers that rely on data from other platforms are somewhat at the mercy of what data those outside platforms are willing to share via integration, and how they're willing to share it (e.g., in one-way 'view-only' form or two-way 'read-write' form). They can't necessarily afford to not integrate with those outside platforms if they form an ecosystem 'hub' of the advisory firm itself, but importers are also limited in how much value they can provide to their users when they can't access or fully use the core ecosystem and platform data that they need from exporters to function.
Which is relevant this month with the news that Orion has announced that it will be charging a new “Connected Ecosystem Support Fee” on third-party technology vendors that access client data through Orion's platform (including Orion's core portfolio management platform as well as its Redtail CRM). The fees will reportedly run from $24,000-$240,000 per year, and although Orion also announced updates to its integration capabilities (including MCP access for AI tools) that the new revenue is intended to help fund, Orion could have also simply invested into its integration capabilities by outright raising its SaaS fees on its existing users who have already chosen to live in that ecosystem. Which means it's hard to see this as anything other than Orion flexing its leverage as a data exporter to try and generate revenue indirectly from the data importers who rely on their access to Orion's trove of client data (instead of Orion simply charging its own users directly).
In the short term, Orion's announcement will have immediate ripple effects for the vendors that currently integrate to it, which will have to choose between whether to simply absorb the new fee, pass it along to their users in some way, or stop integrating to Orion altogether. Different vendors will have different abilities to handle paying Orion's access fee: More established vendors (and/or those with VC backing) will have bigger cash reserves that make it easier to absorb the fee (although doing so could still pull resources away from product development or distribution and make it harder for those firms to grow), while bootstrapped startups will have a much harder time paying the fee without increasing costs for their own users. And to the extent that Orion integration partners have to increase fees, at least to those who use the vendor's Orion integrations, the irony is that Orion's integration fee is still effectively a fee increase on its own users… just one that will be collected indirectly through Orion's integration partners?
But the bigger question is whether Orion will remain the only major platform charging a data access fee to its integration partners, or whether – now that Orion has 'broken the seal' – other platforms will join in.
On the one hand, providing the technology and cybersecurity infrastructure to support data integration access to a wide swath of outside vendors can be a material cost even for a mature technology provider (even more the case now as AI has hugely increased the amount and complexity of integration requests for vendors), which is especially true with portfolio management platforms like Orion that have seen fee compression amid competition from custodial platforms like Altruist. Companies like Orion can and do need to invest into integrations, and ultimately need to generate revenue to fund it, so to the extent AI is driving more integration activity, it is reasonable for Orion to recognize that, somehow, it users must pay for those capabilities. And charging a back-end data access fee is at least one way to allow them to address the rising cost of providing integration access without directly raising fees on users. Yet the concern is that, much as how after American Airlines started charging checked-bag fees in the late 2000s, the other major carriers all quickly followed suit despite the enormous unpopularity of the fees, Orion could simply turn out to be the first provider of many to charge for integration access to its data as others recognize the ability to improve the economics of data sharing – creating an industrywide 'integration tax' on technology vendors, advisors, and ultimately clients as everyone is forced to pay access fees to the handful of firms that hold most of the data.
But it's also possible that other providers will hold off from charging data access fees, and instead recognize the ability to differentiate by being the ecosystem with free and open access to data – especially if doing so draws startups that will innovate the next generation of popular advisor technology that will also create value for the data providers that will integrate with them (which is how TD Ameritrade and its Veo platform become the home of AdvisorTech innovation in the 2010s). Because as long as integration fees are lower outside the Orion ecosystem than within, future startups will have stronger incentives to either integrate to other non-Orion platforms (and thus draw new technology innovation away from Orion) so they don't have to take on additional outside funding just to maintain Orion data access.
The key point is that in a data-heavy industry, it still matters where client data lives because whoever owns that platform ultimately controls how the data is used and accessed. And maintaining data and an ever-expanding array of integrations does have real costs, that must be paid for somehow. But ecosystems face delicate choices now of how to cover that costs, as otherwise advisory firms that curate their tech stacks carefully to maximize their integration capabilities can be disrupted when those capabilities are downstream of one vendor's business decision of how to generate revenue to fund its business model, and potentially shift the competitive landscape in the process.
