Part 7 of 8 of Building the Bank from the Top Down. The main paper makes the argument; this part holds the detail.
D1. Glossary
| Term | Meaning |
|---|---|
| AISP / PISP | Account information and payment initiation service providers: the licensed third parties allowed to read accounts or initiate payments |
| Apex | The customer-facing point where intent, context and value are coordinated. Related to, but not the same as, the upper tiers of Bain's pyramid and the top of a Wardley value chain (Section 2.1; Appendix A2) |
| Autonomy ladder | Seven rungs from observe to execute autonomously; each action's rung depends on risk, reversibility, value and confidence (Appendix C3.3) |
| Baggage disintermediation | Risk scenario: an agent captures the relationship while the bank retains much of the ledger, capital and compliance cost |
| Claims register | Appendix D4: each load-bearing claim with its status (fact, evidence, interpretation or hypothesis), basis and test |
| Core-led / outcome-led | Transformation where customer value waits for core modernisation to finish, versus transformation that starts from a customer outcome and invests in the core only where a named need requires it |
| Cost-to-income ratio | Operating costs divided by operating income; lower is more efficient |
| DORA | EU Digital Operational Resilience Act, applied from 17 January 2025 |
| FiDA | Proposed EU Financial Data Access regulation extending open banking to open finance |
| Kill criteria | Pilot thresholds that trigger a shift of weight from market A to market B if missed at month 9 (Appendix C3.1) |
| Market A / market B | The two products of one platform: A is the bank's own agent, competing for the customer's interface; B is the trust layer beneath every agent (Section 3.1; Appendix C1) |
| North Star | A customer outcome, enabled by AI, used to decide which programmes get funded |
| PFA | Personal Finance Agent: an AI agent that plans and acts on a customer's finances with their consent |
| PSD3 / PSR | The EU's third Payment Services Directive and the Payment Services Regulation, replacing PSD2 |
| SCA | Strong customer authentication: two-factor authentication required for account access and payments |
| Semantic control plane | The controlled chain that turns raw legacy data into canonical concepts, evidence and verified claims |
| Technical annex (T1 to T7) | The second tab: agent control architecture, autonomy ladder, authentication, liability, failure scenarios, semantic control plane and a stress test against legacy cores |
| Trust layer | Identity, verified claims, consent, delegation and liability, offered to the bank's own agent and to any other agent the customer authorises |
| Trustworthiness / assurance / liability | The three questions trust answers: is the system reliable, can that be verified, and who pays if it is not (Appendix C1.3) |
| Verified financial claim | A signed, purpose-bound, revocable statement from the bank, such as "income above €3,000", issued instead of raw data |
D2. Sources
- Accenture, 2026 Banking Trends, via Orbograph: 70% of IT spend on maintenance; technology costs rising four times faster than revenue.
- European Banking Authority, Risk Dashboard Q1 2026: cost-to-income by country; costs and income index.
- Almquist, Senior and Bloch, The Elements of Value, HBR 2016.
- Bain & Company, In Search of Customers Who Love Their Bank, 2018.
- Simon Wardley, Wardley Maps.
- Konsentus, The Unfinished Story of European Open Banking, November 2025.
- Juniper Research, Open Banking API Call Volume to Surpass 720bn, February 2025.
- Norton Rose Fulbright, PSD3 and PSR: from provisional agreement to 2026 readiness.
- Morrison Foerster, PSD3 and the Payment Services Regulation: key developments, April 2026.
- Council of the EU, FiDA non-paper, April 2026.
- Regulation-AI.eu, Annex III high-risk AI, updated September 2026.
- Korea Times, Can AI be a public utility? World watches Korea's bold experiment, September 2026.
- KPMG Belgium, Belgian banks are most cost-effective.
- Fitch Ratings, Dutch bank cost savings to narrow efficiency gap, January 2026.
- Wave examples: Euromoney on Boursorama, bunq, Adyen, Finovate on Ohpen.
Author's working analysis: the FOB-analysis workbook (Wardley matrix, PFA decomposition); research notes on the modernisation trap, the five waves and outcome-led PFA architecture; and notes on information abundance, trust infrastructure and the future of legacy products (Appendix C1 and C4).
Sopra Steria, Payment Services Regulation in 2026: the state of play for banks, August 2026.
European Banking Authority, Final report on the amendment of the RTS on SCA and CSC, 2022.
W3C, Verifiable Credentials Data Model 2.0, 2025.
European Commission, European Digital Identity Wallet.
