Twice in the past four months, I sat in boardrooms having what sounded like opposite conversations. The first bank was determined never to touch its core, the system works, the conversion horror stories are real, and the board wanted assurance that standing still was safe. The second was determined to replace it, the demos were impressive, architecture was modern, and the board wanted assurance that moving was safe. Each board was asking me to bless one side of the ledger and neither had priced the other side. That is the core processing market of 2026: every institution is carrying two risk books – the risk of doing something to its core, and the risk of doing nothing and almost every one prices only the book it already fears. This article is the sequel to our October digital banking series, it is about both books: where the war over your core actually moved, what the three real strategies are and why the most dangerous position in this market is not motion or stillness but drift.

War Everyone Expected Never Happened

A decade ago, industry braced for a core-replacement war: cloud-native challengers such as Thought Machine, Mambu, 10x Banking would storm the ledger, and the installed base of thirty-year-old cores would finally turn over. It did not happen, and the reason is worth stating. The Kansas City Fed’s core modernization research identifies three credible paths (1) full replacement, (2) component replacement, and (3) wrapping the existing core with modern layers and the market overwhelmingly chose the third. Our own vendor-by-vendor analysis confirms it from the supply side: of twenty-nine core vendor portfolios we classified this fall, fifteen primarily preserve a continuing ledger while modernizing hosting, interfaces, and integration around it; only ten, five cloud native challengers and five global enterprise platforms lead with replacement or bounded-domain entry and the two largest incumbents run both strategies at once. Wrapping won because the ledger is the one system whose failure is existential and whose replacement offers customers nothing they can see.

The exceptions prove the rule and they reward precise reading. JPMorgan Chase selected Thought Machine’s Vault for its US retail core a money-center budget. Arvest Bank is live on Vault at the product level, an equipment-financing lending line launched in 2023, with the broader conversion phased a product domain, not a bank. And Zions Bancorporation actually finished: its FutureCore program converted consumer lending in 2017, commercial lending in 2019, and deposits in July 2024 – eleven years, end to end. Meanwhile 10x itself now leads with a “meta core” that wraps legacy systems rather than replacing them.

And the most instructive story of all belongs to a man most readers will not have heard of which is exactly why it matters. Al Karim Somji spent two decades building Zafin, the best-known product and pricing layer that sits above the ledger. Wells Fargo, PNC, and Navy Federal run it, a whole company premised on the idea that banks do not need to replace their cores. In November 2025 he left to launch OpenCoreOS, an AI-native startup to rebuild the ledger itself. It debuted in January. By March, filings show FIS held a controlling stake; the deal was publicized in September, and Somji is now FIS’s President of Enterprise Platforms. Challenger to incumbent in roughly four months. The incumbents did not defeat core replacement by building better cores. They defeated it by making the core not the point and by buying, at speed, anyone who threatened to make it the point again.

Follow the Acquisitions Upstairs

If the ledger is settled ground, look where the incumbents are spending. FIS bought Dragonfly (corporate digital banking), Amount (account origination), and OpenCoreOS (AI-native core talent and architecture) three floors in three years and its September momentum release shows the strategy working: a newly created institution with more than $100 billion in assets took FIS as its core through M&A, five de novo banks signed in the first half of 2026, and Mercury – the fintech with conditional approval for a national charter, the same Mercury competing for your small business deposits – selected FIS as its core platform. CSI bought Apiture, Qolo, and Velocity Solutions, and explicitly pitches the stack across other vendors' cores. Fiserv bought Finxact, embedded Personetics AI in its digital platform and made the defining incumbent move of the year: CoreAdvance, a modern platform built on Premier with the best of Cleartouch and Precision folded in. Consolidating three cores into one is not a growth strategy; it is a cost and retention strategy that frees investment for the floors above. Jack Henry plays the same game in the open: its platform documentation says it is working toward integration with third-party cores alongside its own the layers as the product, the ledger as optional.

And the sellers confirm the thesis from the other side. Finastra once the consolidation story itself has been dismantling: its global core business sold, its US mid-market business – the Phoenix core, Malauzai digital, Fusion Analytics – sold to CORA Group under Constellation Software. And the buyer’s first move is instructive: CORA relaunched the estate in September as PhoenixWorx, serving 200-plus organizations a permanent-hold owner investing in a ledger for its cash flows while the growth capital, everywhere in this market, goes upstairs.

Four Floors Upstairs

What exactly is “upstairs”? Our research maps four distinct layers above the ledger, united by one buying thesis, modernize without a core conversion and each is consolidating the same way:

The consolidation pattern repeats on every floor, Fiserv bought Finxact, FIS bought OpenCoreOS, nCino bought Sandbox, Kinective bought Janusea and a fifth floor is being poured: Zafin is building AIOS, an agent operations platform to govern AI agents doing banking work. Last week’s capstone argued that the coming architecture separates AI proposals from deterministic policy from authoritative records. The vendors are already selling the floors of that building.

Three Strategies, Not One War

Strip the vendor noise away and an institution has three strategic choices, and each one carries a different risk signature.

Wrap: preserve the ledger and replace everything around it - channels, onboarding, workflow, product configuration where feasible. It minimizes conversion risk and can deliver most of what customers see; its structural limit is that a facade does not change the wrapped engine’s data model, posting behavior, or release train, so every product change still waits on the old core.

Decompose: progressively move bounded domains - deposits, lending, payments, pricing to modern platforms and retire legacy functions wave by wave. This is the Zions path, and it is the best risk-adjusted bridge for most established institutions, provided the coexistence ends.

Replace: move the system of record outright. It buys the cleanest architecture and carries the most concentrated risk and our research finds the version of the sidecar pitch belongs here too, because a sidecar is not a low-risk replacement. It is a replacement that exchanges single-cutover risk for prolonged dual-estate risk: two systems, two truths, and a growing web of synchronization that must someday be unwound.

