BCBS 239 while the core banking platform is replaced
What it took at Alpha Bank London to remediate risk data and produce audit evidence while the bank moved onto a new core banking platform: a method, a cleansing pipeline, and ownership and lineage that could be shown.
Quentin Casares · · 4 min read
Most banks would rather not remediate risk data aggregation in the middle of a core banking replacement. The source systems are moving, the people who know the data are busy with cutover, and every control you document risks describing a platform that will not exist in six months. At Alpha Bank London, where I was Head of Data reporting to the Chief Operating Officer, we did not have the luxury of choosing the order. The bank was moving from IBIS to Finastra Fusion Essence, and BCBS 239 remediation, delivered in partnership with PwC, had to happen at the same time.
Start with the method, not the tooling
The temptation in a remediation programme is to start with a catalogue or a quality tool and let the work follow the product. I designed the remediation methodology and the operating model first. That meant agreeing which data mattered to risk reporting, who owned it, what quality it had to reach, and how a finding would be raised, fixed and closed. Only then did the tools have something to record.
The order matters more during a migration than at any other time. When the platform underneath you is changing, the only stable things are the decisions the data supports and the people accountable for it. An operating model anchored on those survives the cutover. One anchored on the old system's tables does not.
Cleanse the party data deliberately
Customer and counterparty records sit underneath almost every risk aggregate a bank produces, and a migration is the moment their weaknesses surface. The programme included a party cleansing pipeline that ran in twelve passes. Each pass did one job, so a reviewer could see what had changed and why, rather than trusting a single opaque transformation.
That design choice was as much about evidence as about quality. A regulator or an auditor does not only want clean data. They want to know how it became clean and that the process can be repeated. Twelve named passes can be inspected. One clever script cannot.
Make ownership and lineage visible
The third step was to establish ownership, lineage and quality in Microsoft Purview, with Collibra used alongside it to capture, measure and report governance progress. The point was not the catalogue itself. It was being able to answer, for any number in a risk report, three questions without a meeting: who owns this, where did it come from, and does it meet its quality threshold today.
During a migration those answers change week by week. Recording them in a governed tool, rather than in a spreadsheet maintained by whoever had time, meant the picture stayed current as data moved from the old platform to the new one.
Let the evidence accumulate as a by-product
The fourth step was the one the board cared about. I produced the evidence base for the Deloitte FY25 data-governance risk audit, and the audit had no material findings. That evidence did not have to be assembled in a rush at the end, because each of the earlier steps had been designed to leave a trail: the method set out what good looked like, the cleansing passes showed how the data got there, and the ownership and lineage records showed it was still true.
So don't treat audit evidence as a separate workstream that starts when the auditors arrive. Design the remediation so that doing the work and proving the work are the same activity.
What I would ask a board to check
If your bank is about to run regulatory data remediation through a platform change, four questions will tell you whether it is set up to hold:
- Is there a written remediation method and operating model that does not depend on the old system's structure?
- Can someone show how the most important reference data, usually party data, is being cleansed, step by step?
- For a sample figure in a risk report, can the owner, the lineage and today's quality be shown from a governed tool rather than from memory?
- Is the audit evidence being produced by the work itself, or is it a project that starts later?
If any of those answers is no, the programme can still succeed, but it will be relying on effort at the end rather than design at the start. That is a much harder way to reach no material findings.
If you are weighing a similar programme and want an outside view of whether it will hold, book a confidential introductory call.