Okay, disclosure first and then intro. For important disclosures, please see Morgan Stanley Research Disclosure website at morganstanley.com/researchdisclosures. The taking of photographs and use of recording devices is also not allowed. If you have any questions, please reach out to your Morgan Stanley sales representative. Okay, with that as a backdrop, I am thrilled to have with us today Bridget Engle, Chief Information Officer and Head of Engineering at BNY Mellon. Thanks so much for joining us.
Thank you for having me.
Bridget, you've had a very varied experience in technology in a variety of different financial organizations, and BNY Mellon has just so many different parts of all of those threads, wealth, global markets, you know, payments, et cetera. I think you've talked openly about some resiliency challenges that were faced by BNY Mellon when you joined. When was that? In 2017.
Yep, yep.
You have made massive modernization investments in the plant equipment here at BNY Mellon. If you could just give us a sense as to where you are on the resiliency journey, and maybe you could also describe what resiliency really means to you, it would be helpful. Where do you feel your investments have already paid off?
Sure. First of all, what does resiliency mean to me? I use maybe it's a little bit dating myself, but I say dial tone, right? We have to make sure that for our clients, there is a dial tone every time you pick up the phone. Everything that goes into making sure bad things happen, oftentimes the CEO or our board don't necessarily want to hear, you know, that there was a problem, but unfortunately, technology fails, software fails, hardware fails, and so each one of those pieces has to make sure it picks up. A lot of that, oftentimes, I say, goes to a question of imagination. Can you imagine all the things that can possibly go wrong, and can you put, you know, different mitigants in place to actually overcome that?
Yes, you know, I think, when I think about when I arrived, I wasn't sure I had the disclosure. There was an enormous book of work that I had when I walked into the bank, when I joined five years ago, and, you know, end of life hardware, software, inconsistent software and data, and frankly, just too many high priority incidents that were impacting our clients. We made significant investments to upgrade our infrastructure, and back then, we were spending roughly about two and a half billion dollars, and over the course of the years, that has risen to, last year, three and a half billion dollars in terms of our investments. A lot of what we went into was evaluating where we were and how much resiliency we had.
One of the things we made an active decision to do was to add another data center into our footprint, because we had two, but in order to get the kind of real-time resiliency we needed, we needed a data center that was within, if you will, a 30 mi radius, roughly thereabout, but that was because we wanted to have data replication. That's important to make sure that we can recover our transactions from a real-time perspective. Adding additional you know, data center into the footprint. We also invested in effectively rebuilding all of our infrastructure. We basically kind of, if you can imagine, put up a wall, and we took new floor space, and we laid out our whole architecture for the physical plant and the data centers, and we set them up in neighborhoods for each of our businesses.
We did that with a very intention sort of point of view, that we wanted to make sure that we had isolated pockets. I often describe it as a submarine or a battleship. If one of those were to take a missile or have something go wrong, you can shut off the compartments and contain the water from spreading into other parts of your businesses. By having these neighborhoods, as we set up the infrastructure, that allowed us to have a lot more agility and to really reduce the surface area of problems should they occur. The other thing, when we went about doing this, we didn't build in traditional hardware.
We went after software-defined IT infrastructure that was largely a hyper-converged infrastructure that allowed us to have a private cloud context within the businesses in terms of what we had. Then, as a part of that, we went through, and we assessed all of our applications that were in our distributed portfolio, and we virtualized over 95% of them in either containers or in virtual machines, VMware, those kinds of technologies. The reason for that was it gives you a great deal of agility. In today's world, one of the biggest challenges we all talk about is cyber, right? Log4j was something that was out there. It's a vulnerability, but they didn't get it right.
