Banking has reached a capability tipping point. 65% of financial institutions struggle to fill critical positions. Only 18% achieve their transformation goals. 43% of global banks acknowledge that regulatory tasks go undone due to staffing shortfalls, not delayed, undone. The constraint is no longer budget, strategy, or technology. It is capability. This article draws on Outsized platform data from banking engagements across APAC, Africa, and the Middle East in 2025 to show where the gaps are sharpest, where independent specialists are being deployed, and what the organisations maintaining delivery momentum are doing differently.

Why is banking facing a structural capability crisis?

Three pressures are converging simultaneously, and unlike previous cycles, all three are permanent.

Regulatory intensity has reached unprecedented levels. DORA became applicable in January 2025, yet only 25% of European entities felt compliant with ICT risk requirements at the point of the deadline. CPS 230 became mandatory in Australia in July 2025. AML fines hit $8.2 billion in 2024, up 27% year-on-year. TD Bank's $3.09 billion penalty under the Bank Secrecy Act illustrated that even well-resourced institutions fail when compliance capability lags supervisor expectations. Regulators no longer accept intent. They demand verifiable execution with documentation that can withstand examination.

Transformation has become a permanent portfolio, not a programme. Banks are running dozens of initiatives simultaneously: core modernisation, cloud migration, payments upgrades, digital onboarding, data remediation, and embedded finance. 94% of core banking projects exceed timelines and budgets, not by small margins, but by multiples. 70 to 75% of IT budgets remain consumed by legacy maintenance, leaving finite capacity for change. A missing architect or model risk specialist can stall 20 to 30 workstreams. When delivery depends on one or two people in critical roles, the organisation is not understaffed. It is fragile.

Competition for execution talent has fundamentally shifted. Banks are not competing only with each other. 30% of banking professionals who changed jobs in 2025 moved to fintechs. Stripe pays $350,000 for experienced AML analysts in roles banks budget at $180,000. A payments architect at a scaling fintech earns $300,000 to $400,000; the equivalent role at a traditional bank pays $180,000 to $220,000. The mid-career specialists with 8 to 15 years of experience are the most likely to leave, precisely the cohort banks need most for transformation delivery. And many are returning to the market as independents, choosing where and how they work rather than accepting permanent roles in institutions that move slowly.

What are banks actually hiring independent specialists for?

Analysis of banking engagements on the Outsized platform across APAC, Africa, and the Middle East reveals six execution clusters where independent talent is being deployed.

Digital transformation and core modernisation (35 to 40%). Core banking implementations, digital journeys, and platform migrations dominate. Temenos specialists, full-stack engineers, data migration leads, and programme managers are the most common profiles. This cluster is the largest because these are multi-year commitments with fixed regulatory checkpoints, and the cost of losing a lead architect mid-programme is measured in months of delay, not weeks.

Data, analytics, and decision science (25 to 30%). Credit decisioning, portfolio analytics, IFRS 9, and ML infrastructure. Decision scientists, quantitative analysts, BI analysts, and ML engineers. Demand here reflects both the AI governance gap and the fundamental shift in how banks make decisions about credit, fraud, and customer management.

Strategy and transformation consulting (15 to 20%). Operating model redesign, capability building, and commercial banking strategy. Ex-MBB banking transformation consultants and commercial banking specialists dominate. Consulting firms, not just enterprise clients, drive a significant share of this demand as they source independent execution capacity for their own client engagements.

Product management and customer experience (10 to 15%). Everyday banking products, customer segment strategies, and lifecycle management. Product managers with retail banking operator experience are in particular demand as banks accelerate digital channel builds and payments integration.

Risk, compliance, and governance (10 to 12%). Retail conduct, AML/KYC, operational resilience, and Sharia compliance. Though the smallest share by volume, this cluster represents the most urgent work. Regulatory RFIs arrive with 30-day response windows. One bank's vacant sanctions role cost $25 million in fines. Another mobilised 40 specialists in 72 hours to clear a regulatory backlog. The difference was not budget. It was capability access.