D3. Author's related work
| Article | What it adds to this paper |
|---|---|
| Enterprise Digital Office (EDO), July 2025 | The operating system behind the method: Wardley maps to start every initiative, backlogs tagged to Bain's value tiers, five immutable gates and spend targets (Appendix B1, C2 and C7) |
| The Answer Layer, September 2026 | How AI answer engines form a new layer between firms and customers, and how to test whether agents can complete tasks through a firm (Appendix C1) |
| Bespoke Platform Engineering (BPE), July 2025 | Hypergraph and ontology patterns for reading legacy data, agents as first-class clients of platform services, and inspectable audit trails (Appendix C3 and C5) |
D4. Claims register
Every load-bearing claim in the paper carries one of four labels. Fact: verifiable from law or published data. Evidence: supported by published data, with limits on scope or interpretation. Interpretation: the author's reading of facts or law. Hypothesis: a claim about causes or the future that the paper cannot yet support. Each claim below names its basis and the test that would confirm or overturn it.
| # | Claim | Status | Basis | Test | Where (main section; appendix) |
|---|---|---|---|---|---|
| 1 | Nearly 70% of bank IT spend goes to running existing systems and regulation | Evidence (global figure) | Accenture, 2026 Banking Trends | The bank's own run-versus-change split | 1; A1.1 |
| 2 | Banking technology costs grew about four times faster than revenue over 15 years | Evidence | Accenture | The bank's own cost and revenue series | 1; A1.2 |
| 3 | Cost-to-income is about 65% in France, 58% in Belgium, 53% in the Netherlands | Fact (read from a chart, approximate) | EBA Risk Dashboard Q1 2026 | None needed | 1; A1.3 |
| 4 | The run burden limits what incumbents can redirect to new customer value | Hypothesis | Consistent with claims 1 to 3; not shown causally | Apex share of change spend over time (Appendix C2.3) | A1.1 |
| 5 | PSD3 and the PSR require dedicated interfaces, list banned obstacles and introduce permission dashboards | Fact | Final texts agreed April 2026; Norton Rose Fulbright, Morrison Foerster | None needed | 2.3; B2.1 |
| 6 | AI Act high-risk rules apply from December 2027; PSR core obligations around H1 2028 | Evidence (planning assumption) | Regulation-AI.eu; Sopra Steria | Re-check at each roadmap gate | 2.4; C5.2 |
| 7 | Agent-initiated payments collide with SCA, which needs a known amount and payee | Evidence | RTS on SCA; Sopra Steria | Final PSR technical standards on delegated payments | 2.3; B2.2 |
| 8 | In past technology waves, challengers rented the new commodity and built above it | Interpretation | Five cases in Appendix B1.4; illustrative, not proof | Not testable in advance | 2.2; B1 |
| 9 | An outside agent could capture the relationship while the bank keeps the cost | Hypothesis | Seven-step chain; steps 1 to 3 technically possible | Share of interactions in bank channels; third-party API calls | 2.3; B2.4 |
| 10 | Customers reward multi-element and upper-tier value with loyalty | Evidence (general, not AI-specific) | Bain, 2018 | Retention of pilot users against a control group | 1; A2.1 |
| 11 | An AI agent can deliver emotional value such as reduced anxiety at scale | Hypothesis | Chain in Appendix A2.3 | Perceived control and anxiety in the first release; behaviour over 6 to 12 months | 2.1; A2.3 |
| 12 | As AI makes answers nearly free, an answer a person can safely act on becomes scarce | Hypothesis | Reasoning in Appendix C1.2 | Whether relying parties pay for verified claims | C1.2 |
| 13 | Banks start ahead on assurance and liability, behind on AI trustworthiness | Interpretation | Trust stack, Appendix C1.3 | Pilot trust score; model incident rate | 3.1; C1.3 |
| 14 | A bank's lasting edge is vouching for facts and paying if they are wrong | Hypothesis: the paper's central claim | Appendix C1.4 and C1.5 | Share of relying parties accepting non-bank claims on equal terms; price per claim; claims per consented customer | 3.2, 3.5; C1.5, C6 |
| 15 | The consent router and permission dashboard are a likely moat | Interpretation | PSR dashboard obligation; Map 2 | Share of customer consents managed through the bank | C3.4 |
| 16 | Customers will choose the bank's agent over a free general assistant | Hypothesis | Six advantages, Appendix C3.1 | Active and repeat use; the month-9 kill criteria against a general assistant | C3.1 |
| 17 | Outcome-led delivery reaches first customer value in quarters, not years | Hypothesis (working estimate) | Dependency analysis, Appendix C3.6 | Time to first customer value in the first release | 3.4; C3.6 |
| 18 | An agent customer can be worth more than they cost | Hypothesis (illustrative model only) | Appendix C3.7 | Pilot economics against a matched control group; the Scale gate | 3.4; C3.7 |
| 19 | Verified claims stay an edge only if they become infrastructure outside agents must call | Hypothesis | Four conditions, Appendix C1.5 | Share of outside agents' high-value journeys that call the bank's claim service; relying parties integrated | 3.2; C1.5 |
Previous: Appendix C4–C7: Product lines, guardrails and roadmap · Next: Technical annex: Agent control, liability and failure
Top comments (0)