Nevis Raises $70M, But Is The Market For An AI All-In-One Big Enough To Scale?
As advisors have taken on more and more technology in their practices over the years, it's been increasingly common to hear about the 'swivel chair' problem. With each individual software tool having its own login and interface, advisors encounter significant friction from the act of 'swiveling' back and forth between different tools all day. Which then threatens to undermine the hoped-for increases in efficiency and productivity that the advisor had had in mind when buying the software to begin with.
The issue with solving the swivel chair problem, however, isn't that no one has figured out the technology to bring everything into one clean and united interface. It's that everybody (from CRM to portfolio management to custodial platforms) wants to be that interface – the central 'hub' that the advisor logs into at the start of the day and stays open until they leave for the night. As there's typically more perceived value for a software vendor in being the platform that the advisor lives in all day than in being essentially just a back-end to someone else's interface. And so tech companies build out dashboards and workflow tools and integrations to pull in data from other providers into their software, all to fight for a bigger share of not just the advisor's technology budget but the advisor's workday… with the result for advisors paradoxically being even more friction: With two or three tools being capable of generating the same report or performing the same function, there's more confusion about which tool the advisor should use than if each one simply stuck to its single core function (and advisors might also wonder why they're paying different vendors for multiple versions of the same features).
More recently, AI has put a new face on the old problem of creating a unified advisor dashboard. Some providers took the traditional path of starting with one function and branching out with new features and integrations, like Jump, Zocks, and Hazel (which all grew beyond their origins as pure AI notetakers), Slant (which has built features like workflows, data gathering forms, and agentic AI onto its core CRM), and FinDash (which has sought to bring CRM, financial planning, and a host of workflow and productivity tools under one umbrella). But others seek to sit on top of an advisor's existing technology, to bring all of their functionality under a single login and interface – including startups like Hamachi, JIFFYAI, and Nevis, as well as additions to existing platforms like Advisor360's Wealth OS and Orion's Denali AI, and most recently Anthropic's Claude for Financial Advisors. Although they all vary in which functions they perform themselves versus tying together the advisor's existing software, the goal for each in the end is to become the advisor's 'operating system' – i.e., the environment within which they spend almost all of their time, giving them one system to log into each day.
In this context, it's notable that this month Nevis, one of the new crop of advisor operating system startups, announced a new $70 million Series B funding round. Which is in addition to the $35 million that Nevis announced in late 2025, plus an earlier $5 million seed round, bringing Nevis's total investment to $110 million in its two years of existence.
At the time of its last funding round Nevis still operated as more of a notetaking and meeting support tool, but not surprisingly it has expanded and it now describes itself as a unified AI platform from which advisors can perform nearly every task. In practice, it seems to be more of an interface that sits on top of the advisor's other tools – CRM, custodian, email, file storage, etc. – and builds and runs workflows off of the data it pulls in from those tools (with a sprinkling of AI agents to automate and repeat the workflows that the system builds). In other words, rather than advisors having to choose among their many point-solution tools all competing to be the primary hub, Nevis is a building a point solution to be the hub and the proverbial “single pane of glass” that advisors can log in to in order to run most/all of their advisory firm across all their systems.
The question, though, is how large and scalable the market for a dedicated AI operating system really is, especially when ironically it comes as yet another piece of software that advisors would have to purchase and log into on top of everything they already buy. As noted above, the technology field's failure to produce a single dominant all-in-one technology hasn't been for lack of trying – it's more likely because there are too many providers, through both point solutions and add-on features alike, who are all competing to be the all-in-one. And if anything that competition has only increased in recent years: As AI has increased the speed with which new tools can either be built from scratch or built onto existing solutions, providers like Slant, Jump, and Hazel have been rapidly building onto their software to consolidate more and more of the tasks that Nevis is designed to handle, e.g., notetaking, workflows, data queries, and client analytics.
