Banks are under growing pressure to modernise outdated compliance systems amid the shift towards instant payments, risking operational stability and regulatory compliance if they fail to adapt quickly and effectively.
Banks can no longer treat compliance technology as something to be patched around the edges. As instant payments become the norm, the gap between real-time money movement and batch-era controls is exposing a deeper problem: many monitoring and screening tools were built for a slower world. In an interview with The Fintech Times, Madhu Nadig, co-founder and chief technology officer of Flagright, said the first failure point appears when a payment can move before a bank has gathered enough context to judge the risk properly.
That pressure is showing up across the industry. KPMG’s 2026 Banking Technology Survey found that 82 per cent of banking executives are focused on cost reduction and operational efficiency, while 59 per cent are prioritising legacy-system modernisation. The consultancy said regulatory demands and changing customer expectations are pushing that shift, and its separate payments research argues that modernisation has moved from a back-office concern to a strategic issue tied to relevance, trust and growth.
Nadig’s central argument is that the problem is not just speed. Real-time screening depends on fresh information about customers, counterparties, devices and past behaviour, but older systems often pull that data from separate places, in sequence, or in batches. When that information is stale or fragmented, banks can end up with duplicate alerts, missed patterns and growing queues of manual exceptions. The result is either a delay to supposedly instant payments or a control that fires too late.
The hidden expense of legacy compliance systems, he said, is the constant effort needed to keep them working. Every new rail, product, market or rule change can force fresh mappings, reconciliations, regression tests and compensating controls. Banks also become reliant on a shrinking pool of specialists who understand why old rules and exceptions exist, while investigators and engineers spend more time stitching together evidence from multiple systems. In practice, the real cost is not the licence fee, but the cost of changing, operating and proving the system.
That is why the build-versus-buy decision should start with the control model rather than the software catalogue, Nadig said. Institutions need to decide which checks must happen before a payment leaves the bank, how quickly those decisions must be made, what evidence they need to retain and who should be able to alter controls. He warned that many banks get this wrong by treating modernisation as a procurement exercise, underestimating the work involved in data migration, integration, validation, decommissioning and operating-model change. KPMG’s survey and its wider banking research both point to the same conclusion: banks that modernise well will be those that can change safely, maintain auditability and retire old dependencies, not simply add another layer on top.
The technical challenge becomes even sharper when banks try to replace a compliance stack without interrupting live operations. According to Nadig, the hardest part is preserving decision continuity while the meaning and movement of data are changing underneath. Older platforms contain more than code; they also hold years of field mappings, manual exceptions, timing assumptions and undocumented dependencies. The safest approach, he said, is to feed old and new engines from the same replayable data stream, compare outcomes and cut over only once discrepancies are understood.
Artificial intelligence can help, but only in bounded ways. Nadig said machine learning is useful for alert prioritisation, anomaly detection, entity resolution and network analysis, while natural-language tools can help extract facts from case files and assemble evidence. It becomes overhyped when sold as a substitute for controls, clean data or human judgement. The strongest model, he argued, combines transparent rules for explicit policy requirements, statistical models for pattern detection and human review for ambiguous cases.
That layered approach reflects a wider shift across banking. KPMG’s recent trends work says AI and adjacent technologies are accelerating change, but banks still need to preserve trust, clarity and operational effectiveness. Flagright, meanwhile, describes its own platform as an AI-native tool for real-time monitoring and risk screening, underscoring how vendors are pushing the market towards faster, more automated controls.
For banks deciding whether to keep patching or to rebuild, the dividing line is becoming clearer. Institutions that modernise well will be those that can change controls quickly without losing evidence or resilience. Those that continue to layer fixes on old systems may appear stable until a new rail, regulatory change or major incident exposes how brittle the whole structure has become.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
