How Tommaso Pace is rewriting risk in fintech

Fintech sits at the collision point between innovative tech culture and risk-averse financial services, forcing legal leaders to rethink their role. Tommaso Pace, General Counsel at Tabby, explores how legal teams can move beyond risk avoidance to enable smarter, faster decisions.

Tech companies tend to share a similar mantra: act first and ask for permission later. It’s an industry that rewards speed, innovation, and risk-taking. Diametrically opposed to this philosophy is the world of finance, where caution is paramount because people’s livelihoods are on the line.

“Move fast and break things works in tech. In financial services, when you break something, it breaks in someone’s life,” Pace says.

A collision of opposing cultures 

Legal leaders, like Pace, in fintech companies, often find themselves with an impossible job: to bridge the gap between fast-moving tech culture and the very real reality of severe fiscal consequence.  

The unique intersection that fintech finds itself at creates what Pace describes as “an asymmetry of harm.” While one side of the business is production-driven, with a focus on experimentation, the other side is the highly regulated, risk-sensitive world of financial services.  

Pace points out that in typical tech and SaaS companies, errors are often reversible. Bugs can be fixed, and faulty features can be rolled back. But errors with people’s money have far graver consequences.  

Reversible vs irreversible risk 

At Tabby, one of the Middle East’s leading consumer fintech, Pace built a risk framework of “reversible and irreversible risk.” He classifies reversible harm risk as “anything that can be fixed without too much of a consequence, for the customer, and business.” Think minor UX changes, or controlled pricing experiments that can be monitored and easily corrected. 

Whereas irreversible risk encompasses any potential regulatory risk, high reputational risk, or potential harm to a customer’s wellbeing.  

When it comes to customers, Pace believes “harm is often deferred or invisible till it’s too late.” While errors such as a delayed payment, misreported credit record or incorrectly applied fee can seem small in isolation, they can have lasting impacts on a customer’s financial reputation. 

This framework frees the legal team of the shackles of being the “No department” and allows it to work with the product and engineering teams to recognize what category a decision falls into before it is made.  

“My job is to make the product team feel that collision before it’s hit,” says Pace.

The importance of reputation 

Reputational risk is as important as regulatory risk in Pace’s opinion. In fact, in the Middle East market specifically, the two are intertwined.  

“For us, reputational risk is intricately linked to regulatory risk,” he says. The regulators Tabby works with across the region are incredibly proactive, monitoring customer sentiment across social media and often intervening early when patterns emerge. 

Reputational stakes are high, and a significant factor for product teams. A poorly communicated feature or misunderstood pricing change can quickly escalate from a customer complaint to a regulatory inquiry. 

Legal teams must work hand-in-hand with engineering, marketing, and customer experience teams to identify potential issues and ensure consistency in brand messaging and perception.  

A reputation–first mindset needs to be embraced across the whole business, not just legal, and Pace believes that hiring the right people is crucial to achieve this.  

“Cultural fit – commercial instinct and customer-first thinking – is often more important than technical excellence,” he says. 

His team is investing in broader business and coding education for in-house counsel. As a software company, Tabby promotes vibe coding across the organization – legal included – so lawyers understand both the commercial and technical context in which they operate and can communicate effectively with colleagues in other departments.  

100% compliance shouldn’t always be the goal 

Pace has a provocative take on compliance that allows his legal team to find the meeting point between SaaS culture and finance caution – “that 100 percent compliance is not always the best outcome.” 

Tech companies move fast as they scale up, putting pressure on legal teams to address multiple urgent matters at once. Sometimes it’s simply impossible to solve every single compliance issue on legal’s desk, and delays only increase overall risk exposure. In this case, Pace believes time is of the essence and that prioritizing risk is the answer.  

“You can get 70 percent compliance today, or 100 percent in nine months,” he explains. He’s an advocate for addressing irreversible risks and accepts that less critical issues may not be worth the time.  

This approach might rub some lawyers the wrong way, particularly for counsel who are fresh from the private practice world, where their job entails identifying every possible risk for a client.  

Pace stresses that shifting one’s perception from working for a client to being the client is crucial. In-house lawyers need to provide their company with solutions, fast. Conversely, often private practice lawyers don’t need to worry about the application of their advice, and their main role is to flag every possible risk for their clients.