Specialised capabilities (5 to 8%). Climate finance, GenAI architecture, actuarial analysis, and bond securities. Small in volume, but growing fast and extremely difficult to source through traditional channels.

The pattern is unambiguous: banks are not buying strategy. They are buying execution capacity for programmes already underway.

What are the three capability battlegrounds in banking?

Is your risk, resilience, and AI governance capability fit for examination?

The operational resilience gap is acute. 73% of institutions have two or fewer full-time employees managing vendor risk while overseeing 300-plus vendors. Only 8% report full compliance on third-party risk and resilience testing. 50% of firms experienced a third-party cyber event in 2025. CPS 230 in Australia, DORA in Europe, and equivalent frameworks globally have made resilience a board-level obligation, yet the specialists who can build these frameworks to examination standard are exceptionally rare.

AI governance is the emerging crisis within the crisis. Banks are deploying machine learning models across credit, fraud, and customer decisioning, but the governance infrastructure lags dangerously. Model risk specialists who combine MLOps depth with regulatory fluency barely exist as a profession. 87% of organisations struggle to hire AI developers; the subset who also understand SR 11-7, SS1/23, or MAS FEAT guidance is vanishingly small. Goldman Sachs reportedly had 22 open AI compliance roles unfilled for eight-plus months in 2025. Dedicated Responsible AI roles number just 138 people across the top 30 global banks globally, a 21% increase in six months, signalling that leaders are building these functions while the broader market remains chronically underserved.

Compliance as a profession is greying out in parallel. 41% of senior compliance officers retired in the past two years. The median CCO tenure is now 3.2 years. 72% of CCOs report staffing shortages that directly caused control failures, not theoretical risk, but actual breakdowns that reached regulators. The pipeline is not refilling.

The strategic implication: risk gaps constrain every other initiative and create direct regulatory exposure. A bank cannot scale AI without model governance. It cannot modernise without resilience. Risk is the binding constraint.

Can your core modernisation programme survive the talent attrition it will face?

The failure rate is documented. A major Australian bank's core transformation ran seven years over timeline. A European universal bank wrote off €400 million after abandoning a payments platform migration. TSB's 2018 IT migration failure locked out 1.9 million customers, cost £366 million in direct remediation, and resulted in the CEO's departure. 94% of core banking projects exceed timelines and budgets.

92% of banks are concerned about legacy systems and technical debt. Only 24% achieved cost reduction targets from modernisation programmes. An estimated $370 million annually is wasted per average enterprise due to inefficiencies from technical debt. COBOL specialists now command $250-plus per hour, and the median age of practitioners is 55-plus.

The capability gap is specific. Banks need Technical PMO and Transformation Director profiles who can lead multi-hundred-million programmes without derailing production. They need architects who understand both legacy core banking systems and cloud-native infrastructure. They need data engineers who can build pipelines while maintaining BCBS 239 compliance. These hybrid profiles do not come from graduate programmes. They come from people who have done it before, many of whom have chosen independent careers precisely because they can see the same transformation being restarted at the next institution on the same avoidable mistakes.

The strategic implication: core modernisation is a five to ten year commitment with 18-month regulatory checkpoints. Banks that succeed staff for resilience, assuming attrition and building capability redundancy. Banks that fail staff for efficiency and discover they have single points of failure across critical workstreams.

Are you winning or losing the payments capability race?

Real-time payments account for 25% of global digital volumes and growing. India's UPI processed 228 billion transactions in 2025, surpassing Visa in daily volume. Brazil's PIX has achieved near-universal adoption. The ISO 20022 migration deadline has passed, yet only 38.5% of global cross-border traffic is ISO 20022 native. Approximately 5,000 banks may be non-compliant.