So it isn't a question of whether Nevis is building a useful product – there's clearly a demand for the type of AI-enhanced workflow automation that it's building given the sheer number of other solutions who are building versions of it as well. But the question is how many advisory firms will want to buy a separate dedicated solution for it on top of their existing software, and whether enough of them will do so at a price point that can make the math work on the $110 million investment. Nevis hasn't disclosed what it's charging for its product, but given Hazel's per-seat price of $60/month, Slant's $150/month, and Jump's $200/month (including its client onboarding and business growth add-ons), there's only so much higher than that that a tool like Nevis could conceivably go without adding demonstrably more value. And while Nevis has successfully signed on several enterprise clients including Focus Financial Partners and IEQ Capital which can at least help make it profitable, it's unclear how much room there is to scale in that space as well given how many larger RIAs have opted to build their own 'operating systems' in-house (including Mercer, Mariner, and, most recently, Modera Wealth Management).
The key point is that while it isn't impossible to solve the 'swivel chair' problem and create a product that ties together the many different pieces of technology that an advisor uses, it is quite difficult for providers to convince advisors that their product should be the one that solves that problem – especially when every other tool the advisor is using is putting out the same message. And the only thing harder than paying for an AI-native operating system to overlay all of the advisors tech and workflows is paying for several overlapping vendors doing the same. As a result, the most recent crop of AI 'operating systems' hasn't solved this issue yet, so much as it has added yet another layer of tech choices clamoring to be the all-in-one advisory dashboard. Which means, in the end, some providers may have greater success by just becoming the “point solution” that really is built to plug into others AI operating system, and those building AI operating systems will be under pressure to eliminate the redundancies… as otherwise, the whole structure just adds complexity (and cost with a whole additional layer of tech) to advisors' technology decisions, in a category that ironically sells itself on the ability to make advisors' lives simpler!
Pershing Winds Down Wove After Failing To Gain Adoption By Being Everything To Everyone
Financial advisory firms vary widely in their service models, target clients, and planning focus, so there are few pieces of technology that are universal to every advisor. The closest major categories to achieving universal adoption, according to the 2024 Kitces Research on Advisor Technology, were financial planning software (95%), CRM (92%), and performance reporting (87%). But one category of provider that is just as ubiquitous is RIA custodians – which are technically service providers and not pure technology (since RIAs generally don't custody assets and clear trades themselves); hence, they are not included in the Technology Study, but they do require a heavy technology infrastructure to facilitate the services they provide and the interface that advisors use to interact with them.
The combination of near-universal adoption and existing technology resources would seemingly make RIA custodians prime candidates for making other technology offerings as well. If an advisor is already logging into the custodian's platform every day, that gives the custodian many opportunities to get their other offerings in front of the advisor, and given the underlying economics of the custodial business they could probably afford to offer the technology at low (or even no) cost since the revenue from additional client assets that advisors bring on the platform could make up the cost of offering the software. In fact, that has been almost the exact business model of Altruist since its early days, which packaged rebalancing and performance reporting software for 'free' alongside its custodial offering, betting successfully that the ability to save what could amount to $10,000+ on portfolio management software would entice newer and growing RIAs to hand them their custody business as well.
However, this was also one of the driving factors behind BNY's Wove platform, which officially launched in 2023 (though it brought together components that existed previously under its predecessor, Pershing X). BNY's initial ambitions for Wove were possibly even more ambitious than Altruist's: To bring together portfolio management and CRM and financial planning, with a selection of in-house native apps (Salesforce CRM, Conquest financial planning, Albridge portfolio reporting, etc.) and connectivity for advisors to integrate their own software. All sitting on top of BNY/Pershing's custodial platform – because while Wove always purported to be multicustodial in functionality, the purpose was clearly to bring advisors closer to BNY's custodial ecosystem.
However, just over three years after its initial launch, BNY announced this month that it is dismantling Wove. Although some of the components (presumably including its Archer managed accounts technology and its Albridge reporting platform) will reportedly be retained and tucked into BNY's wealth solutions arm, they'll no longer be sold as a unified offering.
