Build versus buy

Why it is rarely all one or the other

Almost every bank buys its core banking platform, card systems and much of its infrastructure, and builds at least some of its customer experience and decisioning. The real questions are which capabilities belong in each group, how much to customise what is bought, and how to keep the ability to change course. This page gives a framework, not a verdict. The right answer differs by bank and changes over time.

Six factors

Try it: a simple scorer

Rate one capability against the six factors. The scorer treats differentiation, urgency and in-house talent as the strongest influences, and control, scale and regulatory complexity as moderate ones. The result is a starting point for discussion.

System by system

Patterns by type of institution

• Public-sector banks tend to buy large, proven platforms and run long programmes with system integrators. Scale, procurement rules and the need for stability shape those choices. SBI's core banking has run on TCS BaNCS since an implementation that began in 2001; in October 2021 TCS said the partnership was extended for five years.^{4Tata Consultancy Services. SBI deepens partnership with TCS to drive innovation and enhance customer experience. As of 6 October 2021.}
• Large private banks usually buy the core and build more around it: apps, decisioning and data, with sizeable in-house engineering teams.
• Small finance banks and newer banks often choose modern or hosted platforms to launch quickly, and build selectively where they compete.
• Cooperative banks frequently share a platform rather than run their own. IFTAS's Indian Banking Community Cloud provides core banking and other applications, such as SFMS and mobile banking, as web services.^{3Reserve Bank of India. Chief Executive Officer (CEO) for Indian Financial Technology and Allied Services (IFTAS). As of 20 September 2022.}
• Fintechs build most of their product, rent infrastructure and partner with banks for the regulated parts.

These are tendencies, not rules; any single institution may differ.

What RBI expects when a third party is involved

Buying often means a vendor runs part of the service, which makes it outsourcing. RBIReserve Bank of India. India's central bank. It regulates banks and payment systems, runs RTGS and NEFT, and holds the accounts in which banks settle with one another.’s Direction on IT outsourcing sets the expectations:

• Outsourcing does not reduce a regulated entity's obligations; its board and senior management remain ultimately responsible for the outsourced activity.^{1Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (full text). As of 10 April 2023.}
• Responsibility for resolving customers' grievances about outsourced services stays with the regulated entity, and outsourcing cannot reduce customers' rights against it.^{1Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (full text). As of 10 April 2023.}
• Due diligence on an IT service provider must cover its experience and competence to deliver over the contract period and its financial soundness.^{1Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (full text). As of 10 April 2023.}
• Regulated entities must consider the risk of concentrating their outsourcing with a single provider or a few providers.^{1Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (full text). As of 10 April 2023.}
• A regulated entity's outsourcing policy must include termination processes and exit strategies, including business continuity if a service provider leaves the arrangement.^{2Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102). As of 10 April 2023.}
• RBI's IT outsourcing Direction counts cloud computing services as outsourced IT services and adds specific requirements for storing, computing and moving data in the cloud.^{2Reserve Bank of India. Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102). As of 10 April 2023.}

How lock-in happens

Lock-in is rarely one decision. It accumulates through customisations that only the vendor can maintain, proprietary data formats, integrations built against vendor-specific interfaces, contracts without data-export clauses, and skills that exist only at the vendor. Each of these is manageable on its own; together they can make leaving impractical. The defences are configuration over customisation, owning data in documented formats, putting your own APIs in front of bought systems, contract clauses for exit, and keeping enough in-house knowledge to run a transition.

A worked example

This example is illustrative. A mid-sized bank wants better fraud detection for UPIUnified Payments Interface. NPCI's real-time system for paying from a bank account with a UPI ID, QR code or phone number, through apps on a phone. payments. It rates the six factors:

• Differentiation: high. Fraud losses and false declines both affect customers.
• Regulatory complexity: medium.
• Scale: high.
• Urgency: high. Losses are rising.
• Talent: medium. It has data scientists but no real-time engineering team.
• Control: high. The models use sensitive customer data.

The factors pull in both directions, which points to a hybrid. The bank buys a proven real-time scoring engine to deploy quickly. It then builds its own features and models on its data, and keeps the right to export rules and models. It also plans, from the start, what it would take to replace the engine.

Questions for a decision

• Would a customer notice, or care, if this capability were the same as every competitor’s?
• What will it cost over ten years, including people, upgrades and exit, for both options?
• If we buy, which parts will we still build, and who owns them?
• How would we leave this vendor, how long would it take, and what would we lose?
• Which RBI outsourcing requirements does this arrangement trigger, and who will evidence them?