Decisions that changed what our systems are measured against

Slowing down the first forty-eight hours of a new digital account

In March 2022 we launched account opening in our mobile app: a photograph of a government ID, a selfie and a liveness check, with the account usable within minutes. By mid-2023 we were opening about 64,000 accounts a month this way. In the first half of that year our fraud operations team traced ₱412 million of reported scam proceeds credited to Talampas accounts. Seventy-one per cent went to accounts less than thirty days old, the median time from credit to onward transfer or withdrawal was twenty-six minutes, and investigations confirmed 8.3 mule accounts for every thousand digital openings.

Customers elsewhere were losing money through us, and other banks' fraud teams were calling ours daily. I proposed that for forty-eight hours after opening, or until the customer completed a short video call, a new digital account could send no more than ₱10,000 a day by instant transfer, and that large credits from unrelated senders would be scored before the money could move. Andrea Villacorta, our head of digital banking, opposed this in writing: e-wallets opened accounts instantly, and genuine customers would go there. Our chief executive approved the change on condition that completed openings and complaints went to the executive committee every week for six months.

We built scoring of every inbound credit within seconds, bound each account to one device and added the video-call route, live from January 2024.

Completed openings fell 17% in the first quarter, and 2,300 customers complained about the limits. By December 2024 openings had recovered to 91% of the earlier level. In the second quarter of 2025 confirmed mule accounts were 1.6 per thousand openings, the share of flagged funds frozen before they left had risen from 6% to 41%, and scam proceeds received in the first half of 2025 were ₱97 million, while our instant-transfer volume had roughly doubled. When the anti-scam law passed in mid-2024, we could already hold suspicious funds in time.

What I would do differently: the video-call route arrived six weeks after the limits and caused most of the complaints. Worse, we held the first wages of 3,400 factory workers whose employer paid them by instant transfer from another bank, because our rules treated the payroll provider as an unrelated sender. We should have consulted our payroll clients before switching anything on.

Reporting a payday by what customers could not do

On Friday 15 December 2023, a payday in the busiest month of our year, QR payments and instant transfers from our app failed intermittently for 3 hours 40 minutes from 11:50. A connection pool in our payments middleware ran out at 2.6 times average load, and automatic retries made it worse. About 410,000 payment attempts failed, 19,000 customers saw a debit for a payment that never completed, all reversed within two days, and 27,000 complaints followed. We notified the Bangko Sentral ng Pilipinas that afternoon. Our availability report for December nevertheless showed 99.94%, because the core systems had never stopped.

The stakes went beyond one bad afternoon. Our board risk oversight committee had been receiving uptime figures that described our machines rather than our customers, and I had been presenting them since 2019.

I proposed three changes: replace system uptime with nine customer journeys, each with an impact tolerance approved by the committee and tighter on paydays; freeze non-urgent production changes for two business days either side of the fifteenth and month-end; and buy capacity for three and a half times average load, tested monthly on a synthetic payday. Our head of digital banking objected that the freeze removed about eight working days a month from her release calendar. Our chief financial officer, Miguel Abellera, questioned ₱640 million of capacity and testing spend in 2024. Corporate communications resisted a public status page.

We gave up release speed. Production releases fell from 22 a month to 17 in early 2024, before smaller and more frequent releases brought them back to 21 in 2025. We now publish a status page and send an SMS notice within fifteen minutes of a confirmed disruption.

In 2025 payday QR success was 99.86%, against 99.2% across the paydays of 2023. We had four payday incidents longer than thirty minutes in 2023 and none in 2025, and complaints per million payments fell 61%. The committee now sees the worst payday of each quarter beside the average, on the first page of my report.

What I would change is the number of journeys. Nine at once overwhelmed the teams who owned them; four would have been enough to start. I also left merchants' QR acceptance out of the first set until 2025, although a market stall owner feels a failed payment long before we see the complaint.

Leaving the mainframe one product family at a time

Talampas has run its deposit and loan ledgers on a mainframe since 1997. By 2022 only eleven engineers understood the deposit modules, with an average age of fifty-seven, and the hardware and software agreements were due for renewal in March 2027 at about 38% more than we were paying. A six-hour-ten-minute overnight batch meant that instant credits received at night sat in a shadow ledger until morning.

Marrowgate Technologies, still our core integrator, proposed replacing the core in a single cut-over for a fixed ₱5.8 billion over thirty months. Our chief financial officer favoured it because it cost less and ended dual running sooner. I recommended a phased route: a new core in our own data centres, with deposits moved one product family at a time and loans after them, at about ₱7.1 billion over five years including roughly ₱0.9 billion of parallel running. The board risk oversight committee asked each of us to describe the worst credible weekend for our option. Mine was a failed savings migration that we could reverse. The single cut-over's was a failed migration of everything with no way back. The board approved the phased plan in March 2023.

We moved 1.1 million time deposit accounts holding ₱148 billion in September 2024, after three full rehearsals, and 5.8 million savings accounts holding ₱262 billion in August 2025, after four. Each had a tested reversal plan that we did not need. Instant credits to migrated accounts now post immediately, the overnight batch is down to three hours twenty minutes and mainframe capacity has fallen 41%. That lets us negotiate the 2027 renewal on a smaller footprint, about ₱420 million a year below the original quote. Current and payroll accounts follow in February 2027, moved back once from October 2026 when the third rehearsal found statement errors. Each stage now reaches the board with its own reversal plan and go or no-go paper.

What I would do differently is the grouping. Leaving payroll accounts on the mainframe while their holders' savings moved split 14,000 customers across two cores, and their combined statements for September 2025 were wrong. Payroll and savings should have moved together, whatever that did to the first timetable. I also priced parallel running too optimistically; it has come in 14% above the estimate, mostly in reconciliation staff.

Splitting one integrator's contract into three

In 2020 Marrowgate Technologies received about ₱1.9 billion of our ₱3.0 billion change budget, ran most application support and employed the only three architects who understood the integration layer connecting our app, ATMs and cards to the mainframe. When the contract came up for renewal in 2021, Marrowgate offered a five-year exclusive agreement with a 9% rate reduction. Our head of procurement, Rodel Macaraeg, recommended accepting it, and on price alone he was right.

What was at stake was our ability to change the bank. Every significant project queued for the same three people, and if Marrowgate moved them, as the contract allowed, nobody at Talampas could safely alter how our channels reached the core. As an auditor in 2009 I had raised supplier access. In 2021 the dependency was knowledge rather than access, and much harder to remove.

I proposed three lots: Marrowgate would keep delivery around the mainframe, Habilin Systems, a Manila firm, would take over integration-layer support, and we would build our own design authority and channel engineering team. That meant losing the discount, paying about ₱310 million in transition costs and accepting slower delivery while knowledge moved. Our chief operating officer and procurement opposed it. Our chief executive approved it after I took the key-person dependency to the board IT steering committee, which had never seen it reported.

Marrowgate at first declined to release time for handover. We agreed a fee to hire two of the three architects with its consent, wrote documentation and handover duties into all three contracts and paired every Habilin engineer with one of ours for six months. Change delivery fell by about a fifth in the first half of 2022, and in May that year a failed integration release took our ATMs and cards down for two hours ten minutes on a Saturday, the worst incident of the transition.

By 2024 Marrowgate's share of change spend was 37%, Habilin's 21% and our own engineering's 42%. Our team had grown from 12 to 52 people, cost per delivered change point had fallen 11%, and nine people could safely change the integration layer. Supplier key-person risk is now a standing committee item.

If I did it again, I would build the design authority first and split the contract a year later. Doing both at once put our least experienced engineers in charge during the riskiest months.