Deepfake fraud attempts have increased 2,137% since 2023. 50% of fraud is now AI-enabled. Biometric authentication and AI-driven checks can cut fraud losses by up to 75%, but deploying these systems requires machine learning engineers, fraud intelligence scientists, and responsible AI specialists.

Traditional corridors face existential pricing pressure. Fintechs offer cross-border fees of 0.5 to 1% against banks' 6 to 7%. Embedded finance is integrating payments into non-financial platforms. Banks risk becoming invisible infrastructure, processing transactions but losing the customer relationship.

The strategic implication: speed of capability deployment determines competitive position. The banks winning in payments are those that can mobilise integration architects, scheme specialists, and product managers in weeks rather than months. The rest are watching others build the customer relationships they used to own.

How should banking leaders deploy independent specialists?

A Tier 1 Australian bank needed to stand up an operational resilience framework to meet a regulatory deadline. Internal risk team understood the business but lacked expertise in threat modelling, scenario testing, and third-party risk quantification. Permanent hiring would have taken four to six months. A Big 4 team quoted $2.3 million for a nine-month engagement with a junior-heavy pyramid.

Instead, they mobilised a four-person independent specialist pod within eight days. Framework designed and implemented in 14 weeks. Total cost: approximately $580,000.

This is not an outlier. It is the pattern that emerges when organisations shift from "we have unfilled roles" to "we need specific capabilities by specific dates." That reframing changes every downstream decision.

Four behaviours distinguish banks that extract maximum value from independent specialists. They define stewardship roles, where institutional knowledge and continuity matter, separately from delivery roles, where specific expertise by a specific date is what drives value. They maintain relationships with specialist talent partners who understand banking well enough to challenge the brief. They have fixed onboarding governance: pre-approved categories, IT access in one to two days, clear accountability in mixed teams. And they measure performance by programme milestones and regulatory deadlines met, not day rates.

82% of organisations with formal flexible workforce strategies report meeting transformation milestones, versus 54% of those without.

What does the 2026-27 outlook mean for banking talent?

The convergence of regulatory deadlines, transformation backlogs, and AI governance obligations will intensify through 2027, and the talent constraints will not ease fast enough to absorb them through traditional hiring.

By end of 2026, 60-plus percent of Tier 1 and Tier 2 banks will have active core modernisation programmes. More than nine in ten will exceed timelines and budgets without blended delivery models. AI governance specialists will become the single most difficult role to fill in banking: AI skills jumped from sixth to first most scarce in 18 months, and regulatory expectations from MAS, HKMA, the FCA, and APRA are only intensifying.

The fintech talent drain is structural, not cyclical. The mid-career execution talent that banks need most is the talent most likely to leave, and increasingly to return as independents on their own terms. The organisations that build access infrastructure before the next capability crisis arrives, pre-qualified talent pools, streamlined governance, and relationships with specialist networks, will outperform those that start sourcing when the deadline is already visible.

Summary

Banking faces a capability crisis that is structural, not cyclical. 65% of institutions cannot fill critical positions. Only 18% achieve transformation goals. 43% acknowledge regulatory tasks go undone. The six execution clusters on the Outsized platform show where banks are actually deploying budget: digital transformation and core modernisation, data and analytics, strategy consulting, product management, risk and compliance, and specialist capabilities including AI governance and climate finance. The organisations maintaining delivery momentum have stopped waiting for permanent hiring to solve problems that arrive faster than hiring cycles can respond. They are deploying independent specialists as strategic capability infrastructure, mobilising risk, architecture, and delivery talent at the speed their regulatory and transformation agendas demand. The question is not whether banking has a capability gap. It is whether your access model is built to close it before your next deadline arrives.

Need risk, transformation, or AI governance capability at pace?

Talk to the Outsized team.

Author 

Johann van Niekerk is EMEA Lead, a qualified actuary with 15 years at Metropolitan Life and RGA spanning product, business development, and insurtech investment, and founder of RGA Ventures.