AWS Financial Services Symposium 2025 | Patrick Palomo, Smarsh

Clips
More from AWS Financial Services Symposium 2025

Patrick Palomo

Principal Solutions Architect

Smarsh

play_circle_outline Smarsh founded in 2001 at the intersection of innovation and regulation.

play_circle_outline Data residency issues addressed through deployment in various jurisdictions.

play_circle_outline Flexibility and agility in compliance with changing regulations and technologies.

play_circle_outline Unlocking Smarsh's Customer Opportunities through Advanced APIs for Data Capture and Monitoring

play_circle_outline Diversifying Growth: Exploring Opportunities in Healthcare and Tech Sectors

Info
Transcript

Patrick Palomo, Smarsh

Patrick Palomo

Principal Solutions Architect Smarsh

In this interview from the AWS Financial Services Symposium, Patrick Palomo, principal solutions architect at Smarsh, joins theCUBE Research’s Dave Vellante and Scott Hebner to discuss how compliance is evolving from a regulatory necessity into a business enabler. Palomo reveals how Smarsh is helping financial institutions leverage AWS-powered innovation to modernize operations while staying ahead of global regulatory demands.

Palomo dives into the strategic impact of turning compliance into a competitive edge by highlighting real-world examples where ... Read more

explore Keep Exploring

What is the history and overview of Smarsh? add

What approach do you take to address data residency requirements for your customers in various jurisdictions outside of the U.S.? add

What is a practical example of utilizing regulatory anticipation and technology in the financial services industry? add

What types of capabilities does the platform offer for building and integrating custom software solutions? add

What industries do you foresee your business expanding into in the future? add

bolt Powered by CUBE AI

Patrick Palomo, Smarsh

search

Dave Vellante

>> Hi, everybody. Welcome back to New York City. You're watching theCUBE's coverage of AWS Financial Services Symposium 2025. I'm Dave Vellante with Scott Hebner, and we're excited to have Patrick Palomo back on theCube, Principal Solutions Architect for Smarsh. Good to see you. Thanks for coming on, Patrick.

Patrick Palomo

>> Thanks, Dave. It's good to be back.

Dave Vellante

>> This is my first AWS Financial Services Symposium, I have to say. I've interacted with AWS FS pros, but never in this symposium. It's pretty impressive.

Patrick Palomo

>> Yeah, as we were kind of chatting before we started, it's about double the size as it was last year, so it's pretty exciting to see the growth in attendance just year over year.

Dave Vellante

>> Yeah, my quick scan of the keynote this morning, I thought north of 500, then I upped it to 700. It's probably closer to 1,000 as we've been talking about. So let's talk about Smarsh. It was founded in 2001 by Stephen Marsh, hence the name. And I'll just give a quick overview. In an industry defined by rapid change and strict oversight, Smarsh sits at the intersection of innovation and regulation. So we're going to talk about how financial services firms are leveraging the cloud and particularly how you're helping with regulation. But specifically, 2001, that was the time when we were doing all kinds of chatting and it was sort of unregulated and there was probably all kinds of information that shouldn't have been floating around, floating around. That was kind of the genesis for the company, right?

Patrick Palomo

>> That's right. It's funny you mentioned that. When I think back, the securities laws that we help customers comply with actually kind of predate the advent of the internet. So if you think, you're talking about a 2001, that was really a big shift from what was once a interoffice memo became an email.

Dave Vellante

>> Right.

Patrick Palomo

>> So communications really became electronic from that time, as we all know, and from emails to chats to now the way we work is on video conferences and collaboration tools like Zoom or Microsoft Teams. So that's the normal now.

Dave Vellante

>> And you're still helping with those other vehicles, correct?

Patrick Palomo

>> Email hasn't gone anywhere. Since you asked, email is still by volume the largest channel that we see with our customers. So it hasn't gone away. I'm sure your inboxes are probably as fault as mine are still today.

Dave Vellante

>> It's worse now with AI. But in the Federal Rules of Civil Procedure, I think it was 2006, was a catalyst. I think it was Morgan Stanley, got the first big lawsuit, and that really put the onus on companies to get their act together. That must've been a tailwind for your business.

