The Composable Bank: An APAC Core Modernization Playbook for CIOs and CTOs in 2026

Executive Summary

Across APAC, the core banking question has quietly become the most consequential technology decision of the decade. McKinsey estimates that only around 30% of large-scale transformations in the past ten years were completed in full, and timelines are typically underestimated by as much as 75% (McKinsey & Company, 2024). Yet the pressure to act has never been higher: Accenture reports that banks operating a modern, cloud-enabled digital core can attain up to 60% higher revenue growth and 40% higher profits than peers (Accenture, 2026). The winning move is no longer "rip and replace". It is a composable, sidecar-driven, phased modernization strategy that runs modern and legacy cores in parallel, delivers new products in months rather than years, and keeps regulators - MAS, APRA, HKMA, OJK and Bank Negara - comfortable throughout the journey.

This article lays out a practical 2026 playbook for CIOs, CTOs and Heads of Digital across banking, insurance, financial services and fintech in APAC, drawing on the latest thinking from McKinsey, BCG, Accenture, IDC and Gartner, and the operational realities we see at sourceCode across Australia and Southeast Asia.

Introduction: Why Modernization Cannot Wait Any Longer

The APAC banking landscape in mid-2026 is defined by three converging pressures.


First, real-time, always-on customer expectations shaped by super-apps, digital banks and instant payment rails such as UPI, PromptPay, PayNow, DuitNow and Australia's NPP.


Second, an AI operating model that demands clean, event-driven data flows the traditional monolithic core simply cannot supply.


Third, a regulatory environment: MAS TRM, APRA CPS 230, HKMA OR-2, OJK, and RBI resilience guidelines that have moved from prescriptive controls to outcomes-based operational resilience, forcing boards to prove they can absorb and recover from disruption.

Against this backdrop, the classic 5-to-7-year "big bang" core replacement has become commercially and reputationally untenable. Yet standing still is worse. Gartner's 2026 research on core banking modernization concludes that AI, composability and adaptive UX now dominate CIO agendas, and banks that fail to modernize the core will find their AI ambitions structurally capped by the systems underneath them (Gartner, 2026).

Industry Context: The 2026 State of the APAC Core

Three signals capture where the region stands.

Southeast Asia is at the front of the queue. According to Fintech News Singapore, many Southeast Asian banks are on the cusp of core replacements or first-time core deployments, with Vietnam experiencing particularly aggressive modernization, 94% of Vietnamese bank executives report that slow technology transformation has cost them customers (Fintech News Singapore, 2025). Thought Machine's Vault Core now underpins HD Bank in Vietnam, one of the country's largest retail franchises, and Malaysian digital consortium GXS Bank. Temenos has active implementations across Cambodia (Hattha Bank), Brunei, Myanmar, Thailand, Singapore (Green Link Digital Bank), Malaysia and Vietnam.

Australia's Big Four are pursuing very different paths. NAB has migrated more than 80% of its applications to the cloud, running a "hollow the core" strategy that leaves the mainframe ledger intact while moving non-transactional services to AWS and Azure. Westpac's UNITE, BizEdge and Westpac One programs are in full execution, and its commercial core ledger decommissioning is projected to avoid ~A$400 million of upgrade cost and complete by December 2027. ANZ Plus, the group's cloud-native platform, crossed one million customers and roughly A$20 billion in deposits in its first year, a proof point that a greenfield, sidecar-style architecture can attract meaningful primary balances (Westpac Banking Corp, 2026; Kalkine, 2026).

Singapore's incumbents are betting on AI-native platforms. DBS, OCBC and UOB have collectively committed to retraining all 35,000 domestic employees for the AI era over the next 24 months, with OCBC embedding AI into its core architecture through its WoW wealth platform and open-source-led modernization (Maxthon, 2026).

The pattern is clear: no APAC leader is standing still, but almost none are attempting a monolithic replacement.

Current Challenges: Why Traditional Modernization Fails

Executive teams that revisit their core roadmap in 2026 typically face five recurring obstacles.

The first is scale of risk. Core replacements touch every product, channel, GL entry and regulator interface. McKinsey's data on transformation success rates, 30% completion, up to 75% schedule overrun, reflects the compounding complexity of migrating millions of accounts under load (McKinsey & Company, 2024).

The second is fragmented data. Even where modern core lands, legacy customer, product and risk data typically live in dozens of source systems that were never designed for real-time, AI-ready consumption.

