Engineering Maturity Models for Regulated Financial Services

Narrative

Financial press coverage of engineering hygiene uplift in banking clusters around three threads: regulatory deadlines, the cost of not being resilient, and AI-driven productivity claims that are reshaping the underlying economics of the engineering workforce that any maturity programme has to work with.

On regulation, the EU's Digital Operational Resilience Act moved from adoption by the Council in November 2022 to full application on 17 January 2025, and now applies to more than 22,000 EU financial entities and their ICT providers, with five pillars covering ICT risk management, incident reporting, resilience testing, third-party risk and information sharing. In the UK, the equivalent pressure comes from the PRA and FCA's operational resilience regime under SS1/21 and PS21/3, which reached its transitional deadline on 31 March 2025, and from a fresh wave of 2026 policy statements (PS7/26, PS26/2, new SS1/26) creating a single UK incident and third-party reporting framework. None of this directly mandates DevOps practices, but it forces firms to produce evidence of resilience testing and incident recovery capability that DORA-metric-style telemetry is increasingly used to satisfy.

The evidentiary case for why this matters is concrete and largely came through Reuters, Bloomberg and UK parliamentary reporting rather than vendor material. The House of Commons Treasury Committee found that nine of the UK's largest banks and building societies accumulated at least 803 hours, or more than 33 days, of unplanned IT outages between January 2023 and February 2025, across at least 158 incidents, with Barclays alone expecting to pay between £5 million and £7.5 million in customer compensation for a single January 2025 mainframe-degradation outage. The July 2024 CrowdStrike incident, though not a banking-specific event, gave regulators and insurers a live case study: analytics firm Parametrix estimated banking sector direct losses at roughly $1.15 billion to $1.4 billion out of a $5.4 billion Fortune 500 total, with cyber insurance covering only 10 to 20 percent of losses, a data point since cited repeatedly in FCA and industry commentary on third-party concentration risk.

On the delivery side, Reuters and Bloomberg reporting through 2025 and 2026 documents banks treating AI coding tools as the primary lever for engineering productivity rather than classical DevOps maturity programmes per se. Reuters reported that tens of thousands of JPMorgan software engineers increased productivity 10 to 20 percent using an internally built coding assistant, against a $17 billion 2024 technology budget and 63,000-strong tech workforce, a figure that later reporting put at roughly $19.8 billion with over 40,000 engineers using AI coding assistants. Goldman Sachs CEO David Solomon told Bloomberg's Odd Lots podcast that AI could halt the decade-long rise in banks' engineer headcounts, and an internal "OneGS 3.0" memo seen by Reuters in October 2025 tied AI-driven efficiency directly to headcount constraints and limited role reductions. Citigroup's CFO cited a 9 percent productivity improvement in software development and about 100,000 developer hours saved weekly through automated code review. This is a live tension for any central standards capability: AI adoption is being reported as a headcount and efficiency story by banks' own executives to investors, which is a different frame from the reliability and change-failure-rate frame that operational resilience regulation demands, and financial press coverage has not yet reconciled the two.