Risk and resilience

Understand the shift, not just the reduction.

Core modernisation is often justified on risk grounds. Ageing infrastructure, brittle integrations, escalating cyber exposure and operational fragility are legitimate concerns. Legacy platforms accumulate risk over time.

But while replacing legacy technology significantly reduces risk, it does not eliminate it and alongside a core replacement, institutions should be prepared to update some of their risk capabilities.

A changing risk landscape

A new core system reduces risk. Moreover, it reduces the most existential risks that should keep board members awake at night, like a hacker getting access to an entire monolithic system or the risk of not being able to adapt quickly to keep up with changing market conditions.

However, a core replacement also introduces new considerations that institutions should recognise and address during the planning process. Whereas in legacy systems, risk often accumulates through inertia, in modern architectures, risk can accumulate through acceleration.

Risk can accumulate through acceleration.

Everything else being equal, a 4th-generation core will lead to much faster throughput. For transactions, for instance, this can increase fraud exposure since fraud happens at the speed of transactions. As a result, monitoring and fraud detection capabilities must evolve alongside the core platform.

Greater ecosystem openness can also expand the attack surface. APIs, partners and embedded channels introduce additional dependency chains and third-party risk, which the institution should seek to monitor, for example, by investing in data security technologies and subscribing to exposed data intelligence services.

Continuous deployment accelerates change cycles. Governance therefore needs to evolve from periodic oversight toward more embedded control.

Core selection cannot, therefore, be separated from broader system architecture and operating discipline. Security increasingly moves toward zero-trust principles. Data governance must strengthen as accessibility expands. Resilience shifts from simple availability metrics toward active-active configurations, automated failover and defined recovery objectives.

A 4th-generation core materially improves structural resilience, when implemented within a coherent and well-governed ecosystem.

In a regulatory environment where there is growing focus on operational resilience, third-party dependency and systemic interconnection and where Boards are increasingly accountable for technology risk and recovery capability, upgrading core systems becomes critical – but as part of a systematic upgrade of risk and resilience.