When the U.S Department of Justice filed criminal charges against TD Bank and multiple other agencies cited violations of anti-money laundering rules and the Bank Secrecy Act, the government highlighted a “severe underinvestment in personnel, technology, and training” that created significant gaps in its identification and reporting of suspicious activity.
The Financial Crimes Enforcement Network says TD Bank and TD Bank US Holding Company, subsidiaries of Toronto, Canada’s $1.9 trillion The Toronto-Dominion Bank, delayed “technology implementation and investment in personnel” to grow business without commensurate compliance costs. TD Bank pled guilty to criminal charges and agreed to pay more than $3 billion in combined criminal and civil money penalties; the U.S. bank units are also restricted from growing beyond their combined $434 billion in assets. The bank did not return requests for comment.
“We have taken full responsibility for the failures of our U.S. AML program and are making the investments, changes and enhancements required to deliver on our commitments,” said Bharat Masrani, group president and CEO of TD Bank Group, in a statement. “This is a difficult chapter in our bank’s history. These failures took place on my watch as CEO and I apologize to all our stakeholders.”
Regulators have also identified underinvestment leading to deficiencies in compliance, transaction monitoring or customer identification in recent enforcement actions against other banks. Clearly, failing to invest adequately in technology that supports key systems can pose major risks to financial institutions. But how do you know when your institution is underinvesting in tech?
While it may be expensive for financial institutions to invest in technology, the cost of not making those investments could be even higher in the long run. Technology budgets seem to only grow. This can make it harder for technology executives to justify asking for more funding to rectify areas that have been underinvested in or need to be replaced, or to spend more to grow and expand an existing offering.
Three-quarters of respondents to Bank Director’s 2024 Technology Survey, sponsored by Jack Henry & Associates, said their tech budget increased between 2023 and 2024, with a median rise of 4%. The median tech budget in 2024 was $1.5 million, according to the survey, with 10% of the budget earmarked for new initiatives. But some respondents in the survey were concerned their existing budgets were insufficient: 37% of respondents said their bank does not allocate sufficient resources to technology and innovation. Of those, 52% believe their institution should allocate more budget dollars to these areas, and 36% believe their bank doesn’t have enough midlevel staff like programmers, developers or data scientists.
At Kansas City, Missouri-based Academy Bank, one indicator that the bank has made good investments is the amount of paper on employee desks, says Chief Operating Officer Tom Kientz.
“If people have messy desks and tons and tons of paper on them, we’re probably doing something wrong,” he says.That’s because the Kansas City, Missouri-based bank, which is a unit of $4 billion Dickinson Financial Corp., has spent a decade digitizing its processes, which should reduce the need to print. A decade ago, he says Dickinson’s headquarters had about 200 printers; today, it’s 20.
Jason Chorlins, principal in risk advisory services at Kaufman Rossin, says tech underinvestment could be indicated by latency or lag times in transaction processing that could improve through automation. Or perhaps a credit union has too many transactions happening in a branch versus digital channels. Or a bank takes a long time to onboard a business customer or needs to print out materials to complete the account opening or onboarding. Brad Smith, a partner at Cornerstone Advisors, adds in an email that commercial customers leaving over poor digital banking experiences, long call center wait times, high customer abandonment or increasing fraud or cyber exposure could all be signs that an institution has underinvested in these areas.
One potential gap in investment is updating or replacing legacy systems. The Office of the Comptroller of the Currency flagged the cost associated with upgrading technology and a lack of a clear strategy as reasons why institutions continue to use aging technology or tech that’s near the end of its lifecycle in a special section of its Semiannual Risk Perspective for Spring 2023.
“Delaying investments and failing to maintain technology infrastructure can lead to operational inefficiencies and reduced resilience,” the OCC wrote. “Banks that do not keep their technology infrastructure up to date may experience opportunity costs due to the inability to implement new products and services or achieve longer-term productivity gains.”
Using old tech can hinder an institution’s operational resilience by causing potential operational outages and posing security vulnerabilities. Postponing or delaying these upgrades and investments in so-called zombie technology can increase an institution’s technology debt, requiring complicated workarounds and making it difficult to adopt new technology that works with the dying tech.
A big indicator for executives that their institution uses zombie technology is whether the system they use is being sold to new customers, Smith says. He recommends executives reassess their tech halfway through a contract, which could give the institution several years to begin evaluating alternative providers and convert the system.
While the board of directors is involved in approving the technology budget, Chorlins says it’s especially important that the board understand the stakes involved when it comes to tech investment and is aware of areas of underinvestment. The IT steering committee or other board-facing executive should ensure the board understands what appropriate investments look like and will cost, the potential risks an institution takes by underinvesting and what challenges could arise during a migration.
“The board should have a top-down understanding of what an institution needs from an information technology perspective and ensure that the institution has appropriate technology in place,” Chorlins says. “They have the responsibility of having the right resources from both a human personnel perspective, but also the technology systems.”
Previous