Your legacy systems don’t have to
keep your regulatory view fragmented.

Legacy explains why the data sits in different places. It no longer explains why the regulatory view has to stay fragmented.

The fear around legacy technology is rational. Core systems are deeply embedded, heavily controlled and connected to critical services. Replacing them can be expensive, disruptive and risky. That is exactly why firms have often tolerated regulatory evidence being split across Conduct, Operational Resilience, Financial Crime, customer systems, service platforms and local reporting.

But the choice has changed. A joined-up regulatory ecosystem can now sit across the estate firms already have: obligations linked to products, journeys, customers, services, controls and evidence. Source systems can remain authoritative. The enterprise view does not have to remain siloed simply because the technology estate is.

Legacy explains the silos. It doesn’t have to preserve them.

Three green dashboards can hide one red outcome because the evidence behind them is organised around systems and functions, not around the customer, product or journey experiencing the risk. The practical opportunity is to connect those relationships above the existing estate rather than wait for every underlying system to be modernised.

The important shift is not ‘legacy is easy’. It is that cross-regulatory intelligence no longer has to wait for wholesale core transformation.

No Board wants another open-ended core transformation

Legacy is not simply old software. It is embedded business logic, customer history, payment flows, controls, reconciliations, interfaces and operational knowledge accumulated over decades. Change can create migration risk, resilience risk and a long tail of dependency work.

That has produced an understandable executive response: protect the core, innovate around it and defer the hardest change. For a long time, that was often the least risky answer. The problem is that the cost of the delay is now appearing in speed, duplication and the difficulty of joining evidence across the enterprise.

The customer journey is already crossing systems. The regulatory view has to catch up.

A digital journey can change in weeks while the evidence needed to understand its consequences remains scattered across older systems. Complaints may sit in one platform, vulnerability markers in another, service incidents elsewhere and fraud interventions in a separate control environment. The customer experiences one journey. The firm can still see four separate stories.

That is the speed mismatch that matters. A new proposition can launch quickly, but the enterprise still needs to know whether customer outcomes changed, whether an operational dependency contributed, whether fraud controls created friction and whether the same issue is appearing in complaints. If that requires manual reconciliation across teams, the front end may be digital while the regulatory view is still analogue.

The customer sees one journey. The firm cannot afford four regulatory stories.

Connect the ecosystem before you replace the estate

For many intelligence use cases, the practical first step is not to migrate the core. It is to create a governed relationship layer across the estate: regulation → product → journey → customer → service → control → evidence. That joined-up ecosystem gives each domain the same business context while preserving the source systems underneath it.

Take a payment failure. The service incident can stay in the operational platform; the complaint can stay in the complaints system; the vulnerability marker can stay in the customer record; the fraud intervention can stay in the financial-crime environment. What changes is that the enterprise can recognise that they relate to the same journey, customer cohort and regulatory outcome – and investigate them together.

Modernise the intelligence across the estate

Modern technology makes this practical in a way that was difficult a few years ago. APIs can expose controlled evidence without moving it wholesale. Metadata and lineage can describe where information comes from and what it means. AI can help map logical requirements to physical data and identify changes. A governed relationship model can hold the links between obligations, products, journeys, customers, services, controls and evidence.

None of that removes permissions, data quality, ownership, testing or human accountability. It changes the order of operations. Firms can establish the joined-up regulatory view first, prove where the hidden issues sit and then target deeper modernisation where the evidence shows it is genuinely required.

The systems can stay. The silos don’t have to.

The regulator is also questioning the cost of layered assurance

On 22 October 2026, FCA chief executive Nikhil Rathi challenged the accumulation of ‘tick-box compliance’ and potentially duplicative assurance in data packs, risk reports and internal audit. The point was not that firms should weaken control. It was that assurance activity has to produce useful outcomes rather than simply accumulate evidence. [1]

Three days earlier, the FCA described its own move towards an ‘agentic regulator’: using AI to gather evidence from disparate sources, surface intelligence and flag early warning signs, while developing machine-readable data-collection APIs. [2] These are regulatory developments, not instructions for firms to adopt one technology design. But they reinforce a direction of travel: better intelligence from connected evidence, with less tolerance for duplication that does not improve judgement.

Value before replacement

The economics change when value does not depend on the final migration. Start with one joined-up use case – for example, connect complaints, vulnerability, service incidents and fraud interventions around one customer journey. If that reveals risk earlier or removes repeated reconciliation, the value is visible before any core replacement.

That same intelligence can then inform the modernisation agenda: which systems create the greatest operational dependency, which repeatedly break lineage, which constrain product change and which simply happen to be old. The firm can modernise against evidenced constraint rather than architectural anxiety.

This is not a claim that legacy no longer matters

Some systems will still need replacing. Some data will still need remediation. Some interfaces will still be too brittle, slow or risky. Intelligence cannot manufacture data that does not exist or make an inaccessible system safely accessible.

The important change is more modest and more useful: firms no longer need to treat wholesale estate modernisation as a prerequisite for every cross-enterprise intelligence use case. The boundary between ‘what must be replaced’ and ‘what can be connected’ can now be tested rather than assumed.

Five questions that should now be asked