More than a decade after the Basel Committee issued its principles on risk data aggregation and risk reporting (BCBS, 2013), supervisory assessments continue to find that institutions cannot reliably assemble accurate, complete and timely risk data across the group.
The European Central Bank’s thematic review of significant institutions found that none had fully implemented the principles, with weaknesses concentrated in accountability for data quality (ECB, 2018). The Basel Committee’s later progress report concluded that banks remained at different stages of alignment and that further work was required at all of them (BCBS, 2023).
On the collection side, the Bank of England’s transformation plan identified complexity, legacy architecture, ambiguous reporting instructions, difficulty in sourcing data and reconciliation burden as persistent structural problems, not transitional ones (Bank of England, 2021).
What is a financial-sector micro app?
A financial-sector micro app is a narrowly focused application supporting one decision, control or workflow. It sits above existing systems and consumes governed data rather than becoming another source of truth. Its value comes from focus: a single question, a defined population, a defined output, and a user who is accountable for what happens next.
A banking app might identify apparently performing borrowers with emerging stress. An insurance app might prioritise complex claims. An asset-management app might detect mandate drift. A payment app might reconcile safeguarded customer funds. A supervisory app might identify institutions showing simultaneous deterioration in capital, liquidity and profitability.
The distinction that matters is not size but scope of authority. A micro app is a lens, not a ledger. It should be able to be switched off without leaving an orphaned record that nothing else holds.
Why large dashboards are not enough
Enterprise dashboards remain necessary because boards, executives and supervisors need common indicators and a shared vocabulary of performance. But aggregation drops many details required in decision making.
A bank may remain comfortably above its regulatory liquidity minimum while becoming steadily more dependent on a small number of depositors; the ratio is met, the concentration is not visible. An insurer’s aggregate claims ratio may conceal an unusual severity or frequency pattern arising from a single intermediary. An investment portfolio may sit within every headline limit while accumulating exposures that are individually compliant and jointly correlated. A payment firm’s safeguarding position may reconcile in total while a particular account has drifted out of segregation.
Micro apps provide the drill-down layer between monitoring and action. They show which cases caused the change, what evidence supports concern, and which question should be investigated next. They are the mechanism by which a movement in an indicator becomes a name, a file and a decision.
A portfolio of practical uses
In banking, useful applications include early-warning credit review, expected-credit-loss movement attribution, connected-counterparty mapping, liquidity scenario analysis and regulatory-return reconciliation.
In insurance, they include claims triage, underwriting exception review, lapse and persistency analysis, and intermediary conduct monitoring.
Asset managers can use them for mandate and guideline monitoring, valuation exception review, and liquidity mismatch analysis at the fund level.
Payment firms can apply them to merchant risk assessment, safeguarding reconciliation, fraud case management and operational incident analysis.
Financial authorities can use them for prudential deterioration monitoring, business-model analysis, peer comparison, inspection evidence management and complaint pattern detection. The survey evidence in the Financial Stability Institute’s most recent work on supervisory technology is instructive here: tools become genuinely embedded in supervision when they address an identifiable pain point in an existing process and when supervisors understand what the tool is for; tools built to demonstrate capability rather than to solve a process problem tend to remain peripheral (Prenio, 2024). An earlier stocktake of prudential suptech tools found that more than half analysed mainly qualitative information, which is a useful corrective to the assumption that these applications are essentially numerical (Beerman, Prenio & Zamil, 2021).
For authorities in particular, one boundary should be stated explicitly. These tools should support risk-based prioritisation and evidence assembly. They should not automatically determine supervisory ratings, capital add-ons or enforcement outcomes. The output is an input to judgement, and the judgement remains attributable to a person.
Data and governance architecture
The preferred structure is layered: source systems, a governed data platform, curated data products, analytical services, and micro apps at the edge. Common identifiers and definitions should be resolved before application logic is built, not encoded separately inside each application. The app should retrieve information through controlled interfaces and preserve lineage back to the source, so that any figure it displays can be traced to the record that produced it.
Every application needs a named business owner, a data owner and a technical owner. Access should reflect role, entity, jurisdiction and purpose. Rules, thresholds and models require documentation, testing and version control. Material alerts, overrides and decisions should be auditable.
That last requirement deserves more attention than it usually receives, because it qualifies the claim that a micro app does not become a source of truth. The moment an analyst overrides a flag, annotates a case or records a disposition, the application is holding a record that exists nowhere else. Those records need retention periods, ownership and a defined destination — normally a case management or supervisory record system — before the application is deployed rather than after.
Where an application supports an important business service, it also falls within operational resilience scope. In the European Union this is now explicit: the Digital Operational Resilience Act imposes ICT risk management, incident reporting, resilience testing and third-party oversight obligations on financial entities, applying from 17 January 2025 (Regulation (EU) 2022/2554). Comparable expectations exist in other jurisdictions under operational resilience and outsourcing frameworks. A small application is not exempt because it is small; it is in scope because of what depends on it.
The proliferation problem
The strongest argument against micro apps is not that they are too limited. It is that they multiply.
What is being described here is, in engineering terms, end-user computing — and unmanaged end-user computing is precisely what the industry has spent two decades trying to contain. The characteristic failure mode is not one over-large dashboard but a hundred small applications with inconsistent definitions of the same metric, undocumented calculation logic, no independent review, dependence on the individual who built them, and outputs that quietly acquire an authority they were never tested for. A tool built to prioritise a review queue becomes, over three years and two staff changes, the basis on which a rating is defended.
Four controls address most of this.
