CATEGORY
CTO / CIO concerns — strategic technology decisions, organisational design, original analysis.
POLICY & RESILIENCE
Supervisors have spent two years reading exit plans that assume an exit nobody has priced, budgeted or rehearsed. In January the most durable excuse for that stops being available.
POLICY & RESILIENCE
Financial entities learned to answer the NIS2 question with one sentence about DORA. That sentence is correct, and it is about to be applied to a regulation it was never written for.
APPLIED AI
Relief on the high-risk file arrived nine days ago. The risk now is that banks read one deferral and stand down a programme that still has an obligation biting today.
PAYMENTS & MONEY
For a decade banks have owned the login. eIDAS 2 turns identity into something the customer carries and the bank is obliged to accept on request.
PAYMENTS & MONEY
Under PSD2 a bank could comply alone: build the endpoint, publish the spec, done. FiDA has no unilateral path. Compliance runs through a scheme, and the scheme is being designed right now.
APPLIED AI
Fifteen years of model risk doctrine was rewritten in April, and the one paragraph that will matter most to a 2026 risk committee is the one that says which models the guidance does not cover.
INFRASTRUCTURE & CRYPTOGRAPHY
Most banks have costed the test. Fewer have costed the supply chain it now depends on: an accredited tester market on a synchronised three-year clock, and threat intelligence that must come from outside every single time.
INFRASTRUCTURE & CRYPTOGRAPHY
Every post-quantum roadmap assumes an inventory that does not exist. The asset register knows the server, the owner and the criticality; it does not know the algorithm, the key length, the library or the expiry.
PAYMENTS & MONEY
Payee verification stopped being a competitive feature the day it became a legal obligation. What remains is an operations problem: a five-second budget, an ambiguous middle answer, and corporate files that must be taken apart before they can be checked.
APPLIED AI
Immutable is not the same as trusted. As instant settlement and probabilistic AI reshape banking, the uncertified ledger becomes the weak link, and a certifiable blockchain becomes the audit spine.
APPLIED AI
Agentic AI is operational infrastructure in 2026. This index measures it the way banks measure capital and credit: a six-dimension readiness score across autonomy tiers, the control plane, regulatory evidence, unit economics, organisational readiness, and global regulatory alignment.
INFRASTRUCTURE & CRYPTOGRAPHY
As of June 2026, post-quantum cryptography (PQC) has transitioned from an experimental technical concern to a primary fiduciary obligation. Boards must now oversee the systematic migration of legacy encryption...
