In This Episode
Craig Schwartz and Heather Diaz of fTLD Registry Services join host Rory Holland on Mighty Finsights to explore what it takes to safeguard digital trust across financial services. Craig reflects on stepping away from ICANN in 2011 to launch .bank and .insurance without funding or guaranteed approvals, while Heather breaks down the rigorous verification and compliance protocols that make their top-level domain the most secure namespace in banking. Together, they address why thousands of institutions hold a .bank domain yet hesitate to activate it, how AI accelerates impersonation attacks, and why transparency remains their strongest asset. From candid self-reflections on leadership feedback to publishing their direct cell phone numbers online, this episode highlights the human dedication driving cyber resilience.
Key Takeaways
- Built-in Verification Over Open Registration: Unlike traditional domain extensions, .bank mandates strict identity verification at registration and annual re-verification to ensure only legitimate, regulated financial institutions enter the namespace.
- The Adoption Paradox: Roughly 40% of US banks own a .bank domain, yet a smaller fraction actively deploy it as their primary address due to perceived migration costs and fear of customer confusion.
- AI-Accelerated Cyber Risks: Deepfakes and AI-generated social engineering have made impersonation cheaper and more convincing, elevating domain-level security and authenticated email standards from optional upgrades to operational necessities.
- Proactive Security Governance: Mandating technical protocols like DNSSEC, HTTPS, and email authentication (DMARC/SPF) only works when backed by daily compliance monitoring and direct outreach.
- Complementary Leadership Styles: Running a lean team governing high-stakes infrastructure requires balancing high standards for execution with direct, candid communication across executive roles.
- Radical Accessibility: Building market trust in financial infrastructure relies less on corporate distance and more on human connection, direct support, and open communication channels.
Transcript
The Battle for .Bank
Craig Schwartz
We made the case that these other applicants for .bank and .insurance were either just purely speculators that were not going to create value, that were not going to add security, and ultimately were going to wreak havoc for banks and insurance companies. We prevailed through that process. We’re one of the only applicants that took advantage of it and prevailed. So the fact that we won for both of our two TLDs was really incredible.
Introduction
Rory Holland
Rory Holland, CEO of CSTMR, and the host of Mighty Finsights. Today I have two special guests on the show: Craig Schwartz, president of FTLD Registry Services, and Heather Diaz, Vice President of Compliance and Policy. In this episode, we talk about why Craig left a stable job at ICANN to lead a venture that had no funding and no guarantee the business model would even be viable.
The importance of domain name security when 73% of Americans are being attacked by cybercriminals every week, and the massive digital real estate land rush that is happening right now. We’ve had a few clients on the show so far, but this time stands out because Craig is at a critical juncture in his life and professional journey. He’s made the decision to retire next year. I’m honored that Craig and Heather have trusted CSTMR with their brand and to help the company grow in this season of change and transition.
Sit back and enjoy my chat with Craig and Heather.
Craig and Heather, so good to have you on Mighty Finsights. Welcome to the show.
Craig Schwartz
Thank you.
Heather Diaz
Thanks for having us.
Rory Holland
Absolutely. We’ve been talking about having you on for a bit, so I’m excited to finally have you on. I think you’re our first doubleheader, no pun intended, with baseball season here, and I guess now we’re overlapping with football. It’s been a little while, so glad to have you guys on. It’s a cool opportunity for us to get together and chat about the great work you guys are doing at FTLD, which we’re going to get into in a bit. But before we do that, I wanted to take a minute to let the audience get to know you guys a bit better.
Two Ways to Get Outside
Rory Holland
From what I know about you, you both enjoy the outdoors, time outside, but in very different ways. From what I know about you, Craig, you’re a gardener. I share that too. So I definitely want to get into that. Heather, you love the outdoors as well, but more hiking, and I could imagine that makes a lot of sense with all the technical work we do. We spend a lot of time behind the computer, so getting out for a nice hike makes a ton of sense. But I wanted to start with you, Heather. What’s behind that for you? I know you love national parks. Is there a particular favorite park you love to hike in, and anything in the future that you want to go to that you haven’t been to yet?
Heather Diaz
Yes, so Yosemite is on my bucket list, so I haven’t been there yet. I live very close to Rock Creek National Park. Part of that trail is minutes from my house, so I like to get out there. I enjoy the outdoors just to see nature and the beautiful landscapes of our area.
Rory Holland
Yeah, what part, where are you located?
Heather Diaz
I’m in Maryland.
Rory Holland
Okay. And what was the name of the place you like to go to again?
Heather Diaz
Rock Creek Trail.
Rory Holland
Rock Creek Trail. And what’s that trail like? Just curious. I’ve hiked portions of the Appalachian Trail. And I’m curious, what is the terrain like there?
Heather Diaz
Some near my house has paved trails, but then it does go into dirt and very heavily wooded areas. So it’s really varied, and then that trail is pretty cool because it extends all the way to Washington, D.C., I believe. It’s a pretty extensive trail system.
Rory Holland
And you mentioned Yosemite. You haven’t been to Yosemite?
Heather Diaz
No, I missed a trip when I was in middle school, I think it was. All the kids went in my area and I missed it. So I really want to go.
