Who can argue with open source? The concept of opening software to a community that develops enhancements and shares the benefits has proven valuable time and again. In cybersecurity, for example, after attempts to keep codes proprietary proved futile, open-sourcing spawned innovation at greater scale and resulted in more resilient – albeit constantly under attack – ecosystems.
Similar results are hoped for as governments and industry face the hazards of artificial intelligence, and future quantum computing potentially rendering conventional data encryption obsolete.
Questions have arisen around the new generation of autonomous AI models that have escaped experimental constraints. The premier frontier labs Anthropic and OpenAI have maintained that open-source exposure could compound those risks, even as Chinese rivals like DeepSeek and Z.ai are open source. Unintended distillation of models is a competitive concern.
Meta chief executive Mark Zuckerberg, a longtime open-source believer, argues: "The notion that AI is so dangerous that the only safe path is an extreme concentration of power seems inherently problematic. Historically, hoping that an absolute power will benevolently provide for humanity if sufficiently enlightened has not led to safe or positive outcomes.”
(Anthropic did open up its Project Glasswing to collectively explore cybersecurity solutions. Openness is key to AI chipmaker Nvidia’s Open Agent Safety Platform, incorporating OpenShell software for AI agents. Nvidia’s $12.9 billion AI platform acquisition Hugging Face is definitively open source.)
FINOS Executive Director Gabriele Columbro
There is no question about where FINOS stands. The Fintech Open Source Foundation, according to its website, “unites the financial services industry to collaboratively build open technologies and standards that enhance profitability, improve resilience, and accelerate innovation.”
Having launched various workstreams since being established in its current form in 2018, FINOS this year waded directly into AI. With a dedicated governing board and founding premier members Depository Trust & Clearing Corp. (DTCC), Morgan Stanley, Royal Bank of Canada (RBC) and NatWest, the FINOS AI Fund “is designed to help the industry collectively shape the governance, standards, and implementation foundations needed for responsible agentic AI adoption in regulated financial services,” the organization said in June,
The AI fund “is about moving from exploration to measurable outcomes,” commented FINOS executive director Gabriele Columbro. “As open source continues to reshape technology stacks, the fund and its governing board are uniquely positioned to look across the industry to identify where effort should be focused in order to deliver the strongest ROI for the industry across agentic AI, controls, training and certification, and shared utilities.”
“Open source is fundamental to how financial services innovates,” intoned Bhupesh Vora, RBC’s Europe head of Capital Markets Quantitative & Technology Services, who like Columbro sits on the FINOS governing board. “By actively participating in its development, we help shape not just the foundations we depend on today, but the innovations we'll all rely on tomorrow.
“As agentic AI moves from pilot to production, the decisions the industry makes now will determine how safely and sustainably it scales. It takes this kind of collective effort to turn responsible AI from a pledge into a practice.”
Headquartered in San Francisco, and now with a globally dispersed team, FINOS was initially launched in 2015 as the Symphony Software Foundation, reflecting the instrumental role of Symphony Communication Services, a messaging, collaboration and analytics platform with roots on Wall Street and connecting over 1,400 institutions.
In April this year, fully committed to the open source mission as the financial services arm of the Linux Foundation, FINOS announced that Canada-based TD Bank Group joined as a Platinum Member, with an initial focus on the Fluxnova open source orchestration platform and industry-wide AI governance. That concurrently brought FINOS’s Open Source in Finance Forum (OSFF) to Toronto, “underscoring the bank’s leadership as a top-tier North American institution, actively helping to shape how open source and AI are adopted safely and at scale,” the announcement said.
Rajesh Raman, TD Bank
The membership “strengthens our commitment to building shared standards, championing AI governance, and advancing core technologies like Fluxnova,” stated Rajesh Raman, TD’s head of credit card and unsecured lending technology, who also joined the governing board.
Also as of April, institutions and technology providers including Citi, Morgan Stanley, RBC Capital Markets, AWS and Oracle joined in a high-performance computing initiative “to build a unified, vendor-neutral compute framework designed to help financial institutions run large-scale workloads more efficiently.
Morgan Stanley, AWS and RBC Capital Markets contributed two new open-source projects – Open Resource Broker and Five Spot Scheduler – to “a growing ecosystem of technologies that already includes the high-throughput compute scheduler, HTC-Grid, and workload router, OpenGRIS, pioneered by Citi with contributions from AWS and Oracle,” FINOS said.