As the diverging paths of Altruist and Wove's advisor technology offerings show, it isn't necessarily a slam-dunk proposition for a custodian to get into the SaaS business. The technology has to be carefully calibrated against what advisors actually want and need, and the more separate pieces there are, the harder it is to get it right for a high enough number of advisors to gain any traction. It's possible that Wove was simply trying to do too much: although Altruist has since expanded its offerings to include things like donor advised funds, direct indexing, and cash management (along with its separate Hazel AI notetaker, tax planning, and financial planning suite), it started with a narrower range of technology that fit a high number of advisors' needs (rebalancing, performance reporting, and billing) and grew gradually from there rather than trying to be everything to everyone at the outset.
It's also worth noting that BNY isn't the only custodian that has struggled to gain traction on its software offerings. Fidelity once aspired for its Wealthscape platform to replace third party portfolio management tools, only to reverse course in 2024 and announce a bundle of third-party tools like Advyzon and Fidelity-owned eMoney (which it even seems to have backed off on since then, as no evidence of the bundle is available on Fidelity's site as of now). And Schwab's Portfolio Connect, which has been around since 2018, still offers little more than basic performance reporting and billing capabilities and lags far behind third party tools in adoption. From that perspective, Altruist is actually the outlier in having a reasonably successful technology offering as a custodian.
Which suggests that the reason behind Wove's struggles might not be (just) vision and execution, but also the hard reality of building new technology at a large and established financial institution. Because not only are there the challenges of competing for resources among the many divisions of a company like BNY, Fidelity, or Schwab, but once you actually get the green light to build something, the underlying infrastructure that you have to build on may well have been around for decades, making it hard to make something that feels truly modern and functional. To Pershing's credit, it did seem to be building Wove from the ground up – not just tacking it onto legacy technology – but performance is everything at a massive corporation like BNY, and after three years of not gaining much traction (as well as the departure of Pershing president Ainslie Simmonds earlier in the year) the parent corporation decided it had seen enough.
The takeaway, in part, is that it's just easier to build fast as a startup that can iterate and change directions when need be but still be focused on the end goal (e.g., having a successful technology offering to bring advisors and ultimately client assets onto the custody platform). Bigger organizations have the double whammy of being more cumbersome (requiring more time and dollars to turn the ship around) while also having a limited time to prove performance while risking having the entire operation cut. But the other side of it is that execution matters as well, and the bigger that you try to build all at once (say, with a multi-functional, multi-custodian, open-architecture-plus-native-app all-in-one platform) the riskier it is that key portions of it won't land with advisors. And in the end that proved too hard even for a company with BNY's size and balance sheet.
Milemarker Launches MCP To Plug AI Tools Into Firm Data – But Wasn't This What AI Was Supposed To Solve?
Advisory firm data lives in a lot of different places. A firm might have data on any given client stored in their CRM, custodian and/or portfolio management software, financial planning platform, document storage vault, and any number of other places. Which makes it hard to get a high-level picture of a client's situation or to do deeper firm-wide analytics (e.g., look up the average household size for each advisor at the firm): When all the data is scattered across multiple systems, there's no single dashboard to tie it all together.
Of course, API integrations between software providers have helped at least somewhat to solve the problem, but they only help up to a point. Software providers are inconsistent about the number of integrations they build to other providers, and the depth of those integrations: Some might only offer 'read-only' access to data, while others might allow read-and-write access where updates in one system will be automatically reflected in other systems. And while many software providers feature some form of dashboard or another for tracking client metrics, that doesn't help much for firms that want to build more customized dashboards with metrics that aren't available from an off-the-shelf product.
And so the past several years have seen the rise of several advisor data warehousing providers like Skience, BridgeFT, and Milemarker, whose main value proposition is in aggregating the data from multiple disparate technology platforms and converting it into a single clean format. Advisory firms can then plug into that data via the data warehouse's API (either with their own custom-built tools or off-the-shelf products) rather than needing to rely on complex and inconsistent point-to-point integration.
