Andrew, a CIO at a respected traditional bank, spent years building his career on two pillars: stability and security. His main job was to ensure that banking systems ran reliably 24/7. Today, however, he feels the ground is shifting out from under his feet. Pressure is coming at him from all sides. Management, fascinated by the success of agile fintechs, demands innovation and new digital revenue streams. The compliance department is bringing him bound volumes of documentation on the DORA regulation, imposing draconian digital resilience requirements on the bank. Customers, accustomed to the convenience of apps like Uber and Netflix, expect instant, personalized and seamless banking services on their smartphones. Andrew realizes with growing frustration that his carefully nurtured, monolithic core systems and traditional waterfall approach to IT, which for decades guaranteed stability, have now become an anchor that prevents his organization from competing effectively. It needs a new strategy playbook.

Read also: What is Netlify? A leader

The scenario Andrew finds himself in is the reality of technology leaders across the Financial Services Industry (FSI). This is an industry in a state of permanent transformation, driven by powerful converging forces: the technological revolution, fundamental regulatory changes and a new definition of customer expectations. Having online banking and a mobile app has long ceased to be a differentiator - it has become a staple. The real battle for the future is at a much deeper level: the ability to build open, connected ecosystems, ensure unprecedented operational resilience and leverage data to create truly intelligent services. This article is a strategic guide for FSI leaders who must navigate this new, complex reality. We will show how open banking is evolving, the challenges IT faces with DORA regulation, and how modern architecture, cloud and AI are becoming key tools in the battle for customer and regulatory compliance.

Why has the traditional banking model reached a turning point?

“70% of digital transformation initiatives fail, most often due to resistance from employees and lack of management support.”

— McKinsey & Company, Unlocking success in digital transformations | Source

For decades, the business model of banking was simple and stable. Banks were closed, vertically integrated fortresses that controlled the entire value chain: from product to distribution to customer relationship. Trust, security and physical presence (branches) were key assets. Today, this model is being challenged from all sides, and the tipping point we find ourselves in is the result of three powerful forces.

1 Changing customer expectations: A new generation of consumers, raised in the digital age, has very different expectations. They value convenience, speed, personalization and a seamless user experience (UX) over loyalty to a single brand. They expect financial services to be as simple and intuitive as ordering food or hailing a cab through an app. They are ready to entrust their finances to new players (fintechs) if these offer them better, more customized and cheaper solutions. For them, a bank is not a building, but a service available “here and now” on a smartphone.

2 Regulatory pressure and market opening: Regulators, especially in Europe, have become a powerful driver of change. The Payment Services Directive 2 (PSD2), introduced in 2018, broke banks’ monopoly on customer payment data. It forced them to open up their systems through APIs (Application Programming Interfaces) and make this data available to Third Party Providers (TPPs), such as fintechs. This ushered in the era of open banking, transforming banks from closed fortresses to open platforms. Upcoming regulations, such as the potential PSD3 and Payment Services Regulation (PSR), go a step further, aiming to create an even more integrated and competitive financial services market.

3 Technological innovation and new competitors: Technologies such as cloud computing, artificial intelligence, big data analytics and mobile development platforms have dramatically lowered the barrier to entry in the financial services market. Agile startups (fintechs), unbound by the baggage of outdated IT systems and ossified organizational culture, can build innovative products much faster and cheaper. Technology giants (BigTech) such as Apple and Google, with their huge customer bases and capital, are also increasingly boldly entering the financial world (e.g., through Apple Pay, Google Pay). For the first time ever, traditional institutions have to compete in an open, dynamic and highly innovative ecosystem.

In this new world, only those institutions that can transform their technology and organizational culture to become as agile, open and customer-focused as their new competitors will survive and succeed.

What is the evolution from open banking (PSD2) to open finance (PSD3) and what does it mean for IT strategy?

The era of open finance, ushered in by the PSD2 directive, is one of the most important forces transforming the financial sector. However, PSD2 was just the beginning. We are now on the threshold of another, even deeper wave of change, which is referred to as open finance and will be supported by new regulations, conventionally called PSD3. Understanding this evolution is key to shaping a long-term technology strategy.

