Why banks need to leave their comfort zone
Customers, trust, capital, data, licences and distribution: what keeps most banks from using them is nerve, not capability.
A bank holds a set of assets that most companies spend a decade trying to build: an existing base of paying customers, decades of accumulated trust, a balance sheet that can absorb real risk, more transaction data than any single competitor, a licence that lets it hold other people's money, and distribution reaching into nearly every household and business it already serves. Most of that bank is organised around one job: defending the handful of products it currently sells to the customers it already has.
The list fintechs would kill for
None of those six assets is scarce inside a bank. A fintech spends years, and a large share of its funding, trying to acquire the first three: customers, trust and capital. A regulator can take the better part of a decade to hand over the fourth, a licence. The fifth, data, compounds every day a bank keeps operating, whether anyone inside the bank actually uses it or not. The sixth, distribution, is the one incumbents talk about least and depend on most: a branch network, an app already on millions of phones, business banking relationships that reach into a company's payroll and its supply chain.
The uncomfortable part is not that banks lack these advantages. It is how narrowly most of them choose to use them.
Why most banks stop at protecting
Protecting the core is not, on its own, a mistake. A bank's first obligation is to defend the deposits, cards and loans it already runs, against churn, against fraud, against a new entrant undercutting it on price. What turns protection into a trap is when it becomes the only stage the organisation is actually resourced and governed to execute.
Capital markets divisions offer a visible version of the pattern. Celent's research on bank technology spending found that 56% of IT budgets went to running the existing business rather than changing it in 2023, falling only slightly to 53% in 2024, before reaching a 50/50 split with change spending in 2025, according to Celent (1). That is not a technology constraint. It is where governance, risk appetite and career incentives point: a team that keeps the lights on rarely gets exposed the way one that ships something new, and watches it fail, does.
The same logic runs through the rest of the bank. A programme that extends the franchise into a new product, opens the bank's infrastructure to outside brands, or backs a venture with the bank's own balance sheet, asks for a different kind of sponsorship than one that patches the core. It needs an executive willing to be accountable for something that might not work, and a governance process built to fund exploration rather than just control risk. Most banks have the first kind of sponsorship in abundance and the second kind almost nowhere.
The playbook: protect, extend, platform, ecosystem
Aulay's view is that the move out of pure defence runs through three further stages, each building capability the next one needs.
Protect defends the core: the existing accounts, cards and loans, against churn, fraud and price competition. It is necessary, and on its own, insufficient.
Extend puts a genuinely new product in front of customers, usually under a distinct brand, still owned and run end to end by the bank. It tests whether the organisation can build and ship something outside its existing product set at all.
Platform turns that capability into infrastructure other companies can build on: the bank keeps the licence and the balance sheet, and lets a non-bank brand own the customer relationship on top of it. It requires giving up something the bank has never had to give up before: exclusive control of who the customer thinks they are banking with.
Ecosystem goes further still: instead of only licensing the infrastructure, the bank builds or takes a stake in the businesses that sit on it, deliberately creating something bigger than a single balance sheet under one brand.
One bank's two stages, another bank's leap
NatWest has run the first two stages in sequence, on the same underlying capability. It piloted Mettle from 2018 as an app-only digital account for freelancers, sole traders and small businesses: a separate brand, but still a conventional bank product built and owned entirely by NatWest. Mettle then grew fast on its own terms, with customer numbers up 500% and deposits up 600% in the year to March 2022, reaching 50,000 business customers and around £2 billion in processed transactions since January 2021 (2). That is Extend: proof the organisation could build and scale something genuinely new, still inside its own four walls.
NatWest then took the further step of turning the same infrastructure into a service for other companies' brands. NatWest Boxed, its banking-as-a-service division, signed the AA as its first client in February 2025, launching an FSCS-protected savings account under the AA's own brand that March, with NatWest underwriting behind the scenes (3). By July, it had signed Saga to a seven-year partnership to build savings products for the over-50s market, again under Saga's brand (4). That is Platform: the same licence and balance sheet that once served only NatWest customers now serve customers who may never open a NatWest app.
