The AI race in banking is increasingly being decided below the model layer. The institutions that can make fragmented, decades-old data estates reliable, traceable and usable in real time will have an advantage that no frontier model can buy on its own.
The AI problem hiding underneath the AI boom
Banks are talking about artificial intelligence as if the main strategic question were which model to adopt. That is becoming the wrong level of the stack. A bank can license the same frontier model as its competitors, hire talented engineers and build an impressive assistant in a laboratory. If the system underneath cannot produce complete, current and well-governed data, the model will still be reasoning over a distorted version of the bank. (BIS Financial Stability Institute, March 2026).
The Financial Stability Institute made this point unusually clearly in March 2026: data-management challenges are not new, but they are a significant barrier to the wider adoption of advanced AI in finance. Privacy, quality and security become more consequential as AI moves into core activities because the machine can amplify whatever it is given. A missing field in a conventional report may create a manual exception. The same missing field inside an automated decision chain can affect thousands of interactions before anyone notices. (FSI Insights No. 73).
This is why the real constraint on banking AI is increasingly architectural rather than algorithmic. The bank of the future may use generative models, predictive models and agentic systems at scale, but those systems still need authoritative customer records, reliable transaction histories, consistent product definitions, permissions, lineage and controls. Artificial intelligence does not remove the old data problem. It makes the cost of leaving it unresolved much higher. (FSB responsible AI consultation, June 2026).
A modern model can still sit on top of a 30-year-old information problem
Large banks are accumulations of history. Mergers add overlapping customer masters. Product launches create new databases. Jurisdictions impose local data rules. Mainframes continue running processes that are too critical to switch off casually. Teams build tactical interfaces around old platforms, then later build new interfaces around those interfaces. The result is often not one legacy system but an ecosystem of dependencies whose logic is partly encoded in software and partly retained in the institutional memory of employees. (Basel Committee BCBS 239 implementation newsletter, January 2026).
The Basel Committee's January 2026 update on risk data aggregation describes the practical consequences. It says legacy systems, distributed data estates and the changing nature of data lineage continue to complicate banks' ability to trace information end to end. It also notes that fragmented responsibilities, resistance to change and insufficient management attention remain barriers in some organisations. These are not abstract governance shortcomings. They determine whether a bank can explain where an AI input came from, when it was updated, how it was transformed and whether the output should be trusted. (Basel Committee, January 2026).
In traditional analytics, analysts can sometimes compensate for weak architecture with manual reconciliation, spreadsheets and local knowledge. AI weakens that safety valve because the economic case for AI depends on scale. If every automated answer requires a human to reconstruct the source data first, the system has not really automated the workflow. If the human does not reconstruct it, the bank risks automating the error instead. (Federal Reserve revised model risk guidance, April 2026).
Bad data does more than make AI inaccurate
The obvious risk is accuracy: a model trained or prompted with incomplete, stale or inconsistent data produces weaker output. But banking adds several layers of consequence. Data quality can change who receives credit, which transaction is flagged as suspicious, how a customer is segmented, how liquidity is measured and what a board sees during stress. The Federal Reserve's revised 2026 model-risk guidance identifies input quality and data constraints as fundamental contributors to model risk and emphasises testing data quality, relevance and inputs as part of sound model development. (Federal Reserve, April 2026).
There is also an explainability problem. When information has been copied through multiple systems, enriched by different teams and transformed through undocumented rules, the bank may know the final number without being able to demonstrate the full chain that produced it. That weakens validation. It complicates audit. It makes regulatory challenge harder. And when AI creates a recommendation from that information, the model can make the output sound more coherent than the underlying evidence actually is. (Basel Committee on data lineage).
The risk is not limited to models. In June 2026 the European Banking Authority highlighted data security, operational risk and rapidly advancing AI capabilities as important concerns for EU banks, while the Bank of England's July Financial Stability Report warned that more capable and more autonomous AI systems could materially increase cyber and operational vulnerabilities. The more deeply AI is connected to core data and workflow infrastructure, the more important it becomes to know what data the system can see, what actions it can take and how quickly the bank can contain a failure. (EBA Spring 2026 Risk Assessment). (Bank of England, July 2026).
