Since 9 October 2025, every bank in the euro area that offers ordinary transfers has had to let customers send instant payments at any hour, for no more than a standard transfer costs, and to check the payee's name against the IBAN before the money leaves. For a bank whose core system still posts balances in an overnight batch, meeting that rule meant building a real-time layer in front of a ledger designed for a different era, and preparing its fraud team for scams that now complete in seconds. That one regulation shows how the banking trends of 2026 work: the change customers see is small, and the hard work is deep in the core systems, where the banks pulling ahead are the ones that can change quickly and safely.
The banking industry in 2026: profitable, smaller on the high street, heavier on technology
The European banking sector enters the second half of the decade in good financial shape. The European Banking Authority puts EU banks' return on equity above 10% and expects it to stay around that level through 2028 (EBA Risk Assessment Report, June 2026). The same report warns anyone counting on cost cuts: ICT is a large and growing share of banks' administrative costs, and the EBA calls the assumption that those costs will fall particularly optimistic.
The largest banks spend at a scale few competitors can match. JPMorganChase expects to spend about $19.8 billion on technology in 2026, up 10% on the year, according to its February 2026 company update. The bank told investors it is probably past its peak of infrastructure modernization and has moved the focus to modernizing application code and data, so that it is ready to benefit from AI.
Most financial institutions work with a fraction of that budget and the same list of demands: a mobile banking app customers rate, payments that settle in seconds, fraud controls that keep up with scams, AI that pays its way, and a supervisor who now asks how the bank would keep running if its cloud provider failed. After a decade of digital transformation programs, the future of banking depends less on new channels than on whether the systems behind them can change. Each of the banking trends below lands, sooner or later, on those systems.
Banking technology trends 2026 at a glance
The map places each trend on two scales a board can use: how much it will move a bank's revenue, cost or risk in the next two years, and how proven the technology and the rules behind it are. It is our judgment, based on the evidence in the sections that follow and on our work with financial institutions, not a survey.
Core banking modernization is top left: the least glamorous item on the map and the one with the most influence on the rest, because instant payments, real-time fraud scoring, AI and cloud resilience all need a core that can change. The emerging technologies with the most conference airtime, agentic AI and tokenized money, are the least proven in day-to-day banking, and appear bottom left.
1. Mobile banking is the main channel, and the branch changes its job
For most customers, the bank is now an app. In the American Bankers Association's annual survey, run by Morning Consult in October 2025, 54% of US bank customers named the mobile banking app as the way they manage their account most often, up from 26% when the survey first ran in 2017. Online banking on a laptop or PC came second at 22%, and branch visits third at 9%.
The shift now covers every age group. For the first time, baby boomers named mobile banking as their most-used channel (38%), ahead of a laptop or PC (35%, down from 41% a year earlier); among millennials the figure is 67%. Worldwide, the World Bank Global Findex 2025 counts 79% of adults with an account, with mobile money accounts behind much of the recent growth, and 84% of adults in low- and middle-income economies own a mobile phone. In most markets, digital banking on a phone is where customers open accounts as well as where they use them.
What mobile banking means for the branch network
The branch count follows the channel. The EU had 237,723 bank offices in 2008 and 122,327 at the end of 2025, according to the European Central Bank's structural financial indicators: almost half of the EU's bank branches closed in 17 years.
Some large banks are still opening branches. JPMorganChase plans to open more than 160 branches in over 30 US states in 2026 and to renovate nearly 600, and describes the network as central to its growth in new markets, including low-to-moderate-income and rural communities. The branch stays for the conversations digital banking handles badly: a mortgage, a business account, a fraud victim who wants to speak to a person.
That changes what a branch needs from technology. A banker at the desk should see the same customer history, offers and open cases as the mobile banking app and the contact center, which works only when all three read from one set of customer data instead of three channel systems. Traditional banking built a separate system for each channel; a mobile-first bank needs them to share one.