But with advisory firms increasingly using AI tools to interact with their firm data, it isn't as necessary to build custom dashboards or querying tools – an advisor can just ask their AI assistant of choice (e.g., Claude or ChatGPT) to pull the data for them. Which makes it notable this month that Milemarker has added a new Model Context Protocol (MCP) for firms on its platform to connect their own AI tools to their Milemarker-housed data.
What's interesting about the announcement is that the problem of pulling together inconsistent and widely dispersed data is something that AI has promised to solve. In theory, a tool like the recently released Claude for Financial Advisors can effectively do the same thing – using Claude's chatbot to interact with data from any of the different software tools they use through one interface – without the need to pay for a separate data warehousing solution. And standalone 'advisor operating systems' like Nevis, Hamachi, and the recently launched Pravar AI expand on the interface to include notetakers, dashboards, and workflow automations while connecting directly to the advisor's software tools to pull data. So the question Milemarker's announcement raises is whether there needs to be a centralized data warehouse for AI tools to pull their data from, when they can just go out and connect to the advisor's individual software tools themselves?
One potential answer could be in consistency of data: If Milemarker is able to effectively clean the firm's data after pulling it altogether, it could resolve some issues with inconsistent, incomplete, or incorrect data across multiple systems that AI tools might not catch. It could also be possible that Milemarker has built up more and deeper integrations with advisor tools over its years in the data warehouse business than the newer AI tools, and so it may be able to simply do a better job connecting with more of the tools advisors work with (and being able to do more with that data) than the newer AI tools. For example, Claude for Financial Advisors currently lists 22 advisor-specific tools that it can connect to, whereas Milemarker boasts over 130 integrations. Advisors with bigger and more disparate tech stacks might simply need more connections than the current generation of AI tools can provide. And in a rapidly changing environment in AI tools, there might also be value in having a data connection that any AI tool can plug into (which is the main purpose of an MCP) – so if the advisor later opts to switch to another AI assistant, or build their own, there's no need to re-establish all the data connections to the advisor's individual tools.
Still, as has always been the case with data warehousing and the calls for advisors to 'own their data', the big question is how much extra value there is in centralizing all the firm's data in one spot, which inevitably gives rise to the temptation to build custom tools to make use of that data. It's true that it may be easier now to build custom data dashboards with the rise of no-code AI tools – but it's also much easier now for off-the-shelf AI tools to connect to an advisor's data sources and pull the data in themselves. For firms that truly have niche reporting and data-analytics needs that can't be handled by off-the-shelf tools, or bespoke tech stacks of lesser-used software that aren't as likely to have API connections to newer AI tools, maybe it's worth it to have a warehouse to pull in and clean the data. But as AI tools inevitably expand their integration capabilities and the customizability of their interfaces, it might become increasingly difficult to justify paying for a centralized data warehouse for making custom analytics tools when off-the-shelf software can do much of the same thing.
Missouri Finalizes Rule Barring Advisors From Using Pontera And Other Credential-Sharing Tools
Held-away accounts, and particularly accounts in employer plans like 401(k)s, are a challenge for financial advisors because they usually live outside of the technology infrastructure that the advisor uses to manage the rest of the client's investment assets. Often it's hard just to get visibility into what's in the account, as many 401(k) providers don't integrate with data aggregation technology like Plaid, so advisors need to rely on PDF or paper statements to give advice on the client's portfolio. Even when advisors can see what's in the account, they can't discretionarily trade in the account as they can with the client's other investments, so they need to instruct the client on what trades the client needs to make (and follow up to make sure the client actually follows those directions). And holding onto the client's account information so the advisor can log in on the client's behalf and make the trades themselves is problematic for a number of reasons, including being a potential custody trigger as well as having client privacy and data security issues.