BCBS 239 has quietly become an AI readiness test
The Basel Committee's Principles for effective risk data aggregation and risk reporting were created after the global financial crisis, long before generative AI entered board agendas. Yet their logic maps directly onto the AI era. Banks should be able to aggregate risk data accurately, completely and quickly; they should know its lineage; and boards should receive information that is reliable enough for decisions under stress. Those capabilities are also prerequisites for deploying AI into material banking processes with confidence. (Basel Committee BCBS 239 update).
This reframes data remediation. It is not merely a compliance programme that sits beside innovation. It is part of the innovation platform. A clean, governed data estate can serve regulatory reporting, finance, risk, fraud, customer service and AI at the same time. The Basel Committee's 2026 outreach explicitly notes that some banks have broadened BCBS 239-style governance into enterprise data frameworks because the same investments can remove silos, reduce costs and improve data quality across the organisation. (Basel Committee, January 2026).
The Financial Stability Board is moving in a similar direction. Its June 2026 consultation on responsible AI adoption proposes organisation-wide governance and lifecycle controls rather than treating AI as an isolated model-management issue. That matters because the weakest link may sit nowhere near the model: in a source system, a permission rule, a vendor interface, a transformation script or an ownership gap between two business units. (Financial Stability Board, June 2026).
The strongest banks are building the data layer before they promise autonomy
The contrast between institutions is becoming visible in how they describe their AI programmes. JPMorganChase says its 2026 technology budget is approximately US$19.8 billion and describes the firm as operating on modern cloud and data foundations. More revealing than the spending number is the language around readiness: the bank says data creates an advantage when it is AI-ready and consumable at the point of decision, and it describes modular systems as a way to move products from ideas to production faster. (JPMorganChase 2025 Annual Report, April 2026).
That does not mean every large bank must copy JPMorgan's expenditure or architecture. It does show why AI advantage may compound. Institutions that modernised data platforms before the current generative-AI wave can deploy new capabilities on top of infrastructure that was already being simplified. Banks that delayed modernisation face a double bill: they need to fund the AI layer and repair the foundations at the same time. (JPMorganChase, 2026).
Citi provides a different example. In its 2025 annual report, the bank says more than 80% of its Transformation programmes are at or near target state and directly links that progress to higher-quality data, clearer ownership and faster decisions. Citi also says its developers are using AI-assisted coding tools that create about 100,000 hours of capacity each week. The important point is sequencing: the bank's AI story is being told alongside a multiyear effort to strengthen data, risk and control foundations, not as a substitute for that work. (Citi 2025 Annual Report).
Cloud helps, but cloud is not a data-cleaning strategy
Cloud migration is often presented as the escape route from legacy technology. It can be a powerful one. Modern cloud platforms make compute easier to scale, support streaming architectures and give banks access to AI services that would be expensive to build internally. But moving fragmented data into a modern environment does not automatically make it consistent. A bank can reproduce old silos on new infrastructure with impressive speed. (Deutsche Bank technology transformation, July 2026).
Deutsche Bank's own account of its technology transformation illustrates the broader challenge. The bank says its technology landscape was fragmented when its modernisation programme began in 2019, with duplication across the business and heavy reliance on external vendors. Its response combined stronger in-house engineering, cloud adoption and system simplification. The lesson is that cloud and AI create leverage only when paired with deliberate rationalisation of the estate underneath them. (Deutsche Bank, July 2026).
HSBC's June 2026 partnership with Google Cloud points in the same direction from another angle. The bank expects the partnership to enable more than 200 new AI use cases over two years, on top of more than 600 HSBC applications already running on Google Cloud. That scale is striking, but the most important strategic question is not the number of use cases. It is whether the bank can supply each use case with governed data, access controls and consistent business definitions without recreating hundreds of local AI silos. (HSBC and Google Cloud, June 2026).
The regulatory reporting problem shows how deep the plumbing goes
One way to understand the depth of the issue is to look outside AI at regulatory reporting. European banks still have to reconcile overlapping statistical, prudential and resolution data requirements, often with different definitions and reporting structures. The ECB's Integrated Reporting Framework is designed to harmonise part of that landscape, yet the current timetable envisages a pilot phase starting in the second quarter of 2030 and official IReF reporting beginning in the second quarter of 2031, subject to the regulatory process. (European Central Bank, June 2026).
