Banks now take more than a year, on average, to fully implement a single regulatory change, and most are running several at once while modernising the technology underneath them (CUBE, Cost of Compliance Report 2025). Change management in financial services is the discipline of delivering transformation, regulatory change and legacy modernisation concurrently, inside a risk and compliance culture, by measuring adoption, operational performance and compliance risk while the change is still rolling out. This article is for transformation, change and operational risk leaders in banking, insurance, superannuation and asset management who are accountable for outcomes that boards and regulators will test. It argues that the sector’s real constraint is not appetite for change but visibility: most institutions cannot see whether a programme is landing until after go-live, when fixing it is slowest and most expensive. By the end you will be able to place your organisation on a three-level change maturity scale, make the case for agile delivery that risk and compliance will sign off, and define the five measures that replace narrative with evidence in a board pack.

Why financial services change is different

Financial services change is different because three loads land on the same people at once: continuous regulatory change, ageing technology, and a cap on how much risk any experiment may carry. Other sectors face one or two of these. Banks, insurers and super funds face all three, and each makes the others harder.

Regulatory change never finishes

Regulation in financial services does not arrive in waves with pauses between them. APRA’s Prudential Standard CPS 230 on operational risk management came into force on 1 July 2025 for authorised deposit-taking institutions, general and life insurers, private health insurers and superannuation trustees, with existing service provider contracts brought into line by the earlier of renewal or 1 July 2026 (APRA). The EU’s Digital Operational Resilience Act began applying on 17 January 2025 across 20 types of financial entity (EIOPA). In the same period CUBE logged 157 new laws and rules on AI in financial services, almost double the previous year, and 60 percent of the 2,000 compliance and risk officers it surveyed expect regulatory change costs to rise again (CUBE).

The practical effect is a permanent queue. A change team finishing one compliance programme usually inherits the next before the first has bedded in.

Legacy technology absorbs the change capacity

The second load is technology. Accenture’s 2026 banking trends report found that about 70 percent of bank IT budgets are consumed by maintenance of technical debt, and that software costs have grown by an average of 8 percent a year since 2017, outpacing revenue growth (Accenture). That leaves a small slice of investment for the modernisation that customers, regulators and shareholders are all asking for.

For change leaders the consequence is less about money than about people. Modernisation programmes often depend on the same product owners, operations teams and subject matter experts who are already carrying regulatory deadlines. Every new programme draws on a shared pool of attention that nobody is measuring.

Concurrent programmes compete for the same frontline

The third load is concurrency. A branch manager, claims assessor or relationship banker may in a single quarter absorb a CPS 230 control uplift, a new lending platform, a policy rewrite and a restructure. Each programme tracks its own readiness. Nobody tracks the total. This is the heart of the saturation problem, covered in more detail in managing change saturation, and the mix of change types behind it is mapped in financial services transformation: eight core types.

Unlike a retailer or a manufacturer, a financial institution cannot treat a failed compliance transformation as a project miss. It carries regulatory penalties, remediation costs, customer trust and sometimes shareholder value, so the standard for evidence is higher.

The regulatory pressure cooker

Regulatory pressure shapes financial services transformation because it consumes most of the change budget and sets the sequencing of everything else. Boston Consulting Group found that banks spend 40 to 60 percent of their change budget on regulatory compliance, and that a significant part of that spend is inefficient because of sequential, waterfall delivery (BCG, When Agile Meets Regulatory Compliance, 2017). The share is the most-quoted quantification of the problem, and the 2025 data suggests the underlying dynamic has not eased.

The tension for transformation leaders

This creates a first tension that every transformation leader in the sector recognises. How do you fund modernisation when the majority of resources go to compliance? How do you hold momentum for a digital programme when a new directive resets priorities every few months? And how do you judge success when the regulatory requirement was met on time but the behaviour change that makes the control real never happened?

CUBE’s survey shows the scale of the execution gap. Fully implementing a regulatory change takes more than a year on average, 21 percent of respondents rate their regulatory change management as somewhat or highly ineffective, and only 16 percent report potential regulatory change directly to their executive team or board (CUBE via Wealth Briefing).

