The core has been the one system nobody wants to touch. Too central to replace, too old to leave alone, and every plan to fix it looked like a bet with an uncertain ending. So banks waited, and waiting became the default. What has changed is not risk appetite. It is that the contained path, the one that hollows out the estate gradually and proves each step before the next, has stopped being the slow option. Early movers already have the results. The decision most leaders had closed is worth reopening.efore they occur.
Two ways core programs fail
The failure modes are well documented, and they sit at opposite ends. Big-bang cutovers break: TSB’s 2018 migration locked customers out within hours and ended in 48.65 million pounds of fines and 32.7 million pounds of redress. Deferral carries its own bill: Citi’s postponed modernization has drawn consent orders and a combined $536 million in penalties.
Underneath both lies the same reality:
- The core is load-bearing, with no maintenance window.
- Institutional knowledge has decayed, so teams spend 50 to 70 percent of an effort just understanding the current system.
- Testing and controls cap how much change a bank can absorb, so budget rarely buys speed.
An estimated 70 percent of banking transactions worldwide still pass through COBOL. That is why the problem has proved so durable.
Why the third path is now the default
There has always been a safer route between replacement and deferral: hollow out the estate gradually, contained and reversible, running old and new in parallel until the reconciliation breaks reach zero. Historically it was the slowest route, because the archaeology of understanding the old system and the hand-building of a reconciliation harness took months.
AI removes both bottlenecks. Tools now translate legacy code into plain English specifications in days, and they generate the equivalence tests automatically, which changes the risk profile of every change. For a delivery organization, the first safe change now ships in weeks rather than quarters, and every release after it carries its own proof of equivalence.
Santander proved the containment pattern at the infrastructure layer, and AI extends it to the functional layer. The harder part is governing it. Every sophisticated adopter, from Goldman Sachs to Morgan Stanley to BNP Paribas, had to build supervision, orchestration, and audit around the models themselves.
ALTi AIOS™ gives a bank that governed operating layer in one place: comprehension-first analysis, specification-led rework, equivalence testing, human supervision, audit trails, and value measurement, with the models and agents kept portable so they can be swapped as they improve.
The pattern already has receipts
- Santander moved roughly 80 percent of core infrastructure to cloud with zero reported service interruption. It ran old and new in parallel and compared outputs before each cutover, an approach Google later productized as Dual Run.
- Morgan Stanley’s DevGen.AI processed nine million lines of legacy code in a year and saved an estimated 280,000 developer hours. It did so by producing plain English specifications for re-implementation.
- Amazon’s agentic mainframe service reports 4.5 billion lines processed in a year, and delivered a Fiserv modernization in 17 months against an estimated 29 or more.
The through-line is containment and proof of equivalence, which show up as time saved and risk contained. The gains are bounded too: proven on individual tasks, and still unproven across a full core program at a tier-one bank.
The decision facing bank leaders
Core decisions no longer need to be all or nothing. Progressive, contained, reversible modernization is now faster and safer than it has ever been, so the sensible path is to choose it deliberately. Buy models and agents competitively, keep them portable, and own the control layer that carries authority, audit, safety, and value measurement. Treat the core as an estate to improve continuously and provably, and the years of postponement give way to steady, evidenced progress.
Weighing how to modernize without betting the franchise? Explore how ALTi AIOS™ makes the contained path fast and governable, or talk to our team.
References
1. “TSB fined £48.65m for operational resilience failings,” Financial Conduct Authority, December 2022.
https://www.fca.org.uk/news/press-releases/tsb-fined-48m-operational-resilience-failings
2. “Citigroup Fined $136 Million, Totaling $536 Million Since 2020,” Baird Holm LLP, July 2024.
https://www.bairdholm.com/blog/citigroup-fined-136-million-totaling-536-million-since-2020/
3. “Santander completes the digitalization of its technology infrastructure in Spain with the deployment of Gravity,” Banco Santander, June 2025. https://www.santander.com/en/press-room/press-releases/2025/06/santander-completes-the-digitalization-of-its-technology-infrastructure-in-spain-with-the-deployment-of-gravity
4. “Morgan Stanley Builds AI Tool That Fixes Major Coding Issue,” Entrepreneur, 2026, reporting Wall Street Journal figures.
https://www.entrepreneur.com/business-news/morgan-stanley-builds-ai-tool-that-fixes-major-coding-issue/492697
5. “One year. 4.5 billion lines of code. 1.6 million hours saved,” AWS Migration and Modernization Blog, May 2026.
https://aws.amazon.com/blogs/migration-and-modernization/aws-transform-one-year-milestone/
6. “Learnings from COBOL modernization in the real world,” AWS Artificial Intelligence Blog, February 2026.
https://aws.amazon.com/blogs/machine-learning/learnings-from-cobol-modernization-in-the-real-world/
Author’s Bio
Sanjiv Roy is the Global Head of BFSI Solutions at Altimetrik, where he leads the strategy and delivery of banking, financial services, and insurance solutions. He works with financial institutions to drive digital transformation through engineering-led, AI-native approaches.
View LinkedIn Profile →