Data breaches, regulatory enforcement actions, market disruptions, and executive scandals can destroy financial brands overnight. The companies that survive crises are the ones that prepared before they happened. We build crisis communication frameworks so your team knows exactly what to do when it matters most.
The Problem
You have no crisis playbook and the clock is already ticking
Most financial services companies have no documented crisis communication plan. When a breach occurs, a regulator acts, or a journalist calls, the response is improvised — emails drafted by committee, legal and PR fighting over language, and hours passing while customers and media demand answers. In financial services, delayed or confused crisis response doesn't just damage reputation — it can trigger regulatory penalties and customer runs.
Your crisis team doesn't know who does what
When a crisis hits, who makes the call on public statements? Who talks to regulators? Who handles customer communication? Who briefs the board? In most financial companies, these roles aren't defined until the crisis is already underway, leading to confusion, conflicting messages, and dangerous delays. The first hour of a crisis sets the trajectory for everything that follows.
Regulatory notification requirements add unique pressure
Financial services companies face specific regulatory obligations during crises — breach notification timelines, SEC disclosure requirements, banking regulator communications, and state-level notification laws. Missing these deadlines doesn't just create PR problems — it creates legal liability. Your crisis plan needs to account for the regulatory dimension that other industries don't face.
Social media turns internal problems into public crises in minutes
A customer complaint on Twitter, a leaked internal document, or a screenshot of a system outage can go viral before your communications team has even been notified. Financial services companies are high-profile targets for social media criticism because money is emotional. Without social media monitoring and rapid response protocols, small incidents escalate into full-blown reputational crises.
How We Help
We build crisis communication frameworks tailored to the specific risks financial services companies face. This starts with a vulnerability assessment — mapping the scenarios most likely to affect your business (data breaches, system outages, regulatory actions, executive departures, market events, fraud, and compliance failures) and evaluating your current readiness for each.
For each high-probability scenario, we develop a crisis playbook with specific response protocols. This includes pre-approved message templates, stakeholder communication sequences, regulatory notification checklists, media response guidelines, and social media monitoring and response procedures. The playbook is designed so your team can execute under pressure without improvising.
We define the crisis team — who's on it, what each person's role is, how the team is activated, and what the decision-making authority structure looks like. In financial services, this typically includes communications, legal, compliance, executive leadership, and customer support, with clear escalation paths for different severity levels.
Training is critical. A playbook that nobody has practiced is barely better than no playbook. We conduct tabletop exercises — simulated crisis scenarios where your team practices the response in real time. These simulations reveal gaps in the plan and build muscle memory so the team can execute calmly when a real crisis hits.
Winston Francois brings a direct, operator approach to crisis communications. We build frameworks that are practical and executable, not 200-page documents that no one reads. The goal is a team that can respond to any scenario within 60 minutes with a coordinated, compliant, and credible message.
What we deliver
- Vulnerability assessment — mapping crisis scenarios ranked by probability and impact
- Crisis playbooks — scenario-specific response protocols with pre-approved templates
- Crisis team charter — roles, responsibilities, activation procedures, and decision authority
- Regulatory notification checklist — timeline and process for each applicable regulation
- Tabletop exercises — simulated crises to test and refine the response framework
In financial services crisis communications, speed and transparency are more important than perfection. A company that says 'we detected an issue, here's what we know, here's what we're doing, we'll update you in 2 hours' within 30 minutes outperforms a company that waits 6 hours to craft the perfect statement. Silence in a crisis is never interpreted as diligence — it's interpreted as hiding something.
Our Methodology
Our 90-day crisis readiness sprint starts with a 30-day assessment. We evaluate your current crisis preparedness, map the most likely and highest-impact scenarios, review your regulatory notification obligations, and interview key stakeholders about their understanding of crisis roles and procedures.
Days 30-60 are framework development. We build the crisis playbooks, draft pre-approved message templates, define the crisis team structure, and create the regulatory notification checklists. This phase involves close collaboration with your legal and compliance teams to ensure every template and procedure meets regulatory requirements.
Days 60-90 are training and testing. We conduct 2-3 tabletop exercises that simulate different crisis scenarios and test your team's ability to execute the playbooks. After each exercise, we debrief, identify gaps, and update the frameworks. The goal is a team that has practiced enough to respond confidently under real pressure.
How We Work
The first 30 days are assessment. We interview your leadership, legal, compliance, communications, and customer support teams. We review any existing crisis documentation, audit your social media monitoring capabilities, and map your regulatory notification obligations. The vulnerability assessment is delivered by day 30.
Days 30-60 are document production. Our team drafts the crisis playbooks, message templates, and team charters. Legal and compliance review is built into the process — every template goes through your approval chain before finalization.
Days 60-90 are tabletop exercises and refinement. Each exercise takes 2-3 hours and simulates a realistic scenario with time pressure, media inquiries, and regulatory requirements. We facilitate the exercise, debrief the team, and update the playbooks based on what the simulation reveals.
Crisis readiness engagements run 3-4 months for the initial framework, with optional annual refreshes (updated scenarios, new tabletop exercises, template updates). We also offer rapid-response retainers for companies that want on-call crisis support when incidents occur.
- Documented crisis response capability across key scenarios
- Reduced response time from hours to minutes
- Regulatory notification compliance and documentation
- Team confidence and coordination under crisis conditions
If your financial services company needs crisis communications leadership, we should talk.
Expand your marketing team output with our experts
Let us take a custom approach to your growth goals by assembling and leading the best-in-class marketing team to support your next stage.
Frequently asked questions
How much does a crisis communications program cost for financial services companies?
The initial crisis readiness sprint typically costs $25K-$45K over 3-4 months, covering assessment, playbook development, and tabletop exercises. Annual refresh retainers run $8K-$15K. Rapid-response retainers — having our team on-call during actual crises — are $3K-$5K per month. Compare this to the cost of a poorly managed crisis: customer attrition, regulatory fines, and brand damage that can take years to recover from.
How often should we update our crisis communication plan?
At minimum, annually. You should also update after any actual crisis (lessons learned), after significant business changes (new products, new markets, leadership changes), or after regulatory changes that affect notification requirements. We recommend an annual tabletop exercise to keep the team sharp and identify gaps created by organizational changes or new risk scenarios.
What types of crises should financial services companies prepare for?
At minimum: data breaches and cybersecurity incidents, system outages affecting customer access, regulatory enforcement actions, executive misconduct or departure, fraud (internal or external), market events affecting customers, and negative media coverage. We prioritize based on your specific business — a consumer neobank faces different scenarios than a B2B payments processor.
What makes Winston Francois different for crisis communications?
We build practical, executable frameworks — not shelf-ware. Our playbooks are designed to work under pressure, with pre-approved templates, clear decision trees, and specific timing requirements. We also bring the operator perspective: crisis response isn't just about messaging, it's about coordinating legal, compliance, customer support, and leadership in real time. Our tabletop exercises are realistic enough to actually stress-test your team.
Do you provide crisis support during actual incidents?
Yes, through our rapid-response retainer. When a crisis occurs, our team activates within the hour to support your communications response — drafting statements, coordinating messaging across channels, managing media inquiries, and ensuring regulatory notifications are filed on time. This is separate from the readiness program, which builds the framework your team executes.
How do tabletop exercises work?
A tabletop exercise is a facilitated simulation where your crisis team practices responding to a realistic scenario. We present an evolving situation — injects arrive throughout the exercise mimicking real-world developments (media calls, customer complaints, regulatory inquiries). Your team practices executing the playbook, making decisions under time pressure, and coordinating across functions. Each exercise takes 2-3 hours and is followed by a structured debrief.