That timeline is a useful reality check. Data architecture in a large banking system changes slowly because the information is not decorative; it is wired into accounting, capital, risk, customer servicing and legal obligations. The same institution may need to modernise while maintaining daily payments, quarter-end reporting, fraud controls and cross-border operations. A clean-slate rebuild sounds attractive until one remembers that the old system is often processing the transactions that fund the rebuild. (ECB IReF milestones).
Why “rip and replace” is usually the wrong metaphor
Banks therefore face a paradox. They need to move faster, but the fastest-looking transformation can create the most risk if it ignores dependencies. Replacing a core system in one move can break interfaces, historical data, reconciliation routines and controls that have accumulated over years. Leaving everything untouched is equally dangerous because every new AI service then depends on brittle translation layers. (Basel Committee on legacy systems and lineage).
The more credible path is progressive decoupling: identify authoritative data domains, expose them through controlled interfaces, standardise definitions, automate lineage, retire redundant stores and build new services against governed data products rather than against whichever database happens to be convenient. That is an architectural inference rather than a single regulatory prescription, but it follows directly from the problems supervisors keep identifying: fragmented estates, uncertain lineage, inconsistent ownership and weak ad-hoc reporting capability. (Basel Committee, January 2026).
This approach also helps banks avoid a new form of technical debt. If every AI team builds a private retrieval layer, a separate customer view and its own logic for permissions, the institution can repeat the mistakes of the last technology cycle under a newer name. AI becomes another silo. The model may be state of the art, while the bank becomes harder to govern. (BIS FSI on AI data governance).
AI changes the economics of data remediation
For years, data programmes struggled with an awkward return-on-investment problem. Better lineage, cleaner reference data and common definitions were obviously useful, but the benefits were spread across many functions and were hard to attribute to one revenue line. AI changes the calculation because the same clean data can now support dozens of use cases: fraud investigation, coding assistants, customer servicing, underwriting, relationship management, compliance, treasury and internal knowledge systems. (HSBC AI partnership).
The benefit can therefore compound. A bank that fixes a customer-identity problem for one regulatory process may also improve personalisation and fraud controls. A governed transaction dataset can support sanctions monitoring, liquidity analytics and AI assistants. A common product taxonomy can reduce reporting errors while making recommendation engines easier to validate. The economic case for data modernisation becomes stronger when the bank stops treating each AI use case as a separate project and starts treating data as shared infrastructure. (JPMorganChase on data as a strategic asset).
The counterargument: AI can sometimes work around bad legacy systems
There is a legitimate counterargument. Modern AI can extract information from unstructured documents, map schemas, generate code, reconcile inconsistent labels and create intelligent interfaces over systems that were never designed to work together. Retrieval-augmented generation can let employees query old repositories without migrating every document first. Agentic tools may eventually automate large parts of data mapping and remediation itself. In other words, AI can be part of the cure as well as a consumer of clean data. (BIS Financial Stability Institute).
That should make modernisation faster, not optional. The ability to infer that two fields probably mean the same thing is not equivalent to establishing a controlled definition. A generated mapping can accelerate engineering work, but someone still needs to know whether it is correct, authorised and stable enough for a material financial decision. The Federal Reserve's revised model-risk guidance makes the same broader point for models: sound use depends on understanding inputs, limitations, data quality and performance, even when third-party products are involved. (Federal Reserve model risk guidance).
There is also a resilience trade-off. AI can help banks find vulnerabilities and automate defensive work, but the IMF warned in June 2026 that shared digital infrastructure, common service providers and machine-speed attack-and-defence dynamics can magnify the spread of cyber risk. A bank that modernises by concentrating more critical functions onto common platforms must therefore strengthen segmentation, recovery, access control and dependency management at the same time. (IMF, June 2026).
What this means for banks
For bank management teams, the practical priority is to stop separating the AI roadmap from the data and architecture roadmap. Every material AI use case should force questions about source-of-truth systems, lineage, permissions, freshness, reconciliation and ownership before model selection becomes the dominant discussion. The most valuable technology investment may be the one that makes five future AI applications possible, not the one that produces the most impressive demo this quarter. (FSB responsible AI consultation).
