Build vs. Buy Is the Wrong Question for BFSI Technology Capacity in 2026

How the fastest-growing delivery model in financial services technology is also the one with the fastest-growing failure rate - and what actually separates the two outcomes

Key Takeaways

• Global capability centres (GCCs) serving banking, financial services and insurance are on a trajectory from roughly US$40-41 billion in value in 2023 to US$125-135 billion by 2032 - yet more than 25 GCCs closed in 2025, and industry data firm Neovay expects that number to roughly double in 2026 (YourStory EnterpriseStory, 2025; Das, 2026).

• Regulators are simultaneously raising the compliance bar on the alternative. Singapore's MAS has proposed guidelines that extend third-party risk obligations beyond formal outsourcing contracts to essentially every external technology arrangement, drawing explicitly on lessons from Australia's CPS 230 regime (HSF Kramer, 2026).

• Independent data on why capability centres succeed or fail points to governance maturity, process ownership and executive sponsorship - not insourcing versus outsourcing as a category - as the deciding variable (EY India, 2024; Das, 2026).

• Most BFSI technology leaders still underwrite this decision as a day-rate or headcount-cost comparison. The more useful 2026 framing is: where should regulatory accountability and institutional knowledge sit, and is the organisation actually prepared to invest in the governance that either model requires?

Introduction

In the same week that one insurer's captive technology centre changed hands for US$10.5 million, Singapore's regulator was finalising a consultation that will make it harder for financial institutions to treat any external technology arrangement as "someone else's problem." Guardian Life, a US insurer, sold its global capability centre (GCC) to HCLTech in 2026 - one of a wave of BFSI institutions quietly exiting capability centres they had built to bring technology delivery in-house (Das, 2026). At the same time, the Monetary Authority of Singapore has proposed guidelines that would extend third-party risk obligations well beyond formal outsourcing arrangements, explicitly citing the lessons Australian institutions have learned implementing APRA's CPS 230 (HSF Kramer, 2026).

Those two facts sit uncomfortably together, and that discomfort is the point of this article. Banks and insurers across APAC and the Gulf are being pulled toward insourcing - building or expanding dedicated capability centres, offshore development centres (ODCs) and in-house engineering teams - at the same time that a meaningful share of those same centres are plateauing, getting sold, or shutting down outright. Meanwhile, the "just outsource it" alternative is becoming more operationally demanding, not less, as regulators formalise what used to be informal vendor-management hygiene.

For a CTO, CDO or Head of Digital evaluating how to resource a 2026-2027 technology roadmap, this is not a comfortable moment to fall back on the old framing of "build vs. buy." The evidence suggests that framing was never quite right, and the cost of getting it wrong is rising on both sides.

The Insourcing Wave Is Real - and the Growth Numbers Are Striking

The scale of movement toward capability centres in financial services is not a niche trend. Everest Group's March 2026 market outlook counts more than 6,350 GCCs now operating across offshore and nearshore locations globally, with new centre formation growing at roughly 7% annually and the market for provider-supported GCC services projected to reach close to US$40 billion by 2027 (Everest Group, 2026). Within that broader market, BFSI is one of the largest and fastest-scaling verticals: a 2025 talent report from Quess Corp, reported by YourStory, puts India's BFSI-dedicated GCCs alone at close to 190 centres employing nearly 540,000 professionals - roughly a quarter of India's entire GCC workforce - with the segment's value projected to grow from roughly US$40-41 billion in 2023 to US$125-135 billion by 2032 (YourStory EnterpriseStory, 2025).

The composition of that growth is telling. AI and data engineering roles now make up close to 29% of new hiring across BFSI GCCs, even as employers report a 42% skill gap in exactly those disciplines, and specialised technical roles command a 1.5x to 4x salary premium over conventional IT positions (YourStory EnterpriseStory, 2025). This is not primarily a cost-arbitrage story anymore, at least not in intent: institutions are explicitly trying to build AI, data and digital capability close to the business, inside their own operating model, rather than renting it by the hour from a vendor.

Southeast Asia tells a parallel story through a different delivery model. The Philippines' IT-BPM sector - which includes substantial financial services delivery work - is forecast to employ between 1.85 million and 2.14 million full-time staff by 2028, generating US$43.3-50.5 billion in revenue (IBPAP, cited in StealthAgents, 2026). Whether the vehicle is an Indian GCC, a Philippine delivery hub, or a Malaysian or Vietnamese dedicated team, the underlying executive decision facing BFSI leaders is converging: bring technology capacity closer to governance and control, or keep extending traditional outsourcing relationships.