Compliance completion is not compliance behaviour

Institutions at lower maturity often stumble because they lack integrated visibility into how regulatory changes cascade through the transformation portfolio. They can complete a compliance programme on schedule and still have no view of downstream operational impact, adoption or whether the risk was actually remediated. A control that exists on paper but is bypassed by a manual workaround is the usual failure, and it tends to surface in an audit or an incident, not in a project status report.

More mature organisations build change tracking into their compliance processes. They separate two questions: did we deliver the control, and did people change how they work because of it? The second question is the one regulators increasingly ask, and the one the governance model for financial services is designed to answer.

The agility paradox: Risk as guardrail, not gate

Agile change management can work in a regulated bank or insurer when risk and compliance are built into every increment of delivery rather than applied as a final approval gate. The same environment that demands caution also demands speed, because regulation itself has become iterative and complex.

Why sequential projects fail against moving rules

MiFID II began as an 80-page level 1 text and expanded to more than 5,000 pages at implementation level (BCG). Sequential approaches assume the requirement is certain before build starts, and in this sector it rarely is. BCG estimated that properly governed agile delivery could reduce IT spending on compliance projects by 20 to 30 percent while improving on-time delivery.

Many boards remain sceptical, and the scepticism is not irrational. A technology firm can run experiments at speed. A fintech can pivot. A bank cannot without regulatory comfort, compliance sign-off and governance endorsement. Ironically, the rigidity designed to protect stability often produces slower time-to-market, higher cost and strategic misalignment when external conditions shift.

Making agile acceptable to the second line

The way through is to reimagine risk management, not to abandon it. Agile risk management means agile-specific risk assessments and continuous monitoring that embed compliance checks at every step, rather than at the end. In practice that means:

• Risk, compliance and the business sit in the same cross-functional team from sprint zero.
• Control objectives are written as acceptance criteria for each increment, so evidence is produced as work is done.
• Release decisions use agreed risk thresholds rather than a single end-of-project sign-off.
• Change impacts on frontline teams are assessed per release, not once at the start. The agile change management in the AI era article covers how to keep this practical.

This turns risk management from a gate into a guardrail.

From second line of defence to design partner

It also requires a cultural shift for risk and compliance functions. They must move from a second-line mindset in which they audit and approve to a design-partner mindset in which they collaborate from day one. Institutions with higher change maturity consistently do this better, because they have embedded risk and compliance perspectives into change governance from the start rather than at the approval stage.

The cultural challenge: Risk-aversion meets innovation

Risk-averse culture is the hidden barrier in financial services transformation because the same instincts that protect customer deposits also make experimentation feel dangerous. Conservative decision-making, extensive approval chains and multiple layers of governance evolved for good reasons. They have also built institutional muscles that resist testing.

Accountability has become personal

That culture is now reinforced by regulation. Australia’s Financial Accountability Regime applies to authorised deposit-taking institutions from 15 March 2024 and to insurers and superannuation trustees from 15 March 2025, and it is designed to improve risk and governance cultures through a strengthened accountability framework for entities and their senior executives (APRA; ASIC). When an executive is personally accountable for a change outcome, appetite for visible experimentation understandably drops.

A technically excellent transformation can stall because the institution’s cultural immune system rejects change it perceives as risky. Conversely, a transformation that wins buy-in by positioning itself as low risk may lack the ambition to change anything.

Risk-aware innovation

Leading institutions create controlled experimentation frameworks, sometimes called risk-aware innovation. The pattern is consistent:

1. Test in a sandbox or limited cohort with defined exposure.
2. Set explicit guardrails and monitoring before launch.
3. Agree in advance what degree of failure is acceptable in pursuit of learning.
4. State the trade-off openly: a marginal increase in risk here to capture an opportunity there, with the mitigation named.

The transparency matters as much as the sandbox. Regulators and boards are far more comfortable with a measured, documented risk than with an undisclosed one.