Rory Holland
Happy to share some perspectives. We went twice a year for, gosh, probably about eight years. I love to go in the fall. It’s a bit drier, but the weather’s beautiful. We’ve stayed in the valley floor and hiked a lot of Yosemite. I’ve done some backpacking trips there in the backcountry, but I take my kids with me in the fall, and my wife, of course, and then in the spring when the falls are running, when the snow’s melting and the Tahoe’s, it is unbelievable. It’s Ansel Adams-esque, if you want to see some beautiful pictures. So that’s awesome. Well, thanks for sharing that. And Craig, sounds like your happy place is in the soil. I share that too. I’ve got a little garden in the back. I’m curious, what’s your favorite thing to garden? Are you growing vegetables? Are you a flower guy? Both? Anything?
Deer Crack and Immediate Gratification
Craig Schwartz
I’m definitely more of a flower and a greenery guy. We live in a pretty heavily wooded area and have a lot of deer. Deer love to eat just about everything that looks pretty, so you have to really pick and choose which flowers you can plant. That’s what I’ve developed over the last six years of living at the beach here in Delaware.
Rory Holland
Yeah, you’re in Delaware, right on the beach. Flowers grow in Delaware. I’m sure there’s tons of them, but what don’t the deer eat? I would think they eat everything.
Craig Schwartz
For some reason they don’t eat daffodils. Every home in our community has some daffodils, and they don’t eat canna lilies. So we have candle lilies in front of our house that are probably five feet tall at this point, and they’re really beautiful. But any variety of tulip or hosta, they’re called deer crack, effectively.
Rory Holland
Yeah, I’ll have to send you some pictures. We actually put out deer feed on our land behind our house. We overlook Lake Travis here in Austin, Texas, and we get a ton of deer. My ninety-pound dog, I was telling you about him prior to starting recording, he loves to chase. If my wife listens to this, she’s going to get mad at me because she doesn’t like that. But we wake up in the morning with deer, and we have a deer fence. Because you’re right, otherwise there wouldn’t be anything. My neighbors complain about it all the time, the ones that don’t have deer fences, because they just eat everything. But I too share your passion for flowers, particularly this time of year when it’s really hot and dry here in Austin. I love watering the flowers, just relaxing and seeing them survive in the hot weather here. You’ve got to keep up with it, that’s for sure.
Craig Schwartz
And the nice thing with gardening is immediate gratification, right? You plant things, they look nice, you cultivate them. In a world that we operate in most of the time, everything is very long term, it takes time to come to fruition, so getting some immediate gratification is a really good feeling. People call me kind of weird because I like to mow my own lawn. But I like to do that because I can see how beautiful it is after an hour. Gardening, I think, is the same way, just appreciation for what is right in front of you at the moment.
Rory Holland
Yeah, I share that too. I cut my own grass too, correct? So we have a lot in common.
440 Feet at Nevis
Rory Holland
All right. So we talked about some tame stuff, but I know that you guys are no strangers to danger and excitement. So I wanted to talk about something that you did, Craig. You bungee jumped at Nevis in New Zealand. From what I know about it, it’s about a 440-foot free fall from a cable car. That sounds terrifying. I’ve never bungee jumped, but I’m curious what that experience was like. And when did you do that? Was that recently?
Craig Schwartz
I want to say that was in 2005, when I was off traveling for a while on my own. It’s not that I ever had a desire to bungee jump, but I was in New Zealand, I read about Nevis, and I thought, how can I be here and not do this? So it was an opportunity, and it was scary, especially the climb to the perch that’s over the cavern. That was really the hardest part, getting to the launch pad. The rest of it is over in literally a couple of seconds. But again, it was an opportunity. I was there. How could I not do it?
Rory Holland
Yeah, I’m curious, do you remember the last thing that went through your head before you jumped?
Craig Schwartz
I really don’t. I have everything on video, so I should watch it at some point. But I was like, all these people have gone before me and they did just fine. I’m going to be fine too.
Rory Holland
Yeah, that’s helpful. I know. We’re going to — hey, Zac, I’m talking to my producer — we’re going to have to get a copy of that video and publish it with—
Heather Diaz
Ha ha ha.
Rory Holland
As long as you’re screaming as you drop, that’ll be perfect. Well, you made a similar jump back in two thousand eleven. I want to talk a little bit about that: leaving ICANN with no registry, no money raised, no guarantee ICANN would even approve the application. You don’t seem to be a stranger to danger or taking risks. Is that a theme in your life, between bungee jumping and making that kind of move?
The Driver Isn’t Watching the Water
Craig Schwartz
It’s really not a theme in my life. I tend to be on the perfectionist side of things, so I like to know where all the pieces are before I leap. But when the trades came to me in 2011 and said, Hey, can you help us figure this out? It just seemed like a no-brainer. Banks are so targeted and ripe for online abuse that having their own safe space online seemed like something everybody would want. And I didn’t think it would be that hard. But as Heather can attest to, eleven years later it’s still really hard.
Rory Holland
Yeah. Yeah. I understand. And I can’t wait to get into some of that with FTLD and .bank and .insurance. Heather, I wanted to see if you could take us back in time. Tell us a little bit about your parasailing in Hawaii. Was that the first time you ever did it? How’d it go?
Heather Diaz
Yeah, so I was in Hawaii on a high school volleyball trip. We were training there and playing local Hawaii volleyball teams, and some of my teammates and I decided for one of our breaks to go parasailing. It was probably one of the riskier days to attempt that, as the ocean was having ten-foot swells. But I like to do things to conquer my fear. I have a fear of heights, and I was like, let’s do this. It was really fun, but one thing I didn’t realize until I was in the moment is that the driver of your boat isn’t watching where they’re driving, they’re watching you. So that adds to the element of fear, I think, when you’re up there.
Rory Holland
When ten-foot swells, that must have been something.
Heather Diaz
Yes.
