Why More Banks and Credit Unions Are Rethinking Their Core Strategy. How to Know If You Should, Too
By Nicole Volpe
Simple Subscribe
Subscribe Now!
Financial institutions have been grappling with the present implications of past technologies pretty much since they first installed mainframe-based core systems in the 60s and 70s. In fact, if you look up the term “legacy system” on Wikipedia, one of the first things you’ll see is a picture of a bank ATM.
But today’s environment is putting new and more intense pressure on legacy core strategies, especially for small and midsized banks and credit unions. These institutions are confronting a set of fast-moving and consequential technology-driven trends — agentic and genAI, steeply rising cyberrisk, tokenized deposits — that are pushing the limits not just of their cores, but of the workaround solutions they have long relied on to close capability gaps and stay competitive.
As accustomed as banks, credit unions, and their technology providers have become to “bolting on” new capabilities in this way, each of these solutions delivers a largely one-off advantage; the value it brings is limited to its initial use case.
Meanwhile, technical debt continues to accumulate: Some institutions still rely on core systems that, while nominally supported, are increasingly difficult to extend with new capabilities. Others are keeping pace more actively, but as bolt-ons (also known as “side cores”) multiply, managing all the vendors and connections becomes an operational burden and a risk in its own right.
Key insight: The net effect can be a ceiling on growth, as new technologies shift the playing field and financial institutions find themselves unable to seize the moment.
To assess whether your core — and your core strategy — are supporting your institution’s success, it’s essential to take stock of the current environment. What forces are driving small and midsized financial institutions to reconsider their approach? And how can you tell if your core is holding you back?
Four Forcing Factors
1. AI is turning up the heat: For the first time in the eight years since Jack Henry has published its benchmark survey, AI has been ranked No. 1 among bank and credit union leaders’ technology investment priorities for the next two years. As institutions advance from small discrete AI use cases to workflow automations to agentic executions, they’re increasingly finding that their data can’t keep pace with their ambitions. And the onus on them to level up their data architecture gains urgency.
Clean, structured, well-governed, consistently accessible databases are a prerequisite for enterprise AI. For institutions running side cores, accountholder and transaction data is often duplicated across parallel systems of record, and these differences must be reconciled before AI can reliably engage. Each additional system and handoff adds another potential point of failure.
Fully 64% of respondents in a survey by Bank Director said they have a data strategy, but their reliance on spreadsheets rose from 41% to 55% over the past year, and their use of data lakes fell from 39% to 30%. Institutions also report that they don’t have all the data they need in house: 61% said they have less than half of their accountholders’ total financial data on hand, and 23% said they have less than a quarter, with the rest scattered across other financial applications.
2. Fraud and cybercrime are accelerating: The global threat landscape in financial cybercrime is expanding rapidly, driven by AI-orchestrated social engineering, deepfakes, and automated fraud. The FBI reported a record $20.9 billion in U.S. cybercrime losses in 2026. Real-time payment capabilities and digital currencies were key contributors to this growth, according to the World Economic Forum; 31% of organizations find legacy systems to be a blocker of cyber-resilience efforts. The average cost of a data breach in the financial sector reached $6.29 million in 2026, a 13.1% year-over-year increase, according to IBM.
According to Lee Wetherington, Senior Director of Corporate Strategy at Jack Henry, this risk can be compounded by the vulnerabilities of financial institutions’ aging infrastructures, which, among other things, lack API connections that enable monitoring and detection of machine-speed attacks. Standing up an effective defense requires deploying new detection capabilities quickly and consistently, a harder task when they must be integrated across multiple systems. Third-party risk is a factor, as ransomware campaigns increasingly target institutions’ vendors and managed service partners, Wetherington said.
3. Tokenized money is coming fast: Standard Chartered estimates that stablecoins could draw as much as $500 billion out of U.S. bank deposits by the end of 2028, roughly a third of the $2 trillion stablecoin market it forecasts. The report said that regional and midsized banks are most exposed because of their heavier reliance on consumer and commercial deposits. A 2025 Treasury Borrowing Advisory Committee estimate went further, identifying about $6.6 trillion in transactional deposits, including $5.7 trillion in demand deposits, as at risk of migrating to stablecoins over time.
Tokenized deposits will require near-instant settlement and a high degree of interoperability across payment rails, while keeping funds inside the regulated banking system, according to a Nacha analysis. At the same time, banks and credit unions will compete for these funds with nonbanks, fintechs, and payments companies, many of which are seeking approval for national trust bank charters.
To be sure, the final rules implementing the GENIUS Act are still pending, and stablecoins currently appeal mainly to institutions serving global corporates or handling significant cross-border volume. But 18% of respondents in Jack Henry’s benchmark — leaders of institutions with $500 million to $10 billion or more of assets — said they plan to support stablecoins, tokenized deposits, or crypto wallets within two years. “Institutions that want to innovate in deposit-taking will need to ensure their infrastructure is ready, ideally by implementing a hybrid core,” said Wetherington. Those that layer on new ledgers or add separate ledgers will increase settlement risk and make it harder to access a comprehensive view of liabilities, he said.
4. Regulators are taking note: The OCC warned in 2023 that prolonged reliance on legacy and sunsetting technology infrastructures could increase the likelihood of outages, introduce security vulnerabilities, and reduce operational resilience. The agency’s report emphasized increased maintenance overheads and especially opportunity costs: Institutions whose infrastructure falls behind may lose the ability to implement new products and services or achieve longer-term productivity gains.
Equally relevant for small and midsized institutions is that many of their competitors now face lighter oversight. In April 2025, the CFPB directed staff to shift its supervision back toward depository institutions, aiming to restore its 2012 split of 70% banks and 30% nonbanks, and explicitly deprioritized supervision of digital payments and peer-to-peer platforms. Meanwhile, with the stablecoin opportunity in view, the OCC has granted conditional national trust bank charters to a growing number of crypto and fintech firms, including stablecoin issuer Circle. No doubt, small institutions benefit from the deregulatory climate too, but they may be less able to capitalize in the immediate term than larger and more technology-adept rivals.
Getting Ahead of Curve
To understand whether your core strategy is holding you back, Wetherington said, it’s important to challenge your status quo. Here are ten questions to ask yourself:
- How much is your core provider investing in its technology, in dollar terms?
- What percentage of its revenue does your core provider reinvest in R&D?
- How many new lines of code has your core provider added in the past 12 to 18 months?
- When your core provider rolls out an update, what does it entail, and how quickly does it reach you?
- Can you implement enterprise-wide changes across all of your systems at once?
- How quickly can you integrate third-party applications into your system?
- Are your provider’s APIs accessible and well documented?
- Does your provider offer you real-time access to your raw data?
- Who are your provider’s ecosystem partners, and how easy are they to work with?
- Is tech vendor management a source of stress for your team or colleagues in other functions, such as Finance?
What’s at stake: In a September joint statement on community banks and their cores, the Federal Reserve, FDIC, and OCC said they will consider providers’ technology investments and capabilities in their examinations, noting that those that fail to invest may be more likely to experience data breaches or service outages. The agencies will also look at how providers manage end-of-support and end-of-life systems so client banks can transition to updated platforms, and whether providers excessively limit unaffiliated service providers from integrating with the core. Financial institutions looking to develop a checklist to evaluate core and side core systems might start there.
