By: Matt Downey
For banks of all sizes, the core processing vendor decision is a critical one—from both a selection perspective and an ongoing management perspective. Community banks, in particular, face an additional decision in this process—outsourcing processing to the vendor or hosting core processing internally. While initially this may seem to be a decision driven by financial forecasts—specifically, the potential savings by hosting internally—there are additional considerations and common misperceptions that can complicate the decision-making process. This article examines several of those.
Cost of ownership: Vendor management or system management?
During core processing selection, banks often give little consideration to ongoing management of an outsourced processing. After implementation, that management becomes a “reactive” process of managing service level agreements (SLAs), system issues, and billing.
When hosting core processing in house, a bank assumes ownership not only of the ongoing processing, but also of key system functions like disaster recovery, data back-ups and updates, regulatory requirements, and procurement and maintenance of equipment and infrastructure—both for the core and ancillary stem hardware integrations. For example, system and operational enhancements (upgrades, scalable memory capacity, fire prevention equipment, etc.) are prerequisites to sustainable operations. For some smaller institutions, those can require substantial investment; thus, they warrant diligent evaluation. While the financial cost is front loaded and may be offset by ongoing monthly savings, banks considering in-house hosting also must carefully estimate the costs of full-time IT and operational managers and potentially additional staff. And while hosting internally alleviates some of the rigor associated with OCC vendor management due diligence, regulatory management remains a requirement.
You cannot outsource risk
When evaluating hosting for core processing, common areas of oversight include business continuity, data security, and regulatory compliance. Core vendors have formal, typically ISO-certified processes, systems, and controls in place for disaster recovery, as well dedicated secure transport and storage for back-up tapes. For a bank hosing its own core processing, these become critical functions.
As a bank grows, its product and channel mix increase in scope and complexity, and its systems become more sophisticated, it will gain—and have to actively manage—new risk considerations. Insourcing requires a strong, formalized change management function and associated controls; capabilities not always inherent in smaller institutions.
Finally, when building a business case, it is important to remember that while a bank can outsource processing operationally, it cannot outsource risk management. Regulatory vendor management guidelines ultimately place responsibility for risk on the bank.
Strategic planning: The flexibility myth?
Often, part of the business case for implementing or migrating to internally managed core processing is the allure of ownership—control over updates, integrations, and internal subject matter expertise. While these are valid considerations, there are limits to the scope of enhanced flexibility. For example, integration flexibility remains limited to vendor compatibility. Furthermore, the proliferation of delivery channels makes connectivity and service continuity essential at multiple integration points. A comprehensive cost/benefit analysis must include these considerations.
Industry trends: Outsourcing has more momentum than it seems
Comparative analyses of industry standards for in-house and outsourced processing can be misleading, as there is an inherent lag in tracking decision making among institutions of various sizes. The time required to make decisions about changing a bank’s core processing approach and then then implement that change is extended; as such, the trend towards outsourcing among smaller institutions is more significant than the modest increase over the past decade (depicted in the exhibit below) would suggest.
Source: “Automation in Banking” 2001, 2011
These exhibits show that outsourcing, while still the less common approach, has begun to close the gap among smaller institutions over the past decade. Larger banks, which are able to manage the operational constraints, have remained constant with respect to outsourcing over the same time period.
Key considerations for the business case
Ultimately, a community bank that is evaluating whether to outsource core processing or manage it internally should include these key inputs as part of the business case:
- Self-assessment of internal capabilities, including risk/change management, operational scalability, and subject matter/support Expertise
- Estimated investment for infrastructure, equipment, and capacity
- Financial implications, including forecasts for high/medium/low cost of ownership, vendor costs, and investment