Rory Holland
Yeah, I didn’t even know. Yeah, you hope they don’t run into anything, and you sink into the water. Well, clearly you’ve got a competitive streak too. You played Division I volleyball, is that right?
Heather Diaz
Yes, I played at the University of Pennsylvania for four years.
Rory Holland
What was that experience like? Playing Division I, anything in Division I athletics is incredibly challenging. So it’s a pinnacle to even be able to do that. Does that kind of pressure and desire to perform and compete play a role when you think about it day to day and the things you do now?
Heather Diaz
Well, maybe I’m lucky, but I never felt pressure to perform. With athletics, a lot of what you’re trained to do, and I played athletics from pretty much age ten on, is what I take with me now. It’s all the preparation that you put into your craft, and some of the soft skills as well, like collaboration. Dedication to excellence and teamwork, of course. So those are things that I really value even in my work life now.
Rory Holland
Yeah, I can imagine. We’ve had a lot of collegiate athletes on the show. And that translation from being a competitive athlete to business, it’s a direct draw.
The Worst Grade I Ever Got
Rory Holland
Craig, I wanted to ask about you. So you were president of Tau Kappa Epsilon at Maryland. You went to school at Maryland and studied finance. Tell me about the Craig coming fresh out of college. Where did you see yourself going from there? Did you have a plan?
Craig Schwartz
Good question. And I can’t say I had a great plan. College was a lot of fun. I initially thought I wanted to be a stockbroker, and I took my first securities class, and it was the worst grade I ever got in college. I think I got a D, and I quickly realized, okay, maybe brokerage is not for me. But I knew I wanted to be in business, so I sought out opportunities to capitalize on that. I pretty much have cycled through jobs every five or ten years, not every year like a lot of younger people. I seem to land on my feet, stay for a while, learn, and move on. And this last run is coming up on twenty years in the DNS.
Rory Holland
Yeah, I’m curious. I keep up with some of my fraternity brothers from college. Would they have ever pegged you for the role you’re in now, in the business you’re doing back then?
Craig Schwartz
They probably would have pegged me for a chief executive. I don’t know that they would have pegged me for being in the domain industry, but I was always one of those guys who jumped in, took the ball by the horns, and figured out what needed to be done. And, it’s funny, I was on a call earlier with a colleague, and one of the things he remembers from my interview with him to take this job was me telling him that I was a taskmaster. That’s how I approach everything. It’s got to get done, what’s the plan? What are the results? I think my college roommates and my college fraternity brothers probably recognized that back then.
Rory Holland
Yeah. Was there anything in your upbringing, or from the college experience or your early career days, that you would point to that helped prepare you to found FTLD and run it?
Craig Schwartz
I think as a kid, my parents were not the most instructive. There were four of us kids, all very close in age, and we had to figure things out on our own. So I learned pretty quickly that I have to handle this myself. I think that’s where the perfectionist nature maybe comes from. And it has served me for the most part pretty well over the last coming up on forty years of working.
Rory Holland
Yeah. Scary number, isn’t it?
Craig Schwartz
Yeah, it sure is.
What the F and the G Stand For
Rory Holland
Yeah. Can you tell us a little bit about FTLD? I want to get into gTLD as well, but maybe first a little bit about FTLD, and then I want to jump into another topic.
Craig Schwartz
Sure. FTLD Registry Services is the holding company, if you will, of the .bank and .insurance domains. It was formed back in 2011 by a coalition of banks, insurance companies, and financial services trade associations, all of whom got together and contributed money to participate in this gTLD, or generic top-level domain, expansion program, as you said earlier, with no guarantee of results. But we knew something needed to be done to protect the financial services sector, and the best way to do that was to participate in it and go through this whole ICANN application cycle. Fast forward fifteen, coming up on sixteen years, FTLD is very successful. We provide a very valuable service to the financial sector, almost serving as a utility, much like energy or gas or electricity, but a valuable part of a financial company’s infrastructure from a domain perspective. It’s been really successful. Investors are very happy. I think our board is very happy. We have a very solid team, and we’re poised for the next decade of the company.
Rory Holland
What about, so from what I read about you, 2006 to 2011, you were the chief gTLD registry liaison. So you ran the team that dealt with every registry operator. You helped build the new gTLD program, the thing that blew open the internet’s naming system. What is a top-level domain? So TLD stands for top-level domain. What do the F and the G stand for?
Craig Schwartz
F doesn’t really mean anything, but we kind of treat it as financial, right? We operate financial top-level domains. And the G comes from really the ICANN side, generic. So a generic top-level domain, in contrast to a ccTLD, a country-code top-level domain like .ca in Canada or .au in Australia. Generic is the ones you’re used to seeing: .com, .net, .org, and now .bank and .insurance.
Rory Holland
And so .bank and .insurance didn’t exist until you guys created them. Is that right?
Craig Schwartz
Correct. When I was at ICANN there were sixteen commercially available gTLDs. Now there are around twelve hundred, and I would say in another three years it’ll probably be more than two thousand.
Rory Holland
Goodness. Really that many?
Craig Schwartz
Well, ICANN just had another new gTLD round. It closed on August thirteenth, and they’re already reporting something like sixteen hundred applications.
Rory’s Commentary
Rory Holland
You have to be a little bit nerdy to fully understand the impact this avalanche of new domain applications will have on the internet. If you think of domains as digital real estate, this is roughly equivalent to opening 1600 continents where you can buy and sell land. On Earth, we have a finite amount of real estate. In cyberspace, we can keep creating new space for people to build businesses, establish communities, and innovate. This is a kind of digital land rush, if you will.