We wound up patching, you know, multiple times in terms of having to patch across the environment, and having those virtualized, containerized environments gave us a great deal of agility without the risk of kind of hurting our systems or taking them down. The other thing we invested in was enhancing our monitoring. Oftentimes, you know, we have signals or signals intelligence, right? Kind of like the intelligence community uses. All of the telemetry from our infrastructure, we brought into our monitoring ecosystem, and we visualized that in our CTOC, which is our Cyber Technology and Operations Center, that sits on our executive floor. It's got a beautiful 106 ft digital screen. Really it was democratized.
that was previously locked up, and I sometimes talk about it as like, you know, doctor, you know, the orthopedic, you know, has his specialty, the heart doctor has their specialty, and they all have their tools. Well, similarly, in technology organizations, we have people who understand the servers, people who understand storage or network, and even something like databases. There's not just one tool set. If it's Oracle or Sybase or Snowflake, each of them have different tools. When you have problems, what do you wind up doing? Oftentimes, many companies, they have an incident call. Everybody gets on, and they go: "What do you see?
What do you see?" You have to get the diagnostic, and this ultimately gives us huge transparency across the environment with AI and ML to make sure, again, that we can kind of draw those insights. You know, years ago, in terms of payoff and results, we were seeing hundreds of those kinds of problems. We've seen virtually none in the last 18 months, you know, significant improvement in terms of the incidents and problems. We look at the number of changes we put through our environment, which we've more than doubled over the course of the last number of years with very few incidents, basically four nines of reliability as a result of change, nothing kind of impacting the environment.
You know, I would say the systems have performed well, and we've seen that through COVID, as well as all the volatility in the last number of years. I think, you know, now that we've got the foundations in place, the payoff isn't so much monetary as it is in clients, and they see the difference, and we hear that in terms of, you know, resiliency being a commercial attribute for what we do. Now that even our CEO talks about resiliency being commercial, I think it's kind of permeated the organization.
Okay, great. That's a great backdrop and understanding. It sounds like you've taken the organization to a place where, you are ahead of the pack as opposed to when you started, right?
Yes. You have to keep running, so I never like to say ahead of it, but we have to keep on that treadmill.
When I'm thinking about the, you know, coming years, can you give us a sense as to how you're expecting the technology investment strategy to develop and change?
Sure. Now that the foundation is in place, I always kind of like to liken this to a building. To me, it's like we set the concrete, and that's the foundation. Now, we have to actually deal with the house, and the house are our applications and our systems. A lot of work is going into simplifying and modernizing our application portfolio. Overall, the number of applications that we have has remained rather constant. However, the mix of the kinds of applications we have within the portfolios has changed quite a bit. We've decreased the on-prem applications that we have by roughly 15%. We've reduced our mainframe footprint and applications by 23%, and we've retired over 1,000 applications as a part of what the work that we're doing.
We've also built contemporary applications, so back to we've got roughly the same number of applications. We've been building applications and leveraging more cloud and SaaS applications as part of the overall mix. You know, when I talk about simplify and modernizing, maybe just making it real, you know, there's a computer science adage that's called Conway's Law, and it states that systems technology represents the organizations and the communication structure that built them. What, in sort of simple terms, that means is we've got these monolithic applications that have multiple components in them that do not lend themselves to agility. They don't lend themselves to being able to make changes at speed and pace to be responsive to your clients.
Our strategy is to take those applications and decompose them into service-based architecture that allows us to be much more agile in terms of what we're doing. We also, no surprise, have data that's locked up in those silos and those systems, so investing in our data and breaking that down and making sure we have a single source of truth with, you know, single master reference data that is used throughout the firm. Kind of, the analogy I talk is that we have clean water running through our pipes, but also that each of the businesses is using that data to connect things like clients.
The other areas we're investing in is digitization and automation, and we've made a lot of progress, but we still have 20,000 people in our operations, and they're still doing, you know, more manual, repetitive tasks, and we think that we can do better. There's north of 13,000+ faxes that come into the environment, and, you know, we've been looking for innovative ways to be able to combat that. One of the things we've done was to create some tools that allow us to basically put a zero footprint application on our clients' desktops and to communicate them more digitally. It allows for chat, and we're able to meet them where they are, in terms of helping to drive the real time real-time engagement in terms of file exchanges and the like.