The mobile banking app is only as good as the systems behind it
Customers judge the bank by its mobile banking app, but many of the frustrations they blame on the app start further down: a balance that updates only after the overnight batch, a payment shown as pending over a weekend, a feature the bank cannot launch because the core cannot support it. A bank can redesign its app in a quarter. Whether that app can show a real-time balance is decided in the core, which is where the next trend begins.
2. Core banking modernization: the legacy problem under every other trend
Many large banks still keep their accounts on core systems built decades ago, often written in COBOL and running on mainframes. They are dependable at what they were designed for, posting transactions in large overnight batches, and they are run by small teams who know exactly how they behave. They struggle with what the banking industry now asks of them: real-time balances, products launched in weeks, APIs open to partners, and availability around the clock with no maintenance window.
The cost shows in the budget. In the EBA risk survey published in June 2026, 72% of the EU and EEA banks surveyed named core banking and payment systems as a major source of ICT spending, and the EBA expects those costs to stay, or to rise if old systems have to be replaced. Most banks have accepted that the core has to change, and the debate is about method.
Big-bang migration: what TSB's 2018 failure taught the banking industry
In April 2018 TSB moved the data for its customer and corporate services onto a new IT platform in one migration. The data itself migrated successfully, but the platform failed as soon as customers began to use it. All of TSB's branches and a large share of its 5.2 million customers were affected, across branch, telephone, online and mobile banking, and some problems lasted until December 2018. In December 2022 the FCA and the PRA fined the bank £48.65 million, on top of £32.7 million it had already paid customers in redress (Bank of England).
The regulators' findings were about governance as much as software: TSB had not organized and controlled the migration program adequately, and had not managed the operational risk of depending on its critical IT supplier. The lesson for every bank is that a core migration should never depend on everything working on the first morning. A big-bang cutover puts the risk of a decades-old system into a single event, and when it fails, it fails for every customer at once.
Progressive modernization: how Santander moved its core off the mainframe
Santander took the opposite route with Gravity, its cloud-based core banking platform, and in June 2025 completed the move of its core technology infrastructure in Spain. The method matters more than the destination. Gravity lets the bank run the same workloads on the mainframe and in the cloud at the same time and test them against live operations, and a workload leaves the mainframe only once its stability and performance are verified. Santander says the platform cut the time to launch new features from weeks to hours, and that after the rollouts in Brazil and Mexico about 80% of the group's core infrastructure will run in the cloud.
The pattern behind this approach has a name in software engineering: the strangler pattern. New services grow around the old system, a routing layer sends each function either to the old core or to its replacement, and traffic moves piece by piece until the old component has nothing left to do. Each step can be tested, measured and reversed. Our guide to the strangler pattern for application modernization explains the mechanics, and the legacy system modernization guide compares it with the alternatives.
A modern bank technology stack, from the app to the ledger
The diagram shows the layers most banks end up with, and how often each needs to change. Progressive modernization inserts a routing layer between the fast layers and the core, so the parts that need speed can move without waiting for the slowest system in the bank.
Core banking services such as accounts, deposits and the general ledger usually move last, once the product services around them no longer depend on the old core's batch timetable. Digital transformation that stops at the app leaves this layer untouched, and with it most of the cost and most of the risk.
This is the work we do at Stratoflow for banks and fintechs: we modernize business-critical Java systems step by step, with the old system running until the new path has proved itself, and without a risky rewrite. For Legerity we were the main development team on FastPost, a rule-driven accounting platform whose in-memory engine processes a billion financial transactions in under an hour in the cloud, volumes that established vendors handled in overnight batches. The engagement ran for nearly ten years, through every change the product needed, and Legerity was acquired by insightsoftware in April 2022.
3. AI in banks: measured returns in fraud and productivity, slower progress elsewhere
Artificial intelligence is on the agenda across the banking industry, and the spending is real. The Evident AI Index, which scores the 50 largest banks in North America, Europe and Asia-Pacific from public data, found that 47 of the 50 improved their scores in 2025 and that their combined AI talent pool grew 25% in a year. JPMorganChase ranked first for the fourth year running, ahead of Capital One and RBC.