In recent years, the startup Pontera developed a workaround to the problem of 401(k) plan management. Rather than the client sharing their login credentials directly with their advisor, they could instead enter them into Pontera's interface and grant the advisor permission to view and transact within their account. The advisor could then log in under their own Pontera credentials, view the client's account, and direct trades which Pontera would log into the client's account and execute on their behalf. Pontera also featured a function for advisors to bill on the value of the 401(k) plan assets they managed for the client, for which it positioned itself as a revenue-generation tool (and billed accordingly, charging an estimated 30 basis points of the client's assets managed through Pontera).
Pontera quickly gained momentum on account of the improvement it represented over more manual methods of advising on a client's 401(k) assets (and the clear improvement over the advisor holding onto the client's credentials themselves), as well as the reality that many clients liked the fact that they could outsource management of their 401(k) plan assets to their advisor just as they did with their other investments. However, that momentum was significantly stalled beginning in late 2023, when Washington state regulators informed their state-registered advisors that using Pontera could constitute an 'unethical business practice', and continuing in 2024 when Missouri sent out a similar notice to advisors in that state. Both states centered their arguments on the fact that clients give their 401(k) login credentials to a third party (i.e., Pontera), which could be a violation of their user agreement with their 401(k) provider that could theoretically void any fraud protections the client may have been entitled to from the provider. Meanwhile, Fidelity – the largest 401(k) provider – effectively blocked credential sharing apps like Pontera from its platform.
And now, in another blow to Pontera's prospects, Missouri state regulators have approved a new rule that officially declares credential sharing technology like Pontera to be an unethical business practice, moving the regulators' opinion from less-formal guidance to formal regulation.
Pontera has made attempts over the years to explain its perspective to regulators (that advisor access to client 401(k) accounts was a good thing and that its technology represented a better method than directly sharing login information with the advisor), and publicly accused Fidelity of anticompetitive behavior by walling off outside advisors' access to Fidelity-held accounts. It even made progress in some states including Texas and Rhode Island, which both issued guidance allowing data aggregation (including held-away account management) contingent on due diligence, disclosure, and fiduciary requirements. But it hasn't persuaded states like Missouri or Washington to come around to its viewpoint, leaving it in an unfortunate split regulatory environment where advisors might be able to use it for clients in some states but not in others. (Notably, the SEC hasn't officially disallowed or discouraged the use of credential sharing, so the problem is currently confined only to state-registered advisors.)
On its face, the argument that credential sharing is unethical does hold water given that advisors are effectively asking their clients to allow a third party software to log into their account (which is different than, for example, API-based access via Plaid, which allows the app to access just the data and doesn't give them full authority to log into the account itself). And yet, the regulators miss a big part of the picture, which is that the only reason that advisors have to use Pontera and the like to manage client 401(k) accounts is that the providers of those 401(k) plans are so loath to give even API access to client account data – in some cases because they're built on outdated technology, and in others because keeping the account walled off from outside parties will make it more likely that that account will stay on the platform and not be rolled over to another provider or custodian. In other words, as flawed as Pontera's workaround may be, it only exists in the first place because there's no current practicable way for advisors to do management of client 401(k) assets the 'right' way via secure API!
At the end of the day, though, state regulators can only control what's in their jurisdiction, and while they can't regulate 401(k) providers at a national level, they can regulate state-registered advisors who operate within their borders. 401(k) providers and other financial institutions might someday be compelled to share client data more freely (if the Consumer Financial Protection Bureau's long-awaited 'open banking rule' ever takes effect), but for now the unfortunate reality is that state regulators are forced to come down on the credential sharing platforms rather than speaking out in favor of the much more straightforward way that held-away account access could be done – if only 401(k) plan providers could be bothered to offer it!
SEC Will Prioritize AI Scams And Spoofing In 2027 Examinations – How Do RIAs Protect Clients In A World Of AI Threats?
Threats of identity theft and wire fraud have long existed for advisory firms given advisors' close proximity to client assets. Next to the client themselves, no third party has greater authority to move money on the client's behalf, and compared to the large financial institutions like custodians or broker-dealers that hold the client's assets, advisory firms tend to be much smaller and have less stringent policies around cybersecurity and fraud protection.
