The financial services industry is learning expensive lessons about the true cost of treating mainframe systems as "black boxes." Over the past few years, three major banking institutions have paid nearly $1 billion in combined penalties—not for exotic trading losses or cyber breaches, but for fundamental failures in data visibility and risk management that proper mainframe data lineage could have prevented.
With mainframes processing 70% of global financial transactions daily, 95% of credit card transactions, and 87% of ATM transactions, these aren't isolated incidents—they're wake-up calls for an industry that can no longer afford operational blindness in its most critical infrastructure.
In March 2024, JPMorgan Chase paid $348 million in penalties for a decade-long failure that left billions of transactions unmonitored across 30+ global trading venues. The US Federal Reserve and Office of the Comptroller of the Currency found that "certain trading and order data through the CIB was not feeding into its trade surveillance platforms" between 2014 and 2023.
This wasn't oversight—it was systematic breakdown of market conduct risk controls required under US banking regulations.
The Mainframe Connection
JPMorgan, like 92 of the world's top 100 banks, relies heavily on mainframe systems for core trading operations. These IBM Z systems process the vast majority of transaction volume, but the critical problem emerges when trading data originates on mainframes and feeds downstream surveillance platforms. Without comprehensive data lineage, gaps create dangerous blind spots where billions in transactions can slip through unmonitored.
The $348 million penalty signals that regulators expect complete transparency in data flows. For banks running critical operations on mainframe systems without proper data lineage, JPMorgan's experience serves as an expensive reminder: you can't manage what you can't see.
The pain continued with Citibank's even costlier lesson. In October 2020, Citi received a $400M penalty from the Office of the Comptroller of the Currency, followed by an additional $136M in combined fines in 2024 from both the OCC and Federal Reserve—totaling $536M for systematic failures in data governance and risk data aggregation that regulators called "longstanding" and "widespread."
The Core Problem
The OCC found that Citi failed to establish effective risk data aggregation processes, develop comprehensive data governance plans, produce timely regulatory reporting, and adequately report data quality status. Some issues dated back to 2013—nearly a decade of compromised data visibility.
The Mainframe Reality
Like virtually all major banks, Citi runs core banking operations on mainframes where critical risk data originates. Every loan, trade, and customer transaction flows through these platforms before being aggregated into enterprise risk reports that regulators require. The problem? Most banks treat mainframes as "black boxes" where data transformations remain opaque to downstream risk management systems.
Citi's penalty represents the cost of operational blindness in critical infrastructure. The regulatory failures around data governance and risk aggregation highlight exactly the kind of visibility gaps that comprehensive mainframe data lineage addresses.
The pattern culminates with Danske Bank's ongoing struggle, which has resulted in $2B+ in penalties since 2020. While these stemmed from various violations, many could likely have been exposed earlier through proper BCBS 239 compliance. The bank's transaction monitoring failures and AML deficiencies represent clear gaps in the comprehensive risk data aggregation that BCBS 239 requires.
BCBS 239: Banking's Most Persistent Challenge
Nearly 11 years after publication and 9 years past its deadline, BCBS 239 remains banking's most persistent regulatory challenge. The November 2023 progress report reveals a sobering reality: only 2 out of 31 global systemically important banks achieved full compliance. Not a single principle has been fully implemented across all assessed banks.
The Escalating Consequences
The ECB has made BCBS 239 deficiencies a top supervisory priority for 2025-2027, explicitly warning that non-compliance could trigger "enforcement actions, capital add-ons, and removal of responsible executives." With regulatory patience exhausted, the consequences are no longer just financial—they're existential.
Most BCBS 239 discussions miss a critical point: the majority of banks' risk data originates on mainframe systems that handle core banking operations and risk calculations. The Basel Committee's assessment highlights the core issue: "Several banks still lack complete data lineage, which complicates their ability to harmonize systems and detect data defects."
