Even Southeast Asia’s finance sector is becoming more halal. Islamic finance in Southeast Asia totaled roughly $859 billion in 2023, up from $754 billion in 2020, according to a study from the Islamic Corporation for the Development of the Private Sector and the London Stock Exchange Group.

Mambu, a cloud-native, software-as-a-service, composable core banking platform based in Amsterdam, wants to tap this growing market. “The Southeast Asian market, particularly Malaysia and Indonesia, is incredibly dynamic in terms of how they’ve grown in the Islamic banking space,” says David Becker, managing director and head of APAC sales at the firm. 

The company already works with Southeast Asian clients like Bank Islam, Malaysia’s largest provider of shariah-compliant financial products, and Bank Jago, an Indonesian digital bank. 

Becker says that Islamic finance is growing just as quickly as traditional banking, and so Mambu hopes to provide tools to support shariah-compliant products like profit sharing. 

Unlike in conventional banking, Islamic financial institutions must avoid companies that deal in products that are harmful or considered “haram”, like pork, alcohol, or gambling. 

Islamic banks also can’t charge interest and so must instead generate a return through some other mechanism, like profit-sharing or leasing. 

Becker is optimistic that Southeast Asia’s younger and more mobile-savvy population will gravitate towards digital financial solutions—and particularly those that reflect Islamic principles.

Indonesia, the world’s largest Muslim country, is a clear target market for Islamic finance. Neighboring Malaysia, where two thirds of the population identify as Muslim, is another option. There are also significant Muslim populations across Singapore, the Philippines, and Thailand.

Malaysia, the first country in the region to adopt Islamic finance, has “reached a peak” when it comes to growth, says Cedomir Nestorovic, a professor at the ESSEC Business School in Singapore who focuses on Islamic business. Instead, Indonesia offers more potential for retail banking and “takaful” insurance, a type that follows Islamic principles.

“There is plenty of room for progress in the country, so many companies want to come to Indonesia,” Nestorovic says.

Yet he cautions that Southeast Asia presents its own risks. For one, unlike the Middle East’s more homogenous market, Southeast Asia is more heterogenous, meaning businesses will need to tailor their offerings to an array of different economies, consumer bases and regulatory regimes. 

Becker, from Mambu, acknowledges the challenges present in Southeast Asia, including the need to follow regulations. Yet the size of the opportunity outweighs the risks. 

“We just see it growing and growing, and I think that’s a factor in why governments and regulators have been so supportive,” he says.  

The scale is staggering: one UN estimate pegs global losses from these schemes at $37 billion. And it could soon get worse.

The rise of cybercrime in the region is already having an effect on politics and policy. Thailand has reported a drop in Chinese visitors this year, after a Chinese actor was kidnapped and forced to work in a Myanmar-based scam compound; Bangkok is now struggling to convince tourists it’s safe to come. And Singapore just passed an anti-scam law that allows law enforcement to freeze the bank accounts of scam victims. 

But why has Asia become infamous for cybercrime? Ben Goodman, Okta’s general manager for Asia-Pacific notes that the region offers some unique dynamics that make cybercrime scams easier to pull off. For example, the region is a “mobile-first market”: Popular mobile messaging platforms like WhatsApp, Line and WeChat help facilitate a direct connection between the scammer and the victim.

AI is also helping scammers overcome Asia’s linguistic diversity. Goodman notes that machine translations, while a “phenomenal use case for AI,” also make it “easier for people to be baited into clicking the wrong links or approving something.”

Nation-states are also getting involved. Goodman also points to allegations that North Korea is using fake employees at major tech companies to gather intelligence and get much needed cash into the isolated country. 

A new risk: ‘Shadow’ AI

Goodman is worried about a new risk about AI in the workplace: “shadow” AI, or employees using private accounts to access AI models without company oversight. “That could be someone preparing a presentation for a business review, going into ChatGPT on their own personal account, and generating an image,” he explains.

This can lead to employees unknowingly uploading confidential information onto a public AI platform, creating “potentially a lot of risk in terms of information leakage.”

Agentic AI could also blur the boundaries between personal and professional identities: for example, something tied to your personal email as opposed to your corporate one. “As a corporate user, my company gives me an application to use, and they want to govern how I use it,” he explains. 

But “I never use my personal profile for a corporate service, and I never use my corporate profile for personal service,” he adds. “The ability to delineate who you are, whether it’s at work and using work services or in life and using your own personal services, is how we think about customer identity versus corporate identity.”

And for Goodman, this is where things get complicated. AI agents are empowered to make decisions on a user’s behalf–which means it’s important to define whether a user is acting in a personal or a corporate capacity. 

“If your human identity is ever stolen, the blast radius in terms of what can be done quickly to steal money from you or damage your reputation is much greater,” Goodman warns.