Why "Build" Is Not the Safe Default It Looks Like

The growth numbers above make a strong case for insourcing. The failure data makes an equally strong case for caution.

Industry tracking firm Neovay recorded more than 25 GCC closures in 2025 and expects that figure to roughly double in 2026 - against a base of roughly 2,100 centres generating around US$100 billion in annual revenue, per Nasscom figures cited in the same report (Das, 2026). More striking than the closures is the plateauing: research from Embark and UnearthIQ, also cited in that reporting, finds that 30% of GCCs established since 2021 - on the order of 150 centres over five years - have stalled in their growth, with more than 500 centres failing to realise their intended potential. Neovay's own assessment is blunter still: over half of India's GCCs are "sub-scale" (Das, 2026).

The reasons are consistent with what EY's GCC advisory practice has been documenting since at least 2021: capability centres fail less often because of talent availability and more often because of how they are set up and run. EY identifies five recurring failure patterns - the absence of senior executive sponsorship once the initial build is complete; an operating model that inherits the fragmentation and unclear ownership of the business functions it serves rather than correcting it; insufficient authority over budget and resourcing decisions, leaving the centre stuck in approval queues; growth targets disconnected from local talent-market realities; and performance metrics that stay anchored to early-stage measures like ramp-up speed long after the centre needs to be evaluated on strategic contribution (EY India, 2024).

The 2026 data adds a sharper edge to that diagnosis. ISG research cited by Das (2026) found that 40% of India-based GCC leaders prioritise innovation as a mandate, compared with only 17% of headquarters executives - and that 70% of parent organisations still primarily use their GCC to reduce staff costs, regardless of how the centre is positioned internally. A separate EY survey found that 80% of GCCs have less than 10% of leadership roles filled locally, concentrating strategic decision-making thousands of kilometres from where the work actually happens. Put plainly: a large share of the institutions building capability centres are still managing them as cost centres while describing them, externally, as innovation engines - and the resulting mismatch between stated intent and actual governance is where plateauing and closure tend to originate.

Why "Buy" Just Got More Expensive to Run Badly

The regulatory environment is removing the other comfortable option - continuing to outsource without investing in the governance that outsourcing itself now requires.

MAS's proposed Guidelines on Third-Party Risk Management, consulted on between March and April 2026, would extend the regulator's expectations beyond formally designated "outsourcing" arrangements to cover essentially all third-party relationships for financial institutions operating under Singapore's Financial Services and Markets Act 2022 (HSF Kramer, 2026). The proposal would require institutions to maintain a semi-annual register of material third-party arrangements, run every relationship through a defined five-stage lifecycle - risk assessment, due diligence, contracting, onboarding and monitoring, and termination - and document tested exit plans rather than termination clauses alone. Sub-contractors are explicitly in scope: institutions must be able to monitor and control risk even where their vendor has outsourced work further down the chain.

MAS is drawing this framework in part from how Australia's financial institutions have implemented APRA's CPS 230, which took effect on 1 July 2025 and required pre-existing contracts to comply by their next renewal date or 1 July 2026, whichever came first. The practical lesson from that rollout, as HSF Kramer (2026) documents, is that the compliance burden lands hardest on vendors and clients who treat contract renegotiation as a late-stage, compressed-timeline exercise rather than something to map and resource well in advance - and that service providers frequently have no formal right to challenge how a client classifies the materiality of their arrangement, which has itself become a point of friction.

None of this makes outsourcing untenable. It does mean the version of outsourcing that worked when vendor governance was lighter-touch - a signed SOW, a quarterly business review, a termination clause nobody expected to use - no longer meets a reasonable regulatory bar in Singapore, and increasingly not in Australia either. The hidden economics compound this. A widely used total-cost-of-outsourcing model estimates that each percentage point of staff attrition on an outsourced engagement adds roughly 0.24% to the effective cost of that engagement once hiring, training, coaching and productivity-ramp costs are accounted for - meaning a vendor team running at 20% annual attrition can cost a client on the order of 3.6% more than an otherwise identical team at 5% attrition, even when the headline rate card is unchanged (Laughlin, Nearshore Americas, n.d.). Institutions that have never measured attrition on their outsourced BFSI technology work are, in effect, not pricing a cost they are already paying.

