Is legacy banking IT the biggest risk to the global economy?

This may be a bold headline. However, regulators around the world apparently agree, given their imposition of large fines on banks for recent IT resiliency failures. It seems the aging infrastructure used by major banks to deliver services is increasingly in the spotlight.

In total, there are about 30 or so very large banks known as G-SIBs or Globally Systemically Important Banks, the smallest of which manages assets worth more than the combined GDP of the world’s 30 poorest nations¹. The impact of these banks, both individually and collectively, on the global economy is profound. As a result, their performance and resiliency are critical to reducing global economic risk and strengthening the global economy.

While many of these banks have invested heavily in core digitization and the creation of positive customer experiences, the majority are still reliant on supporting systems built in the 70s and 80s—COBOL applications wrapped in layers of middleware. Although these solutions remain robust and deliver daily, there’s increasing concern that their underpinning technology is no longer fit-for-purpose and could be negatively impacted by climate change, the move to 24/7 banking, and increasingly sophisticated cyber-attacks.

Global economic stability depends on banking IT modernization

The success of these banks, and others, in preserving global economic stability depends on the modernization of this legacy technology. CGI’s annual Voice of Our Clients research confirms this. Over two-thirds of banks that participated in our in-depth discussions indicated that legacy systems continue to prevent them from realizing the full benefit of their digitization investment.

Further, the move toward real-time data and 24/7 operations and availability has become a massive challenge, thanks to the growing antiquity of these systems. Based on the current pace of technology evolution, legacy IT will remain a significant issue for at least the next decade.

So, could legacy banking IT, in fact, be the biggest risk to the global economy? Simply put, if any one of these 30 or so G-SIBs became unable to transact for more than a couple of days, there would be devastating impacts on financial markets around the world. Further, the impact on global liquidity and settlement failure could have catastrophic implications on businesses operating in the affected markets.

Some G-SIBs are already looking at how core services could be restored—regardless of risk—just to keep markets going. However, this is a survival-of-the-species type of business continuity planning, rather than an elegant reset of the bank.

Regulators have already recognized the global economic risk of bank IT failure. New legislation, such as the European Union’s Digital Operational Resilience Act (DORA), ensures that resiliency remains a high priority for bank CIOs. However, systems that have been in place for more than 40 years tend to be woven into the very fabric of the bank and may seem impossible to pull out and replace. Larger banks that have initiated core replacement projects often find that they are decades-long journeys that tend to outlast the executives who first backed them and the modernity of the new platform being implemented.

Three proven modernization approaches

Fortunately, digital leaders in the banking industry are now at the tail end of their digital transformation programs and have some lessons to share. Three distinct modernization models have emerged that banks are applying through partners, managed services, and/or modernization-as-a-service. These models focus on migrating functions while maintaining alignment with bank risk models.

Model one: Wrap and squeeze

This model represents “death by a thousand cuts” for the legacy application. The first stage involves performing a functional and data flow audit. Next, a plan for migrating functional blocks to new or existing applications within the ecosystem is developed. Once a migration roadmap is in place, the functionality of the legacy system is slowly squeezed until it no longer has work to do. This process can start with moving applications off the mainframe to make them more accessible and easier to work with. Although this is a long-term project, it’s relatively low risk and allows for changes of direction within the modernization program.

Model two: Parallel build

This model involves building a replacement infrastructure and migrating traffic from the old infrastructure to the new one, either in phases or all at once. A total migration carries more risk and therefore is used less frequently. A parallel build can be completed in a relatively short timeframe. However, an inherent risk is that—due to budget restrictions— the new infrastructure may be built to replace only the most important parts of the legacy system rather than the full scope. This limited functionality can later become problematic. If a bank chooses a parallel build model, it should commit to replacing full functionality to reap the full benefits.

Model three: Just enough to… (JET)

This model is the least ambitious approach. Using a “lift and shift” strategy, the mainframe is re-platformed or modernized to reduce project costs. The bank, rather than changing the core application, evolves the application’s technology just enough to postpone a major overhaul for a few more years. The JET model has had a revival, thanks to generative artificial intelligence (GenAI). AI-based coding tools, such as Copilot, are used to translate the original code into a modern language so that it can run on a newer technology stack and be coupled to API layers or even streaming data platforms. However, what the JET model doesn’t fix is the 40-year-old design of the application, resulting in a resiliency play rather than a genuine modernization. JET doesn’t reduce risk; it simply defers it.

Mitigating the threat of aging IT on the global economy

With more than two-thirds of the world’s banks facing systemic technology debt in their ecosystems and requiring complex, multi-day business continuity plans, chronically outdated IT infrastructure poses a real threat to global economic stability. Compounding this issue are challenges such as inadequate global supply chains for mainframe hardware, a shortage of COBOL developers, and reliance on telecom infrastructure.

Banks, however, have an opportunity to come together to improve the systemic health of the global economy through modernization. Of course, the benefits for their industry and the customers who rely on their services also are significant.

If your bank is wrestling with some of these legacy challenges, CGI can help. Feel free to contact me to discuss how we can help advance your digital transformation.

¹ G-SIBs Monitor H1 2024: Living Up To Expectations (spglobal.com), p.14.