Banks’ AI Bottleneck Isn’t New. Regulators Named It in 2013.

Ask a bank technology leader why an AI programme keeps stalling between the pilot and the balance sheet, and the answer is almost always the same: legacy infrastructure. Core banking platforms built on COBOL in the 1970s and 1980s, patched together through decades of mergers, cannot feed a model clean, joined-up data. That explanation is correct as far as it goes. What it misses is that this is not a new problem waiting for AI to force a fix. It is the exact problem regulators named after the 2008 financial crisis, gave banks a deadline to repair over a decade ago, backed with the threat of fines, and largely failed to get fixed anyway. That history matters more than the diagnosis: this bottleneck is not a phase banks will simply spend their way through.

The obvious explanation holds up, as far as it goes

Legacy systems really are that old. More than 90% of the world’s largest banks still run core platforms built in the 1970s and 1980s, many on COBOL. Zions Bancorporation, a mid-sized US regional bank with around 88 billion dollars in assets, took more than 11 years to move off several legacy core providers onto one platform, from a board decision in 2011 to its deposit system going live in 2024, per American Banker’s account. JPMorgan Chase spends roughly 18 billion dollars a year on technology and says it has invested in AI for “over a decade.” Yet at its May 2025 investor day, chief financial officer Jeremy Barnum told investors the firm was “past the point of peak modernization spend.” Minutes later, chairman and chief executive Jamie Dimon corrected him: “I don’t think it’s mostly done.” If the best-resourced bank on the planet has not finished after a decade and 18 billion dollars a year, smaller banks will not out-invest their way past it quickly.

What the consensus view misses

In January 2013, responding directly to the crisis, the Basel Committee on Banking Supervision, part of the Bank for International Settlements, published its Principles for effective risk data aggregation and risk reporting, BCBS 239, requiring the largest banks to aggregate risk data accurately and quickly across the group, with a 2016 compliance deadline. Supervisors have assessed progress seven times since, most recently in November 2023, covering 2022 data. Nearly ten years after publication, of the 31 global systemically important banks assessed, including Barclays, HSBC, JPMorgan Chase, Citigroup and Deutsche Bank, only two were fully compliant. Not one Principle had been fully implemented across all 31: 6% of the world’s largest, best-capitalised banks reaching full compliance under a mandate with a fixed deadline and fines as an available penalty. The Committee describes progress as “occurring at a slower pace than envisaged,” naming the cause: several banks “failed to fully assess the complexity and interdependence of related projects, especially to address IT legacy systems.” One line connects this directly to AI: “New technologies such as artificial intelligence have not yet materially impacted banks’ risk data aggregation and risk reporting processes… many banks still lack quality data, which is a prerequisite for embarking on any digitalisation project.” A banking supervisor, not a technology vendor, is saying AI is being asked to run on the same data foundation a decade-long, penalty-backed mandate could not repair.

Banks are deploying AI anyway

None of this has slowed adoption. The Bank of England and Financial Conduct Authority have jointly surveyed UK financial firms on machine learning and AI three times: 2019, 2022 and 2024. Roughly two-thirds of firms already used machine learning in 2019, rising to 72% by 2022. On AI specifically, a question added in 2022, 58% were already using it, with 14% more planning to within three years; by 2024 that had climbed to 75%, with another 10% planning to. Adoption rose 17 percentage points in the two years to 2024, over almost exactly the window in which the Basel Committee’s own data shows compliance ratings barely moving, and falling for several Principles. Banks are not waiting for the data problem to be solved before deploying AI. They are deploying around it.

The verdict

Treating legacy infrastructure as a temporary lag, a gap banks will eventually close, is the wrong planning assumption. Ten years of regulatory mandate and near-unlimited budgets at the world’s largest banks produced two fully compliant firms out of 31. A roadmap that sequences “fix the data, then scale AI” as separate phases risks a phase one that never finishes. Asked whether the technology work was mostly done, Dimon said modernisation spend is “table stakes. It will be for the rest of eternity,” pointing to the same unfinished piece the Basel Committee flags: “the hardest part is getting data into the form where it can be used properly.” AI tools may eventually do for data remediation what a decade of governance committees could not, since automated documentation and lineage discovery suit large language models, and the 2023 report raises that possibility. But it attaches the same precondition that stalled progress for a decade: quality source data first, digitalisation second. The likelier path is not that AI fixes the data problem, but that banks design use cases around fragmented data, the way some banks in the BCBS 239 case studies built new central repositories rather than repairing every legacy system underneath. Banks are not behind on AI because they lack a strategy. They are behind because the data problem AI needs solved was named, dated and backed with financial penalties in 2013, and it remains unsolved at 29 of the world’s 31 largest banks.

Sources

• Basel Committee on Banking Supervision, “Progress in adopting the Principles for effective risk data aggregation and risk reporting,” Bank for International Settlements, November 2023
• Bank of England and Financial Conduct Authority, “Artificial intelligence in UK financial services 2024” survey results, November 2024
• JPMorganChase, 2025 Investor Day Transcript, May 19, 2025
• American Banker, “Zions leaders reflect on lessons learned from 11-year core upgrade,” August 2024