The third is regulatory drag. In APAC, cloud outsourcing, data residency, third-party risk, cyber resilience, and AI governance are all evolving simultaneously. MAS's revised outsourcing guidelines took effect in December 2024, and its November 2025 consultation on AI Risk Management explicitly names data governance as a foundational domain (Monetary Authority of Singapore, 2024; 2025). APRA's CPS 230 has forced Australian banks and insurers to map and stress-test critical operations and material service providers by mid-2025.

The fourth is talent. The engineering skills required to build event-driven, cloud-native, API-first architectures, SRE, platform engineering, domain-driven design, secure-by-design AI are scarce across the region, particularly outside Singapore, Sydney and Bangalore.

The fifth is business case fatigue. Boards have watched core programs consume budgets for a decade with intangible returns. They will not fund another one without demonstrable, incremental value.

Key Trends Shaping the 2026 Playbook

Five trends are decisively reshaping how APAC institutions modernize.

The rise of the sidecar core. IDC projects that 40% of global banks will pursue sidecar approaches by 2026, rising to 70-80% by 2028 (IDC, 2025). A sidecar core runs a modern, cloud-native platform alongside the legacy system, taking a defined slice of customers, products or geographies typically new-to-bank digital customers, a specific product line, or a greenfield brand. It de-risks the transformation by delivering value in months while the legacy system continues to run the bank.

Composable architecture as the default. BCG and McKinsey both describe the shift from monolithic platforms to modular, cloud-native components glued together by APIs, events, and AI-ready data fabrics. McKinsey research indicates 44% of banks expect API programs to reduce costs by more than 10%, while 31% expect them to lift revenues by more than 10%; global API-enabled banking revenue is projected to exceed US$25 billion annually by end-2026 (McKinsey & Company, 2024).

The "hollow the core" pattern. Pioneered visibly by NAB in Australia, this approach leaves the mainframe ledger untouched for stability while progressively lifting product logic, orchestration, customer engagement and analytics out of the core into cloud-native, API-addressable services. It buys time and optionality without demanding a wholesale ledger migration.

AI-ready data fabrics. BCG's January 2026 analysis of GenAI in banking concludes that the highest-return use cases from personalized advice to risk decisioning to code generation, depend on domain-modelled, real-time data that legacy cores struggle to produce (BCG, 2026). Modernization is now inseparable from data platform strategy.

Outcomes-based regulation. MAS TRM, APRA CPS 230, HKMA OR-2 and Bank Negara's RMiT all now frame resilience in outcomes, tolerance for disruption, recovery objectives, third-party concentration risk rather than prescriptive controls. Architecture must be observable, testable, and recoverable by design.

Strategic Analysis: The Composable Bank Blueprint

Synthesizing the evidence, the winning APAC playbook rests on four architectural moves.

Move 1: Choose a modernization pattern deliberately. There is no universal answer; there are four defensible patterns. Sidecar core for banks with a low-risk appetite and a specific customer or product slice they want to accelerate. Progressive strangler for banks willing to systematically retire monolith functions over 3-5 years. Hollow the core for institutions with stable, high-volume ledgers where the priority is agility on top rather than replacing the base. Greenfield build for new digital brands, banking-as-a-service plays or geographic expansion where speed to market and cost-to-serve dominate the case. The choice must match risk appetite, board time horizon, and the maturity of the engineering organization.

Move 2: Build a composable domain platform, not a project. The unit of investment must move from projects to persistent product platforms: payments, deposits, lending, cards, onboarding, financial crime, data. Each is API-first, event-published, independently deployable and owned end-to-end by a single team. This is where domain-driven design, platform engineering and SRE stop being fashionable words and start being organizational reality.

Move 3: Land an AI-ready data fabric alongside the core. The core does not have to be modern for the data to be modern. Event streams (Kafka, Kinesis, EventBridge), a lakehouse or open-table data platform (Databricks, Snowflake, Iceberg), a semantic layer and a feature store give the bank AI-grade data long before the ledger is replaced. This is often where BCG and McKinsey both see the first credible ROI in a multi-year program.

Move 4: Wire compliance and resilience into the platform. Under MAS TRM, APRA CPS 230 and HKMA OR-2, resilience must be evidenced, not asserted. That means observability, chaos engineering, immutable audit, granular RBAC, encryption-in-use, tokenization, exit strategies for cloud and SaaS providers, and continuous control monitoring built into the platform, not bolted on afterwards.

Real-World Examples

NAB (Australia). By migrating over 80% of applications to AWS and Azure while preserving the mainframe ledger, NAB has demonstrated that "hollow the core" can deliver material infrastructure cost reduction, faster product delivery and cloud-native resilience without a full ledger replacement.