For many years, email has been the predominant means of initiating wire fraud. Many advisors have had the experience of getting an email that seemingly comes from a client, but on closer inspection comes from an email address that isn't the client's. Sometimes, however, hackers do actually manage to get access to a client's email (e.g. if the client clicked an email link that turned out to be a phishing scam) and send a message from their actual account, and so many advisory firms have a policy of obtaining voice confirmation for any money movement to any outside bank account: If the client sends the request via email, the advisor will call them to confirm it was them that actually made the request.
In the last few years, however, AI technology has gotten reasonably proficient at imitating a person's voice. In theory, just a little bit of recorded speech can give the AI enough training material to create a 'deepfake' of that person's voice, at least to the extent that it could fool someone talking to them over the phone. Which means that it might soon no longer be enough to just receive voice confirmation of wire requests, because the 'voice' that the advisor hears over the phone might not actually belong to the client.
In this vein, it's significant that the SEC, in their statement of examination priorities for 2027, is planning to prioritize preparedness for AI-related threats, including AI-generated “phishing messaging and synthetic or deepfake voice and video used for social engineering.” The agency doesn't say that it will be disciplining firms that it finds lacking in preparedness, but it will surely be gathering data on how prepared RIAs as a whole are for the emerging fraud threats from AI.
Often the answer to fraud and identity theft is to require some form of multi-factor authentication (MFA). Traditionally, MFA relies on the framework that authentication requires an individual to produce something that they know, something they have, or something they are, and requiring a combination of more than one of these things results in stronger authentication. The voice-confirmation requirement is itself a form of MFA, requiring a thing the client knows (the advisor's email address, as well as the password to their own email account) and a thing that they are (the unique sound of their voice). But the easier it is for one or both of those things to be stolen or spooked, the more likely the authentication is to be compromised. Email passwords can be stolen (and along with them lists of contacts and prior email conversations that could include exchanges with the advisor), but up until now it's been hard to steal a client's voice.
Going forward, advisory firms might need a different second form of authentication – preferably in the form of something they have or something they are. That could mean giving clients a physical security key of some kind, or setting up an authenticator app on their phone with a code that they could read to the advisor to confirm their request. Or maybe advisors could require clients to complete a thumbprint scan on their app along with any money movement requests, since a unique physical trait like a fingerprint is much harder to duplicate than a sound pattern like a person's voice. Those would require special technology that all but the largest RIAs likely aren't using at the moment, but it's less a matter of the technology existing (thumbprint scanning has been a normal authentication method on smartphones for years) than it being accessible to smaller RIAs without the in-house resources to develop them.
Ultimately, the need for enhanced authentication might make things more cumbersome both for clients (who will need to jump through more authentication hoops) and advisors (who will need to adjust their policies and workflows to incorporate more layers of authentication – as well as incident response and notification procedures in the event a fraudulent request slips through). And plenty of people, clients and advisors alike, have some form of MFA fatigue with an increasing number of apps requiring MFA. But it's important to note that, in contrast to getting a nuisance MFA request when trying to order from the local pizza parlor, an extra layer of authentication from one's financial advisor can literally make a difference of millions of dollars and a sizeable chunk of the client's net worth. So as more powerful AI begets more powerful fraud attempts – and as regulators start paying more attention to advisors' ability to respond to those threats – cybersecurity (and more specifically protection against AI-created deepfakes and phishing attempts) could end up being one of the emerging themes in advisor technology in 2027.
In the meantime, we've rolled out a beta version of our new AdvisorTech Directory, along with making updates to the latest version of our Financial AdvisorTech Solutions Map (produced in collaboration with Craig Iskowitz of Ezra Group)!
So what do you think? Will other AdvisorTech platforms follow Orion's lead in charging vendor-level data access fees? Does a standalone AI 'operating system' offer something more than what's available in existing advisor software (that often wants to be the operating system itself)? Do AI tools reduce the value proposition for centralized data warehouse providers like Milemarker? Let us know your thoughts by sharing in the comments below!
