Cutting costs, speeding up decisions and retiring legacy systems all read well in an annual report. Inside a global bank, however, simplification is rarely simple.
According to Corlytics, every decommissioned system leaves data that must be housed somewhere, every merged team brings responsibilities that need reallocating, and every outsourced service still demands oversight.
That question of ownership surfaces repeatedly in the 2025 annual reports of HSBC, JPMorgan Chase, Citi, Deutsche Bank and UBS, all systemically important financial institutions. Their businesses differ, but their priorities converge: stronger returns, leaner operations, technology investment and tighter risk management. Sustainable performance gains depend on a bank changing how it works without losing control of it.
Deutsche Bank completed a €2.5bn operational efficiency programme, including reshaping its German platform and cutting headcount. Citi focused on modernising technology and reinforcing risk controls, while UBS pressed ahead with integrating Credit Suisse. Decades of acquisitions can leave banks with sprawling, patched-together infrastructure.
The hard part is understanding what old processes actually do before replacing them. Reconciliations, exception handling, approvals and record-keeping must continue.
Banks need to know whether work has been removed, automated or reassigned, whether the new owner is aware, and whether they have the information and authority to act. Undocumented knowledge, such as the familiar reliance on one colleague’s spreadsheet, is easily lost.
AI adds another layer. UBS appointed a chief artificial intelligence officer in 2025, JPMorgan’s shareholder letter ties future success to AI adoption, and HSBC reports board scrutiny of GenAI governance.
Using AI to locate a document carries very different consequences from using it to inform a credit or compliance decision, and oversight should reflect that. Early alignment between business, technology, legal, compliance and risk teams is essential.
Supplier risk is also extending further down the chain. HSBC’s board considered expectations for fourth and fifth parties, while Deutsche Bank highlighted the difficulty of moving critical workloads away from major technology platforms. Seemingly separate services may share an underlying provider, making any initial assessment merely a snapshot.
Geopolitics compounds the challenge. Sanctions, tariffs and conflicts can simultaneously affect credit, compliance and operations. Spotting a new sanctions requirement is only the start; banks must identify the affected relationships, act, and evidence their response.
Data quality underpins all of this. Citi acknowledged ongoing challenges in meeting regulatory expectations on data governance and reporting. Unreliable information breeds duplicate checks and workarounds, eroding efficiency gains.
With capital discipline prominent across the reports, unclear ownership can quickly turn savings into remediation costs. Boards approving major change should ask who inherits each responsibility, what information they will rely on, and how management will know if something has slipped through.
Read the full Corlytics post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
