Designing for Progressive Transformation in Retail Banking

Key takeaways

1. 1Not everything in a bank changes at the same speedPosting transactions, maintaining balances, accounting and settlement should change as little as possible. Customers, products, pricing, onboarding, payment mechanisms, rules and limits change constantly. The trouble starts when the two are mixed, because then a pricing tweak means touching the core.
2. 2Execution stays near the core. Business behaviour moves outCore product processors keep doing what they are best at. Everything that changes more often moves to an enterprise layer of capabilities defined once and reused, over a foundation layer of shared services. This does not replace existing cores. It protects them.
3. 3Events where the core can, adapters where it cannotEnterprise components talk to each other through events. Where an existing core can publish or consume events, they integrate that way; where it cannot, they work through controlled APIs and adapters. No core is re-engineered to make the model work.
4. 4Change enters production a fraction of traffic at a timeAn insulation layer sits between changeable capabilities and stable downstream systems, so new behaviour starts on a very small share of live traffic and grows only as observation justifies it. Production stops being a final exam and becomes a controlled learning environment.
5. 5A governor decides how much stress reaches stable systemsA dedicated control layer watches downstream health continuously and throttles incoming traffic when the core shows strain, so pressure is contained upstream instead of being pushed into systems that cannot absorb it. It is in place always, not just during incidents.
6. 6Active-active is an operating posture, not a recovery planTwo things, and they protect against different failures. The regions serve traffic at the same time and sit deliberately more than 1,000km apart, so a disaster confined to one geography cannot reach the other. Separately, the two regions can run on different cloud providers, so a provider-level outage takes one region and not the bank. Failover and failback become controlled transitions rather than high-stress events.
7. 7AI earns its way into the transaction pathOutcomes are exposed first to operations and banker-facing users, where the reasoning is visible and a person can overrule it. As the bank builds confidence in them, the same outcomes are put in front of customers, and then into the critical path of the transaction itself.