Decisions that cost time or money and left the bank safer

Moving the core migration back four months after the third rehearsal

Over the Sports Day weekend in October 2024 we ran the third of four planned full rehearsals for moving 3.4 million accounts to Kaname. Cut-over was set for the Coming of Age Day weekend in January 2025, and letters giving that date had reached 1.6 million customers. The rehearsal found three problems. Interest on 19,600 time deposits under two discontinued step-up products differed from the old system by between ¥1 and ¥340 an account. The first simulated night batch overran its window by three hours and fifty minutes. Reconnecting ATMs and internet banking took 96 minutes against a plan of 40.

The stakes were visible in other banks' histories: Japanese banks whose systems failed during or after integration have faced days of unavailable ATMs, delayed transfers and business improvement orders. Mikage's programme director judged the fixes straightforward and provable in the December rehearsal. Our head of retail banking opposed any delay because customers, branches and corporate clients had prepared for January. Our chief financial officer questioned spending ¥2.3 billion on extended mainframe running, vendor staffing and new letters for problems with known fixes.

In 2023 the board had accepted my rule that we would go live only after two consecutive clean full rehearsals. January allowed one. I recommended Golden Week 2025 and told the president that the rule mattered more than the date. He agreed, and the board approved the change on 22 November 2024. We wrote to every customer again, extended the mainframe contract and reconciled every account to the yen in each later rehearsal.

The February and March rehearsals were clean: no interest differences, the batch finished with 70 minutes to spare and channels reconnected in 34 minutes. ATMs and internet banking stopped for 59 hours over 3–6 May 2025, and every branch opened on time on 7 May. One utility's direct-debit file ran a day late for 2,140 customers; we covered any late charges. Annual core running cost falls from ¥7.8 billion to ¥5.3 billion from April 2026.

Two clean rehearsals and full reconciliation are now required for any major change, and Kaname adopted full reconciliation for later joiners. I would give customers a date only after the penultimate rehearsal, and would have demanded full reconciliation from the first rehearsal rather than learning in the third that sampling had hidden the step-up products.

Paying retiring mainframe engineers to explain rather than to code

In 2021 the bank and our technology subsidiary had 37 engineers who could maintain the mainframe applications we were about to replace: about 4,600 programs and 2,300 batch jobs, much of it changed over thirty years without updated specifications. Fifteen would reach sixty, our retirement age, before cut-over. Under our continued-employment terms they could stay to sixty-five on one-year contracts at about 55% of final pay, usually in lighter roles. Several had already been approached by systems integrators offering more.

The danger was not that nobody else could write COBOL. It was that nobody else knew why the programs behaved as they did, and a migration that missed those reasons would apply the wrong rules to customers' money.

I proposed fixed-term migration-specialist contracts for the twelve engineers whose knowledge covered the most critical areas, at final pay until six months after cut-over, with a written duty to explain and review rather than write code. The extra cost was about ¥210 million over four years. Our head of human resources opposed it: more than 600 re-employed colleagues were on standard terms agreed with the employees' union, and experienced branch staff held knowledge as valuable as any engineer's. She was right about the last point.

The compromise took four months. HR and the union approved a role-based contract category with published criteria, open to any re-employed colleague whose role met them; three people outside IT later qualified, in agricultural lending administration and treasury operations. My division absorbed the cost, which meant two fewer graduate engineering hires that year. Each specialist worked with two younger engineers and spent most of the week with business divisions, recording rules in their language rather than the program's.

Eleven of the twelve stayed until November 2025; one retired early on health grounds. They recorded 2,140 business rules, 318 of which appeared in no specification. Twenty-seven would have produced wrong results on the new core, including harvest-linked repayment schedules on farm loans and a rounding convention on a 1980s savings product. Each rule now has an owner in the relevant division, and every change request we send to Kaname cites the rules it touches.

I would start two years earlier. I would also have included the night-shift operators who ran the batch, whose manual workarounds we discovered only in the second rehearsal.

Testing how long a clean restore really took

By 2023 ransomware had disrupted Japanese hospitals and manufacturers for weeks at a time, and our board asked how quickly we could recover from an attack. Our continuity plan said twelve hours for the critical systems outside the core: internet banking, loan origination, the branch information system, email and the directory that controls administrative access. Nobody had tested that figure from end to end.

In June 2023 I commissioned an unannounced restore into an isolated environment, using only our backups. It took 61 hours. Worse, the backup servers belonged to the same administrative domain as production, so an attacker who took control of that domain could have deleted the backups before encrypting anything else.

I proposed ¥1.3 billion for immutable, isolated backups, a separate administrative domain and controls over privileged access. Fitting it into the year's change budget meant postponing our new analytics platform by nine months. Our head of digital strategy argued against the delay, because the platform was to support the launch of a new housing loan, and she took her case to the president. I also asked the business to agree the order of restoration in advance. Retail banking wanted internet banking restored first. I argued for corporate payment files, because most of our corporate customers pay salaries on the 25th and a missed payroll harms people who may not bank with us at all. The executive committee accepted both proposals.

The 2024 test restored critical services in 19 hours and the 2025 test in 9 hours 40 minutes. Privileged administrative accounts fell from 388 to 74. The analytics platform went live in October 2025, nine months late, and the housing loan launched with the old reporting. The board now sees the measured restore time each year beside the plan's objective, and takes part in an annual tabletop exercise.

What I would change is the scope. Our tests covered our own estate but not the contractors holding customer data. In August 2024 a direct-mail printing contractor was hit by ransomware, and the names and addresses of about 8,300 customers were exposed. We reported to the Personal Information Protection Commission and to our supervisor, wrote to every affected customer and opened a dedicated telephone line. Our exercises now include the 41 contractors that hold customer data, and their contracts require notice of an incident within hours rather than days.

Closing the bank's own payment app

Shiomine launched a smartphone payment app in 2019 at our president's initiative, and my systems planning team built it. Customers paid local merchants by QR code directly from their accounts, and the prefecture and four municipalities used it for premium-voucher programmes. At its peak in 2021 it had 88,000 registered users and 3,100 merchants. By early 2025 it had 11,200 monthly active users and carried ¥2.4 billion of payments a year, at an annual cost of ¥430 million. A security review found that its authentication needed a rebuild costing about ¥600 million. Meanwhile 410,000 Shiomine accounts were already linked as the funding source for the large code-payment services used across Japan.

The choice was between rebuilding an app few customers used and stopping. The president saw it as part of the bank's commitment to the prefecture. Our regional development division valued the local spending data it produced for municipal reports, and prefectural officials did not want to move a voucher programme in mid-year.

In July 2025 I recommended closing the app on 31 March 2026 and spending part of the saving on the services customers actually used: stronger verification when accounts are linked to outside payment services, a weakness criminals had exploited at several Japanese banks in 2020, and faster settlement for local merchants receiving card and code payments into Shiomine accounts. We gave up our own brand at merchants' counters and about six months of local spending data. The president accepted after we met the prefecture together and agreed that its spring 2026 voucher programme would run on a widely used service, with Shiomine as settlement bank.

The app closed on 31 March 2026. Of ¥186 million in balances, 97.6% returned to customers' accounts automatically and the rest was paid at branches. We handled 1,320 enquiries, most from older customers, through branch staff trained beforehand. The bank saves about ¥380 million a year and avoided the rebuild. Merchants settling into Shiomine accounts rose from 3,100 to 4,700, and there has been no unauthorised account linking since the new verification began in October 2025.

Every customer-facing digital service now has closure criteria set at launch. I should have made this recommendation two years earlier, when usage first fell, and I would have agreed a data-sharing arrangement with the prefecture before the closure rather than after it.