Means the protected TLD of .bank is becoming more important, not less so.
What the F and the G Stand For, Continued
Craig Schwartz
So what that translates into, by way of delegated TLDs, remains to be seen. But a lot of companies have been very public about what they’ve applied for, in contrast to two thousand and twelve, when nobody really said anything. So yeah, I think the gTLD space is going to explode even further in the next two to three years.
Rory Holland
Yeah, I remember when the internet first came out and some people I knew made some smart choices and bought some domains. And I thought, huh, that’s interesting. I wasn’t early to the game for buying domains, that is. But I’m curious, looking back over the last sixteen years, and even prior to that, what we just talked about, 2006 to 2011, was it a bit of a land rush? Do you feel like we’re through that? Or are there new opportunities for growth that maybe people haven’t explored yet?
Craig Schwartz
I imagine there are opportunities for growth, but what I see is mostly a shifting of where people put themselves online. Instead of being in .com, they’re moving into .coach or .law or some other TLD that’s more germane to their brand or their business. But overall, the number of domains registered across the entirety of the internet continues to grow. As new businesses get created, and as AI expands and changes the way we all live and do business, I think there are a lot of opportunities. At the same time, I personally think the internet’s getting littered a little bit, because there’s just so much stuff out there. I guess it’s good for choice, but it can be very confusing to consumers too.
Rory Holland
No, totally agree with you there. Heather, I wanted to come to you now. You’re now vice president and leading the DNS working group more directly, I think, day to day. It seems like there’s a lot of activity you have to do as you work with potential banks, not only registering but activating their domains. What do you wish more people knew about the work you do, and understood about .bank, for example?
If It’s Not .Bank, It’s Not Your Bank
Heather Diaz
I think I would start with consumers. They probably don’t think as carefully about securing a website, or all that goes into protecting their data, as much as a bank or a registry like us. So we’re really helping banks simplify that consumer education, where they can tell consumers that if it’s not .bank, it’s not your bank. I was just reading some research online by the Pew Research Center, Rory, and it just hits home so hard. It said seventy-three percent of Americans are experiencing some kind of online scam or attack, and most are getting scam calls, emails, and texts weekly. So that’s over sixty percent of Americans reporting those types of attacks weekly. When you think about this onslaught of attacks, especially targeting those of us who bank, what are banks to do about that? How can they create context and trust in real time? .bank is a tool for them to do exactly that.
Rory Holland
Yeah, and I definitely want to come back to that. Craig, I want to ask you. A few years ago you reached out to us. So, full disclosure, we work with Craig and Heather at .bank, and we were part of a really fun project to rebrand .bank. It’s been a great journey. We’ve certainly loved working with you guys, and we’re excited about what the future looks like and watching the company grow. Would you mind, Craig, and Heather too, jumping on this? Just reflecting on that process of rebranding. How it affected your perception of .bank and FTLD, but also how it changed the market’s perception.
Craig Schwartz
Yeah, really good question. We came out with our first websites probably in 2012 or 2013. They were pretty rudimentary, very basic. The logos were very simple. We had talked over the years about rebranding, but we were so busy that we never got to it. And then, I don’t know, maybe it was like 2023, we said, okay, we need to do this. We need to jump into the next decade. Working with your team and going through the whole process of how you define your brand visually and how you talk about it was a really fun and eye-opening experience. We also had people from the ABA helping us, who know how banks talk and how they message, so we invited them to be part of the process as well. It’s been great for the company. We’ve had tremendous feedback from our board and from our investors about how clean things look, how pointed the messaging is, and just how much clearer it is. And just visually appealing. Two thousand twelve to two thousand twenty-three, that’s a long time. So it’s been great for us and for our brand.
Rory Holland
How has the market responded to it? And maybe describe a little bit about the market you serve, the types of banks you guys serve.
Craig Schwartz
We serve any bank around the world, retail and commercial banks. Statistics say there are probably about 18,000 in the world, and about 4,200 here in the US. Through our registrar partners, we make domains available. If they’re looking to have something that’s unique and memorable and really relevant to their brand, they’re coming to us more and more frequently. Most of them are in the process of doing their own rebranding and refreshing their websites, and they’re saying this is the perfect time to deploy .bank. We’ve also seen a fair number of banks that are just forming for the first time. Not a big number the last few years. I think it’s about 20 since 2024. But they’re coming to us before they do anything else and saying, we’re going to establish a bank. We want to lock down a name that’s important to us, that’s meaningful. Can you help us with that, and how do we do it? So it’s been a very fun process with the rebranders and also the new guys.
Rory Holland
How about you, Heather?
Heather Diaz
I’m going to say, something your team helped us take a hard look at is: we always knew our target market was banks and insurance companies. But you guys helped us look at where the decision makers are in those organizations, and that can really vary from bank to bank. So we’ve had to take a hard look at how we segment our marketing, and how we’re reaching out to banks in different parts of the world and even in different regions of the US.
Rory Holland
Yeah, I want to come back to you, Heather, on the topic of security and the cyber threats and everything that’s going on. I don’t know how many of our listeners are aware of what makes a .bank domain so powerful from a cybersecurity standpoint. Can you give our listeners a brief explanation of that?