Patrick Palomo

>> Absolutely. It starts with simple record keeping requirements our business does, that those communications with customers are just records of the firm, but since they're records of the firm, then what comes right behind that is potential litigation or investigations and the need to produce that in court or as part of a regulatory investigation.

Dave Vellante

>> Yeah, so that law basically said that electronic records are now admissible. And so at the time, you didn't have a good way to archive those or even categorize them. So that was a real white space that the industry had to deal with.

Patrick Palomo

>> Yeah, absolutely. Hence, kind of the founding of Stephen seeing the opportunity to start a business in this space, and that was now 20 years ago. And as you pointed out, the first fines in this space from what was the NASD in NYC. It's over 20 years ago now. So 2025, it's been a journey.

Scott Hebner

>> And you're operating perhaps one of the most financially regulated industries in the world, right? And the regulations are changing all the time. Then you have the dimensions of technology, like new AI, regulations are changing all the time, not just in the industry, but for AI and data privacy across the world. How do people keep up with all this as far as the communications are involved?

Patrick Palomo

>> You bring up a good point. Our largest customer was telling us that they're subject to 256 different regulators across the globe, which is an astronomical number to kind wrap your brain. That's more countries than there are in the world, if I'm not mistaken. And it does cover a lot of aspects, like what does it mean to be regulatory compliant in a heavily regulated industry with respect to comms? It's of course the record keeping requirements that I spoke about. It's how do you demonstrate a good faith effort to supervise and monitor those to make sure that you're protecting the health of capital markets, preventing market misconduct, investor protection, things like that. It's resiliency requirements, making sure that you are responsive to European requirements around resiliency. So it's really pretty expansive what I see our customers having to deal with in the market today.

Dave Vellante

>> Is categorization part of the value you bring? In other words, any communications related to this company or this stock? Is that part of the value that you bring, or is that sort of not your area?

Patrick Palomo

>> No, absolutely. Maybe I'll give you a very simple example. So I mentioned that our customers are obligated to do some sort of surveillance or monitoring of those electronic communications, and you were alerting to your inbox, how crowded it is.

Dave Vellante

>> Yeah.

Patrick Palomo

>> So if you asked about categorization, one of the more recent things that we've done is we have some LLMs that are great at categorizing what we call non-conversational data. So if you think of things like newsletters, of course, spam, maybe at a large company, corporate communications, other things that aren't really people talking, it's just information coming into your inbox? We categorize that, and that's an easy way to take those, filters those out, and set those aside so a human being doesn't accidentally have to see one of those triggered for review. So it's kind of an efficiency play and a very simple method of drastically improving the efficiency that compliance teams.

Dave Vellante

>> And tech-wise, LLMs, relatively new. The state-of-the-art used to be other math like support vector machines, probabilistic latent semantic indexing. I know that's a mouthful, but that's what the state-of-the-art was. Have LLMs elevated that? Have they supplanted that? Do they complement the old math? Old but still works math?

Patrick Palomo

>> That's a great question. Our R&D team, what I like to call our Applied Machine Learning Team, I think they're probably the best, the most experienced in the business. Dr. Uday Kamath wrote the book on explainable UI, he co-authored a textbook on the subject.

Dave Vellante

>> Awesome.

Patrick Palomo

>> What you're talking about, which I've learned to refer to as classical machine learning techniques, like logistic regression, we still think those tools might have a place in the kit, super explainable, but with some of these newer technologies, we were able to see just better efficiency. So it's an all-the-above approach for us. And the way that we look at our technology choices, it's through a different lens. Last year, we were talking about regulatory grade AI. What does that really mean? It's important for our customers to be able to explain how the model is arriving at the decision it's making, and for it to be repeatable. Meaning when you give it an input, it consistently gives an output. So that's how we balance these things when we make our technology choices. But yeah, we've absolutely invested in some LLMs and our customers are going to start taking advantage of that.

Scott Hebner

>> So could you give us an example of where AI has mined the mix of unstructured communications, like voice and chat and email, to actually identify a risk signal?