Then came the June announcement, at the Open Source in Finance Forum in London, of the Open Source Enterprise Resiliency Alliance (OSERA), “a global, vendor-neutral, member-governed coalition to strengthen the industry’s supply-chain resiliency.”
The intent to form OSERA followed a member-only pilot phase involving Deutsche Bank, Goldman Sachs, Morgan Stanley, RBC and TD. In an example of FINOS’s linkages to other initiatives, and reaching out cross-industry, OSERA complements Akrites, which enables coordinated disclosure and upstreaming. In addition to the Akrites collaboration, FINOS together with the Open Source Security Foundation will represent the voice of its industry in defining remediation standards.
The Linux Foundation also supports the Agentic AI Foundation, with which FINOS works closely “to make sure that we don't reinvent the best practices they do,” said Olivier Poupeney, FINOS’s New York-based field chief technology officer, who in the past worked on open-source strategy at Symphony. “We assume they’re best practices, and we apply them the right way, based on the requirements from the financial services industry.”
“AI has collapsed the time to discover serious vulnerabilities from weeks of expert effort to minutes of automated scanning, and the sector should expect a flood of new CVEs [common vulnerabilities and exposures] across both current and older versions institutions still run,” Columbro stated, regarding OSERA. “We started exploring mutualized backpatching and adopting common supply-chain standards in late 2025; now AI has made this approach urgent at scale.”
The executive director added: “Ingesting, testing, deploying and proving remediation across a vast regulated software estate is as important as producing the fixes themselves. OSERA aims to standardize a machine-readable consumption evidence pack mapped to” such requirements such as those of the EU Digital Operational Resilience Act (DORA) and Cyber Resilience Act.
Undergirding open-source cooperation is that “at least 70% of everything banks are doing is non-competitive,” Poupeney remarked
Olivier Poupeney, Field CTO
“We are proud of having a way where we can bring together vendors, buy side and sell side and having this collaboration for the sake of everyone,” he continued. “Not a single cloud provider is complaining about that, and the banks are seeing their costs reduced because by collaborating, they can share all of the cost of ownership.”
Addressing security challenges, the foundation’s AI framework can detect problems in scenarios like a compromised trading agent influencing a compliance agent to approve trades that violate risk limits, or a compromised fraud-detection agent giving a payment-processing agent a false clearance. These governance measures can be embedded into an AI agent’s operations to enforce guardrails and flag actions that violate policies as they happen.
Banking systems are dependent on open-source software, and AI can find the liabilities, Poupeney said. “AI is going to find thousands or millions of vulnerabilities. A lot of them will be the same because it’s different models doing the same kind of work, with the same capabilities.”
Virginie O'Shea of Firebrand Research, who attended the OSFF in London, referred to the Linux Foundation as “probably the most well-known cross-industry example of open source development, and FINOS is the association that works on specific financial services projects in the realm of open source. This is where FINOS projects like the Financial Desktop Connectivity and Collaboration Consortium (FDC3) come into play.”
FDC3 came into FINOS in 2018 by way of the fintech venture OpenFin, now branded as Here Enterprise.
Jane Gavronsky, COO
Another integration into FINOS was the International Swaps and Derivatives Association’s (ISDA) Common Domain Model (CDM) in 2023.
FINOS chief operating officer Jane Gavronsky said then: “This is the perfect time for the industry to double down on standards collaboration – progress in digitizing regulatory rules, advances in smart contracts, continuous demand for greater transparency from regulators, and last but not least mounting cost pressures in the current market, all point at the need to join forces across the industry, to increase interoperability via standard proliferation, and to ‘do more with less’ by mutualizing development cost.”
In September, Tokenovate, a U.K.-based post-trade automation platform built on the CDM, announced completion of the first intra-day repo transaction on the Canton Network using the CDM, with cash settlement in the Circle USDC stablecoin.
“There’s no doubt that the shift to a more automated, digital infrastructure will bring important liquidity management and collateral mobility benefits, but those efficiencies will be limited without interoperability across firms and platforms,” said Scott O’Malia, CEO of ISDA. “Implementing the CDM within a distributed ledger environment enables market participants to automate complex post-trade processes using a common framework for representing trades and lifecycle events, bringing standardization and scale.”