One item is rising to the top of many bank chief information officers' list of worries: the concern that one or a few key people who understand core legacy systems will retire or leave. When that happens, updating the system to meet a new or modified regulation or offer a new product becomes almost impossible.
This "key-person risk" is compounded by the fact that banks are having trouble finding talented young techies who want to work in a bank and a shortage of people with mainframe and COBOL skills. The mainframe was supposed to have been be replaced by farms of smaller commodity servers and cloud computing by now, but it still endures at many banks.
"It's really hard to get new graduates interested in those old technologies," says Bruce Livesay, the CIO at First Horizon National Corp., the $26 billion-asset parent of First Tennessee Bank in Memphis.
Key-person risk is a side effect of the U.S.'s aging population and the fact that many banks' legacy systems were built 40 or more years ago by people who are now headed for retirement.
It's not just a private-sector problem, says Bob Olson, a vice president at Unisys. One of Unisys' government clients "has someone who runs a chunk of their technology who's on oxygen, he's 70 years old, he knows the keys to the kingdom, he knows where everything is, it's all sitting in his head. They send out a police car to pick him up every morning and bring him in to work in a vault-like room."
According to IBM, 92 of the top 100 banks use mainframes and 71% of all Fortune 500 companies have their core businesses on a mainframe.
And yet few students are graduating college with mainframe skills, partly because schools are not teaching them, says Livesay. Those that do teach them tend to be technical schools and community colleges rather than major universities.
To try to jump-start mainframe enthusiasm among students, IBM has been running a "Master the Mainframe" contest for the past three years that's meant to "develop the skills of a new generation of mainframe experts." More than 68,000 students have gone through the program so far, the company says. IBM also runs a System z Academic Initiative program in which it provides materials for a 15-week IT course that's offered by 90 U.S. colleges.
Key-person risk is also a concern with core systems. In some cases, only one or two people understand the core banking software the bank runs on and the older programming language in which it is written, such as COBOL.
First Horizon's answer is to bring in young techies and train them on the older technologies.
"You don't want to be in a situation where you have that key-person risk," Livesay says.
Even so, finding young, talented tech workers who want to work for a bank isn't easy, he says. "It's difficult right now to attract even .net and Java programmers into the banking space," Livesay says. "The banking industry has gotten so much negative publicity through the past several years, it has made it more difficult to recruit people. We're seeing fewer people feeling motivated to get into banking."
Banks lack the allure that tech giants like Google and Facebook naturally have for college graduates.
"I don't think you can compete with Google, Twitter or Facebook on the coolness factor. It's just not doable," says Inder Koul, CIO at the $38 billion-asset First Niagara Financial Group in Buffalo. "It would be difficult for me to try to be a Google because I cannot match that."
However, he ticks off several advantages his bank does have in the competition for IT talent, including proximity to technical schools in Rochester, Syracuse and Buffalo and a chief executive who has articulated a strong commitment to investing in technology. CEO Gary Crosby has said that the bank will spend to $250 million over the next three or four years upgrading old technologies and investing in new digital banking platforms.
Koul adds that his bank has avoided key-person risk by making sure it has no situations in which only one person knows what's going on in an area.
First Niagara is also trying to help IT staff see a direct alignment with the business, whether it's infrastructure, business services, applications, or digitalization. "That makes it much easier for the rank-and-file tech talent to see how their work impacts others," Koul says.