The last is really driving the company to be much more agile. you know, I think that, will generate more speed and productivity for the firm.
There's a lot to unpack there. I just have one very simple question on the faxes. I thought we got rid of them, when you say 13,000, you're talking about?
A day.
A day?
A day.
Okay. I guess some users need retraining.
Well, it's a opportunity for us to work with our clients on what we can do to help them.
Great. Okay, good. I want to unpack a few things, but before I do that, I do want to just ask about a recent announcement, Pershing X, Wove platform.
Yep.
Is that an example of a house on top of the foundation, or how would you-
Yeah
describe what that is?
I think that's a great kind of example of, you know, building. That was built from both, you know, to take the house analogy, both new lumber that we brought in, but we were also able to salvage things as a part of looking at our wealth tech capabilities and using those to be able to be a more modular house in terms of the acceleration, what we're building.
Maybe you could just describe in a couple of bullet points what Wove is, for people who might not have seen the press release yet.
Wove, you know, I think the problem that we're trying to resolve for the wealth advisors is this swivel chair, right? They've given it a name, you know, our teams have talked about, in just swivel chairing between the different applications. It's really a single, intuitive place to be able to bring together the workflows, the tools that the financial advisors need to be able to deliver to their clients. We think that there's a lot more. I mean, this is just our launch that we talked about last week, we think there's obviously a road map in terms of how we're going to deliver that.
Okay. You mentioned agile, and that you're moving towards an agile, dynamic operating model. How should we think about the investment spend required to deliver those agile results?
You know, I think there's two ways to maybe look at, I think, you know, the investment spend. You know, I think we're roughly, as I said, sort of spending, three and a half billion, and part of that is also generating efficiencies. One of the questions, I think, is, you know, do you capture that efficiency and take that to the bottom line and reduce your investment spend? Do you redeploy that capacity in terms of perhaps more modernization, investing in creating new products to be able to drive higher market share growth or maybe even build more scale and capture, more efficiency? From an agile perspective, what I'm sort of very excited about is that it reduces what I call the wait state for technology.
I've seen this is not just a phenomenon at this bank, but IT typically finds itself in traditional waterfall methodologies, waiting for requirements that are never on time, that are never complete, that are changing all the time. So in agile development, I think bringing those pods of individuals together rather than that happening side of desk, is going to bring significant productivity to the work that we do. You know, again, I think Pershing X was really a great example of that in terms of we hired our employee number one in towards the end of 2021. Six months later, we had an MVP because this was done in a fully scaled, agile way. So that first MVP was out there, and then six months later, we went live with that.
Mm.
As the team has matured their agile practices and rituals, we've seen a 40% increase in terms of the number of sprints delivered over that period of time, with the team just getting better and better at the groove, working together with themselves.
Okay, great. Just backing up for one second to the budget that you mentioned, three and a half billion on technology. Could you give us a sense as to what the governor on that tech budget is? Is that your decision? Is it business units that own it? Maybe you can give us a sense of also the composition of that budget between, say, run the bank, change the bank type of thing.
Right. You know, it's funny, sometimes the different business leaders think I am the one making the decisions, and I'm not. I tell them that all the time. I do have, obviously, a voice in terms of making sure we are thinking about that technical debt and where we are in investing for the future and making sure we're not missing opportunities. That three and a half billion dollars you talked about is roughly 20% of the core revenue, and, you know, we don't really see a big step change this year. As a firm, we don't calibrate the tech spend as a percent of revenue. We really think each investment has to stand on its own. You know, whether the question is, does it have compelling economics? Is it driving growth for the firm?
You know, are we able to get maybe more scale and efficiency or a better client experience? You know, those are the primary things that we're really driving with the organizations. I think the other things maybe just to add is that as a firm, we're pivoting towards higher ROI, more tangible payback. To your question on the percent of run versus change, you know, we've really sort of moved into about 50% now being on change the bank initiatives. Within that may sort of understate the impact to kind of retrospectively look because in prior years, one of the things we were doing with that change budget was not just building change for the infrastructure, but it was also, how do the applications work?