Open Banking (PSD2 era): Focus on payments The main objective of PSD2 was to increase competition and innovation in the payment services market. The directive forced banks to provide (with customer consent) two types of third-party providers (TPPs) with access to payment accounts via APIs:

  • AISPs (Account Information Service Providers): Companies that can aggregate a customer’s account information from different banks into a single application, giving them a complete picture of their finances.

  • PISPs (Payment Initiation Service Providers): Companies that can initiate payments directly from a customer’s bank account (e.g., card-not-present payments at online stores).

From an IT perspective, PSD2 implementation has forced banks to build secure, efficient and well-documented APIs, which has been a huge technological and cultural challenge for many.

Open Finance (PSD3 era): Open finance’s full view of customer finances is a natural extension of the idea of open banking to the entire world of financial products. It assumes that the customer should have control not only over his payment accounts, but over all his financial data. This means that financial institutions (not only banks, but also insurers, investment companies, pension funds) will have to share (with the customer’s consent) data on:

  • Savings accounts and deposits.

  • Mortgage and consumer loans.

  • Investments (stocks, bonds, funds).

  • Insurance (life, property policies).

  • Pension plans.

What does this mean for IT strategy? This evolution has fundamental implications for technology leaders at FSI:

  • API explosion: Instead of a few regulatory APIs for payments, institutions will need to build and manage an entire ecosystem of APIs that share data from virtually all of their product systems. This requires a mature API-first strategy and modern API management platforms.

  • Need to modernize core systems: Much of the data required by the open finance model is locked up in old, monolithic systems (legacy systems) that were not designed to communicate with the outside world. Real-time access to this data will require deep modernization or “packaging” of these systems into modern service layers (microservices).

  • Data governance as a core competency: Financial institutions will need to become experts in data management - aggregating, cleaning, standardizing and sharing data securely. Investments will be needed in modern data platforms, analytics and data governance.

  • Strategic shift from product provider to value aggregator: In the world of open finance, banks can adopt two strategies. They can remain just a “pipe provider” (providing data to others), or they can become an aggregator themselves, creating applications that integrate data from multiple sources (including competitors) and provide holistic, personalized advisory services to the customer. The latter path requires tremendous competence in UX, analytics and software development.

The evolution toward open finance is an inevitable trend. IT leaders must begin today to build the technological and organizational foundations that will allow their companies to not only survive, but succeed in this new open finance era.

What is the DORA regulation and why is it becoming the most important operational challenge for the financial sector in the EU?

If PSD2 has opened up the financial sector to innovation, then DORA (Digital Operational Resilience Act) aims to ensure that this digital transformation does not come at the expense of stability and security. DORA is a European Union regulation that goes into full effect in January 2025, and represents the most significant regulatory change in the area of technology and security for the financial sector in years. For the first time ever, it creates a single, legally binding framework for digital operational resilience across the EU, covering not only banks and insurers, but also key technology providers to these institutions.

The goal of DORA is to ensure that the financial system as a whole is able to withstand, respond to and recover from all types of ICT (information and communications technology) disruptions and risks. For technology leaders, DORA means the need to implement a series of stringent requirements and a fundamental change in the approach to technology risk management.

Why is DORA so important?

  • Harmonization and coverage: Previously, each institution and country had its own, often inconsistent, guidelines. DORA creates a single, common standard for almost all financial entities in the EU, from banks to investment firms, stock exchanges to payment institutions and insurance companies.

  • Board responsibility: DORA clearly states that ultimate responsibility for ICT risk management rests with the institution’s governing body (board of directors). This means that the CIO and CISO (Chief Information Security Officer) must regularly report and justify their strategies at the highest level.

  • Third-party oversight: The regulation introduces for the first time direct regulatory oversight of critical technology providers (CTPPs), such as the largest cloud providers (AWS, Azure, GCP). However, banks must actively manage the risks associated with all their IT providers.