Verified at the Front Door, Every Year
Heather Diaz
I’ll try to keep it brief. I always tell your team, and we publish quite a bit on it, that there’s so much that goes into making .bank more secure, from not only our operations at FTLD but also through our partners and our registrars. But first and foremost, what makes .bank more secure is strict verification. We verify anyone that purchases a .bank domain to make sure they’re truly a supervised, legitimate bank institution or a bank trade association. That gating right at the front, and ongoing annually, is what keeps our top-level domain more secure. We also have mandatory security requirements for institutions using their .bank domain, and that’s where we help banks level up their cybersecurity practices through different technologies, like DNSSEC, which helps ensure customers are reaching the legitimate .bank website they intend to reach. We require TLS, which secures the customers’ data in transit and prevents data loss and misuse. We also require HTTPS and a whole host of other features that secure the bank’s website hosting environment and the website itself from vulnerabilities. And a big feature of .bank is on the email security side, where we require banks to follow email authentication best practices. That helps the bank ensure that when customers receive a .bank email, it’s legitimate, authentic, and not an impersonation attempt.
Rory Holland
Yeah. I’ve got to imagine with AI and deepfakes and everything else, there’s a lot of work on the technology side to keep up to date.
Heather Diaz
Yeah. Go ahead, Craig.
Craig Schwartz
I was going to say I could jump in for a second. One of the important things to remember is that we not only mandate these security protocols be in place, we actually monitor them daily for compliance. If we see something is not up to snuff, email authentication is not where it should be, or they’re using a weak type of certificate for their website, we will contact the bank, we’ll contact their registrar partner, and work with them on a remediation strategy. So it’s really two-pronged. It’s requiring the security, but also monitoring it, to make sure banks are doing what they’re supposed to be doing.
Rory Holland
Yeah. From a marketing perspective, I’m curious how banks see value in having a .bank domain.
Heather Diaz
I think banks do ultimately see value, Rory, but initially is where we struggle to convey that value proposition to banks. They have a fear of switching from, say, their current domain to a .bank. They fear not only the hard cost investment, but also causing any potential consumer confusion or loss of a customer. But what we’ve seen over the last eleven years is that those fears, quite frankly, do not materialize.
Rory’s Commentary
Rory Holland
Banks are risk averse and resistant to change, for good reason. It’s a feature, not a bug, of their business model. Trouble arises when that bias toward stability becomes a hurdle to innovation and security. Many businesses struggle to demonstrate urgency around their value proposition. We’ve worked with .bank to build their brand and hone their marketing message, and the urgency seems abundantly clear to me. But I sympathize with Heather and Craig about getting others to see it the same way. Cyber kernels [?] are only getting faster and more sophisticated. The financial industry needs all of the advantages we can get.
Verified at the Front Door, Every Year, Continued
Heather Diaz
Thanks to seamless technical transitions that make it transparent to the end user where they’re landing on .bank, and thanks to what Craig was highlighting, the ongoing compliance monitoring that we do, they’re getting built-in security by design, and that ends up being invaluable.
Rory Holland
So would you say the biggest thing that banks come to .bank for, to register a domain, is the security element? Or is it the idea of being able to have a .bank domain? And let me add one thing. Craig, you and I talked about this a couple of years ago. If I recall correctly, there are several banks in Texas with practically the same name, but I think one of them, among that many, has a .bank domain. So they can actually say their whole name dot bank. Back to my question about the marketing perspective, it seems like that allows them to stand out in the market a bit.
Craig Schwartz
I think the vast majority of banks still come to us because they see the security value. There are also a lot of banks that want a .bank domain because they can finally get something that’s like their name or relevant to their brand. As you just said, there are a lot of banks in a lot of states with the exact same name. But as they’re rebranding, or if they’re post-merger or after an acquisition and need a new name, .bank is still really uncharted real estate. The opportunities are endless. In .com you can’t get anything that’s short, and you don’t get any of the security value you get from a .bank domain.
Rory Holland
How many banks have a .bank domain that they’re actually using, versus those that have registered one but haven’t converted yet? I don’t know if you can share these numbers publicly, but I’m curious.
Craig Schwartz
I compile statistics every month, so it’s the first of September, and I was just looking at this this morning. In the United States, there are around 4,200 banks, and about 40 percent of those have .bank domains. That’s around 1,800, give or take. Of the 1,800 that have them, 20 percent are actively using them. It actually is a little bit more than 800. The number of banks using it continues to grow every month. On average, about five new banks switch per month. So there’s very strong usage in the United States. That makes sense, obviously, because of our longstanding relationship with the ABA, the ICBA, and the Bank Policy Institute. It’s where our roots are, and it’s where our largest messaging channels are.
Rory Holland
Is there anything you want to add to that?
So I wanted to go back to 2011, Craig, if you’ll indulge me. You’re at ICANN, the banking trade association comes to you and asks for advice on how the industry should play in the new gTLD program. Can you take me back to that moment when you realized that an entity like FTLD and .bank needed to be born and exist?
Craig Schwartz
I remember lots of conversations at ICANN as we were talking about building this new program. Part of me was thinking, why do we need more? I’ve come to appreciate why more is better. But when the trades came to me and said, can you help us with something in the financial sector? As I said earlier, it just makes absolute sense that a bank would want to have a domain and a visual authentication factor, whether it’s a URL in a browser bar or an email that shows up in your inbox. Because of the security that Heather mentioned, which came not too long after the establishment of the company, it just makes absolute sense that banks should play in this space. It made sense then, and it still makes sense now.
We Had to Compete for Our Own Name
Rory Holland
Maybe even more so now, it seems like with all the security challenges. You wrote that one of your greatest accomplishments, that you’re most proud of, was the successful creation of FTLD, including raising money to get it off the ground. Can you tell me about a moment in time, one of the greatest challenges you had to tackle? How did you overcome it in the early days?