Do I need them to make changes in the way the application behaves or other characteristics in order to get the resiliency or recovery benefits that we had to have? Now that we have brought our applications to this heightened level of resiliency, and we're exercising that on a pretty regular basis in terms of rotating our applications across our different data centers, so we don't just do DR tests any longer. We're actually practicing that through the rotations. I think more of that is really going towards change the bank. The other point maybe to make is disciplined prioritization. Really focused on margin. Most of the growth spend is going towards the Market and Wealth Services businesses, which had a 48% pre-tax margin last quarter.
The efficiency spends, the dollars we're earmarking for efficiency, are earmarked for Securities Services, our Investment Management, our Wealth Management businesses. The other point maybe also to highlight is that, as a firm, we're self-funding more, we're seeing, you know, nearly two times the efficiency saves that are we've seen in the last couple of years in technology. I'm proud to say it's been a big part of helping the firm get there in that. One of the key things we talk about with the team is making sure we have the tools to measure and track our performance and make sure that the batting averages for all the teams, they know where they are and that the, you know, where we think they can actually do better.
Over the longer term, I think the trajectory is sort of flattening, as the resiliency investments have faded, and I think we're getting more done, for the same dollars.
Are you suggesting that the level of spend as a % of revs comes down over time, or is there a slower growth rate in tech spend that we should be expecting?
You know, I think it's hard to call it because I think the appetite is there as a firm to invest if the returns are there, which is why I sort of said we don't really look at that as a percent of revenue, as much as do we believe in what's, you know, what we think is our business case. Again, a great example was this Pershing X...
Right.
belief, how we decided as a firm to be able to put the dollars behind that and to see that business grow. I think, you know, with the results, the fact that we've executed in record time, you know, I think this is one of the things sometimes you know, say things, but do you really execute on it? Can you kind of see the momentum behind what's being done? That's why I think that question of track record, so are people delivering, will be a key theme in terms of the firm and how we reward investments.
You've mentioned several of the different businesses just now that BNY Mellon's involved in. You've got Pershing, core servicing, multiple investment boutique managers, for example. You know, there's more beyond that. How do you think about integrating the tech stack so that all the systems are interoperable? Are they already at that stage at this point with the foundation that you've laid?
The foundation has been about a lot of the infrastructure. Again, we've created some agility through that virtualization and containerization, one of the things we have done that has built, I think, a fair amount of integration without full modernization, has been our investments in terms of APIs. It allows our systems, even legacy, to be able to talk to one another and our clients to be able to integrate with us in a much easier way. You know, the APIs are especially useful in this journey as we're driving modernization to be able to kind of accelerate those efforts to connect our systems.
One of the measures, just to kind of put some stats behind it, the number of APIs we had has tripled over the last number of years across our both internal and our external APIs, with a 10x increase in terms of the APIs for our clients, and an 18x increase in the number of APIs internally. I think that would underscore our systems are talking to one another. In January of this year, we saw a record 912 million API calls in just that month. We are seeing a lot of activity, and APIs, I think, are a key part of what we're doing. The second has been this journey that we talked about in terms of data.
You know, many companies, as we said, are kind of built in this siloed way, and, you know, getting that master data, even though it is taken sometimes, oftentimes, I don't know if you've seen the movie, but like building the Field of Dreams, will they come, right? And so we've built enterprise client master data, product master data, securities data. You know, we had a great example of two systems built over time using different security masters. Having reconciliation problems downstream, well, it's no real surprise, right? This is just, you know, getting it on the priority list and making sure we're getting these items cleaned up, and then continuing this journey of decomposing and, you know, driving the service-based architecture.
I think one of the things we have tried to do to make sure, because, again, you can have great intent, but how do you actually make it realized inside the organization? We've created a robust architecture function, and sometimes they kind of are the lofty tower and so forth, but, you know, they really are a part of looking through as we build applications, as we set out the architecture, do they have the right stack? Are we reusing capabilities that exist in another business? Again, back to Pershing X. One of the reasons that they were able to move so quickly is they took LEGO blocks out of the kit of our wealth tech and put them into the house that they were building for Pershing X, and that's been enormous in terms of an accelerator for us.