What this means for fintechs and technology providers
For fintechs and vendors, the opportunity is not simply to sell better models. Banks need tools that connect modern AI to old estates safely: data observability, lineage, access governance, semantic layers, reconciliation, model monitoring and migration tooling. Providers that reduce architectural complexity without creating a new proprietary dependency may become more valuable than vendors offering another isolated AI interface. (Basel Committee on data lineage and vendor challenges).
What this means for regulators
For regulators, the debate will increasingly move from asking whether a bank has an AI policy to asking whether the bank can demonstrate the integrity of the information flowing through the AI system. Governance at the model layer is necessary but insufficient if the institution cannot trace critical inputs or contain operational dependencies. The FSB's 2026 sound-practices consultation and the Basel Committee's continued focus on risk data aggregation both point toward a more integrated view of technology, data and risk management. (FSB, June 2026).
What this means for investors
For bank investors, AI announcements should be evaluated alongside evidence of infrastructure quality. Measures such as technology expenditure, cloud migration, application rationalisation and data-remediation progress may say more about sustainable AI economics than the number of pilots. Institutions with cleaner data estates can potentially convert the same models into faster deployment, lower operating friction and better risk control. Institutions that carry heavy legacy debt may still benefit from AI, but more of the gross productivity gain may be consumed by integration and remediation costs. (JPMorganChase and Citi annual reporting). (Citi 2025 Annual Report).
EVIDENCE VS INFERENCE
Evidence: International supervisors continue to identify data quality, lineage, legacy systems, fragmented estates and governance as barriers to effective risk aggregation and responsible AI use. Large banks that report advanced AI deployment also emphasise cloud, modern data foundations and multiyear control remediation.
Inference: The durable competitive advantage in banking AI is therefore likely to sit less in access to a particular model and more in the ability to make trusted institutional data available safely at the point of decision. That inference is strongly supported by current evidence, but it is not a guarantee that every bank with modern architecture will achieve superior AI returns.
Conclusion: the model is not the moat
Artificial intelligence is making sophisticated analytical capability cheaper and more widely available. That is good news for banks that spent years improving data architecture and a warning for those that treated the underlying estate as a problem to postpone. When similar models are accessible to everyone, the difference shifts to what the model can reliably see, how quickly it can use that information, whether the bank can explain the result and whether the institution can act on it safely. (BIS FSI, March 2026).
Legacy systems will not disappear because boards declare an AI strategy. They have to be mapped, simplified, governed and gradually replaced while the bank continues operating. That work is less visible than a chatbot launch and harder to demonstrate at an investor day. It may also be the work that determines whether AI becomes a durable productivity engine or another expensive layer sitting on top of unresolved complexity. (Basel Committee, January 2026).
The central strategic question is therefore changing. Banks do not only need to ask which AI they should deploy. They need to ask whether their information architecture is good enough for AI to deserve authority inside the institution. In the next phase of banking technology, the smartest model may be commoditised. Trusted data will not be. (FSB responsible AI consultation).
References
1. In data we trust? Emerging policy and supervisory approaches to AI data use in financial services. Bank for International Settlements, Financial Stability Institute, 26 March 2026.
2. Implementation of the Principles for effective risk data aggregation and risk reporting (BCBS 239 Principles). Basel Committee on Banking Supervision, 6 January 2026.
3. Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report. Financial Stability Board, 10 June 2026.
4. EU/EEA banks remain resilient amid rising geopolitical, market and technological risks. European Banking Authority, 18 June 2026.
5. Financial Stability Report - July 2026. Bank of England, July 2026.
6. Supervisory Guidance on Model Risk Management. Federal Reserve / OCC / FDIC revised interagency guidance, 17 April 2026.
7. Letter to Shareholders from Jennifer A. Piepszak, 2025 Annual Report. JPMorganChase, 6 April 2026.
8. Letter to Shareholders, 2025 Citi Annual Report. Citigroup, 2026.
9. HSBC and Google Cloud announce transformative AI banking partnership. HSBC, 17 June 2026.
10. How do you modernise the tech stack of a 150-year-old bank?. Deutsche Bank, 2 July 2026.
11. ECB announces main milestones for roll-out of Integrated Reporting Framework. European Central Bank, 8 June 2026.
12. Artificial Intelligence and Cybersecurity in the Financial Sector. International Monetary Fund, 30 June 2026.