Standard Chartered has gone one stage further, through SC Ventures, its venture-building arm. It launched Mox Bank in Hong Kong in September 2020, in a consortium with PCCW, HKT and Trip.com (5), and Trust Bank in Singapore in September 2022, with FairPrice Group and its parent NTUC (6). SC Ventures now describes running more than 20 portfolio companies across Asia, Africa and the Middle East (7), not licensing its infrastructure to a partner brand but co-building or taking stakes in entirely new consumer businesses. The ventures themselves sit outside the UK, but the group is London-headquartered and LSE-listed, and the underlying logic, a bank's licence and balance sheet used to build ownership stakes in new consumer businesses rather than just serve its existing ones, applies as directly to a UK or European banking group weighing the same choice.
The turn
None of the four stages above requires a capability most large banks actually lack. What separates a bank still stuck at Protect from one that has reached Platform or Ecosystem is not headcount, technology spend, or even regulatory appetite in the abstract. It is whether the organisation is willing to give something up in the short term, direct control of the customer relationship, exclusivity over the products it built, a slice of the fee income it currently keeps whole, in exchange for reach it cannot get any other way.
That is a different question from “can we build this.” It is “who gets to sponsor a bet that might not work, and what happens to them if it doesn't.” Most banks have solved the first question. Very few have solved the second.
Aulay's point of view
Transformation programmes rarely fail for lack of ambition. They fail because Extend, Platform and Ecosystem moves are asked to compete for funding and sponsorship against Protect work that never has to justify itself on the same terms. Fixing that is a governance problem before it is a technology or product one: give the later stages a mandate, a budget line, and an executive who answers for outcomes the same way the core business does, rather than running them as a side project that gets cut the moment the core needs the money back.
If you are trying to work out which of the four stages your organisation is actually resourced to execute, and where the real constraint sits, get in touch.
References
1. Celent, “Spend Strategically: Findings from Celent's Dimensions: IT Pressures & Priorities 2025 Series,” 2025. Capital markets IT budget share spent “running the business”: 56% (2023), 53% (2024), reaching a 50/50 split with “change the business” spending by 2025.
2. Crowdfund Insider, “UK's Mettle, The App-Only Business Bank, Reports 500% Customer Growth Since Early 2021,” 29 March 2022. Mettle's customer, deposit and transaction growth figures, and its 2018 launch.
3. Embedded Finance Review, “NatWest Boxed reveals first client: Embedded Finance for 14m British consumers,” 21 February 2025. AA named as NatWest Boxed's first client; savings account launch end of March 2025.
4. Yahoo Finance (wire), “NatWest Boxed, Saga partner to offer tailored savings for over-50s,” 14 July 2025. Seven-year partnership between NatWest Boxed and Saga.
https://finance.yahoo.com/news/natwest-boxed-saga-partner-offer-114105988.html
5. Standard Chartered, “Announcing the official launch of virtual bank Mox in Hong Kong,” press release, 22 September 2020. Consortium partners PCCW, HKT and Trip.com.
https://www.sc.com/en/press-release/weve-officially-launched-a-new-virtual-bank-mox-in-hong-kong/
6. FairPrice Group / NTUC, “FairPrice Group and Standard Chartered Launch Trust Bank, Singapore's First Digital Bank,” press release, 1 September 2022.
7. SC Ventures, “About,” accessed September 2026. More than 20 portfolio companies across Asia, Africa and the Middle East.
Frequently asked questions
- What does “leaving the comfort zone” actually mean for a bank?
- It means giving Extend, Platform and Ecosystem initiatives the same governance, funding and senior sponsorship that Protect work already receives, rather than running them as side projects that lose funding the moment the core business needs it back.
- Do banks have to move through Protect, Extend, Platform and Ecosystem in strict order?
- Not by rule, but each later stage tends to depend on capability the one before it built. NatWest ran Mettle as an Extend product for several years before turning the same infrastructure into the Platform business NatWest Boxed.
- What actually separates a platform bank from an ecosystem bank?
- A platform bank licenses its infrastructure, letting another company's brand front the customer relationship, as NatWest Boxed does for the AA and Saga. An ecosystem bank goes further and builds or takes ownership stakes in the businesses sitting on that infrastructure, as Standard Chartered has done through SC Ventures.
- Does reaching the platform or ecosystem stage mean giving up the customer relationship?
- Largely yes. In both NatWest Boxed's partnerships and Standard Chartered's Mox Bank and Trust Bank ventures, the partner brand fronts the customer relationship while the bank retains the licence and the balance sheet underneath it.