Treat resistance as data, not as a communications problem

This is also where maturity differences show most clearly. Lower-maturity organisations treat cultural resistance as an engagement problem to communicate away. Mature organisations read it as a signal of misalignment between stated strategy and actual incentives, governance structures and decision rights. They use change data, such as adoption patterns, sentiment and participation, as diagnostic tools to surface those tensions and address them directly.

Change maturity: The predictor most programmes ignore

Change maturity is a stronger predictor of transformation success in financial services than budget, sponsorship or project management rigour, because it determines whether anyone can see and correct problems while the work is under way. Institutions sit on a spectrum, and the CUBE data shows why tooling alone does not move them along it: 98 percent of respondents have some automation in regulatory change management, yet 21 percent still rate their process as ineffective (CUBE). The distinguishing factor is how change data is used, not whether it exists.

The three levels

• Level 1, project-centric. Change is an overlay during a project. A team is assembled, engagement campaigns run, and the team disperses at go-live. Nobody tracks whether changes stick, adoption plateaus or benefits are realised.
• Level 2, governance-integrated. Change is part of project governance and practitioners are trained. Measurement is qualitative: surveys for adoption, workshop attendance for engagement, spot checks for compliance. Leaders cannot reliably tell a programme that looks on track from one that is failing without anyone saying so.
• Level 3, data-driven operations. Change is a continuous operating discipline. Adoption metrics reflect behaviour, not logins. Operational performance is tracked against baseline, compliance risk is forward-looking, and financial impact is checked against business case assumptions in real time.

What Level 3 looks like in practice

The most mature institutions integrate these streams into one view that supports diagnosis, not just description. If adoption in a division is 65 percent, the question is why: a training gap, a process design flaw, misaligned incentives, cultural resistance or weak leadership communication? Each has a different fix, and a leader armed with diagnostic data can intervene precisely.

They also distinguish the expected J-curve dip, where performance falls before it improves as teams learn new processes, from structural degradation that needs action. Their capability often goes unrecognised externally. Peers see the results and attribute them to better technology or luck, when the cause is a deliberate investment in making change visible. The foundations are laid out in why change maturity matters and how to build it.

A worked example: One control uplift at three levels

Take an illustrative case: a mid-sized insurer uplifting its operational risk controls and service provider management to meet CPS 230. At Level 1, the project team documents the new controls, runs briefings for process owners and closes the programme at the regulatory date. Whether claims or procurement teams actually follow the new steps is discovered at the next internal audit. At Level 2, the team adds a readiness survey and a training completion report, which is better, but both measure intent and attendance, not behaviour.

At Level 3, the insurer tracks the control in use: how many contract renewals went through the new due diligence step, which teams still approve suppliers through the old email route, and how long the new step adds to cycle time. When one division lags, the data shows whether the cause is workload, unclear ownership or a poorly designed form. The programme closes with evidence that the control operates, which is what a supervisor will ask to see.

What boards and regulators need: Evidence, not narrative

Senior leaders and boards in financial services need operational evidence of risk and impact, not change management frameworks or engagement scores. They want to know whether the transformation is on schedule, where adoption is stalling, what the effect on operational performance is, whether compliance is at risk and what return the investment is producing. Only 16 percent of compliance and risk leaders report potential regulatory change directly to their executive team or board (CUBE via Wealth Briefing), which suggests much of this information is not reaching the people who need it.

Five measures that replace narrative

Operational leaders in the sector think in a distinct vocabulary. These are the five measures to put in front of them:

1. Regulatory risk. Which processes remain misaligned with requirements, what is the remediation timeline, and what is the forward-looking exposure as systems and processes change?
2. Operational performance. How steep is the J-curve, how long will it last, and which signals mean intervene?
3. Adoption velocity. Not only whether people use the new system but at what pace and proficiency, which groups lag, and which steps are bypassed with manual workarounds.
4. Financial impact. Cost savings, revenue from faster time-to-market and reduced rework, tracked in real time against the business case.
5. Risk incident frequency. Whether the transformation is introducing new operational risk: error rates, compliance incidents, early warnings of instability.