The Real Variable Is Governance Maturity, Not Ownership Model

Read together, the growth data and the failure data are not contradictory - they are describing the same underlying truth from opposite directions. The institutions whose capability centres are scaling toward that US$125-135 billion 2032 figure and the institutions whose centres are among the 25-plus closures in 2025 are, structurally, doing the same thing: building a dedicated technology capability outside their traditional head-office footprint. What differs is whether that capability was built with genuine executive sponsorship, clear process ownership, locally empowered leadership and metrics that evolve past the ramp-up phase - or whether it was built primarily to arbitrage labour cost and then left to find its own level of maturity.

The same logic now applies on the outsourcing side of the ledger. An institution that has mapped its material third-party arrangements, tested its exit plans and built sub-contractor visibility into its contracts is in a fundamentally different risk position under MAS's proposed regime than one that has not - regardless of whether its underlying delivery relationship is, on paper, "outsourcing" or something more collaborative. Ownership model is a structural choice. Governance maturity is an investment decision. The data increasingly suggests the second variable explains more of the outcome than the first.

A Decision Framework: The Capacity Readiness Matrix

For technology and risk leaders evaluating whether to insource, extend an existing outsourcing relationship, or establish a hybrid dedicated-team model, four questions do more diagnostic work than a cost-per-FTE comparison:

1. Executive sponsorship. Is there a named, senior accountable owner for this capacity - insourced or outsourced - who tracks its contribution beyond the initial build or contract signature, or does accountability diffuse once the centre or vendor relationship is operational?

2. Process boundary clarity. Can the work assigned to this capacity be described as an end-to-end process with clear ownership, or does it inherit fragmented handoffs from the business functions it serves? EY's research suggests this single factor predicts more failure risk than talent availability (EY India, 2024).

3. Local empowerment and decision rights. Does the team - wherever it sits - have real authority over its own prioritisation and resourcing, or is every meaningful decision routed back to a head office thousands of kilometres and several time zones away? The 80%-of-leadership-not-local statistic cited above is as relevant to an offshore ODC relationship as it is to a wholly owned GCC.

4. Regulatory and exit readiness. Is there a current, tested register of this arrangement's materiality, data dependencies and exit path - the discipline MAS and APRA are now formalising - regardless of whether the arrangement is structured as outsourcing, insourcing, or a dedicated hybrid team?

An institution that cannot answer the first three questions confidently has a governance problem, not a sourcing-model problem, and building a captive centre will not fix it - the EY and Neovay data on plateauing and closure is largely a record of institutions discovering this after the fact. An institution that cannot answer the fourth has a compliance exposure that MAS's 2026 guidelines and APRA's CPS 230 are both, independently, about to make considerably harder to ignore.

What This Means for the Buying Committee

For a CTO or CDO, the practical implication is that the architecture decision and the governance decision cannot be separated. A dedicated team - whether structured as insourcing, an ODC, or a hybrid model - needs the same end-to-end process ownership and empowered local leadership that a well-run GCC requires, or it will underperform for the same reasons a badly-run captive centre does.

For a CFO, the Capacity Readiness Matrix reframes the economics. The honest comparison is not day-rate versus fully-loaded headcount cost; it is the fully-loaded cost of a governed, accountable capacity model against the fully-loaded cost of an ungoverned one - including the attrition premium outsourcing buyers routinely leave unmeasured, and the compliance cost that both outsourcing and insourcing now carry under tightening third-party risk regimes.

For Risk, Compliance and Procurement, MAS's proposed register and five-stage lifecycle, and APRA's existing CPS 230 obligations, apply to material third-party arrangements regardless of how "outsourced" they feel in practice. A dedicated or hybrid delivery team run by an external partner is not automatically exempt from this scrutiny simply because it resembles an internal team; the materiality test is about the arrangement's risk profile, not its label.

The sourceCode Perspective

From sourceCode's experience delivering insourced and outsourced technology teams for financial institutions across Australia, Malaysia and Vietnam, the pattern in this data matches what we see in practice: the clients who get the most durable value from a dedicated capacity model are the ones who treat governance as a day-one design decision, not a retrofit. That means defining process ownership and decision rights before the team is staffed, not after a quarter of underperformance forces the question - and it means building the regulatory and exit documentation that MAS and APRA now expect into the engagement from the start, rather than assembling it under deadline pressure during a contract renewal window.

This is also, in our view, the practical case for a dedicated team model that sits between a from-scratch captive GCC and a conventional staff-augmentation outsourcing contract: an institution gets a team with the process clarity and continuity that EY's failure analysis says matters most, without absorbing the full organisational-design risk of building and running a captive centre from zero in a market where, per the 2026 data above, roughly a third of recently established centres have already plateaued. For organisations evaluating this question for an upcoming technology or AI roadmap, the useful first step is less "build or buy" and more a candid internal audit against the four questions above - which is a conversation worth having before the staffing or sourcing decision gets made, not after. Talk to us here!