ANZ Plus (Australia). A greenfield, cloud-native platform that crossed one million customers and ~A$20 billion of deposits in its first year, evidence that sidecar and greenfield builds can attract primary banking relationships, not just secondary balances.

HD Bank and GXS Bank (Vietnam, Malaysia). Thought Machine Vault deployments show how new digital cores can support tens of millions of customers in Southeast Asia's fastest-growing markets, without the legacy debt of incumbent stacks.

OCBC (Singapore). By embedding AI into the platform architecture and open-sourcing key modernization components, OCBC has framed AI-native banking as a core architectural choice, not a channel-level bolt-on while its WoW platform demonstrates monetizable customer value.

Westpac (Australia). The UNITE program illustrates that even the most complex incumbent estates can retire commercial ledgers, simplify product portfolios and modernize wealth platforms, provided the program is broken into evidenced, sequential outcomes rather than a single leap.

Actionable Recommendations for the CIO and CTO Agenda

For the next 12 months, boards and technology leaders should focus on six moves.

First, define modernization outcomes in business terms: cost-to-serve per active customer, time-to-market for a new product, incident recovery time, AI use-case throughput, and hold every architectural decision against them.

Second, pick the modernization pattern (sidecar, strangler, hollow-the-core or greenfield) explicitly, and communicate it to the board, regulators and delivery organization. Ambiguity is the single largest cause of program drift.

Third, invest in platform engineering as a discipline, not a job title. Standardize a golden path for services, data pipelines, and AI workloads. Every hour saved on infrastructure toil compounds across every product team.

Fourth, land the AI-ready data fabric within 12 months even if the core replacement will take five. Data is the shortest path to executive-visible ROI and to defensible AI use cases under MAS's incoming AI risk guidelines.

Fifth, treat regulators as design partners. Bring MAS, APRA, HKMA, OJK or BNM into the architectural narrative early: cloud exit plans, third-party concentration, AI model governance and CPS 230-style critical operations mapping should be first-class deliverables, not audit responses.

Sixth, rebuild the delivery operating model around long-lived, product-aligned teams with clear accountability for reliability, security, cost and customer outcome. Vendor bodies alone do not transform banks.

The sourceCode Perspective

At sourceCode, we work alongside banks, insurers and fintechs across Australia and Southeast Asia on precisely this transition from monolithic cores and project-based delivery to composable, cloud-native platforms and long-lived product teams. Our engineering teams pair core banking domain fluency with cloud-native, event-driven and AI engineering practice, and we operate under Australian and APAC regulatory expectations by design.

We see three practical patterns consistently deliver value in the region. Landing a sidecar or greenfield digital experience on a modern core (Thought Machine, Mambu, Temenos, Finacle, or a custom platform) in 6–9 months to prove the operating model. Building an AI-ready data fabric: streaming, lakehouse, semantic layer, feature store in parallel with the core roadmap so AI use cases have somewhere to land. Wiring resilience and compliance into the platform in line with MAS TRM, APRA CPS 230 and HKMA OR-2, so modernization is defensible to the board, the regulator and the auditor from day one.

The composable bank is not a product. It is a way of engineering, a way of organizing teams, and a way of governing risk. It is what sourceCode is built to help clients deliver.

Conclusion

The 2026 core modernization question is no longer whether to modernize. It is how to modernize without betting the bank. The evidence from McKinsey, BCG, Accenture, IDC and Gartner points in the same direction: composable, sidecar-led, data-first, resilience-by-design. The APAC institutions that internalize this playbook across Sydney, Singapore, Kuala Lumpur, Ho Chi Minh City, Jakarta, Manila and Bangkok will define the next decade of banking. Those that continue to treat modernization as a one-off program will find themselves capped, structurally, by the systems underneath them.

Looking to design a composable core modernization roadmap that satisfies your board, your regulator and your customer at the same time? sourceCode partners with APAC banks, insurers and fintechs to move from legacy monolith to composable, cloud-native, AI-ready platforms pragmatically, one product at a time. Talk with sourceCode about building the composable bank.

Frequently Asked Questions (FAQ)

What is a composable bank? A composable bank is a financial institution whose technology estate is built as modular, API-first, event-published, cloud-native components: payments, deposits, lending, onboarding, financial crime, data that can be recombined to launch products and enter markets rapidly without replacing the entire core.