Why the data usually does not exist

Most programmes track adoption at process level but not operational performance at transaction or customer level. They record compliance status historically, not as a forward-looking view. They report milestones, not business impact. Without the data, leaders decide on narrative and intuition, and cannot tell a programme that is tracking well but communicated poorly from one that appears on track while masking emerging operational risk. In financial services, discovering the second case at go-live rather than during implementation is exponentially more costly.

How change management software supports transformation

Change management software supports financial services transformation by turning adoption, readiness, impact and compliance exposure into a continuous, shared data set that leaders can act on before go-live. Rather than relying on periodic surveys, workshops and engagement tracking, platforms instrument the transformation to capture continuous signals. Their relevance has grown as regimes like CPS 230, which requires entities to identify, assess and manage operational risks with effective controls, monitoring and remediation (APRA), expect evidence of oversight rather than assertions of it.

What effective platforms capture

• Change management metrics and success measurement. Dashboards that track whether transformations deliver intended outcomes, moving from activity metrics (people trained, workshops held) to outcome metrics tied to adoption velocity and business impact.
• Change monitoring and readiness assessment. Continuous readiness for change by department, team and role, so support goes where it is needed before go-live rather than after problems appear.
• Change tracking and analysis. Operational, financial and compliance position of each change, integrated with operational data to indicate what is driving adoption patterns and which interventions will work.
• Performance metrics and analytics. Correlation of adoption with operational performance, compliance risk and financial outcomes, answering questions such as whether 75 percent adoption in a division is sufficient.
• Strategy alignment and initiative orchestration. Connecting individual initiatives to the wider strategy so leaders see how concurrent changes interact, compound or conflict. This matters in a sector juggling dozens of regulatory and technology changes simultaneously.
• Assessment and challenge identification. Early surfacing of skills gaps, process misalignments, governance mismatches and resistance, while leaders can still act.

Embedding change data in the operating rhythm

The decisive difference among mature organisations is that they do not treat this as optional project reporting. Change measures feed monthly leadership reviews. Alerts fire when adoption thresholds are breached. Compliance risk is assessed continuously, and financial impact is tracked against projections with course correction when they diverge. IAG’s change governance team describes this kind of data-led approach in a large insurer.

When a regulatory change rolls out, leaders see whether behaviour is really changing or whether people are working around it. When agile teams experiment, leaders see whether the risk envelope is holding. When a cultural programme runs, they track sentiment and behavioural adoption instead of waiting for a survey that arrives months after the decisions were made. The software is valuable not because it is clever but because it makes visible what was previously invisible.

Building credibility with regulators

This data infrastructure has a second function in the sector: it builds credibility with regulators. When a supervisor asks about a major transformation, the question underneath is whether leadership has genuine visibility of operational risk and compliance impact. Real-time transformation metrics show leadership is monitoring and managing the change, not hoping it works. In a regime where accountable executives are named, that evidence matters to the individuals as much as to the institution.

A digital tool for change visibility

For organisations ready to move from project reporting to this kind of operating discipline, purpose-built platforms such as Change Compass provide the integrated view of change impact, load and adoption across a portfolio, so that decisions about sequencing, capacity and intervention rest on evidence. The benchmark for the sector is no longer a well-run project; it is a transformation portfolio managed with the same rigour as financial or operational performance.

Systems thinking: Five data streams in one operating model

The shift from reporting to operating discipline rests on integrating five streams of data rather than collecting them in parallel. Adoption data goes beyond login frequency to whether processes are followed correctly and deliver the intended outcome. Operational data tracks speed, accuracy, error rates and compliance breaches against baseline as the change lands. Risk data gives forward-looking signals about exposure, process gaps and vulnerabilities the transformation itself introduces. Financial data compares actual cost and revenue impact with the business case. Sentiment and engagement data provides early warning of resistance or leadership misalignment.

