Scalable Capital: Partnership

The leadership read

Scalable Capital's entry into the TAC programme commits it to operating under a security posture that is materially different from standard commercial AI deployment. Access to GPT-5.5-Cyber, covering penetration testing, binary reverse engineering, and red teaming at lower refusal rates, means the firm is now running AI-assisted offensive-and-defensive security workflows that require internal authorisation chains, audit trails, and governance structures most fintechs have not had to build. The selection is not an endorsement; it is an obligation. OpenAI's safeguards against misuse sit on the vendor side, but accountability for authorised workflow integrity sits with the participant. The related-signals set for this 90-day window is thin on directly comparable cybersecurity-programme entries; the 12 partnership signals provided span sectors and themes too dispersed to constitute a coherent pattern. What is legible is the TAC cohort itself: Deutsche Telekom, Telefonica, Sophos, and BBVA alongside Scalable Capital. That is a list of regulated infrastructure operators, not early-adopter experimenters, and OpenAI's simultaneous EC engagement points toward a regulatory-access framework being constructed around these models before broader commercial release. Across financial-services firms reaching this stage of AI-security integration, the functional pressure concentrates in two areas: risk and governance leadership capable of translating model-access permissions into auditable internal policy, and security-engineering depth that can operationalise red-team and vulnerability-analysis workflows responsibly. The market is moving toward operators who can hold both the compliance and the technical implementation simultaneously, a combination that remains scarce in European fintech.