Patrick Palomo

>> What you're describing is actually what our customers do every day. Our largest customers will have eight, 10 million plus communications come into our platform every day. And overnight, we do analyze all the voice and written communications and surface things for review. So it's a great question, but that is fundamentally every day what's happening. We're trying to minimize the number of things a human being has to review while also trying to really surface the things that are material, meaning it could actually be something worthy of an investigation. You've identified potential misbehavior or things like that in your .

Scott Hebner

>> What's in scope? I mean, obviously regulatory, policy, is it everything? Any bad behavior of any type?

Patrick Palomo

>> You gave me the greatest hit. So of course, market misconducts, that would be things like front-running clients, trades, potential indication of insider trading. It also covers cultural things like harassment or bullying, customer complaints. It's really that full gambit of things that if you were running a business, the things that you wouldn't want to see happening. It does cover a full breadth of human behaviors. And those do align to, in some cases, very specific regulations. I mentioned customer complaints, so of course, there's a very specific federal rule around complaint handling. So you see a little bit of both.

Dave Vellante

>> So the business case for things like, well, anything in compliance, or take security, it's risk reduction, reduction in expected loss or avoidance of fines. And so the holy grail is always how do you make a business case where it's driving other business values, strategic advantage, competitive advantage? And so how do you think about that and do you have examples of where customers have been able to achieve that?

Patrick Palomo

>> We think that really is the future of being successful in this space. You mentioned it's a license to operate initiative for our customers. So they make significant investments in their compliance infrastructure, but the way that we see our customers achieving greater ROI is by getting more use out of it. So it is a simple technology play like clean up your architecture, streamline it, make it simplified, reduce redundancy. Then it's what you're talking about, like the customer complaints example I gave. You're using an AA model to detect customers complaining. What we hope is that customers will partner with us and kind of flip that around. What about where customers are saying positive things about your business that you could learn from? Are there other revenue opportunities where maybe you're missing? Everybody knows when they executed a trade, what about where you missed? So things like that, we think, and that will start to turn how customers really think about that platform and their compliance investment. They could get more out of those.

Scott Hebner

>> So with the trend of data residency, solvency, regulations that are, like you said before, are getting more and more narrow by country and industry. How does it deal with all that, particularly with data residency issues?

Patrick Palomo

>> Specifically with data residency, we're tightly aligned with AWS. They're a huge partner of ours. That's why we're here today. They allow us to deploy in several jurisdictions. So outside of the U.S., the most common places we see would be in the U.K., post-breakfast, Brexit, excuse me, in Frankfurt, in Switzerland. So we address the data residency requirements by deploying where those customers need us to deploy. You mentioned just the wide sweeping breadth of regulation. What we found is our customers have gotten pretty good at risk managements and they try and rise above and come up with a compliance program and framework that works across all of those. Because I mentioned my biggest customer with 256 regulators, you can't have a bespoke compliance program for those, and you certainly can't have a bespoke tech stack for 256 regulators. So you need to come up with a strategy that looks across all that.

Dave Vellante

>> We can't help but see what's happening with regulation, with tariffs, the ebb and the flow, tax policy. I mean, look at NVIDIA. It's like, "Okay, no chips for you." "All right, we're going to design a chip that you can sell actually into certain parts of the world." AI diffusion laws come out, "Oh, you can't sell to these countries." Just yesterday, the administration said, "Oh, yeah, you can sell to those countries selectively." And so it's impossible to keep on top of, it's like whack-a-mole. So how does your platform help address that uncertainty and can customers be anticipatory with your help?

Patrick Palomo

>> It's a great question. When we talk to customers, they're fundamentally in the risk management business, not just in the context of their compliance programs, but in their trading and investment operations. So one could certainly argue maybe we are in a time that is unprecedented, but I think our customers have gotten quite good at managing through turbulent times. So we've seen pretty steady hands there. In terms of a platform, we do run exclusively on AWS. So I don't think we run our business in a way where we're worried about procuring hardware because we're cloud native. So we kind of stand on the shoulders of giants in that regard to make sure we can keep our platform healthy. So it is a very interesting conversation, but we don't necessarily see it impacting our business day-to-day or even in the short-term or medium-term.