Conclusion

The headline numbers on global capability centres in financial services point in two directions at once: a market scaling toward US$125-135 billion in BFSI value by 2032, and a failure and plateauing rate running at roughly 30% of recently established centres, with closures set to double in 2026. Both trends are true, and neither resolves the other, because they are not actually describing a contest between insourcing and outsourcing.


They are describing what happens when a capacity decision is made on cost grounds and left to find its own governance maturity afterward - on either side of the build-vs-buy line. For BFSI technology leaders setting 2027 capacity plans in a regulatory environment that is formalising third-party risk management regardless of delivery model, the governance question is no longer optional homework to do once the sourcing decision is made. It is the sourcing decision.

Frequently Asked Questions

What is a global capability centre (GCC) in financial services? A GCC is a dedicated, wholly or majority owned delivery centre that a bank, insurer or other financial institution establishes - typically offshore or nearshore - to run technology, operations, data or analytics work that would otherwise be outsourced to a third-party vendor or kept entirely at head office.

Why are so many GCCs failing or being sold despite the market's overall growth? Independent analysis from EY and 2026 industry data attribute failure less to talent shortages than to governance gaps: lack of sustained executive sponsorship, fragmented process ownership, limited local decision-making authority, and performance metrics that never evolve past early-stage ramp-up measures.

Does insourcing remove third-party risk and regulatory exposure? Not automatically. A dedicated or hybrid delivery arrangement run by an external partner can still fall within the scope of regulatory third-party risk requirements such as MAS's proposed guidelines or APRA's CPS 230, depending on the materiality of the arrangement - the label "insourced" does not itself determine the applicable regulatory treatment.

What should a CTO or Head of Digital evaluate before choosing an insourcing, outsourcing, or hybrid delivery model? Four factors do most of the diagnostic work: whether the capacity has a named, accountable executive sponsor; whether its work is scoped as an end-to-end process with clear ownership; whether local leadership has genuine decision-making authority; and whether the arrangement has a current, tested regulatory and exit readiness position.

Reference List

Das, A. (2026) GCCs struggle to go beyond cost arbitrage in AI era, shows data. Business Standard, 17 July. Available at: https://www.business-standard.com/technology/tech-news/gccs-struggle-to-go-beyond-cost-arbitrage-in-ai-era-shows-data-126071401063_1.html (Accessed: 12 October 2026).

Everest Group (2026) Global Capability Centers (GCCs) Market Outlook for 2026 - What is Next for Providers, report EGR-2026-34-R-7948. Available at: https://www.everestgrp.com/report/egr-2026-34-r-7948 (Accessed: 12 October 2026).

EY India (Sen, A. and Ghatak, K.) (2024) Why Some Global Capability Centers (GCCs) Cannot Deliver Value. Available at: https://www.ey.com/en_in/insights/consulting/global-capability-centers/why-some-global-capability-centers-gccs-cannot-deliver-value (Accessed: 12 October 2026).

HSF Kramer (Herbert Smith Freehills Kramer) (2026) Extending the Regulatory Perimeter Beyond Outsourcing: MAS' Proposed Third-Party Risk Management Guidelines and Lessons From Australia's CPS 230, 29 June. Available at: https://www.hsfkramer.com/notes/tmt/2026-posts/extending-the-regulatory-perimeter-beyond-outsourcing-mas-proposed-third-party-risk (Accessed: 12 October 2026).

IBPAP (IT and Business Process Association of the Philippines) (2026) IT-BPM Industry Outlook, cited in: StealthAgents (2026) BPO Employee Attrition & Replacement Cost Statistics 2026. Available at: https://stealthagents.com/research/bpo-employee-attrition-replacement-cost-statistics-2026 (Accessed: 12 October 2026).

Laughlin, K. (n.d.) Completing the Total Cost of Outsourcing Model. Nearshore Americas. Available at: https://nearshoreamericas.com/total-cost-outsourcing/ (Accessed: 12 October 2026).

sourceCode (n.d.) Homepage. Available at: https://www.sourcecode.com.au/ (Accessed: 12 October 2026).

YourStory EnterpriseStory (2025) BFSI GCCs in India to Touch $125B in Value by 2032: Report, citing Quess Corp BFSI GCC Talent Report 2025, 21 August. Available at: https://yourstory.com/enterprise-story/2025/08/bfsi-gccs-in-india-to-touch-125-billion-in-value (Accessed: 12 October 2026).