The returns are harder to find. Only 25 of the 50 banks publish how many AI use cases they run, seven publish projected returns across their AI portfolio, and four publish realized returns. Three banks (BNP Paribas, DBS and JPMorganChase) publish both. According to Evident, bank leaders most often name 2026 to 2027 as the period when AI returns become material and reportable at scale.
Fraud detection and risk: where AI has paid for years
The banks that do report numbers point to the same place. JPMorganChase has put the value of its AI at $1.5 billion to $2 billion a year, much of it from fraud prevention, and in February 2026 it told investors that machine learning had improved revenue and costs for many years, particularly in marketing and fraud detection. DBS reported SGD 750 million of economic impact from more than 370 use cases, and BNP Paribas reached its €500 million AI value target and raised it to €750 million for 2026 (figures compiled by Evident).
Most of that value comes from predictive models trained on the bank's own transactions, a mature kind of AI that scores payments, credit applications and alerts at volume. It attracts less attention than a chatbot and is much easier to measure, because a fraud loss avoided or a false alert cleared has a number attached.
Customer service: the CommBank lesson
Customer service is where AI plans met reality in public. In July 2025 Commonwealth Bank of Australia announced that 45 contact-center roles would go because a new voice bot had reduced call volumes. The Finance Sector Union challenged the claim at the workplace tribunal, saying calls had in fact risen and managers were answering phones. In August the bank reversed the decision, called it an error and apologized to the staff (ABC News). The mistake was cutting jobs on a forecast before the call volumes had been measured.
JPMorganChase's account of generative AI points the same way. Jamie Dimon told investors that about 150,000 employees use the bank's large language model platform every week and believe it saves them around four hours a week, but that the bank leaves those hours out of its return calculations, because they do not show up as fewer people.
Software development: faster code, same need for review
Coding assistants are now standard in bank technology teams, and JPMorganChase lists them among its main AI deployments. Engineers use them without fully trusting them: in the 2025 Stack Overflow Developer Survey, 84% of developers use or plan to use AI tools, while 46% distrust the accuracy of the output and 33% trust it. In a regulated bank that gap is a review and testing question. Code an assistant writes still needs the tests, the reviewer and the audit trail that code written by a person needs. The same holds when AI reads and converts legacy code, a use we cover in AI application modernization.
What has not delivered yet
- Agentic AI that acts on customers' money without a person approving. Evident reports that banks still struggle to move generative AI from proof of concept to scale, and names model validation by risk teams as one of the biggest blockers.
- Headcount reduction as the business case. CommBank reversed its cuts, and JPMorganChase does not count the hours its staff save as savings.
- Enterprise-wide returns. Four of the 50 largest banks publish realized returns across their AI portfolio.
Regulation adds a deadline. Under the EU AI Act, AI used to assess the creditworthiness of individuals is classed as high-risk, with the obligations now expected to apply from December 2027, so banks using models in lending decisions need documentation, human oversight and data governance in place before then. Our advice is to put AI where the outcome can be measured and checked, to keep a person accountable for any decision that affects a customer, and to agree in advance which sensitive data a model may see.
4. Real-time payments and open banking from the bank's side
Instant payments became the norm in Europe's banking industry in 2025. In the euro area, banks have had to receive instant payments since January 2025 and, since 9 October 2025, to send them at no higher price than a standard transfer and to verify the payee's name against the IBAN before the customer confirms (European Commission). In the US, more than 1,800 financial institutions were live on the Federal Reserve's FedNow service by July 2026, three years after its launch. In the UK, open banking handled 40.16 million payments in June 2026 alone, with 18.8 million user connections and more than a billion payments since it began (Open Banking Limited).
Money arriving in seconds changes several things for the bank at once:
- The ledger never closes. An instant payment has to update balances at 3 a.m. on a Sunday, so a core that relies on a nightly batch window needs a real-time layer in front of it, or a replacement.
- Liquidity management moves to real time, because outflows no longer wait for the next settlement cycle.
