Five main risks recur. Data sits across systems that serve other purposes and expose it in the wrong shape. Fraud models decay as attackers adapt. Over-tuned controls decline good customers and cost more than the fraud they stop. Hosted models move the PCI boundary and fall under DORA. And the running cost of monitoring, retraining and documentation continues after launch.