Core banking replacement projects fail at a predictable rate. IBM’s 2026 Global Outlook for Banking and Financial Markets found that 94 percent of core modernization programs exceed their original timelines, while full replacement in regulated markets typically takes four to five years once underway (IBM 2026; Cheiffetz 2026). TSB Bank’s 2018 migration remains the cautionary case: five million customers were affected, normal service took more than 230 days to resume, and the eventual cost approached £400 million. The independent review found the causes were not exotic: inadequate testing and dependence on more than 70 third-party suppliers, much of it visible before go-live (Cheiffetz 2026).

No Saudi bank building an AI strategy today needs to relive that case study. But it also does not need to choose between replacing the core and putting a thin API wrapper around it.

The layer banking must focus on

Real-time payments, AI-driven decisioning, embedded finance, and event-driven fraud detection increasingly depend on the data and semantic layers built around the core, not on replacing the transactional system itself. A modern data fabric and unified semantic layer determine what the bank can expose to AI and how that information can be interpreted, while the core continues to provide the underlying system of record (Cheiffetz 2026). In a regulated market, the case for leaving the core alone gets stronger, not weaker, i.e., a full replacement program brings sustained elevated operational risk, heavier supervisory scrutiny, and renewed attention on third-party concentration, none of which a bank invites lightly (Cheiffetz 2026). Some institutions already run a modern layer in parallel with the legacy core for a defined set of products, building operational competency without a single disruptive cutover (Cheiffetz 2026).

Saudi banks already built half of this

Saudi banks have already built much of the plumbing AI needs. SAMA’s Open Banking framework has been in effect since February 2022, with full compliance required by June 2024, and it already requires every licensed bank to expose account and payment data through standardized APIs covering account information and payment initiation, with consumer consent and strong customer authentication built into every call (SAMA; Open Banking Tracker). None of that infrastructure needs to change with the addition of an AI agent. What changes is who, or what, is allowed to initiate a call against it, and under what conditions. A payment initiation call triggered by a customer inside the banking app carries different risk than the same call triggered by an autonomous agent acting on a standing instruction, yet the open banking framework does not distinguish between the two today. What is missing is not more APIs. It is a governed layer above them that understands what each API call means in terms of the bank’s own policies, and can decide, case by case, what an AI agent is allowed to act on without a human in the loop.

An agent that can call an API is not the same as an agent that understands why a policy allows one transaction and blocks another. The governed layer has to interpret a credit exception, a sanctions-screening hit, or a reconciliation break according to the bank’s own policies and exceptions before allowing the agent to act. The point is not to make the agent more intelligent. It is to make its authority explicit, which is also the first thing a regulator will ask to see: not how capable the agent is, but what, specifically, it was allowed to do and why.

Built around the core

This is the architecture that allows Saudi banks to introduce AI without turning AI adoption into a core replacement program. It is also the architecture CodeNinja builds with Saudi banks: engineering capability that sits above the existing core and its API layer, adding the governed decision-making an AI agent needs, without triggering a multi-year replacement program or the risk profile that comes with one. The bank’s core stays exactly where it is. What changes is what the bank can safely do with the data already flowing through it.

The core was never the constraint holding Saudi banks back from AI. The missing piece was a governed layer above it. That is a problem most Saudi banks can realistically solve in a matter of months, not through the five-year replacement programs that have defined core modernization until now. And once that layer is in place and agents begin acting through it, the next question becomes unavoidable: where does the record of what they decided go?

Schedule a Meeting

Sources 

IBM. “2026 Global Outlook for Banking and Financial Markets.” IBM Institute for Business Value, 2026.

Cheiffetz, Aaron. “Core Banking Modernization: Why Replace or Wrap Is the Wrong Question.” BizTech Magazine, 29 June 2026.

SAMA (Saudi Central Bank). Open Banking Framework. sama.gov.sa.

Open Banking Tracker. “Saudi Open Banking.” openbankingtracker.com.