Many wealth management firms could be exposing themselves to significant risk without even realising it. They might not realise how dependent they are on it, but open-source technology is widely used across modern businesses, and failures could affect firms that unknowingly rely on it.
Open-source software is made available to the public so anyone can inspect, modify and improve its source code. This type of technology is the backbone of a lot of systems and infrastructure available online. In fact, a report from OpenForum Europe claimed that over 70% of modern software depends on open-source software and its components.
As Prometeia Country Head Switzerland Carmine Cammarota noted, the adoption of digital and cloud technologies is making the banking sector, particularly wealth management firms, increasingly reliant on open-source components. Worryingly, they might not even be fully aware of how dependent they are.
Cammarota said, “This use isn’t always obvious: a bank may be an indirect consumer of open-source software through SaaS services, for example, or cloud infrastructures that incorporate numerous open-source components. It’s an evolution that brings benefits but also raises concerns such as security and vulnerability management. A vulnerability present in an open-source component can, in fact, propagate throughout the entire technology chain.”
The reason many wealth managers are unaware of how much they rely on open-source software is that these dependencies are inherited, not chosen, EXANTE CTO Richard Forss explained. He added, “A wealth or asset manager rarely picks a serialisation library. It picks a custodian, a portfolio system, a broker, a reporting vendor, and each of those brings its own stack.
“Black Duck’s 2026 Open Source Security and Risk Analysis found open source in 98% of the codebases it audited, averaging 1,180 components per application. Your client portal, your rebalancing engine and your market data feed all sit on it, several layers down from anything you signed a contract for.”
The problem with failing to understand how integral open-source technology is to operations is that the risk lies not so much in the code itself as in its maintenance model. Research from Sovereign Tech claims that around 63% of those maintaining widely used open-source projects lack adequate funding. They might be individuals funding their work in their spare time or small businesses that lack sufficient resources.
EXANTE recently discovered how its own platform contained significant risk buried under the hood. Kryo, an open-source Java binary library that is used in high-performance trading systems. However, Forss explained that, since 2009, the technology had been maintained by two people on two continents without external funding.
“Nearly 70% of our critical stack runs on open source, and I would be surprised if others in the industry are much different. The xz utils backdoor in 2024 showed what happens when one exhausted volunteer is targeted. For a firm whose business is client trust, that is a concentration risk you have never been shown.”
This lack of awareness means many wealth management firms do not fully understand how open-source software is often sitting underneath some of the latest innovative technology solutions, such as AI and automation tools.
Forss believes most of the attention is focused on the layer clients can see. This includes the AI assistant, automated rebalancing, digital onboarding and so on. These tools rely on the same libraries, frameworks and protocols as other systems, and those components are now being stretched beyond what maintainers can reasonably support. AI is exacerbating the problem in two ways.
He said, “First, volume. Vulnerabilities per codebase rose 107% in a year to an average of 581, and 65% of organisations reported a software supply chain attack in the past year. AI coding assistants pull in dependencies faster than governance can review them. Second, the attackers have the same tools. A neglected library with a known flaw is a far faster target than it was three years ago, because models can now find and exploit vulnerabilities on their own.
“The practical question for a manager is not whether to adopt AI. It is whether your providers can tell you what their agents are wired into, who maintains it, and what happens when it breaks. If the answer is a shrug, that is your due diligence finding.”
The benefits of open-source technology
Given that many wealth management firms are unaware of how deeply they depend on this technology, it might be tempting to assume that it is unimportant and should be avoided. However, that may not be the case.
Forss noted that open-source technology enables mid-sized firms to achieve institutional-grade execution, reporting and connectivity without needing the budget of a big bank. He noted, “When we started building EXANTE in 2011, it was the only way a small team could build something serious. Fifteen years on, the same economics let a $200 million family office run tooling that would have cost a fortune in 2005.”
Cammarota expressed a similar view. Success in the modern market requires speed and adaptability, both of which open-source technology can offer companies. He said, “This represents an evolution in terms of innovation, flexibility, and development speed, through which know-how is shared. In the modern market, this translates into lower development costs and the ability to adapt to new technologies much more quickly.”
