🛟 AI Is Rewiring Your Bank But the Core’s Still COBOL

Hello, Abbie Widin here,

AI Check In delivers sharp, globally relevant intelligence on AI governance, financial risk, and capital automation. Already briefing strategy, risk, and compliance leaders at the world’s most influential banks, including JPMorgan, Citi, and Bank of America.

What to expect this edition:

• 🛟 Need to Know: AI Governance and the Legacy Core Trap

• 🥷 Deep Dive: How Banks Are Wrapping AI Around Legacy Infra

• 📈 Trends to Watch: Over the Horizon

• ⚔️ Vendor Spotlight: Refactor Without Breaking the Core

Rewrite the rules. Outmaneuver competitors. Stay two steps ahead of regulators.

Let the games begin.

🛟 Need to Know: AI Governance and the Legacy Core Trap

AI is accelerating decision-making in U.S. banks AND trying to run on top of tech from the ‘80s.

While most institutions avoid the risk and cost of full core replacement, they are wrapping legacy infrastructure with AI agents, copilots, and orchestration tools. These overlays can summarize data, forecast liquidity, and even trigger payouts.

However, they still depend on black-box execution paths underneath.

Boards are now facing a blind spot.

The AI overlay lacks robust explainability, and the legacy core beneath, though deterministic, may be poorly documented, fragile, or opaque in practice

Case in point: Wells Fargo uses AI to simulate Basel IV capital buffers. Citi’s treasury platform uses AI to forecast global liquidity. In both cases, execution flows through legacy code.

This gap raises material governance questions:

• What happens when an AI-triggered instruction touches a brittle mainframe API?

• Who is accountable when a model executes through logic no one fully controls?

• What if a rollback fails, not at the AI level, but in the system beneath?

🥊 Your Move:

• If AI triggers legacy workflows, and no one knows what happens next, you’re not governing, you’re gambling. Extend SR 11-7 oversight to mission critical operations.

• The first director to demand execution maps owns the upside (think: observer, nudger, commander). The last will be left holding the breach report.

• Rewriting the core is optional. Controlling what touches it isn’t. Insist on rollback and observability paths.

🥷 Deep Dive: How Banks Are Wrapping AI Around The Legacy Core

A Reuters analysis reported that COBOL still underpinned ~43% of banking systems, powering ~80% of in‑person transactions and ~95% of ATM activity, with ~$3T in daily commerce flowing through these stacks. Although the analysis is dated, the dependency remains material.

Banks are modernizing without ripping out the mainframe. Rather, they’re building AI orchestration layers that translate requests, forecast scenarios, and guide users while letting legacy systems do the heavy lifting beneath.

🧮 Citi and Wells Fargo: AI on the Perimeter

• Citi’s Treasury and Trade Solutions integrates AI with client ERPs to forecast global liquidity. AI triggers reconciliation and analytics, while settlements run on legacy rails.

• Wells Fargo uses AI simulations to model funding shocks and optimize LCR buffers. Execution logic remains tied to older capital models.

🧠 JPMorgan: Orchestrating Intelligence

JPMorgan’s “Ask David” system coordinates multi-agent orchestration across internal documents, proprietary analytics, and structured systems. It can:

• Answer complex investment queries in real time

• Delegate tasks across SQL, RAG, and analytics agents

• Use reflection layers to check coherence and accuracy

JPMorgan scaled its agentic infrastructure only after building the architectural spine to support it.

DBS Bank: Resilience Before Rollout

Unlike JPMorgan, DBS had to be reminded by regulators that resilience must precede rollout.

• In late 2023, Singapore’s financial regulator imposed a six-month freeze on DBS Bank’s non-essential digital initiatives following a string of digital banking system outages. The directive: prioritize restoring core system resilience before scaling innovation.

• DBS responded by simplifying legacy infrastructure, tightening change management, and enhancing incident response.

• With the pause lifted in May 2024, DBS has since resumed its AI push. They have now deployed natural language agents in customer service, machine learning in risk, and AI-driven financial guidance tools across the business.

🥊 Your Move:

• Don’t wait to rewrite the core. Wrap it with orchestration, then control it from the surface.

• But don’t wrap rot. Fortify what’s underneath, resilience, failover, and rollback must be locked before scale.

• Pick a high-impact use case and move. Delay is how slower banks get left behind or penalized. Loss of market share is real.

🔐 Sidebar: Securing the Seam

In July 2024, a faulty security‑AI agent update (Crowdstrike’s Falcon sensor) knocked out ~8.5 million Windows devices, briefly degrading banking and payment operations worldwide. The lesson is not ‘AI gone wrong’ but seam risk and change‑control across interdependent layers.