With mainframes handling 83% of all global banking transactions, understanding these systems is no longer optional. Yet banks continue to struggle because:
The solution lies in comprehensive mainframe data lineage that addresses these fundamental blind spots:
Complete Visibility: Modern tools can trace data flows from mainframe CICS transactions through DB2 operations to downstream systems, mapping exactly how critical risk data moves through complex transformations that conventional tools miss.
Business Accessibility: The right platforms enable business analysts to discover and act on mainframe information without requiring technical expertise—transforming data lineage from technical obscurity into actionable business intelligence.
Automated Monitoring: Real-time tracking of mainframe batch processes detects when critical risk calculations fail or produce inconsistent results, preventing the systematic failures that cost JPMorgan, Citi, and Danske Bank billions.
Regulatory Preparedness: Banks can trace exactly where specific data resides within mainframe environments and extract it rapidly when regulators demand it—the core capability that BCBS 239 requires.
After a decade of BCBS 239 implementation struggles and nearly $1 billion in recent penalties, it's clear traditional approaches aren't working. Banks still wrestling with data aggregation challenges haven't invested in understanding their mainframe data flows.
The evidence is overwhelming:
With the ECB intensifying enforcement and supervisory patience exhausted, mainframe data lineage isn't just modernization—it's regulatory survival infrastructure.
The financial services industry stands at a crossroads. Banks can continue treating mainframe systems as mysterious legacy platforms while paying escalating regulatory penalties, or they can invest in the comprehensive data lineage capabilities that modern compliance demands.
The choice is clear: illuminate your mainframe data flows or continue paying the billion-dollar cost of operational blindness. With regulators expecting rapid and recurring risk data aggregation, banks can no longer afford to manage what they cannot see.
Ready to illuminate your mainframe data flows and achieve regulatory compliance? The path forward starts with understanding what you can't currently see—before regulators demand answers you can't provide.
IBM's RPG (Report Program Generator) began in 1959 with a simple mission: generate business reports quickly and efficiently. What started as RPG I evolved through multiple generations - RPG II, RPG III, RPG LE, and RPG IV - each adding capabilities that transformed it from a simple report tool into a full-featured business programming language. Today, RPG powers critical business applications across countless AS/400, iSeries, and IBM i systems. Yet for modern developers, understanding RPG's unique approach and legacy codebase presents distinct challenges that make comprehensive data lineage essential.
Built-in Program Cycle: RPG's fixed-logic cycle automatically handled file operations, making database processing incredibly efficient. The cycle read records, processed them, and wrote output with minimal programmer intervention - a major strength that processed data sequentially, making it ideal for report generation and business data handling.
Native Database Integration: RPG was designed specifically for IBM's database systems, providing direct interaction with database files and making it ideal for transactional systems where fast and reliable data processing is essential. It offered native access to DB2/400 and its predecessors, with automatic record locking, journaling, and data integrity features.
Rapid Business Application Development: For its intended purpose - business reports and data processing - RPG was remarkably fast to code. The fixed-format specifications (H, F, D, C specs) provided a structured framework that enforced consistency and simplified application creation.
Exceptional Performance and Scalability: RPG applications typically ran with exceptional efficiency on IBM hardware, processing massive datasets with minimal resource consumption. RPG programming language has the ability to handle large volumes of data efficiently.
Evolutionary Compatibility: The language's evolution path meant that RPG II code could often run unchanged on modern IBM i systems - a testament to IBM's commitment to backward compatibility that spans over 50 years.
RPG II (Late 1960s): The classic fixed-format version with its distinctive column-specific coding rules and built-in program logic cycle, used on System/3, System/32, System/34, and System/36.
RPG III (1978): Added subroutines, improved file handling, and more flexible data structures while maintaining the core cycle approach. Introduced with System/38, later rebranded as "RPG/400" on AS/400.
RPG LE - Limited Edition (1995): A simplified version of RPG IV designed for smaller systems, notably including a free compiler to improve accessibility.