On their own each stream describes. Together they explain. The organisations that perform best embed this combined view into how decisions get made, in monthly reviews, investment committees and risk forums, instead of keeping it as a parallel reporting activity run by the change team.

Setting the industry standard

Institutions at the top of this maturity range have stopped trying to choose between risk-aversion and innovation. They designed transformation so that risk management, compliance oversight and governance run inside the rhythm of change rather than in sequence after it. They treat controlled experimentation as a core capability, not an exception to risk doctrine, and they regard every transformation as partly a data problem: the work is to understand change in real time, at the granularity and speed senior leaders and supervisors expect.

The practical lesson for any leader in a regulated sector is that maturity is built through systems and decision infrastructure, not through more training sessions or a longer methodology document.

Frequently asked questions

Why is change management harder in financial services than in other industries?

Financial services runs transformation and regulatory change at the same time, inside a risk and compliance culture built for control. A single regulatory change takes more than a year to implement on average, and regimes such as APRA CPS 230, DORA and the Financial Accountability Regime add personal accountability for senior executives. A failed change can mean regulatory penalties and lost customer trust, not only lost money.

How much of a bank’s change budget goes on regulatory compliance?

Boston Consulting Group found that banks spend roughly 40 to 60 percent of their change budget on regulatory compliance. Much of that is inefficient when delivered through sequential, waterfall projects. The same analysis found agile approaches, properly governed, could cut IT spending on compliance projects by 20 to 30 percent while improving on-time delivery.

Can agile work in a regulated bank or insurer?

Yes, if risk and compliance are built into delivery rather than added as a final approval gate. Cross-functional teams that include risk, compliance and the business can release in small increments while controls are tested at every step. This turns risk management from a gate into a guardrail and keeps the audit trail regulators expect.

What should financial services leaders measure to know a transformation is working?

Track outcomes, not activity. The five measures that matter are adoption velocity (correct use of the new process, not logins), forward-looking regulatory risk, operational performance against baseline, financial impact against the business case, and new risk incidents introduced by the change. Linking them in one view lets leaders diagnose why a division is lagging and intervene precisely.

What are the levels of change maturity in financial services?

There are three broad levels. At the project-centric level, change management is an overlay that disbands when the project ends. At the governance-integrated level, change is part of project governance but measured mainly through surveys. At the data-driven level, change is a continuous operating discipline with real-time visibility of adoption, compliance risk, operational performance and financial return.

Building the transformation financial services needs

Delivering on time and on budget is no longer enough in this sector. The programmes that earn their place are the ones that move adoption at pace, hold operational performance through the transition, manage compliance ahead of the deadline, show a return against the business case and leave the organisation better prepared for the next round. That is an operating discipline more than a project skill, and it depends on a view of the whole portfolio, not one programme at a time.

Start with an honest placement on the three maturity levels, then pick the one measure from the five above that your board cannot currently see. Make that visible first, and use it to build the case for the rest. Institutions that do this are better able to hold regulatory deadlines, concurrent modernisation and a cautious culture in the same plan, because they can show where each is landing while there is still time to adjust.

References

• CUBE (2025). CUBE launches industry-leading Cost of Compliance Report 2025, highlighting role of AI in tackling global regulatory complexity. The AI Journal, 6 November 2025.
• Wealth Briefing (2025). Compliance Corner: Regulatory change management costs seen rising. 6 November 2025.
• Accenture (2026). Top banking trends for 2026.
• Australian Prudential Regulation Authority. Operational risk management (CPS 230).
• Norton Rose Fulbright (2025). Now in force: APRA CPS 230 Operational Risk Management. Regulation Tomorrow, 2 July 2025.
• European Insurance and Occupational Pensions Authority. Digital Operational Resilience Act (DORA).
• Australian Prudential Regulation Authority. Financial Accountability Regime.
• Australian Securities and Investments Commission. Financial Accountability Regime.
• Boston Consulting Group (2017). When Agile Meets Regulatory Compliance.