With the PSD2 directive in Europe accelerating the need for banks to engage with fintechs that can provide the needed digital advancements — and also open the door for more account-to-account payments that can challenge the card rails — the question about what to do with legacy systems has moved to the forefront for issuers, acquirers and processors alike.
"Deciding to just do a massive lift and migration to digital that would take two or three years is not the only alternative for issuers," said Brian Harris, chief product officer for issuer and e-security services at Nets Group, a Denmark-based payments processor. "You don't have to do that, because there are different ways to work with a provider and take a modular approach, not just to change technology but to progress the system to be more responsive to market conditions."
Last month,
The trend toward open banking and open networks, mostly through APIs and cloud services, is forcing issuing banks to look more closely at how they can keep pace with customer demands — and customers' use of mobile phones for so many aspects of their lives.
"Consumers very much want flexibility in the types of payments they want, but they want safety and transparency and they want to know that whatever organization they are dealing with, when they have a problem it is simple to resolve," Harris said.
When considering building and phasing in new technologies over time, as opposed to one complete major overhaul, Nets builds them to adapt to what consumers will demand and issuers will want in the future, Harris added.
"That is fundamental to our belief system around these modules — that we are building them to solve the problems of today, but in a way to adapt to things as they evolve tomorrow," he said.
What defines legacy?
Legacy systems are generally monolithic software systems written in older programming languages and deployed on-site. They run on traditional mainframes and use point-to-point integration systems.
Increasingly, they are difficult to maintain, with many no longer supported by the original vendors. As such, they have struggled to meet business requirements, according to recent Celent research on card-issuing technology.
There's momentum to address the legacy challenge, both from the “demand” and “supply” perspective. Additionally, the COVID-19 pandemic created a need for better support of digital payments and virtual card needs.
On the demand side, while the pressure to reduce the total cost of ownership for legacy systems has always been there, the issue is getting more acute as systems age and people familiar with them start to retire, creating a skills shortage, the Celent report noted.
Whether it is a financial services and payments technology provider like Fiserv or FIS, or companies such as i2c or Marqeta with open platforms and a focus on virtual cards, or Nets with a strong presence in the Nordic markets in Europe, the options to upgrade legacy systems are plentiful. Stripe has also become well-known for its cloud and API-based offerings.
"However, the key demand driver to address the legacy challenge now is the increased customer expectations around payments — where and how they can pay, speed of payment, and availability of information," said Zil Bareisis, senior analyst at Celent and author of the report. "Ambitious payment providers are seeking to create and curate a broad emerging payments ecosystem by providing payments and value-added services."
Celent found that few companies choose to make a major overhaul from scratch, and those that do can still take up to five years to complete the process. Alternatives include migrating to software-based products or outsourcing to payments-as-a-service providers.
Those who don't migrate can manage the legacy system through a layer of new connections, addressing top priorities, or seeking ways to establish interoperability via a single point through the cloud.
Risk vs. reward
A card issuer is unlikely to completely overhaul its legacy systems because such a project invites substantial risks.
"You kind of bet your career on a change like this," said Brian Riley, director of card services for Mercator Advisory Group. "The easiest solution is to just go along with a vendor, and you have to really lay out the components. Doing it in a modular fashion is not a bad idea because you at least limit the risk on it."
Another issue is that despite some old coding and language built into legacy systems, legacy networks generally are built with "industrial strength" to last for decades, Riley added.
Thus, bank decision-makers are loath to fix something that isn't broken. But if they can move along at a pace that allows them to slowly upgrade digitally, it signals a desire to keep up with customer demands.
"New systems may be lean and mean, but you really have to benchmark the functionality," Riley said. "Bigger banks are buying code from a vendor, taking it internal and having the expertise to maintain and repair systems."
Nets Group is seeing the need for upgrades in Europe, based most often on the banks' tendency to deal with international, cross-border business and operating under different market conditions, payments rules and regulations in each country.
The modular approach makes more sense in North America because of the sheer size of the banks and number of consumers using a specific issuer's cards, Nets' Harris said.
"It is very different in the U.S. in terms of complexity, and there will be a point in time where the banks are needing to respond faster [to legacy upgrades] than they are now," Harris said. "The way to take out risk is to pick and choose where you want to do that upgrade and pick what you want for digital-first solutions."
A hybrid or phased approach could be the most practical way to handle upgrades.
"With the advent of APIs, I'd be surprised if an issuer does a rip-and-replace for all aspects of issuance," said Tim Sloane, director of emerging technologies advisory services at Mercator Advisory Group. "This is especially true since card-issuing systems have several components that are rarely tightly coupled."
Core functions are usually limited to card account management and perhaps acceptance processing, but even these are often separate platforms, making it doubtful the issuer would perceive it as valuable to upgrade these all at once from a single vendor that runs these different functions in a single-cloud instance, Sloane added.
"Reliability is gained by having the functions operate independently," he said.
Issuers increasingly facing the need to deliver virtual cards, consistent digital messaging and account management have the modular approach option as a business strategy that can help them keep pace, while also being prepared for what comes next.
"Start doing some of the pieces of it now, and that at least gives you flexibility down the line," Harris said. "Not doing it now doesn't make the problem go away."