- Fraud checks get seconds instead of hours. An instant payment is final once sent, so the decision to stop it has to come first.
- The API becomes a product. Under open banking, third parties call the bank's systems on customers' behalf, and the UK ecosystem publishes availability (99.80% weighted in June 2026) and response times (349 ms on average) for everyone to see.
The commercial opportunity builds on the compliance work: variable recurring payments for bills and savings (7.73 million sweeping payments of this kind in the UK in June 2026), request-to-pay, and account-to-account checkout for merchants. Our payment integration guide covers the technical side, and our fintech trends post looks at payments from the fintech side.
5. Fraud and scams: the threat moved to customers who authorize the payment
The banking industry has become good at stopping fraud it can see in its own data. In the UK, unauthorized fraud losses (stolen cards, account takeover) fell 5% to £703.4 million in 2025, and the industry prevented £1.68 billion of attempted unauthorized fraud, 70p of every pound (UK Finance, June 2026).
Scams are a different problem, because the customer makes the payment. Authorized push payment (APP) fraud rose 19% to £576.4 million in 2025, across 248,070 cases. Investment scams were the largest category at £221.5 million, up 40%. Two thirds of APP cases started online, and 17% by phone, where the scams run larger and account for 28% of losses. UK banks have had to reimburse most APP victims since October 2024; they paid back £354.3 million in 2025, 61% of losses, which turns scams into a line on the bank's own income statement.
Instant payments make the problem harder, since the money is gone in seconds. The controls that work combine data no single bank holds: payee name checks (now mandatory in the euro area), shared intelligence on mule accounts, signals from the telecoms and digital platforms where most scams begin, and models that notice a customer acting out of character in a mobile banking session, such as a first large transfer to a new investment platform during a phone call. Fraud detection is now a data-sharing problem across industries as much as a modeling one.
6. Cloud adoption under DORA: operational resilience becomes the board's job
For EU financial institutions, the cloud question changed on 17 January 2025, when the Digital Operational Resilience Act (DORA) started to apply. DORA makes the management body responsible for ICT risk, and requires banks to classify and report major ICT incidents, test their resilience and keep a register of every ICT third-party arrangement, including which providers support critical functions. In November 2025 the European Supervisory Authorities designated the first critical ICT third-party providers, whose services run from core infrastructure to business and data services, and placed them under direct EU oversight.
Under DORA a bank can use the cloud as widely as before, provided it can prove control over it. A supervisor now expects a bank to show which business services depend on which provider, to have an exit plan it has tested, and to know how it would run a critical service if a provider or a region failed. TSB's fine was partly about this: the regulators found it had not managed the risks of outsourcing to its critical supplier. Choosing a development partner is now part of the same evidence; our list of the best fintech software development companies shows what to check.
Banks that move to the cloud application by application, with each move documented, tested and reversible, produce most of that evidence as they go, and Santander's run-both-in-parallel method is a large-scale version of the same idea. Our cloud migration work for financial services follows that sequence, and our guide to the enterprise cloud covers the governance side: identity, cost ownership and exit plans.
7. Cybersecurity, regulatory compliance and sensitive data
The EBA's June 2026 risk report names cyber risk and data security, together with fraud, as the main drivers of rising operational risk in EU banks. It also raises a new concern: frontier AI language models with much greater ability to find and exploit software vulnerabilities, which banks and supervisors see as further increasing cyber risk. The share of banks hit by 11 or more cyberattacks in the first half of 2026 rose to 11%, from 7% in the second half of 2025.
That warning lands hardest on old software. Applications that have not been updated in years, running on unsupported versions of Java or other runtimes, carry known vulnerabilities that an attacker with AI assistance can now find faster. Upgrading and removing unsupported components belongs in the security budget. Our secure Java guide and the Java end-of-life dates calendar cover the specifics for Java systems.
Compliance follows the same logic. Banks maintain regulatory compliance at lower cost when the controls are part of the systems: every change traceable to a ticket and a test, access to sensitive data logged and limited to what each service needs, and audit evidence produced by the delivery pipeline instead of assembled by hand before an inspection. AI adds new questions about customer data (which data a model may see, where it is processed, who reviews its output), and they are best settled in writing before the first pilot.