One more finding matters before the risk discussion: the strategies converge. Incumbents now sell sidecars and componentized platforms; challengers now sell wrapping and meta-cores; global vendors sell deposits as a standalone domain. The label on the vendor tells you less than it used to. The question that still separates the paths is the one our research asks of every product: which engine is authoritative for accounts and posting, before and after each phase and what evidence shows the old one retired?

Risk of Doing Something

Start with the risk everyone already fears, because the research sharpens it in three specific ways. (1) The central conversion risk is not moving data; it is preserving meaning. Interest accrual, fee assessment, holds, availability, transaction codes, effective dates, and general-ledger mappings differ across engines - a technically flawless load can still produce economic differences after posting, which is why parallel runs and account-to-GL reconciliation are conversion controls, not project administration. (2) Cloud deployment is not modernization. A mainframe core lifted into cloud infrastructure changes location and operations, not the data model, batch semantics or the product constraints - hosted legacy and cloud-native are different architectures wearing the same word. (30 The least discussed: the straddle. Every phased migration runs a period when old and new operate together, and the straddle is only safe while every account, transaction, and data element has exactly one authoritative writer at every stage. An unfinished straddle - dual systems of record, bidirectional synchronization, an orchestrator quietly accumulating all the business rules is not a modernization program anymore. It is two cores at double the cost, with reconciliation as a permanent line item and “waiting for confidence” standing in for a retirement plan. Supervisors have noticed: Georgia’s Department of Banking and Finance explicitly directs institutions to budget for deconversion and sunsetting and to evaluate the timing of both.

Zions is the proof that the risk can be governed and the price list for governing it. Lending first, because it was less customer-visible than deposits. Thousands of simulations runs before the deposit conversion. Old and new systems in parallel for comparison. Branches migrated in waves, not one enterprise event. A full-rollout delay to 2024 when the pilot said wait, a governed delay, not a slipped one. Eleven years, thirty teams working in parallel on the final phase, and it finished. That is what “doing something” costs when it is done well. Price it honestly.

Risk of Doing Nothing

Now the book almost nobody keeps. Doing nothing is also a decision, and it increases risk on its own schedule, the vendor’s. On a consolidating platform, migration is coming whether you plan it or not: Premier, Precision, and Cleartouch institutions will converge toward CoreAdvance on Fiserv’s timeline unless the path, timing, and cost are negotiated onto theirs. On an acquired platform, the owner changes without a conversion - Phoenix banks woke up owned by Constellation, ASI banks by Banyan, Modern Banking Systems banks by Finovifi and the public record does not disclose end-of-sale or end-of-support schedules for much of the installed legacy estate, which means the letter arrives when the vendor decides it arrives. Meanwhile the compounding costs run quietly: integration fees on every third-party connection, a release calendar that constrains what you may buy upstairs, real-time payment rails pressing against overnight batch, and a shrinking bench of people who can maintain the code. And the accountability never transfers: interagency guidance is explicit that using third parties does not diminish the institution’s own responsibility - including the responsibility to have a tested exit.

Here is the sharpest way to say it: the institution that “does nothing” has, in fact, chosen the wrap strategy, it is running a preserved ledger with modern layers accreting around it but without the contract, the controls, or the exit rights that make wrapping a strategy rather than a drift. It carries Camp 1’s constraints and none of its protections. The risk of doing something is concentrated, visible, and budgeted. The risk of doing nothing is diffuse, invisible, and compounding and it is priced by someone else.

What This Means at the Negotiating Table

The practical conclusion inverts how most institutions still buy, twice over. Your core decision is no longer primarily a decision about the ledger, the ledgers work. It is a ten-year decision about which layers you will be permitted to buy competitively, at what integration cost, on whose release schedule and it is a decision you are making even when you decline to make it. Negotiate both risk books at once. Get the integration fee schedule for third-party digital, account opening, and payments vendors in writing, because that fee schedule is the core’s real price. If you are on Premier, Precision, or Cleartouch, get the CoreAdvance migration path, timing, and cost in writing before you sign anything else; if you are on DNA or PhoenixWorx, get the investment commitment. If you are contemplating any phased move, write the retirement into the plan: one authoritative writer per account at every stage, measurable exit criteria for every parallel run, and a funded date when the old core turns off. And everywhere, apply the discipline this series has repeated until it hurts: who, exactly, is live, on the version they are selling you, at your asset size, with the third-party stack you intend to run?

My final comment: the industry has spent thirty years telling itself the core is the decision that matters most, and the vendors have spent the last three proving they believe the opposite, every acquisition dollar went upstairs. Take them at their word, but do not mistake it for permission to stand still. The institutions that get hurt in this market will not be the ones that moved, or the ones that deliberately stayed. They will be the ones that never wrote down which risks they were accepting, who drifted into a wrap without exit rights, or into a straddle without a retirement date. The ledger is infrastructure; the layers are the strategy; the risk lives in both directions; and the institution that prices all of it will own its options for a decade. Tomorrow’s Sector Spotlight maps the core vendor landscape itself.

CCG Catalyst advises banks, credit unions, and fintech companies on core evaluation, vendor selection, and contract negotiation. If your institution is approaching a core decision, reach out to our team at www.ccgcatalyst.com.

See our latest announcement: CCG Catalyst’s Paul Schaus Named a 2026 Top Consultant by Consulting Magazine

By: Paul Schaus | Founder & Managing Partner, CCG Catalyst Consulting

Disclaimer: The views expressed in this article represent the perspective of CCG Catalyst Consulting based on our direct experience advising financial institutions. This commentary is intended to stimulate industry discussion and does not constitute legal, accounting, or regulatory advice.