Dave Vellante

>> But your customers have to be agile, right? So the cloud helps them do that, presumably, as opposed to... ?

Patrick Palomo

>> No doubt. I think the simple maybe less sexy things for some folks, I mean, we do over 1,500 releases a quarter. So those might be small, to keep the platform healthy, to patch for security vulnerabilities, things like that. I mentioned resiliency, which is a huge topic with our customers. So not being attached to legacy infrastructure, having to rack servers, being really efficient in how we deploy code, it's all the really techie stuff that actually turns into big value that allows our customers to move faster.

Dave Vellante

>> Right, so when a regulation changes or is introduced, Europe, obviously, many times leads, and then California picks it up, and then other states have their own. So there's this bevy of regulations that you've got to accommodate. I'm presuming that you have process frameworks, technology to allow your customers to be in compliance with those various regulations. Can you describe how that all works and is that like a superpower that Smarsh has in order to inject those changes into the system and so that your customers can respond?

Patrick Palomo

>> It's a good question. We talked about before our bread and butter and our legacy is in regulated financial services.

Dave Vellante

>> Right.

Patrick Palomo

>> So our customers do get the benefit of the way that our internal staff scans the horizon and tries to anticipate regulatory change. So you have what Smarsh is doing in terms of coming out with the next scenario, the next algorithm that will be responsive to a new regulatory change. One practical example might be cryptocurrency, for example. That wasn't something that 10 years ago you'd have been talking about. So as that comes into the fold, we'll help develop logic that could help detect potential risks around crypto. The other way we do that is we try and make our platform as flexible as possible for our customers so they don't have to wait for us if they need to respond to something quickly.

Scott Hebner

>> Just a scenario here on just maybe the future as we move into agentic AI. So if you're a human being and you're using ChatGPT today, for example, to get information, that's being tracked by you guys, right?

Patrick Palomo

>> Yes, we do have a partnership there where we can capture and retain the prompts that people are using with those types of platforms. The rule book is still being written and interpreted around what does that mean for compliance programs? But I guess that's an example where our customers expect us to be lockstep to have the technical capability today, and we do have that today to be able to capture certain things like the use of Copilot and Microsoft Teams, ChatGPT, like you mentioned. So that's data that we can bring into our platform as customers get their hands around what that means for their compliance program.

Scott Hebner

>> What happens then? So that's sort of the world today. The world tomorrow is going to be I'm going to interact with an agent. That agent's going to go talk to five or six other digital workers. There's going to be a communication stream, and then something's going to come back in terms of a judgment or some kind of decision or plan. Where do you draw the line? Is it human to human surveillance? You get these digital workers, agents, hanging out there.

Patrick Palomo

>> It's a great question. What we practically see with our customers, the first step is create a mechanism to review and assess the different use cases. So what you're describing, we haven't seen customers in regulated financial services yet, they're not prepared to have agents or digital workers interact directly with customers yet. There's kind of a human in a loop in a lot of use cases. But then what you're describing is really, as the line blurs between what might be a human worker and a digital worker, you would suggest that if a digital worker is communicating about your business, that communication is the same as a human being and you would expect to retain that as a record of the firm and monitor that in the same way.

Dave Vellante

>> How do I engage with you? Is it a SaaS platform? I license? How does it all work?

Patrick Palomo

>> We are a B2B SaaS platform, so that's right. Our customers don't manage any infrastructure. We deploy natively to AWS. It's all infrastructure as code. We deploy in as little as 48 hours. So that's really how we do it.

Dave Vellante

>> And it's a consumption based model, pricing model?

Patrick Palomo

>> Yes, correct. If you're asking in terms of a go to market, based on the number of employees that you have that need record keeping or e-discovery or surveillance or monitoring capabilities, that's how we would charge our customers is the number of those people.

Dave Vellante

>> You're a solutions architect. Explain how that role, what are the activities within this world of compliance and risk management? What is a solutions architect architecting?

