Transformation programmes in financial institutions are conceived, almost without exception, in the language of technology: processes to be automated, systems to be replaced, data to be migrated, journeys to be digitalised. The investment cases are technological, the milestones are technological, and the success metrics are technological. Yet the record of transformation in banking tells a consistent story — programmes that delivered their systems and still failed to deliver their promise, because the dimension that ultimately determines success was treated as an afterthought. That dimension is culture: the depth to which GRC awareness, compliant behaviour and the proactive application of governance, risk and compliance principles penetrate the institution — vertically, from the board to the newest employee, and horizontally, across every department, function and subsidiary.
This article advances a straightforward proposition. Automation and digitalisation are necessary components of transformation; they are not its substance. The substance is the creation of an institution in which sound governance is not enforced upon the organisation but exercised by it — at every level, in every unit, as a matter of professional instinct. Transformation strategies that place this cultural objective at their centre meet their targets and sustain their gains. Strategies that subordinate it to technology deliver new systems operated with old behaviours, and their results erode accordingly.
Why technology alone does not transform
The limits of purely technological transformation are structural, not incidental. An automated control is only as effective as the judgement of those who configure, override and respond to it. A digitalised onboarding process accelerates whatever behaviour is fed into it — diligent inquiry or mechanical completion alike. A sophisticated monitoring system produces alerts; whether those alerts are investigated with rigour or cleared with haste is decided not by the system but by the culture of the team that operates it. Technology amplifies the prevailing behavioural standard of an institution. It does not raise it.
This is precisely why supervisory authorities, FINMA among them, assess transformation not by the modernity of an institution's systems but by the effectiveness of its outcomes — and why examinations probe behaviour as closely as architecture. An institution that has digitalised its processes while leaving its risk culture untouched has not reduced its risk profile. It has accelerated it.
The primacy of culture: GRC awareness as the transformation objective
A transformation strategy oriented toward sustainable success therefore defines its target state in cultural as well as technical terms. The target is an institution in which every employee understands the governance, risk and compliance dimensions of their own role — not as abstract policy but as concrete professional practice; in which compliant behaviour is the default because it is embedded in the ordinary way of working; and in which GRC principles are applied proactively — anticipated in decisions, raised in discussions, considered in design — rather than retrofitted after review.
Proactivity is the decisive word. A compliant institution follows the rules it is given. A GRC-aware institution goes further: its product teams consider risk implications before the second line asks; its relationship managers raise the difficult client question before the periodic review surfaces it; its project leads involve compliance at design stage because experience has shown that early involvement produces better outcomes. This anticipatory posture cannot be automated and cannot be mandated. It must be cultivated — and its cultivation is the true work of transformation.
"Technology amplifies the prevailing behavioural standard of an institution. It does not raise it. Raising it is the work of culture — and culture is the substance of transformation."
Vertical penetration: from the board to the first day of employment
GRC awareness must run the full vertical axis of the institution, and it is established from the top. The board and executive committee set the standard not through endorsement — endorsement is inexpensive — but through demonstrated decision-making: strategic choices in which risk considerations visibly carried weight, transformation milestones deferred until control requirements were met, and resource allocations that treat the GRC dimension of transformation as integral to the investment rather than ancillary to it. Organisations read the conduct of their leadership with precision. Where leadership demonstrably applies GRC principles to its own decisions, the standard cascades. Where it does not, no communication programme can compensate.
From senior management, the standard must reach middle management — the layer upon which cultural transformation most frequently depends, and to which it is most rarely addressed. Department heads and team leaders translate institutional principles into daily expectations; they determine, through what they praise, tolerate and escalate, the behavioural reality of their units. A transformation strategy that equips this layer — with clear accountability, practical training and explicit inclusion of cultural objectives in their own performance assessment — reaches the entire organisation through them. The vertical axis concludes at induction: the new employee who encounters GRC standards from the first day, presented as the institution's professional identity rather than a regulatory imposition, absorbs in weeks what remedial programmes struggle to instil in years.
Horizontal penetration: no exempt departments, no peripheral functions
The horizontal axis is equally demanding. GRC awareness confined to the second line and the client-facing front office leaves the greater part of the institution outside the transformation. A genuinely GRC-aware institution recognises no exempt departments. Technology teams apply governance principles to system design, access management and change control. Human resources applies them to screening, performance management and conduct processes. Finance applies them to reporting integrity and payment controls. Marketing applies them to communication standards and client documentation. Operations applies them to every process through which an error or omission could become a client or regulatory event. Each department requires its own translation of GRC principles into the specific decisions and risks of its daily work — and each requires ownership of that translation, not merely receipt of it.
The horizontal axis extends, with particular importance, across legal entities and subsidiaries. Group-wide transformation succeeds where the centre establishes uncompromising common standards and invests in genuine local ownership — local translation into regulatory and market context, local accountability for behavioural reality, and group-level verification that examines practice rather than attestation. Uniformity of standard with authenticity of local application is the formula; its absence produces the most hazardous of outcomes, complete documentation resting upon unchanged conduct.
Culture as the condition of sustainable success
The strategic significance of the cultural dimension becomes fully apparent over time. Technology depreciates: systems age, vendors change, architectures are replaced within a decade. A culture of GRC awareness appreciates: it transfers to each new system, survives each reorganisation, absorbs each regulatory development, and educates each generation of employees through the example of the last. It is the only element of a transformation programme that compounds.
It is also the element that determines whether transformation targets are met at all. Programmes fail overwhelmingly through human factors — controls circumvented under pressure, concerns unraised, new processes operated in old ways — and succeed where the workforce understands, accepts and actively applies the principles the transformation embodies. An institution that invests in GRC awareness with the same rigour it applies to systems investment is not adding a cultural supplement to its transformation strategy. It is securing the strategy itself.
The conclusion for boards and executive committees is exact. A transformation strategy is complete only when it defines its cultural target state with the same precision as its technical one, resources both dimensions accordingly, measures behavioural penetration alongside system delivery, and holds leadership at every level accountable for the standard within its span. Institutions that meet this test achieve what technology alone has never delivered: transformation that reaches its targets, withstands supervisory scrutiny, and sustains its success long after the programme that produced it has closed.