Engineering Maturity Models for Regulated Financial Services

Narrative

Academic and preprint coverage of engineering maturity in regulated financial services is thin and lags the practitioner literature by several years. The clearest finding across multiple 2024-2026 papers is a near-total absence of peer-reviewed, tier-1 venue research on the tools banks actually use. A 2026 Frontiers multivocal literature review of platform engineering and internal developer portals found only two peer-reviewed tier-1 papers on the topic globally and reported that "arXiv, which typically captures early-stage computer science research, returned zero directly relevant results," while noting that scorecards, the primary IDP governance mechanism, have "no peer-reviewed empirical evidence of effectiveness exists despite widespread commercial adoption". The same review found the only large-sample empirical evidence on platform engineering's effect on delivery outcomes comes from DORA's own 39,000+ respondent survey programme, not independent academic work, and flagged self-reported vendor and survey data (Spotify, Puppet) as Tier C/D evidence.

DORA's own metric set is well documented as evolving rather than fixed: the framework's history moved from four keys in 2014 to five by adding "reliability" and later replacing MTTR with a Failed Deployment Recovery Time measure, a debunking early in the research that change fail rate did not initially correlate with a single "IT performance" construct. Recent arXiv work extends or critiques the four/five-key model directly: a 2026 paper on "Measuring Delivery Consistency in Practice" argues DORA's dashboard cannot distinguish steady-cadence from unpredictable release patterns even when deployment frequency and change failure rate are identical, and proposes a deployment-consistency metric tested on 120 weeks of multi-platform release data. A separate ACM paper on automated DORA metrics computation notes that "research on automated DORA metrics is still scarce, apart from a few industrial proofs of concept," and validates an open-source measurement pipeline against a 37-microservice case study. DORA's most recent (2024-2025) research on generative AI, cited in several 2025-2026 arXiv papers, found that AI adoption raises individual effectiveness and throughput but is associated with a measurable reduction in delivery stability at team level, described as AI acting as "an amplifier, magnifying existing organisational strengths and weaknesses" rather than a uniform improvement.

On capability-level models, TMMi has the strongest financial-sector-specific empirical base: a peer-reviewed study surveyed sixty financial institutions (banking, insurance, pension funds) globally on test maturity and reported that the most common achieved level was TMMi Level 3 ("Defined"), with financial institutions reporting benefits concentrated in software quality and testing productivity and near-universal parallel use of test automation, especially at system level. CMMI evidence in financial services is largely case-study and ROI-framing work rather than large-sample studies; one exploratory case study quantifies CMMI's return-on-investment impact but at a single organisation, and broader CMMI-appraisal literature (SCAMPI-based) remains dominated by government-contracting contexts rather than banks. SAFe and Team Topologies have a moderate academic literature, mostly critical: a 2022 ICSE-SEIP paper on SAFe adoption issues, based on 25 respondents from seventeen companies in eight countries, found SAFe "subject to criticism: it appears to be quite demanding and expensive," and a 2023 arXiv empirical comparison of scaling approaches found SAFe holds roughly 53% market share among agile-scaling frameworks yet is contested on effectiveness grounds. A 2025 ScienceDirect paper analysing a SAFe case study frames the core tension as balancing organisational alignment, team autonomy, and control, which maps directly onto the central problem for a central standards capability that does not own delivery teams.

The evidence on AI-assisted coding tools in enterprise settings, directly relevant to the 2026 end of this lane's date range, is now a fast-growing arXiv sub-literature. Papers such as "The Fast and Spurious: Developer Productivity with GenAI" and "Debt Behind the AI Boom" report that Google and Microsoft disclosed AI now writes over 20% of new code in 2025, and that AI-generated code shows measurable maintainability and defect-injection issues even as individual throughput rises, corroborating rather than contradicting DORA's stability-versus-throughput finding. METR's HCAST and RE-Bench benchmarks, while not focused on financial-services delivery, are the most rigorous available empirical instruments for measuring what autonomous coding agents can actually do unsupervised, relevant background for anyone evaluating AI-assisted delivery risk; METR's own research finds the length of tasks models can complete autonomously has been "consistently exponentially increasing... with a doubling time of around 7 months."