  • High penalties: Non-compliance with DORA will result in severe financial penalties and regulatory sanctions.

DORA is not an “IT problem.” It’s a strategic challenge for the entire organization that requires close collaboration between technology, security, risk, compliance and the business.

What are the key pillars of DORA that technology leaders need to focus on?

The DORA regulation is built on five key pillars, each of which imposes specific obligations on financial institutions. Technology leaders must treat these pillars as a roadmap for building a truly resilient organization.

1 ICT Risk Management (ICT Risk Management): Institutions must implement a comprehensive, internal risk management framework that includes the identification, classification, assessment and mitigation of all technology-related risks. This requires:

  • Regular risk analysis for all systems and processes.

  • Implement robust security policies, Business Continuity and Disaster Recovery plans.

  • Continuous monitoring and improvement of security systems.

2 Incident Reporting: DORA harmonizes and standardizes the process of reporting major ICT incidents to regulators. Institutions must:

  • Implement an internal incident classification process to be able to distinguish between serious and less important ones.

  • Be able to report a serious incident to the appropriate authority within a very short, strict time frame.

  • Analyze root causes of incidents and implement corrective actions.

3 Digital Operational Resilience Testing: This is one of the most demanding pillars. DORA requires institutions to test their defense systems regularly and comprehensively. This includes:

  • A

ual comprehensive testing program, including vulnerability scanning, penetration testing, performance testing, among others.

  • For the largest, “critical” institutions, it is mandatory to conduct advanced, controlled Threat-Led Penetration Testing (TLPT), often referred to as “Red Team” tests, every three years. These must be conducted by third-party, certified testers and simulate real attacks carried out by advanced adversaries.

4 Third-Party Risk Management: Institutions must proactively manage risks arising from dependence on third-party ICT service providers. This requires:

  • Maintain a detailed record of all contracts with IT suppliers.

  • Conducting risk assessment (due diligence) before signing a contract.

  • Include detailed clauses in contracts regarding security, availability, data localization and audit rights.

  • Have an exit strategy (exit strategy) in case a critical supplier needs to change.

5 Information Sharing: The regulation encourages financial institutions to voluntarily share information and analysis on cyber threats among themselves. This is aimed at building collective resilience across the sector.

Implementing DORA requirements is a massive transformational project. It requires a detailed review of existing processes, technologies and contracts, as well as significant investment in new tools, competencies and testing programs. For many institutions, this will be a major technology priority for the coming years.

What role do microservices and APIs play in modernizing banking systems?

In the face of pressures from open finance and DORA requirements, the traditional monolithic architecture of banking systems is becoming untenable. It is too slow, too risky and too inflexible to meet new challenges. The key to modernizing and building an agile, resilient and open financial organization is the adoption of modern architectural patterns, particularly microservices architecture and API-first approaches.

The monolithic problem in banking: Many key banking systems (core systems, transaction systems) are still large, monolithic applications, often written in legacy technologies. Such an architecture generates a number of problems:

  • Slow changes: Any modification, even the smallest one (e.g., adding a new field in a loan product) requires changing, testing and implementing the entire, huge application, which can take months.

  • High risk of deployments: An error in one part of the monolith could cause the entire banking system to fail, which in the context of DORA is unacceptable.

  • Difficulty of integration: “Extracting” data from a closed monolith and making it available through an API (required by PSD2/PSD3) is extremely difficult and often requires the creation of complex, “fragile” intermediary layers.

  • Technology barriers: the monolith is built on a single technology stack, which prevents the use of modern tools, such as AI data analysis, in parts of the system where they would be most needed.

Microservices and APIs as a solution: Modernization involves the gradual decomposition of this monolith into smaller, independent and autonomous services (microservices) that communicate with each other through well-defined APIs.

  • Agility and speed: Each microservice (e.g., “customer account management service,” “credit scoring service”) is developed by a small, autonomous team. These teams can implement changes to their services independently of others, drastically reducing the time-to-market for new products and functionality.