Is cloud a part of this as well?
Yeah, cloud is, sorry. Cloud's definitely a part of our journey. At this point, we have roughly 25% of our applications that are in the public cloud. You know, our strategy is to be able to leverage the capabilities and the economies of scale to be able to drive the business and to serve our stakeholders. You know, one of the things to maybe highlight is I think oftentimes people try and start the cloud journey, and they haven't looked at our applications. One of the things, even though it was a bit more infrastructure-focused, was we talked about the fact that we rationalized a lot of our applications, retiring 1,000 as we went through.
We also, as I said, moved them to virtualization and containerization, you know, that ultimately gave us cloud-ready workloads that give us a good position to be able to use the cloud. Ultimately, though, our strategy is to be able to use the cloud for the right things at the right time. You know, I think one of the things people have found is that data egress charges out of the cloud wind up eroding what you think are your cost savings because you've only moved parts of your workload across the environment. We've been thoughtful about what is it that we are moving. Is it actually going to increase our toll charges in terms of how we're building them?
On the other hand, for elastic, on-demand workloads, like those we're doing with data science, it's been an enormous boost in terms of making sure you can spin up 1,000 GPUs and, you know, turn that down as you don't need it anymore. You know, I think it's sort of fit for purpose, use case driven, and really trying to make sure we unlock the agility that we need.
Okay, it sounds like you're benefiting from automation in significant ways. Is there anything that you're benefiting from that we haven't touched on yet as it relates to automation?
You know, I think we had talked through our accounting automation, and I think, you know, the one thing there has been, we really focused on trade capture, making sure we're getting all trades in and getting that to the STP. When we were starting some of this, it's a pretty poor stat, but we were, like, at 6%.
Mm.
We have progressed that to over 90% in terms of where we are in terms of trade capture and making sure that we can drive NAV production across the environment. I think reconciliations and sort of the repair process through automation has benefited greatly from the investments we've made. Then, you know, payments is just obviously you know, eking out the last couple of percentages. You know, we're in 97.7%.
Mm.
you know, driving to 100. Probably never be at exactly 100, but, you know, driving to drive as fast as we can.
You oversee a huge amount of data, you get a view on the financial world globally that is probably, you know, second to none. What do you see as the near and medium-term opportunities associated with that?
Yeah. You know, I think all of the work that we've done to invest in data, you just kind of step back and say, "We're touching 20% of the world's investable assets." You know, we really do think that that gives us a really amazing view into, you know, one of the world's most expansive data sets. You know, I think everything I touched on in terms of all of the data investments, creating certified, authorized data sets for each of our lines of businesses and making sure that we get them into our lake, so that's a place that everyone gets to be able to source that out of the environment.
Making sure we can inventory and catalog and, you know, provide the lineage because not just from a backup, we obviously have regulatory obligations that we have to be able to do that. The richness of that data, you know, I think translates into unique insights for our clients and, you know, better inform more commercial decisions. You know, I think one example is the cloud-based Data Vault that we launched that, you know, we believe can help our clients to collect, connect, store, and be able to distribute their data across their organizations, we can share it to them seamlessly. Via the vault, the clients get to see the full relationship, you know, and all of their data in that.
I think the other is, you know, leveraging those unique vantage points that we have in terms of the intersection of markets, and where we can really provide new client-facing insights with our Ultra report or the iFlow Insights report.
What about artificial intelligence, the buzzword of at least this year? Can you give us a sense as to where BNY Mellon stands on this topic and any use cases that you're anticipating here over the medium term?
Sure. You know, I think we are very excited. I think everybody is very excited about AI and, you know, the use cases typically for us fall into predictive analytics, anomaly detection. There's an automation capabilities that we see, and then, you know, more broadly, knowledge management with all of the unstructured data that exists across the ecosystem. You know, I think one great example of more of the traditional AI is, you may know we're the sole provider of clearance services, you know, for the U.S. Treasury market. We settle $10 trillion every day. As a part of that, a small portion of those transactions actually fail to settle and are a cost to our clients.