Another benefit of open-source software for wealth managers is greater control. Forss explained, “Code you can read is code you can audit. Code you can fix at 2am is code that does not wait on a vendor ticket. Code you can run on your own hardware is code that stays where your regulators expect it. That last point matters more each year: I run technology for a regulated prime broker, and there is a growing category of data and tooling that simply cannot leave the building. Open source is what makes that possible.”
Supporting the foundations
Given how intertwined open-source technology is becoming with the running or businesses, it raises the question of whether there should be greater support for those maintaining the software, especially when handled by a small team. If the technology is left unsupported, it could create risks, ranging from outages to security threats, leaving many firms exposed to significant risk.
This is an issue that Cammarota believes carries significant importance within wealth management. He said, “For wealth management, this issue takes on considerable importance given the nature of the information handled: personal information about the client and their family, financial data, financial goals, and investment strategies that reflect the client’s personal situations are responsibilities that the industry cannot afford to ignore.”
However, convincing firms of the need to support the underlying infrastructure might be a tough sell. Without a clear understanding on how these dependencies affect the firm, allocating a portion of the budget to donate to a distant maintenance team might be difficult to justify.
The solution, Forss believes, is to position it less as an act of generosity and more as a form of risk management.
“Open source is not a charity case. It is load-bearing technology, and the firms moving client capital across these pipes are the ones most exposed if the pipes fail.
“Our industry learned, usually expensively, that you do not run critical infrastructure on goodwill. We built segregation of duties, approval limits and audit trails because good intentions are not a control. The same logic applies here. If your trading, data, security or client servicing depends on a library maintained by two volunteers, that dependency belongs on your risk register whether or not anyone has written it down.”
Most managers will not fund libraries directly, and they should not have to. But they can ask their providers what they do.”
EXANTE recently launched its €1m Gecko Fund to support those small teams working to maintain open-source systems. It offers grants ranging from €10,000 to €150,000 to underfunded projects. It reviews applications on a quarterly basis, considering factors such as adoption, relevance to the financial ecosystem, current funding levels, and potential impact of additional support. Individuals, project teams, communities and organisations are all eligible to apply for the grant.
With EXANTE uncovering its own reliance on the underfunded Kryo, it is no surprise the team was the first to receive a grant, securing €10,000 to support its maintenance.
Forss said, “A million euros is a drop in the ocean, and I am under no illusions about that. The point was to show what money delivered to the bottom of the stack looks like, and to make it a fair question to ask of anyone else holding your infrastructure.”
What needs to change
Open-source technology is not going anywhere and as wealth management firms continue to digitise and adopt tools like AI, they are bound to gain more exposure to the technology. This will require changes across the industry to ensure there is a more sustainable and resilient model for funding and maintaining the open-source infrastructure it depends on.
That change, according to Cammarota, is a need for greater awareness of technology and greater trust. “Careful governance is essential for gaining clear visibility into both in-house and third-party components. Define and enforce clear policies with well-defined responsibilities and thorough controls.”
As for Forss, he sees three needed changes. The first is to make dependency transparency part of vendor due diligence. “Most firms cannot get an accurate software bill of materials from their own providers, let alone find out which components have a single maintainer. DORA already expects you to understand your critical third-party ICT risk. Open source is the part of that chain nobody is currently reporting on.”
Second, wealth firms need to treat maintenance as an operating cost and not a donation. Managers already pay for data feeds, cloud services and compliance tools. Technology providers serving them should therefore budget for the open-source components underpinning their products and demonstrate how they support those components, he said. “It costs a fraction of one outage or one breach, and it is a fair thing to put in an RFP.”
The third change is a need to put money where the weakness is. Forss noted that industry foundations typically fund the visible projects while fragility sits further down. “The fragility sits lower down, in the libraries nobody names in a press release. Direct grants, retainers with maintainers and contributed engineering time all work. Applause does not.”
On a final note, Forss said, “If the industry profiting from this infrastructure will not help sustain it, the plumbing everyone takes for granted is not going to hold, especially under the growing pressure from ever-accelerating AI.”
Copyright © 2026 FinTech Global