  • Increased resilience: Failure of one less critical microservice (e.g., a service for personalizing offers) does not cause the entire system to fail. Other functionality, such as logging in or performing transfers, continues to work. This allows building systems with much higher availability and resilience, which is crucial for DORA compliance.

  • Opeess and readiness for Open Finance: the API-based architecture is naturally suited to the era of open finance. Internal APIs, used for communication between microservices, can be easily and securely exposed to partners (fintechs), forming the basis for a new ecosystem of services.

  • Technological flexibility: Each microservice can be written in the technology best suited to its task. A risk analysis service might use Python and AI libraries, while a high-performance transaction service might be written in Java or Go.

The process of migrating from monolith to microservices, which we discussed in detail in a previous article, is a long and complex journey. But for financial institutions that want to compete in the 21st century, it is an inevitable journey.

How are artificial intelligence (AI) and data analytics revolutionizing financial services?

Artificial intelligence and advanced data analytics are the next powerful forces redefining the financial sector. Financial institutions have always operated on data, but only now, thanks to the massive computing power of the cloud and advanced machine learning algorithms, can they realize its full potential. AI is no longer the domain of experimental R&D projects, but is becoming a key part of daily operations, affecting every aspect of the business - from risk management to customer interactions.

Key applications of AI in FSI:

1 Risk Management and Fraud Detection: This is one of the most mature applications of AI. Machine learning algorithms analyze millions of transactions in real time, learning normal patterns of customer behavior. They can instantly detect anomalies and abnormal activity that may indicate a fraud attempt (e.g., card theft, money laundering - AML), with a precision impossible for static rule-based systems.

2 Personalization and hyper-personalization: In the open finance era, where financial products are becoming commodities, the key to success is building a deep relationship with the customer. AI allows analysis of transactional, behavioral and demographic data to create hyperpersonalized offers and advice. Instead of offering the same product to everyone, the bank can proactively offer the customer: “We noticed that you travel regularly. Maybe you’d be interested in our multi-currency card with travel insurance.”

3 Automated advice (Robo-advisory): AI algorithms are revolutionizing the world of investment management. Robo-advisory platforms can automatically build and manage a diversified investment portfolio based on an analysis of a client’s financial goals and risk profile, offering services that were once available only to the wealthiest clients.

4 Credit Scoring: Traditional credit scoring models relied on a limited set of data. AI allows the use of a much broader spectrum of information (alternative data) to build more accurate and inclusive models that can better assess risk and offer financing to people who would be rejected by old systems.

5 Back-office process automation: Generative AI, which we have written about in the context of the CTO role, is revolutionizing internal processes. It can automatically analyze and categorize documents (e.g., in the KYC process - Know Your Customer), generate summaries and reports, and power intelligent chatbots that respond to employee inquiries, easing the burden on support departments.

Implementing AI in the highly regulated financial sector poses enormous challenges, especially in terms of ethics, transparency and explainability of models (Explainable AI - XAI). But the potential benefits - in the form of lower costs, better risk management and deeper customer relationships - are so enormous that no financial institution can afford to ignore this revolution.

How do you build and scale agile development teams in a highly regulated environment?

One of the biggest dilemmas facing IT leaders in the financial sector is reconciling two seemingly contradictory worlds: the need for speed and agility (required to compete with fintechs) with the need for control, security and regulatory compliance (required by supervisors). Many traditional institutions, when trying to implement Agile, face a wall from risk, compliance and security departments, which see agile as chaos and lack of control.

Successfully scaling agile development teams in an FSI environment is possible, but it requires a conscious approach that integrates, rather than antagonizes, the two worlds.

1. DevSecOps as a cultural foundation: The key is to implement a DevSecOps culture, which we wrote about in our DevOps trends article. Security and regulatory compliance caot be treated as the last, inhibiting step in the process. They must be built into the daily activities of the development team from the very beginning. This means:

  • **Integrate security and compliance experts into agile teams: ** Instead of acting as external “gatekeepers,” they become part of the team, helping to design secure solutions from the very beginning.