Craig Schwartz
So if we go back to when the application window closed, it was actually June of 2012, and we realized several other companies had applied for .bank and .insurance. We thought, okay, now we actually have to compete for this. We knew they were, for the most part, very well funded, and we thought, okay, this is going to be really hard. But at the heart, we knew that with the industry behind us, and with the approach we were thinking about, and how governments were looking upon applicants for these types of domains, we made a lot of commitments. We said we’re going to run things a certain way. And one of the elements of ICANN’s program is the ability for applicants to get objected to by interested parties. So we availed ourselves of that on the banking side, working with the International Banking Federation, and on the insurance side, with what was then the Financial Services Roundtable. We made the case that these other applicants for .bank and .insurance were either just purely speculators that were not going to create value, that were not going to add security, and ultimately were going to wreak havoc for banks and insurance companies. We prevailed through that process. We’re one of the only applicants that took advantage of it and prevailed. So the fact that we won for both of our two TLDs was really incredible.
Rory Holland
Congratulations, by the way. I’m glad you’re here. The industry definitely needs you. It sounds like there were other applicants, is that right?
Craig Schwartz
On the bank side, I want to say there were one or two. On the insurance side, there were three or four. We ended up working with some of the other insurance applicants, and they wound up joining our company, and we wound up working together. But we had to fend off others. With the industry behind us, both domestically and internationally, ICANN did the right thing and awarded those two TLDs to us.
Too Obvious of a Solution
Rory Holland
Yeah, awesome. Heather, I want to talk a little bit about what you’ve built, what you’ve helped build. Your team has built what, by most technical accounts, is the most secure namespace in financial services, with verification before registration and re-verification every year. I’m going to try not to butcher this, but mandatory DNSSEC, mandatory DMARC and SPF. There’s a lot of work here. And roughly thirty percent of your own registrants are actively using it, eleven years in. Why do you think there aren’t more bankers adopting this? Why are they struggling to really understand the value .bank can bring?
Heather Diaz
I don’t quite know, Rory. I think it’s almost too obvious of a solution, maybe, at the end of the day. And it does take banks a lot to make that decision to switch, whether it’s a new bank or they’re renaming, or sometimes banks wait until they’re rebranding their website. I think now, with AI accelerating attacks against the financial sector, and in general accelerating attack vectors that can target the financial sector, it makes sense now more than ever. Having a trusted digital identity is important now more than ever for banks. As we started this conversation, I highlighted some of those stats that consumers are being bombarded with things they can’t trust. So how do you cut through that noise? So frankly, Rory, I think banks should be taking a look at us more closely, and taking a second look: why aren’t they doing this .bank thing? Why aren’t they doing .insurance either?
Rory Holland
Hey, are you seeing an uptick in conversations, like curiosity, now that you mention AI and this boofing [?] and just the acceleration of all this? Are you getting more inbound?
Heather Diaz
I do think banks are taking a look at it. Their regulators are talking about cyber resilience, and about tools that can help banks raise their cyber practices. So we align very much with the conversation banks are having with their regulators and within their governance structure. Now’s the time for them to make that smart choice.
A Feature, Not a Bug
Rory Holland
I wanted to bring up something you each told us: the hardest feedback you’ve ever received. So Craig, that you micromanage, and Heather, that you talk a lot. Thanks for being honest and vulnerable on the show. Craig, who told you that, and what was going on at the time? Did the feedback feel true then, or has that been a recurring theme in your life?
Craig Schwartz
I wouldn’t say it’s been a recurring theme, but I’ve heard it from a couple of peers. I think partly it’s driven by my inherent need for perfection. And I think the other part is when you manage a very small team. We’re literally three full-time employees. When you think about the ancillary folks who really support the structure, we’re probably about ten. But when it’s so small, and you have your hands in everything, and you’re the chief executive and ultimately responsible, whether it’s to the board or to your investors, you have to know every little bit and piece. It doesn’t mean you have to understand how everything works, but you have to be informed. So I ask a lot of questions, and I’m really busy, and sometimes I forget that I asked them, so I ask them again, which maybe can be annoying. But that’s a piece of feedback I’ve gotten, and I’ve tried to learn from it and step back.
Rory Holland
It’s hard to let go of the reins. I wouldn’t say I would be characterized as a micromanager, but I definitely appreciate you sharing that. I want to ask a question about you and Heather in a second, but Heather, I wanted to ask you the same question. When did you hear it, and who shared it with you?
Heather Diaz
I’ve heard it in the past. I would say, Rory, it’s a classic case where this is a feature and not a bug. I come from a family of strong women, and they’re not afraid to speak up and share their expertise and experiences. I also have two twin older sisters, so maybe I had to talk more to get heard in my family. And I’m also cognizant, Rory, that I’m in two male-dominated sectors, banking and the tech industry. I think women should be encouraged to speak up and offer their unique and diverse perspective. We need more women in cybersecurity and in the DNS. So keep speaking up to get your seat at the table, ladies.
Rory Holland
I agree, I agree. Let’s flip this a little bit. Craig, I’m going to start with you. What do you appreciate most about working with the other person, Heather, in this case?
Craig Schwartz
What I appreciate most about Heather, and keep in mind we’ve been together now for eleven years, is that I can go away and know everything is handled. She can do pretty much every facet of my job. She’s very thorough, very particular, and she can be trusted with the security aspect of our business, which is critical. We, at the end of the day, all we have is our reputation. If something tarnishes that, because of a breach, because of something that should have been handled on security and wasn’t, that’s on us. Heather runs a very tight ship from a compliance perspective, which is why our numbers remain very, very high. So it’s trust in driving the ship and steering the part that is in her purview.