Patrick Palomo

>> For me, I spend most of my time connecting business problems with our technology platform. So maybe an example would be helpful here. We still have a lot of conversations around our customer's mobile strategy. Should we be corporate owned or BYOD? We do get questions about what does it mean as we roll out something like Microsoft Copilot for Teams? Could you capture that? We're expanding our business in a way, we need help with voice recording capture or monitoring. I can just kind of connect what they're trying to achieve with their business with a piece of software that Smarsh can make available today.

Dave Vellante

>> Got it. So here's what we're using. Here's where we think there's risk. How can you connect into your platform and mitigate that risk?

Patrick Palomo

>> Yeah, or map business process. So for example, our larger customers might have distinct compliance processes for their wealth division that might be different from their capital markets division. So where I can help is just understand how would you practically leverage our technology to get a business process executed?

Dave Vellante

>> So agents, to your point, they're a wonderful, chaotic potential nightmare for customers, which would be music to you.

Scott Hebner

>> That's a theme.

Dave Vellante

>> Yeah, right? But a company like Smarsh, that's a real opportunity for you, I would presume?

Patrick Palomo

>> We're very much on top of it and in constant conversation with our customers to make sure that if they need us to be capturing or monitoring that, that we have the technology.

Scott Hebner

>> There's APIs to the platform too? So if I build my own software, I build an agent, I can call into the platform and... ?

Patrick Palomo

>> Yeah, that's a great question. Our goal is to make it as easy as possible for our customers to get data into the platform and get data out of the platform for a myriad of use cases. So some of the stuff we're talking about with digital workers or agentic technologies, if you take a step back and just think that there's another channel of communicating, like email, like chat, you can add an agent to that. And if you're using something that's on our menu, Smarsh can handle it for you. Or if you have something bespoke, you can use our APIs and we'll get into the platform in the same way.

Scott Hebner

>> Yeah, because these agentic frameworks, part of it is the ability to call external tools and APIs. So it sounds like your platform is one of those things that can be called if I want to have that sort of function built into my agent?

Patrick Palomo

>> We invest heavily in our API strategy. We just appreciate that within our customer's architecture, we need to be able to speak upstream, downstream, and everywhere in between to different applications for different use cases. So it's a big part of our strategy.

Dave Vellante

>> What's a wheelhouse customer look like for you? Like an ideal customer profile?

Patrick Palomo

>> We do service the entire vertical. So it's really anyone in regulated financial services, buy side, sell side, small.

Scott Hebner

>> Spectrum of size, yeah.

Patrick Palomo

>> The entire. Without exaggeration, we have some of the largest banks in the world and we also service, if you guys wanted to go out on your own and start your own RIA and a brand new company. So we do service the entire vertical, including insurance, buy side, sell side, capital markets, business, hedge funds, all of the above.

Dave Vellante

>> Awesome.

Scott Hebner

>> Would you sell outside financial services? Like life sciences?

Patrick Palomo

>> We do. We do have some customers. We think that the next place our business will continue to grow, we already have some customers in healthcare, will be other heavily regulated institutions like what you're talking about.

Dave Vellante

>> Those financial services, healthcare, government, those are the big three.

Patrick Palomo

>> Anywhere where you see material litigation or need to keep records, that's where we've seen opportunities for growth.

Dave Vellante

>> Tech maybe soon, with all the tech lash. What would you like to be able to say at Financial Services Symposium in 2026? This is my Savannah question that you can't say today.

Patrick Palomo

>> Love that question. We were talking a little bit earlier about how do you see your customer really leveraging your platform outside of regulatory compliance to truly get insights into their business? So when we come back next year, I'd love to give you a very specific story of a customer that's done exactly just that.

Dave Vellante

>> Awesome.

Patrick Palomo

>> So write it down.

Dave Vellante

>> All right.

Patrick Palomo

>> Hold me to it.

Dave Vellante

>> We'll be here next year too, I hope. Patrick, thank you so much for coming on theCUBE again. Really appreciate your insights and time.

Patrick Palomo

>> Thank you for having me.

Dave Vellante

>> You're really welcome. All right, keep it right there. This is Dave Vellante for Scott Hebner. You're watching theCUBE at AWS Financial Services Symposium from New York City. We'll be right back right after this short break.