  • Automate controls in the CI/CD pipeline: Implement automated security and compliance gateways (e.g., code scanning, dependency analysis, IaC configuration checking) that provide developers with immediate feedback.

  • Policy as Code: Defining security and compliance rules in the form of code (e.g., using tools such as Open Policy Agent) that can be automatically verified.

2 Agile risk management: The traditional waterfall approach to risk management, where full documentation must be approved before the first line of code is written, is incompatible with Agile. An agile approach to risk should be implemented:

  • Continuous, rather than periodic, risk assessment: Risk analysis is an integral part of every sprint, not a one-time event at the beginning of a project.

  • Product Owner as Risk Owner: The Product Owner, when defining priorities in the backlog, must consider not only business value, but also risk.

  • Automation of documentation generation: Use tools to automatically generate some of the documentation required by auditors (e.g., based on data from Jira, Git and the CI/CD pipeline).

3. building “golden paths” (Paved Roads): To reconcile teams’ autonomy with corporate standards, it is worth investing in building an internal developer platform (Internal Developer Platform). This platform provides teams with pre-approved, secure and compliant regulatory “building blocks” (e.g. microservices templates, pre-built CI/CD pipelines, standard cloud configurations), allowing them to quickly and securely develop new applications without having to reinvent the wheel and go through a full security verification process each time.

4 Strategic partnership: Building all these competencies (DevSecOps, agile risk management, platform engineering) internally is time-consuming. A strategic partnership with a company like ARDURA Consulting, which has experience in delivering software to the FSI sector, can significantly speed up the process. We can provide entire agile teams or individual experts in **a staff augmentation ** model to bring the necessary expertise and help implement best practices in your organization.

Agility and regulation need not be enemies. On the contrary, mature, automated agile processes can lead to higher levels of safety and control than traditional, manual methods.

What are the biggest cultural and organizational challenges in the digital transformation of traditional financial institutions?

Technology is often the easiest part of the digital transformation. The biggest and most difficult barriers to overcome lie in the culture, structures and human habits that have shaped traditional financial institutions for decades. A technology leader who ignores these “soft” aspects is doomed to failure, even if he implements a state-of-the-art architecture.

1 Risk averse culture: The financial sector is inherently conservative. A culture that prioritizes avoiding mistakes at all costs is in direct conflict with a culture of innovation that demands experimentation, taking calculated risks and learning from failures. Trying to implement an agile “fail fast” approach in an organization that punishes every mistake is impossible. The transformation must start with a change in thinking at the board level.

2 Organizational silos: Traditional banks are often divided into deep, vertical silos: retail banking, corporate banking, asset management, and topped by horizontal silos of IT, operations, marketing and compliance. This structure prevents building a cohesive, holistic customer experience and leads to internal budget and resource wars. True digital transformation requires the creation of cross-disciplinary, product-based teams that break down these silos.

3. “Legacy” not only technological, but also mental: The “legacy” problem in banks is not just about old mainframe systems. It’s also a “legacy mindset” - deeply ingrained beliefs and ways of working. It’s resistance to change, attachment to existing processes (“because we’ve always done it that way”) and distrust of new technologies, such as the public cloud, which is often seen as “less secure” than an in-house server room (which is a myth).

4 War for talent: Traditional financial institutions, with their hierarchical structure and bureaucratic culture, find it extremely difficult to compete for the best technology talent with tech companies and nimble fintechs. The best engineers want to work in places where they have autonomy, influence over the product and the opportunity to work with cutting-edge technologies. To attract and retain them, banks need to fundamentally change their work environment.

How to overcome these challenges?

  • C-level sponsorship: Transformation must have clear and consistent support from the CEO and the entire board.

  • Communication and vision building: It is necessary to constantly communicate the “why” of this change and paint an inspiring vision for the future.

  • An evolutionary approach, not a revolutionary one: Instead of trying to change the entire organization at once, start with pilot projects and “islands of innovation” that will prove the value of the new approach and become a model for the rest of the company.