Rory Holland
Heather?
Heather Diaz
Really appreciate that, Craig. And for you, Craig, I really appreciate over the years your direct and honest feedback. Maybe the term radical honesty might be applicable. But truly, I appreciate it. I think it’s made me improve, not only as an employee but as a person. So thanks.
We Agreed: Steve Jobs
Rory Holland
Yeah, I think folks working with colleagues who have different approaches to things can take a lot from this. We’ve heard opposites attract. In my case too, Craig, I have Jack Macy, my co-founder, and we’re kind of opposite in a lot of things. So it just works. Thank you, guys, for sharing that. Now I want to jump into a fun little thing we like to do called fantasy executive headhunting. You both picked the same person. I want to start with the thing that jumped out to me most. As we communicated about who your headhunting pick would be prior to the show, Heather, you answered first and said Steve Jobs. And Craig, you said your first thought was also Steve Jobs. Tell me more about that choice, and Craig, why don’t you go first?
Craig Schwartz
When you think about what Apple has done to the way we communicate, the way we find information, and the way we stay connected, I think he’s got to be one of the most revolutionary thinkers of our time. Clearly he’s passed at this point, but he and his devices have changed the way we experience life and experience one another. I’d be hard pressed to come up with someone else, and another technology, that has felt so significant.
Rory Holland
Yeah. Heather, why did you pick Steve Jobs?
Heather Diaz
I grew up in Cupertino, California, where Apple is based, so it wasn’t a stretch for me to think about the effect Apple has had on my life personally, and on the world as well. When you think of tech and innovation, Steve Jobs is at the top of the list. What he did at the time, people thought his ideas were outlandish. And now when people look back, they realize he was focusing on simple, human-centered design.
Rory’s Commentary
Rory Holland
The parallel here is a subtle one. You may not think a top-level domain has a lot in common with Apple’s elegant and futuristic technology, but that’s where you’d be wrong. Part of what allowed Apple to become one of the most valuable companies in the world, after nearly disappearing in the ’90s, was their focus on owning the entire experience, from hardware to software to retail distribution. Steve Jobs was relentless about creating products that just worked. Apple achieved that by investing heavily in things that are invisible to most consumers, a bit like the safety and security of a .bank domain.
Heather Diaz
And that is what is so important, especially in this day and age, where we’re all bombarded with AI junk, I’ll call it. We want that human connection and those simple design features.
Rory Holland
Let’s just imagine Steve was alive and his first day was today. What would he do? Do you see him innovating, like big innovation happening at .bank in the future as a result of bringing in Steve?
Heather Diaz
I think AI can automate some of our work, even some of our compliance. We’ve implemented AI in some of our systems recently, and it’s brought new insights. So I could definitely see innovation going in that direction, in how we monitor and report to banks, bringing them more real-time, actionable information. So definitely.
Craig Schwartz
I would add to that: there are a lot of things that we know we know, and there are things that we know we don’t know. I see Steve Jobs as one of those people who was so creative, so thoughtful, and so intentional that he would do something that would raise the bar beyond anything we could conceive ourselves. To have that kind of brain power and that intellect be part of the team, I think it would be phenomenal.
Rory Holland
Yeah, that’d be fun. I can only imagine. You just drop into the business, like, okay, what do we do? What do you think? So I wanted to ask another question you guys had shared. We asked about if you could do anything else, what would you be doing? And you mentioned that if you could have a career doing anything else, it would be teaching middle school science or math. Was that something you thought about in college, or something you discovered an interest in through your career?
The Middle School Teacher He Almost Became
Craig Schwartz
Trying to remember what age it was. I might have been contemplating a career change, maybe I was 30 or 35. I always was the person in the neighborhood helping kids do stuff. I love math and science, and I come from a family of teachers. I’ve got aunts and uncles and sisters who are retired teachers. Teachers can be really powerful people in shaping a young person’s mind and how they live their life. I think if I had not become so comfortable in my corporate salary, I probably would have gone back to school, gotten a teaching degree, and pursued that. What’s interesting is I have a number of friends who had a similar path, very successful in their corporate life. They retired, and then they went back to teaching, or to pursuing teaching. So I wouldn’t say it’s outside the realm of possibilities for me, in some capacity, to find myself in a middle school doing something at some point.
Rory Holland
Funny, between gardening, flowers, and teaching. I share that with you too. So I don’t know about the bungee jumping, but maybe. I don’t know, maybe. If I’m in New Zealand, I’m going to jump off something, maybe I’ll do it. Heather, you’d run a gluten-free restaurant. Are you gluten-free? You just have a heart for people?
Heather Diaz
I am gluten-free, and I have a heart for people with allergies as a result. My dad was our family cook, and his father was also really into cooking, so I had that influence from my dad. My mother-in-law is also a big influence on my cooking. She cooks Dominican food, so I’ve learned a lot of Dominican specialties, like tostones, rice and beans, and pastelón. Now all your listeners are hungry. But I have a passion for cooking the things she’s taught me as well.
Rory Holland
That’s wonderful. I’ve been gluten-free for 17 years by choice, and I don’t miss it. These days there are so many gluten-free options, but back then it was really hard. There just weren’t many choices. People would say, what? You don’t want a bun on your burger? What’s wrong with you?