Not something they asked for, but our teams identified and built a predictive machine learning model that, you know, basically assigned the probability of settlement failure. We were able to take that, deliver that out to markets, and connect that to clients to avoid those kinds of failures through the environment. I think, you know, the thing everybody, obviously, this watershed moment back in November with generative AI and ChatGPT and the like, you know, I think the potential there is, it's profound. I mean, I think it's probably on par with the advent of the internet and what it's going to mean for financial services and markets.
You know, one of the things is really ultimately mobilizing that vast amount of data that we said, both structured and unstructured, to be able to leverage that in generative AI and, you know, hyper-personalization, in delivering that to our clients and new solutions that our businesses are imagining. You know, it's even if I just turned it sort of introspectively on ourselves, Copilot has been around for a while, but with what they've done with the ability to have a copilot, effectively a paired programming partner for our developers.
Mm.
their code quality, their time to deliver is going to accelerate dramatically. One of the things I've talked to many of the tech companies, and I'm seeing kind of the early signs of this, is we still, we've talked about that modernization, right? COBOL code, Fortran, large language models. Programming languages have a lexicon, a taxonomy to them. I think they're going to lend themselves very well to being translated into more contemporary languages. People have had to slog through hundreds of millions of dollars, years and years of investments, to modernize many of those assets. I think we're at this sort of interesting inflection point where I think this is not going to be science fiction, but going to become a real reality.
In our minute and a half left, one question on talent, one question on cyber, one question on outlook. Speed round, 30 seconds each. How do you think about talent acquisition with everything you just mentioned?
It's everything. I mean, the talent, you know, really powers. You know, focused on early stage, building our talent, not just buying our talent, making sure we're getting diversity through our campus. We have just tripled the number of campus hires that we've done this year, making sure they have just-in-time training, and we're using AI to help them in terms of tipping them along in that regard.
Cyber risk, how do you protect yourself against that?
Man, this is a long... That's in 30 seconds, but cyber is the biggest risk, and I think it's the one that-
We'll go over for you.
Okay.
Yeah.
Phishing, smishing, vishing, you know, 75% of breaches are traced to the human element.
Mm.
You know, we have to make sure that we are vigilant. When you look at the generative AI, you used to be able to spot phishing because the grammar, it was imperfectly done. Now, you've got these engines that are going to write them perfectly, and you're not going to be able to tell, right? People get texts, the smishing on their phones. I have no technology to be able to protect people from that, and people are going to websites that look like ours, entering credentials, and people are sitting on the other end of that. Which brings me to, you know, the scariest thing I've seen and learned about is the selling of credentials.
Mm.
There are $100 million Bitcoin wallets on the dark web. They don't have to hack anymore. They are buying credentials to be able to get into systems. That is something that I think has made me, you know, take notice. A lot of this is looking at our controls, how we're investing. Trusted access is something that is a kind of brand name internally, but it really is about zero-trust principles and making sure that we basically take down to a minimum viable, you know, requirement, what access people need, and only ask them to step up with multifactor or other kinds of controls to make sure that they're not able to just go to any website without actually thinking about it, you know, before they go.
Last question here is, I think we might have already answered this, you tell me, the next significant development in tech that will impact the financial services industry?
Yeah, I mean, you know, I was going to say, you know, I think if you thought about financial services, you know, there's also not just AI, but the blockchain and where digital assets go. I don't think that's over. I think digitizing assets, tokenizing them, is going to be. Tokenization is a key technology that has a lot of promise, but I don't think it's as high as kind of what we're going to get out of the generative AI.
Okay, that's our next 30-minute session.
Okay.
Bridget, thanks so much for joining us today.
Thank you.
Teaching us a lot about what's going on at BNY Mellon's tech infrastructure.
Thank you.
Thank you.