RPG IV/ILE RPG (1994): The major evolution that introduced modular programming with procedures, prototypes, and the ability to create service programs within the Integrated Language Environment - finally bringing modern programming concepts to RPG.
Free-Format RPG (2013): Added within RPG IV, this broke away from the rigid column requirements while maintaining backward compatibility, allowing developers to write code similar to modern languages.
Steep Learning Curve: RPG's fixed-logic cycle and column-specific formatting are unlike any modern programming language. New developers must understand both the language syntax and the underlying program cycle concept, which can be particularly challenging.
Limited Object-Oriented Capabilities: Even modern RPG versions lack full object-oriented programming capabilities, making it difficult to apply contemporary design patterns and architectural approaches.
Cryptic Operation Codes: Traditional RPG used operation codes like "CHAIN," "SETLL," and "READE" with rigid column requirements that aren't intuitive to developers trained in modern, free-format languages.
Complex Maintenance Due to Evolution: The evolution from RPG II (late 1960s) through RPG III (1978) to RPG IV/ILE RPG (1994) and finally free-format coding (2013) created hybrid codebases mixing multiple RPG styles across nearly 50 years of development, making maintenance and understanding complex for teams working across different generations of the language.
Proprietary IBM-Only Ecosystem: Unlike standardized languages, RPG has always been IBM's proprietary language, creating vendor lock-in and concentrating expertise among IBM specialists rather than fostering broader community development.
RPG presents unique challenges that go beyond typical legacy system issues, rooted in decades of development practices:
Given these unique challenges - multiple format styles, embedded business logic, and lost institutional knowledge - how do modern teams gain control over their RPG systems without risking business disruption? The answer lies in understanding what your systems actually do before attempting to change them.
Modern data lineage tools provide exactly this understanding by:
RPG systems represent decades of business logic investment that often process a company's most critical transactions. While the language may seem archaic to modern eyes, the business logic it contains is frequently irreplaceable. Success in managing RPG systems requires treating them not as outdated code, but as repositories of critical business knowledge that need proper mapping and understanding.
Data lineage tools bridge the gap between RPG's unique characteristics and modern development practices, providing the visibility needed to safely maintain, enhance, plan modernization initiatives, extract business rules, and ensure data integrity during system changes. They make these valuable systems maintainable and evolutionary rather than simply survivable.
When Grace Hopper and her team developed COBOL (Common Business-Oriented Language) in the late 1950s, they created something revolutionary: a programming language that business people could actually read. Today, over 65 years later, COBOL still processes an estimated 95% of ATM transactions and 80% of in-person transactions worldwide. Yet for modern development teams, working with COBOL systems presents unique challenges that make data lineage tools absolutely critical.
English-Like Readability: COBOL's English-like syntax is self-documenting and nearly self-explanatory, with an emphasis on verbosity and readability. Commands like MOVE CUSTOMER-NAME TO PRINT-LINE or IF ACCOUNT-BALANCE IS GREATER THAN ZERO made business logic transparent to non-programmers, setting it apart from more cryptic languages like FORTRAN. This was revolutionary - before COBOL, business logic looked like assembly language (L 5,CUSTNAME followed by ST 5,PRINTAREA) or early FORTRAN with mathematical notation that business managers couldn't decipher.
Precision Decimal Arithmetic: One of COBOL's biggest strengths is its strong support for large-precision fixed-point decimal calculations, a feature not necessarily native to many traditional programming languages. This capability helped set COBOL apart and drive its adoption by many large financial institutions. This eliminates floating-point errors critical in financial calculations.
Proven Stability and Scale: COBOL's imperative, procedural and (in its newer iterations) object-oriented configuration serves as the foundation for more than 40% of all online banking systems, supports 80% of in-person credit card transactions, handles 95% of all ATM transactions, and powers systems that generate more than USD 3 billion of commerce each day.