  • Investing in people: Investing in training and reskilling current employees to help them find their way in the new reality, as well as strategic partnerships to source missing competencies from outside, is key.

Cultural transformation is the longest and most difficult part of the journey, but without it, all technological investments will remain just superficial modernization.

What does a digital maturity model look like for a financial institution?

The journey toward digital excellence in the financial sector is not a one-time project, but an ongoing process of evolution. The table below presents a maturity model that can help FSI leaders assess where their organization stands and define strategic priorities for the future.

Transformation areaStage 1: TraditionalStage 2: Digitizatio Stage 3: Transformatio Stage 4: The Future (AI-native)
**Systems architecture**Monolithic core systems. Silos of data. Lack of APIs. "Packaging" the monolith into an API. First attempts at building services. Microservices architecture. API-first platform. Hybrid cloud adoption. Event-driven architecture. Real-time systems. Full flexibility and scalability.
**Data management**Data locked in product silos. Limited analytics. Central data warehouse. Buisness Intelligence Reporting. A modern cloud data platform. Democratization of access to data. Data as a strategic asset. Predictive analytics and AI embedded in every process.
**IT operating model**Waterfall. Silo Dev vs. Ops. Long release cycles (quarterly/yearly). The first Agile/Scrum teams. The beginnings of automation (CI). Mature DevSecOps culture. Automated pipelines (CI/CD). Platform engineering. SRE assemblies for extreme reliability. AIOps for proactive management.
**Risk and compliance management**Manual, document-based processes. Reactive approach. Automation of basic controls. Periodic penetration testing. Compliance as Code. Continuous security testing (shift-left). Proactive threat modeling. Automated incident response. Resilience by design.
**Customer Experience (CX)**Focus on branches and contact centers. Universal products. Online banking and mobile app as separate channels.Consistent, multi-channel (omnichannel) experience. Basic personalization. Real-time 1:1 hyper-personalization. Proactive, intelligent guidance.

Looking for flexible team support? Learn about our Staff Augmentation offer.

Let’s discuss your project

Have questions or need support? Contact us – our experts are happy to help.

How do strategic technology partnerships, such as with ARDURA Consulting, accelerate the transformation at FSI?

Digital transformation in the financial sector is a journey of unprecedented scale and complexity. It requires not only huge investments, but above all a unique combination of deep technological knowledge, industry-specific understanding and experience in leading complex change programs. Trying to navigate this path solely on one’s own is extremely difficult, slow and risky for many institutions. A strategic partnership with an experienced technology advisor, such as ARDURA Consulting, becomes a key gas pedal of success in this context.

At ARDURA Consulting, we understand that the challenges of the FSI sector are unique. Our approach is holistic and based on deep expertise in key areas that drive transformation:

  • Architecture Modernization: We have extensive experience in designing and implementing modern, microservices and API-based architectures, which are the foundation for the agility and opeess required in the open finance era. We support our clients in the complex process of migrating from monolithic systems.

  • Ensuring resilience and compliance with DORA: Our cybersecurity and software engineering teams help institutions align their processes and technologies with the stringent requirements of DORA. We offer support for advanced penetration testing, building business continuity plans and implementing a DevSecOps culture.

  • Competency building and team scaling: We understand the challenges of talent acquisition at FSI. In flexible models such as Staff Augmentation and Team Leasing, we provide entire teams or individual experts with unique competencies (e.g., cloud engineers, DevSecOps specialists, architects) who not only execute projects, but also share knowledge with internal teams.

  • Data-driven innovation and AI: We help our clients harness the potential of artificial intelligence and data analytics in a secure and regulatory-compliant ma

er, from building cutting-edge data platforms to implementing specific solutions in the areas of personalization or risk management.

Acting as a Trusted Advisor, we are not just a code provider. We are a partner that helps you navigate strategic complexity, make the right technology decisions, and build an organization ready for the future of financial services.

If you are facing the challenge of digital transformation at your institution and are looking for a partner that combines global experience with an understanding of local realities, consult your project with us. Together we can build the future of your business.