Build, Buy or Partner: Rewriting the Rulebook in 2026

Early in August 2026, ABN AMRO announced a strategic partnership with Mistral, France's frontier AI lab, to jointly design AI tooling built and overseen inside Europe. The framing was not the technical detail. It was the choice. A universal bank with the balance sheet to build in-house and the procurement scale to buy from any global vendor instead chose to partner, and chose a European provider over the incumbent hyperscalers.

That signal did not travel alone. A week earlier, Cover Genius closed its acquisition of Friendsurance in the DACH bancassurance market. Mastercard closed its acquisition of BVNK, folding stablecoin capability into the rails. And under all of it, DORA supervision was tightening around concentration risk in critical ICT providers.

Innovation leads across Europe are being asked the same question by their boards this quarter. When we bring in a new capability, when do we build, when do we buy, and when do we partner? The answer that worked in 2023 no longer holds.

Why the old spreadsheet is quietly wrong

The build, buy or partner decision looks like a spreadsheet exercise. Cost of build. Time to value. Vendor viability. Integration effort. Total cost of ownership over five years. Every institution has a version of that grid, and most of them are dishonest.

They are dishonest because they omit the four forces that now dominate the answer. First, Digital Operational Resilience Act supervision has quietly moved concentration risk from a technology-department conversation into a board-level exposure. If 30 per cent of the sector's critical outsourcing budget already goes to ten providers, the twelfth vendor added to that pile is not free. It creates a systemic multiplier that a national competent authority such as the ECB or the EBA will price for you. Second, the EU AI Act, effective across Annex III use cases from 2 August 2026, converts several build, buy questions into governance questions. Whether the tool is internal or external, the accountability sits with the deploying bank. Third, EU tech sovereignty is no longer a slogan. The European Commission's June 2026 tech sovereignty package pushes procurement toward European infrastructure where feasible. Fourth, delivery pressure has compressed the runway. Innovation teams are being asked to close capability gaps in months, not years, while sustaining the day job.

Any framework that answers 'build, buy or partner' without pricing those four forces will produce the wrong answer. Confidently.

Four routes, four sets of scars

Most banks are quietly running four models in parallel, and defending each one against the others in internal committees.

Build in-house has historically been the default for anything considered proprietary. The trade-off has always been time, cost and the talent question. In 2026 the calculus shifts. Build gives you the tightest control over model risk, data lineage and the AI Act audit trail. It also creates a heavier internal supervision burden and a longer runway before value. For agentic AI and payments modernisation work in particular, few institutions have the specialist headcount to build at the pace the market is moving.

Buy off-the-shelf is attractive on time-to-value and punishing on lock-in. Buying from one of the ten providers already carrying a third of sector outsourcing spend now creates a documented concentration exposure that DORA supervisors, coordinated by the European Supervisory Authorities, will ask about. Buying from a smaller specialist reduces concentration risk but raises vendor viability risk. The regulator has effectively tightened the range.

Partner is the middle path that most banks under-use. The ABN AMRO and Mistral arrangement is a partnership rather than a licence, precisely because the bank wants co-design authority over the models it will supervise, and the provider wants scale and reference credibility. A partnership can preserve optionality: you retain the ability to bring the capability in-house later, or move to a second provider, without a full rebuild. The trade-off is governance overhead. Partnerships are structurally harder to manage than a straight vendor contract, and they demand senior time.

Invest or acquire is the most decisive route, and increasingly used where the capability is core. The Cover Genius and Friendsurance transaction, and Mastercard's acquisition of BVNK, both landed inside a fortnight. Acquisition removes vendor risk, absorbs the talent, and delivers immediate strategic control. It also imports the target's technology debt and cultural integration risk, and consumes capital that could fund three or four partnerships. Analysts at Oliver Wyman and Wolters Kluwer have both pointed to a rejuvenated European banking M&A tape running into late 2026.

Every route has a defensible case. The mistake most innovation offices are making in 2026 is running these as separate lanes. The best-run banks now run one decision matrix that scores each candidate capability across all four routes on the same regulatory, delivery and peer-adoption criteria. Where the answer is not obvious, they hold the decision open for one round of external validation, rather than defaulting to what the last committee said.

Where the decision is really made

The unglamorous truth is that the quality of a build, buy or partner decision is set upstream of the spreadsheet. It is set by how well an innovation team has seen the market before it starts scoring options.

Two forms of upstream input, in particular, change the answer.

First, structured discovery of the innovator field. Most banks meet vendors reactively, through inbound pitches and conference floors, and end up with a shortlist skewed by whoever markets loudest. A discovery process that scans horizontally across the innovator base, filters for regulatory posture and vendor viability, and shortlists on evidence rather than volume, produces a very different set of options. This is where a curated peer-informed format, such as a Discovery Innovation Meeting or a targeted Roundtable run by The Connector, can compress months of scouting into a working shortlist.

Second, peer benchmarking on the decision itself. The most useful data point when choosing between build, buy, partner or acquire is what three or four comparable institutions in other markets have already tried. Not what they said on a keynote stage, but what they retired, what they scaled, and where they got stuck. Peer Forum formats built around that specific question, and editorial platforms such as Finance X Magazine that document real adoption decisions, close the peer visibility gap that most innovation teams admit to privately.

Neither of those inputs replaces the internal committee. They change the quality of the question in front of it.

Why the answer changes this autumn

The August 2026 window is the point where several regulatory clocks and market signals meet on the same desk. DORA supervision is entering its first enforcement cycle in earnest. The AI Act Annex III obligations are now live. The Commission's tech sovereignty package is nudging procurement policy. ESMA and national competent authorities are already asking questions about concentration in critical ICT services. And the M&A tape is telling innovation leads that peers are moving through acquisition rather than pilots.

Any bank still running its build, buy or partner decisions on a 2023 template is quietly accumulating regulatory, concentration and delivery risk it cannot see on the spreadsheet. Boards are starting to ask about that. Innovation leads are being asked to defend past decisions against a new frame, particularly where the vendor sits inside the SEPA perimeter but the compute does not.

The most valuable move this autumn is not to accelerate any single decision. It is to rebuild the framework the decisions will be run through, and to import the peer evidence to support it.

Closing thought

Build, buy or partner is one of the few decisions an innovation lead in a European bank will not be forgiven for getting wrong twice. The winners in 2026 will be the teams that stop treating it as a spreadsheet exercise, price in DORA concentration, the AI Act, EU sovereignty and delivery pressure explicitly, and stress-test their answer against comparable institutions before they commit.

If your board is asking harder questions this autumn than it did in the spring, that is not a warning. It is the market rewriting the brief in real time. If you want a peer-informed sounding board before the next committee, that is the conversation The Connector is set up for.