A register. Every micro app recorded with its purpose, owner, data sources, calculation logic, version, last review date and materiality tier. If the register is not maintained, nothing else in this list is enforceable.
Tiering. Proportionate control by consequence. An application that ranks a review queue does not need the assurance regime of one that produces a figure entering a regulatory return or a supervisory assessment.
A shared definitions layer. Metrics computed from curated data products rather than reimplemented in each application. This is the practical expression of the data-architecture point above, and it is the control that most often fails first.
Decommissioning discipline. Applications retired deliberately when the question they answered is no longer asked. Dormant tools that still run are a larger risk than tools that have been switched off.
There is also a model risk dimension. The Prudential Regulation Authority’s supervisory statement on model risk management treats model risk as a risk discipline in its own right and begins with model identification and classification, followed by governance, development and use, independent validation, and risk mitigants (PRA, 2023). Its formal scope is firms with internal model permissions, but the identification principle travels well beyond that population. Where a micro app applies a quantitative method to produce an estimate or a ranking that informs a material decision, the honest question is not whether it is called a model but whether it behaves like one. If it does, it belongs in the model inventory and within the classification regime, at whatever tier its materiality justifies.
Artificial intelligence: useful but bounded
Artificial intelligence can help classify complaints, summarise files, extract contractual obligations and identify relationships in large document sets. These are real efficiencies, particularly given how much supervisory and compliance material is unstructured.
It should not blur the boundary between fact and inference. Users must be able to distinguish, on the screen, between source data, calculated indicators, model estimates, AI-generated text and human conclusions. Where a model has produced a summary or a classification, the underlying document should be one click away, and the provenance should be visible without being sought.
The Financial Stability Board’s assessment of AI adoption in finance identifies third-party dependency and service-provider concentration, increased market correlation, cyber vulnerability and weaknesses in model risk and governance as the principal channels through which AI use could amplify existing vulnerabilities, and calls on authorities to address monitoring gaps, assess the adequacy of current policy frameworks and strengthen their own supervisory capabilities (FSB, 2024). Its follow-up work notes continued concentration across the AI supply chain (FSB, 2025). For micro apps, the third-party point is the most immediate: an application that depends on an external model inherits that provider’s availability, versioning and change management, and a silent model update can alter outputs without any change to the application itself. Version pinning and output monitoring are not optional refinements.
Finally, the conclusion reached by the earliest survey of supervisory technology users has not been superseded: human expertise remains indispensable, particularly in investigating the results of an analysis and deciding on a course of action (Broeders & Prenio, 2018). Important decisions about credit, claims, customers or supervisory intervention should retain accountable human review, and the accountability should attach to a named person rather than to the tool.
In sum
Financial-sector micro apps can turn existing data investments into focused instruments for risk management, compliance, customer outcomes and supervision. Their purpose is not to create another large platform. It is to place the minimum relevant evidence in front of the right user at the right moment.
But the case for them is conditional. They work where upstream data is governed, where their scope is deliberately narrow, where they are registered and tiered and retired, and where the decision they support remains attributable to a person. Without those conditions, a proliferation of small applications reproduces the problem it was meant to solve, in a form that is harder to see.
Large systems provide scale and control. Dashboards provide a broad view. Micro apps provide context, prioritisation and a route from information to action .
References
Bank of England. (2021, 23 February). Transforming data collection from the UK financial sector: A plan for 2021 and beyond. https://www.bankofengland.co.uk/paper/2021/transforming-data-collection-from-the-uk-financial-sector-a-plan-for-2021-and-beyond
Basel Committee on Banking Supervision. (2013, January). Principles for effective risk data aggregation and risk reporting (BCBS 239). Bank for International Settlements. https://www.bis.org/publ/bcbs239.pdf
Basel Committee on Banking Supervision. (2023, 28 November). Progress in adopting the Principles for effective risk data aggregation and risk reporting. Bank for International Settlements. https://bis.org/press/p231128.htm
Beerman, K., Prenio, J., & Zamil, R. (2021, December). Suptech tools for prudential supervision and their use during the pandemic (FSI Insights on Policy Implementation No. 37). Bank for International Settlements. https://www.bis.org/fsi/publ/insights37.htm
Broeders, D., & Prenio, J. (2018, July). Innovative technology in financial supervision (suptech) – the experience of early users (FSI Insights on Policy Implementation No. 9). Bank for International Settlements. https://www.bis.org/fsi/publ/insights9.pdf
European Central Bank. (2018, May). Report on the thematic review on effective risk data aggregation and risk reporting. ECB Banking Supervision. https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.BCBS_239_report_201805.pdf
Financial Stability Board. (2024, 14 November). The financial stability implications of artificial intelligence. https://www.fsb.org/2024/11/the-financial-stability-implications-of-artificial-intelligence/ (full text: https://www.fsb.org/uploads/P14112024.pdf)
Financial Stability Board. (2025, October). Monitoring adoption of artificial intelligence and related vulnerabilities in the financial sector. https://www.fsb.org/2025/10/monitoring-adoption-of-artificial-intelligence-and-related-vulnerabilities-in-the-financial-sector/
Prenio, J. (2024, June). Peering through the hype – assessing suptech tools’ transition from experimentation to supervision (FSI Insights on Policy Implementation No. 58). Bank for International Settlements. https://www.bis.org/fsi/publ/insights58.pdf
Prudential Regulation Authority. (2023, 17 May). Model risk management principles for banks (Supervisory Statement SS1/23). Bank of England. https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss
Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (Digital Operational Resilience Act), OJ L 333, 27.12.2022, pp. 1–79. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554
Leave a Reply