8. Fintech competition and embedded finance from the incumbent's side
A decade ago, the expected story was fintechs taking the banking sector's customers. What happened is more mixed. Digital banking providers and payment firms won customers and set the standard for the mobile banking experience, and traditional banking lost ground in payments and parts of lending. But many fintechs ended up partnering with banks, selling to them or relying on them for licenses and balance sheets. The fintech side of the story, from funding to payments to embedded finance, is in our companion post on fintech trends in 2026.
For an incumbent, embedded finance means its accounts, cards or loans appearing inside someone else's product: a retailer's checkout, an accounting package, a car dealer's app. It can be a real growth channel, and JPMorganChase lists platform build-outs such as Apple Card among its 2026 investment areas. It also moves risk onto the bank. The partner owns the customer experience on its digital platforms, while the bank keeps the know-your-customer checks, the complaints and the regulator's questions.
Two capabilities decide whether a bank can play this role profitably: APIs a partner can integrate in weeks, and a core that can run many partner-branded products without a new project for each. Both lead back to the core modernization in trend 2.
The same sober view applies to tokenized money and other emerging technologies. JPMorganChase executives told investors in February 2026 that tokenized deposits look the more likely path forward, and that stablecoins may play a part in retail payments at some point, though not in the immediate future. For most banks that means following the rules as they settle (the US GENIUS Act, the EU's MiCA) and keeping a small team informed, without rebuilding the bank around them.
What bank leaders should do in 2026: a trend-by-trend checklist
The table condenses the positions above into one row per trend, for use in a planning session: the evidence, the move we would make this year, and the mistake to avoid.
| Trend | Evidence | What to do in 2026 | What to avoid |
|---|---|---|---|
| Mobile banking as the main channel | 54% of US customers use the app most (ABA, 2025) | Give the app, branch and contact center one view of the customer; show real-time balances | Judging the app by downloads instead of what customers can finish in it |
| Branch network | EU bank offices down 49% since 2008 (ECB) | Fewer, advice-led branches where the market supports them | Closing branches without moving the service they provided |
| Core banking modernization | 72% of EU banks name core and payment systems a major ICT cost (EBA) | Migrate function by function, old and new running in parallel | A big-bang cutover with no way back |
| AI in banks | 4 of the 50 largest banks publish realized AI returns (Evident) | Start where outcomes are measurable: fraud, credit risk, operations, software delivery | Cutting staff on forecast savings |
| Instant payments and open banking | Euro instant payments mandatory since October 2025 | A real-time layer in front of a batch core; run APIs as products with service levels | Meeting the deadline and leaving fraud controls for later |
| Fraud and scams | UK APP fraud up 19% to £576.4m in 2025 (UK Finance) | Payee checks, shared mule-account data, behavioural models | Relying on warnings customers click through |
| Cloud under DORA | DORA applies since January 2025 | Map business services to providers, test exit plans, migrate in reversible steps | Moving applications without the documentation a supervisor will ask for |
| Cybersecurity and sensitive data | 11% of EU banks faced 11 or more attacks in H1 2026 (EBA) | Remove unsupported software; generate compliance evidence in the delivery pipeline | Treating upgrades as optional maintenance |
| Embedded finance | The bank stays accountable for KYC and complaints behind every partner | Partner APIs and a core that configures products without a project each | Signing partners faster than compliance can onboard them |
Most of the banking trends of 2026, like most digital transformation programs before them, end in the same place: a core system that has to change faster and more safely than it was built to. Banks that modernize it in steps, with the old system running until the new path proves itself, collect the benefit of each trend as it arrives, and that is where the future of banking will be decided for most financial institutions. It is also the work we do at Stratoflow on business-critical Java systems. If your next product, regulation or migration depends on a core that moves slowly, our application modernization team can give you a written view of the steps, the risks and a ballpark cost after one scoping call.