Mongolian fintech pioneer chooses ThirdEye to power its Australian compliance operations.
When Jo Norton joined Ecology Building Society two years ago, she saw an opportunity. The society was embarking on major transformation programmes, including a complete migration to a new technology platform. For Norton, this meant a chance to build risk capabilities that would support ambitious growth while keeping the organisation safe.
In a recent conversation with Claire Rees, Regulatory Financial Crime Specialist at ThirdEye, Norton shared how she’s developed the risk function to support Ecology’s transformation.
The pressures facing a mission-driven lender
Ecology faces the same challenges as larger competitors: an unstable economy, geopolitical uncertainty, tight margins, and evolving cyber threats and financial crime. But the society also has a unique environmental and social mission to protect.
“We have a very strong climate, environmental and social lens now, quite rightly, and we’re really pleased that other firms are getting involved because that’s why we’re here,” Norton explains. “But it does mean that we need to be much more active in making sure people know who we are, how they can come to us and how we can serve them better.”
For Norton, this created a specific challenge: how do you do more with less, but do it smartly? How do you respond to emerging threats while managing costs and maintaining your values?
Risk education over risk gatekeeping
Rather than positioning risk as a gatekeeping function, Norton focused on education and empowerment. The 18-month transformation programme centred on helping first-line colleagues understand not just what they needed to do, but why.
“I think some of the biggest achievements in the last 18 months are risk education and really focusing on the three lines and the importance of what role each line plays,” Norton says. “How my second line team has really supported our first line colleagues to enable them to be a lot more self-sufficient, they’ve got a much greater understanding of why they’re doing what they’re doing.”
First-line teams now have a specific forum where they meet monthly to review transaction monitoring alerts, assess whether they’re using the most effective tools, and scan the horizon for what’s coming next.
The approach required strong partnerships. Norton describes her relationship with technology partners like ThirdEye as genuine partnerships, “There’s no competition in the space of fighting financial crime,” she notes. “It’s how we can collaborate, how we can come together and really make a powerful impact, but do that collaboratively.”
Building risk capability that unlocks opportunity
At Ecology’s recent town hall, when teams discussed key successes aligned with the firm’s priorities for the year, many were directly enabled by improved risk awareness and education; opportunities that wouldn’t have been unlocked without stronger risk foundations.
The risk and compliance team also won the award for best team for working collaboratively. Norton describes it as a career first.
“It was brilliant because I think in a risk world, and we’re in the business of risk, if we don’t work collaboratively, we’re not going to drive improvements forward. We have to work in a really agile, fast-paced way. And if you don’t have a really good understanding of the risks that you’re facing, then you’re not going to respond very well, and you end up redoing lots of work.”
Norton’s approach reflects a fundamental shift: risk as a capability that helps the organisation move faster, rather than a function that slows things down.
AI with an environmental lens
For an organisation with Ecology’s environmental focus, AI presents a particular tension.
“AI requires a lot of electricity to generate and work through,” Norton points out. “If you’re thinking about how much electricity and carbon it’s producing and the amount of water to keep those massive computers cool, we need to, as a firm, be really cognisant of how we balance the environment against not falling massively behind everybody else.”
The CRO role is changing
Norton sees a fundamental shift in what the role demands. “Historically, it’s been very much a protective role and quite backward-looking. My role is absolutely changing. It is much more strategic, forward-looking. So, our risk strategy is directly aligned with our business strategy as a key enabler.”
Success requires being “a little bit of everything.” Commercially minded, financially aware, strategically focused, all while keeping the firm and its members safe.
Her advice for others stepping into similar roles: “Use the people around you. Don’t be afraid of not knowing all the answers because you’re not going to know the answer to absolutely everything. So, surround yourself with people who are capable, leverage your networks, build on your relationships.”