You Don’t Have to Wait to Make a Difference
I hope you’ll indulge me. I want to pull in a question that’s been on my heart for you guys. The first one is about what you value. I’ll ask you both, and either of you can jump in: what do you value most in business, and what do you value most in your personal life? Who wants to go first?
Craig Schwartz
Heather, why did you go first?
Heather Diaz
Okay. On business, I’m all about building a safer and more trusted internet. .bank and .insurance tie right into that, and I continue to enjoy working on moving our industry forward and building trust online. Personally, since I have two young children, my interest lies in helping them see how they can have a positive impact on the world. Especially with my ten-year-old daughter: she read a book about children who had made changes that impacted the world, and I turned to her and said, you can do that now. You don’t have to wait till you’re older. She started a project at school, putting together personal hygiene kits for unhoused people, and that took off. Teachers were inspired, and her schoolmates donated supplies. So I try to instill that in my kids now, from a young age: you don’t have to wait to be an adult to do something positive for the world.
Rory Holland
I love that. Craig?
Craig Schwartz
For me, the personal and the professional actually overlap quite a bit. It’s hard to draw the line. I’m very much a relationship-oriented person, and I like being very connected, whether they’re my professional colleagues, friends, or neighbors. It’s all about striving to be better and contributing in a meaningful way in a world that is increasingly challenging, and fraught with a lot of distraction. It’s about focusing on what’s quality, and quality in people, and bringing out the good in people. I think that spans both personal and professional.
Connecting with the .Bank Team
Rory Holland
Looking forward, I read that back in 2025, India’s central bank launched a version of .bank, a government-run version. I think you responded that FTLD believes its private-sector, industry-led approach remains the best way to respond to evolving online threats. And this July you announced a major email security enhancement for both TLDs. So where does it go from here? We’ve talked about AI. It’s a pervasive threat, and it’s only growing. Secure banking is a requirement. We’ve got to have it for people to trust the systems. Is it a private-sector thing, a government mandate, or some combination of both?
Craig Schwartz
I think it’s a combination of both. We have always had very good relationships with regulators, and we understand what they focus on in examinations, what’s important, whether it’s vendor management or reducing a risk profile. We continue those relationships. We also continue working very closely with the trades, the ABA, BPI, and ICBA, and understanding what’s important to their members. A big part of this is really in Heather’s lane: understanding what the landscape looks like ahead, how it continues to evolve, and how we respond to that. We initially created our requirements back in 2009, long before FTLD was ever created, as an input to ICANN’s new gTLD program. Those standards, Rick [?] slash requirements, have evolved over time. We need to keep doing that and stay ahead of the game. Not get so far out that we’re leaving people in the dust, but being responsible and aware of where we need to focus our time, energy, and resources.
Rory Holland
Is there anything you’d like to add to that?
Heather Diaz
Yeah. We’ve always taken a collaborative approach to our compliance program, and part of that is getting input from the banks and the members of our community. To evolve those standards, we’ve gotten banks together every year and continue to gather their input, to make sure .bank security evolves to meet their needs.
Rory Holland
So on that note, for bankers, insurers, and security leaders who want to get in touch with you, what’s the best way to reach you guys?
Craig Schwartz
Go to our website. There’s a big button at the top that says schedule a meeting with me. They can do that with me, or with Heather. My mobile number is on all of our websites, and I think Heather’s is too, which is something you don’t see too often. Pick up the phone and call, and let’s have a conversation. I’ll tell you, 75 to 80 percent of those conversations result in a conversion event. Whether it’s a bank that doesn’t own a domain deciding to register, or a bank that’s been talking about actively using it and is now putting together a program, those calls, whether it’s Heather or myself on the phone, are our job. We help demystify what’s involved and help financial services professionals understand that it’s not as complicated as they think it is, and certainly not as expensive. It’s absolutely something they should be doing for maximum protection of their institutions and their customers.
Rory Holland
Thank you, Craig. Heather, it’s been awesome.
Heather Diaz
Thank you, Rory. Really appreciate it.
Craig Schwartz
Yeah, thanks so much.
Rory Holland
Yeah, my pleasure.
Outro
What Craig and Heather have done with FTLD Registry Services is remarkable. It’s hard to quantify the number of cybercrimes they’ve helped prevent and the number of dollars they’ve saved banks and consumers. As with so many things in life, the best security is all but invisible. For Craig, a self-described perfectionist and methodical operator, I can only imagine what it feels like to reflect on the legacy he’s built and where the company will go next. Heather and the team have an opportunity to stand on Craig’s shoulders. And forge a path through a world excited and troubled by the best and worst forms of AI. As leaders, it can be difficult to release control and give your team room to make mistakes and succeed on their own. You have to create an environment where the company’s future isn’t dependent on you, but on the systems you’ve built. The four-star general Stanley McChrystal wrote in his book, Team of Teams, about the temptation to lead as a chess master. Controlling each move of the organization must give way to an approach as a gardener, enabling rather than directing. A gardening approach to leadership is anything but passive. I know that’s true for Craig because I’ve seen it firsthand. His gentleness and unshakable calm are anything but passive. It’s a lesson for all of us. Sometimes the biggest difference we can make is in the seeds we plant and the relationships that grow from them.
Thank you for listening to Mighty Finsights. You’ll find all of our episodes on our website, cstmr.com, including more one-on-one interviews with fintech and financial leaders, as well as deep-dive episodes on specific topics like branding and marketing. This show is produced and distributed by CSTMR, a financial marketing agency. All rights reserved. Our production team includes Zac Garver, Kathy Logan, Axel Reyes, Brad Jurger, Romina Gomez, and Belén Ancurio.
