Technical debt tops cyber risk challenge for global banks

Investors can distinguish between banks that have invested in modernization and those that have not. The cost of modernizing appears in IT spending ratios. The cost of not modernizing shows up in incident response bills, legal settlements, and lost trust. Regulators are pushing for more transparency around operational resilience. The Federal Reserve's latest stress test scenarios include prolonged IT outages. Banks that treat technical debt as a balance-sheet liability rather than a routine expense hold an advantage.

Earnings calls in coming quarters will offer data points on legacy migration timelines, cloud migration milestones, and the number of systems still running on end-of-life software. Insurance premiums for cyber coverage increasingly reflect a bank's technology posture. Banks with documented modernization programs pay less for coverage, according to broker surveys.

The cost of technical debt also drags on innovation. Banks with legacy systems cannot deploy AI or real-time payments as quickly as peers with modern architectures. That gap widens as the industry moves toward instant settlement and tokenized assets.

The Risk.net survey covered the full G-Sib cohort, though individual bank names were not disclosed. The pattern aligns with previous studies by the Bank for International Settlements and the Financial Stability Board. Both flagged legacy technology as a systemic risk that the industry has underinvested in for years.