What is a sidecar core banking architecture? A sidecar core runs a modern core banking platform alongside the legacy system, handling a defined subset of customers, products or geographies while the legacy core continues to operate. IDC projects 40% of global banks will use this approach by 2026 and 70-80% by 2028.

How long does core banking modernization take in APAC? Full monolithic replacements historically span 5-7 years, with McKinsey noting up to 75% schedule overrun. Composable, sidecar-led approaches typically deliver first meaningful value in 6-12 months and complete major migrations in 3-5 years.

Which core banking platforms lead in APAC in 2026? Thought Machine Vault, Mambu, Temenos Transact, Infosys Finacle and Oracle FLEXCUBE are the most widely deployed platforms across Australia and Southeast Asia, with the choice depending on product complexity, regulatory context and target operating model.

How do MAS, APRA and HKMA expectations affect modernization? Regulators have shifted from prescriptive controls to outcomes-based operational resilience: MAS TRM, APRA CPS 230, HKMA OR-2, requiring banks to demonstrate observability, recoverability, third-party risk management and, increasingly, AI governance across the modernized stack.

References

Accenture (2026) Top Banking Trends for 2026: Unconstrained Banking - A New Age of Possibility. Available at: https://www.accenture.com/content/dam/accenture/final/industry/banking/document/Banking-Top-Trends-FY26-Report-Final.pdf (Accessed: 9 July 2026).

BCG (2026) Accelerating the Path from GenAI Potential to Profit in Banking. Boston Consulting Group, January. Available at: https://web-assets.bcg.com/7d/91/7f9d246e4abbafb9c2a3dc74e8ee/accelerating-the-path-from-genai-potential-to-profit-in-banking.pdf (Accessed: 9 July 2026).

BCG (n.d.) Core Banking System (CBS) Modernization - White Paper, Part 1. Available at: https://media-publications.bcg.com/Core-Banking-System-Modernization-Part-1.pdf (Accessed: 9 July 2026).

Fintech News Singapore (2025) Core Banking Revolution Underway in Southeast Asia. Available at: https://fintechnews.sg/67473/digital-transformation/digital-banks-adoption-shows-core-banking-revolution-underway-in-southeast-asia/ (Accessed: 9 July 2026).

Gartner (2026) Core Banking Modernization Acceleration Trends. Available at: https://www.gartner.com/en/documents/5255063 (Accessed: 9 July 2026).

IDC (2025) Worldwide Banking IT Spending Guide. Available at: https://my.idc.com/getdoc.jsp?containerId=IDC_P7213 (Accessed: 9 July 2026).

Kalkine (2026) Banking Heavyweights of the ASX 100: Are CBA, NAB, and Westpac Still Buys in 2026? Available at: https://kalkine.com.au/news/premium/banking-heavyweights-of-the-asx-100-are-cba-nab-and-westpac-still-buys-in-2026 (Accessed: 9 July 2026).

Maxthon (2026) Singapore's AI Banking Transformation: A Comprehensive Case Study, 8 January. Available at: https://blog.maxthon.com/2026/01/08/singapores-ai-banking-transformation-a-comprehensive-case-study/ (Accessed: 9 July 2026).

McKinsey & Company (2024) Beyond Digital Transformations: Modernizing Core Technology for the AI Bank of the Future. Available at: https://www.mckinsey.com/industries/financial-services/our-insights/beyond-digital-transformations-modernizing-core-technology-for-the-ai-bank-of-the-future (Accessed: 9 July 2026).

McKinsey & Company (2024) Modernizing Core Technology, Without Breaking the Bank. Available at: https://www.mckinsey.com/industries/financial-services/our-insights/banking-matters/modernizing-core-technology-without-breaking-the-bank (Accessed: 9 July 2026).

Monetary Authority of Singapore (2024) Revised Guidelines on Outsourcing. MAS. Available at: https://www.mas.gov.sg/regulation/operational-resilience (Accessed: 9 July 2026).

Monetary Authority of Singapore (2025) Consultation Paper on Guidelines for Artificial Intelligence Risk Management, November. MAS.

The Asian Banker (n.d.) Asia Pacific Banks Must Modernise Infrastructure Without Surrendering Their Trust Advantage. Available at: https://www.theasianbanker.com/updates-and-articles/asia-pacific-banks-must-modernise-infrastructure-without-surrendering-their-trust-advantage (Accessed: 9 July 2026).

Westpac Banking Corp (2026) FY2026 Financial Disclosures. SEC Form 6-K filings. Available via SEC EDGAR (Accessed: 9 July 2026).