Why Banks Cannot Call Innovation Done

On 7 July 2026, Claudia Buch, Chair of the ECB’s Supervisory Board, wrote to the chief executives of the significant banks under ECB supervision. The letter concerns what it calls ‘AI-enabled cybersecurity threats’, and it asks each bank for an action plan by 31 October, submitted to its Joint Supervisory Team. One of the measures it lists has drawn little attention: modernising infrastructure by replacing or updating legacy, unsupported or end-of-life technologies.

A supervisor asks for modernisation plans from an industry it believes still has modernising to do. The request looks routine, and its substance is that the technology running Europe’s largest banks is, in places, old enough to count as a safety question. The rest of 2026 has supplied the evidence for that view, from outages to fines to the shape of the competition, and it points to where the innovation task now sits.

The ECB’s numbers are good, and its priorities point at the systems behind them

In November 2025 the ECB published the results of its annual supervisory review. The numbers were good. Common equity tier 1 capital stood at 16.1% of risk-weighted assets, the liquidity coverage ratio at 158%, and return on equity had risen to 10.1%. Capital requirements for 2026 were left broadly stable.

The same release named the supervisory priorities for 2026 to 2028. The second of them is strong operational resilience and ICT capabilities, including remedying deficiencies in risk reporting and data aggregation. Profitability has recovered. The systems that generate, move and report the data behind that profit are where the supervisor still sees work. What the priority reset does to innovation governance is covered in an earlier piece on this site. On the ECB’s own list, the systems underneath the capital now sit second.

Where the old systems show, from outages to AML data

The outage record is the most visible sign. The UK publishes incident data that the euro area does not, so it is the clearest window. On 25 September, Which? published its analysis of FCA incident data for April 2025 to March 2026. Ten high street banks and Nationwide reported 144 IT incidents between them; ten challenger banks reported 60. Scale explains some of that gap. What it does not explain is the cause. Lloyds blamed its June outage, which left thousands of customers unable to make payments, on a software defect introduced during an update of its banking app. A routine change became a payments failure. HSBC shows what sustained work buys: its incident count fell from 13 in 2021 to four in 2025. Cloud concentration is now a supervised risk on both sides of the Channel.

The European Supervisory Authorities published their list of critical ICT third-party providers under DORA in November 2025, and in July the UK designated four global cloud and technology providers as critical third parties.

Financial crime monitoring shows the same problem over a longer timescale. On 9 October BaFin announced that an order on Deutsche Bank, issued in September, had become binding on 6 October. It sets new deadlines for the data-processing systems behind the bank’s transaction monitoring and updates orders first issued in April 2021 and November 2023. The bank says the order contains no new findings and covers measures still open from 2021 and 2023, which puts the remediation in its sixth year. The same week, the OCC showed what the cost looks like when the data work is not done. It imposed a $350 million penalty and a cease-and-desist order on American Express National Bank, in coordination with the Federal Reserve. Over the past decade, the bank had failed to identify in time, or to sufficiently report, around $13 billion of suspected trade-based money laundering.

Fraud losses are similar from the customer’s side. UK Finance’s annual report, published in June, put payment fraud losses in 2025 at £1.28 billion, up 4%. Authorised push payment fraud rose 19% to £576.4 million. Most of the controls were designed for fraud that arrived through the branch and the card. Two thirds of APP fraud now begins online.

Revolut and the AI leaders are moving on a different clock

Revolut reported its 2025 results on 24 March. Retail customers reached 68.3 million, up 30% in a year. Total customer balances rose 66% to £50.2 billion. In Europe, one in five working-age adults now uses it. In the UK it has exited mobilisation and can now offer banking services to its 13 million customers there, and it is targeting 100 million customers worldwide by mid-2027. For an incumbent, the balances matter more than the customer count. A bank holding £50 billion of customer money is competing for the primary account, on a stack built in the last decade.

On AI, the gap between the leaders and the rest is just as wide. Evident’s 2026 AI Index, published in October, ranks JPMorgan first among 50 of the world’s largest banks for the fifth year running. UBS, in sixth place, is the only European bank in the top ten. Across the index, 12 banks now report a realised or projected return on their AI work. Thirty-eight do not. Only 12% of reported use cases show an impact on operational KPIs. The leaders also run AI differently: 80% of them have sophisticated control mechanisms in place, against 40% across the rest of the industry.

Qivalis and the digital euro are new rails, with a late start on them

The clearest sign that banks can still act together came on 14 October, when Qivalis announced that De Nederlandsche Bank had authorised it as an electronic money institution. Qivalis is the euro stablecoin venture backed by 37 banks across 15 countries, ING, KBC, BNP Paribas and BBVA among them. The authorisation makes it eligible to issue euro-denominated e-money tokens, and Qivalis says it does not yet issue electronic money. The token itself is still to come.

Banks saw a new rail being built in dollars and organised a European answer with regulatory backing. They also did so years after the dollar market had set its terms. A late answer needs a 37-bank consortium and a licence; an early one would have needed a product team.

The public rail is on a similar path. On 23 June the European Parliament’s economic committee voted 43 to 14, with one abstention, to adopt its negotiating mandate on the digital euro, clearing the way for talks with the Council. The ECB’s stated timeline runs to a pilot from mid-2027 and a potential first issuance in 2029, provided the legislation is adopted this year. If it goes ahead, whatever a bank thinks of a central bank digital currency, it will be expected to connect to one, offer it and reconcile it. That is integration work on the core, with a date attached.

What innovation now has to mean, and the question for 31 October

Most large European banks now have a capable app and a working onboarding flow. That was the agenda of the last decade. This decade’s agenda is less visible and harder: infrastructure a supervisor will inspect against an action plan, data a transaction-monitoring system can rely on, fraud controls built for the channels fraud now uses, and integration with payment rails that may be mandatory by the end of the decade.

For a technology company selling into banks, the shift changes the buyer. The budget that funded onboarding flows and app features now sits with the people responsible for data aggregation, transaction monitoring, fraud controls and payment-rail connectivity. Their procurement question is whether a product survives a Joint Supervisory Team’s inspection. A vendor who can show a bank how its product shortens an action plan has a reason to be in the room.

This is an industry in good financial health with an unfinished technology job, and most of the items on it now carry deadlines. If you are signing one of those plans this month, the harder question is this: which items on it would the bank be doing anyway, and which are there because the ECB asked? The answer separates banks that treat modernisation as strategy from banks that treat it as compliance, and the plans themselves will show which is which.

If you lead innovation, technology or operations at a bank and want to test your plan against what your peers are doing, book an innovation meeting with The Connector. If you sell into banks and want to understand what they are buying next, reach us through FinanceX Magazine.