The challenge
One change budget, many fixed claims on it
Capital rules such as Basel 3.1 and FRTB, operational resilience under DORA and AI Act obligations for credit scoring all arrive with dates the bank cannot move. None of them is the hard part on its own. The hard part is that they draw on the same people: risk data, finance, model validation and the platform teams that also own the modernization roadmap.
Resilience is no longer a project with an end date. Registers of information, resilience testing, exit strategies, incident reporting and the remediation of every finding are a standing load on the infrastructure, security and vendor teams that run the bank every day. Meanwhile, the core still has to be replaced while the bank keeps running.
When regulatory work grows, something else slips, and too often nobody can say what until a quarter later. Cost-income targets then cascade as a number, and the change portfolio is cut evenly because nobody can see in time which work carries the value. Each spreadsheet what-if takes days, and the steering deck is outdated when it is presented.