The Compliance Deadline Versus the Legacy Core
Cobalt Financial is a mid-sized lender. A new regulatory reporting rule takes effect in 14 months and requires transaction-level data with lineage that can be demonstrated to the regulator on request. Cobalt's core lending system is 19 years old, has no reliable data dictionary, and three of its four interfaces are undocumented. The data warehouse feeds 40 regulatory and management reports, several of which are built from spreadsheets maintained by a single analyst who retires in eight months. The programme director proposes a full core replacement to 'do it properly', costing $22 million over three years. The regulator has signalled it will examine Cobalt's readiness in nine months. The CFO will not fund a three-year programme before the deadline, and the board is nervous about the analyst's retirement.
1. Evaluate the full-replacement proposal against the regulatory obligation. Is it the right response to this risk?
Read the worked answer
The full replacement is a technically attractive but governance-poor response to a dated obligation.
- Timing mismatch. The obligation bites in 14 months and the regulator examines in nine. A three-year replacement delivers nothing to the examination and leaves Cobalt non-compliant at the deadline. The proposal solves a long-term architecture problem while ignoring the near-term regulatory risk.
- Risk concentration. Replacing the core during a regulatory change multiplies delivery risk: new system, new data model, new lineage, all at once. If the programme slips, both the replacement and the compliance obligation fail.
- Cost and commitment. $22 million over three years is a large irreversible commitment made before the compliance path is settled. It also crowds out the funding needed for the actual deadline.
- But the proposal is not wrong about the underlying problem. Undocumented interfaces, no data dictionary, and single-person spreadsheet dependency are genuine structural weaknesses that will recur after the deadline.
Judgement: the replacement is a reasonable strategic direction but cannot be the compliance response. It should be sequenced after, or run in parallel at low intensity, while a targeted solution meets the 14-month obligation. Approving it as the primary answer would trade a certain near-term failure for an uncertain long-term gain.
2. Recommend a two-track approach: what must be delivered by the deadline, and how should the strategic replacement be governed so it does not destabilise compliance?
Read the worked answer
Track 1 - Compliance by the deadline (targeted, 14 months):
- Data lineage for in-scope reports only. Identify the transactions and reports the rule covers, and document lineage for those, not the whole estate.
- Build a data dictionary for the in-scope interfaces, starting with the three undocumented ones. Capture knowledge from the retiring analyst first - this is the most time-critical action.
- Remove single-person dependency: cross-train a second analyst, document the spreadsheets, and migrate the regulatory-critical ones into controlled reporting.
- Evidence pack for the regulator: a readiness statement showing scope, lineage, controls, and remediation plan for gaps. Demonstrable progress with honest gaps is stronger than an unsupported claim of completeness.
- Assurance: independent review of the lineage evidence before the nine-month examination.
Track 2 - Strategic replacement (governed separately):
- Establish it as a distinct programme with its own business case, stage gates, and funding released in tranches.
- Require an architecture and data-migration plan that reuses the lineage and dictionary assets from Track 1, so the compliance work is not throwaway.
- Set an explicit rule that no replacement release may degrade regulatory reporting; each release is tested against the in-scope reports.
- Report both tracks to the board on one page: compliance status, replacement progress, and the risk of the two interacting.
Governance principle: separate the obligation from the ambition. Fund the obligation with certainty and the ambition with gates, and make the dependency between them explicit.