Excessive Verbosity: COBOL uses over 300 reserved words compared to more succinct languages. What made COBOL readable also made it lengthy, often resulting in monolithic programs that are hard to comprehend as a whole, despite their local readability.
Poor Structured Programming Support: COBOL has been criticized for its poor support for structured programming. The language lacks modern programming concepts like comprehensive object orientation, dynamic memory allocation, and advanced data structures that developers expect today.
Rigid Architecture and Maintenance Issues: By 1984, maintainers of COBOL programs were struggling to deal with "incomprehensible" code, leading to major changes in COBOL-85 to help ease maintenance. The language's structure makes refactoring challenging, with changes cascading unpredictably through interconnected programs.
Limited Standard Library: COBOL lacks a large standard library, specifying only 43 statements, 87 functions, and just one class, limiting built-in functionality compared to modern languages.
Problematic Standardization Journey: While COBOL was standardized by ANSI in 1968, standardization was more aspirational than practical. By 2001, around 300 COBOL dialects had been created, and the 1974 standard's modular structure permitted 104,976 possible variants. COBOL-85 faced significant controversy and wasn't fully compatible with earlier versions, with the ANSI committee receiving over 2,200 mostly negative public responses. Vendor extensions continued to create portability challenges despite formal standards.
The biggest challenge isn't the language itself - it's the development ecosystem and practices that evolved around it from the 1960s through 1990s:
This is where modern data lineage tools become invaluable for teams working with COBOL systems:
COBOL's deep embedding in critical business processes represents a significant business challenge and risk that organizations must address. Success with COBOL modernization - whether maintaining, replacing, or transforming these systems - requires treating them as the complex, interconnected ecosystems they are. Data lineage tools provide the missing roadmap that makes COBOL systems understandable and manageable, enabling informed decisions about their future.
The next time you make an online payment, remember: there's probably COBOL code processing your transaction. And somewhere, a development team is using data lineage tools to keep that decades-old code running smoothly in our modern world.
To see and navigate your COBOL code in seconds, connect with our team today.
Mainframe modernization projects represent some of the highest-stakes technology initiatives an organization can undertake. These systems run critical business operations, store decades of institutional knowledge, and process millions of transactions daily.
Yet despite billion-dollar budgets and multi-year timelines, modernization projects fail at alarming rates—not because the technology is impossible to replace, but because teams make predictable, avoidable mistakes during planning and execution. The difference between a successful modernization that delivers ROI and a failed project that wastes millions often comes down to understanding these critical pitfalls before they derail your initiative. Here are the five biggest mistakes organizations make in mainframe modernization—and how to avoid them.
Mainframe systems combine complex data formats AND decades of embedded business rules that create a web of interdependent complexity. VSAM files aren't simple databases - they contain redefinitions, multi-view records, and conditional logic that determines data values based on business states. COBOL programs embed business intelligence like customer-type based calculations, regulatory compliance rules, and transaction processing logic that's often undocumented.
Teams treating mainframe data like standard files discover painful surprises during migration when they realize the "data" includes decades of business logic scattered throughout conditional statements and 88-level condition names. This complexity extends to testing: converting COBOL business rules and EBCDIC data formats demands extensive validation that most distributed-system testers can't handle without deep mainframe expertise.
Mainframes feed dozens of systems through complex webs of middleware like WebSphere, CICS Transaction Gateway, Enterprise Service Bus, plus shared utilities, schedulers, and business processes. The costly mistake is waiting too long to thoroughly map all these connections, especially downstream data feeds and consumption patterns.
Your data lineage must capture every system consuming mainframe data, from reporting tools to partner integrations, because modernization projects can't go live when teams discover late in development that preserving these data feeds and business process expectations requires extensive rework that wasn't budgeted or planned.
Relying on two or three mainframe experts for a million-line modernization project creates a devastating traffic jam where entire teams sit idle waiting for answers. Around 60% of mainframe specialists are approaching retirement, yet organizations attempt massive COBOL conversions with skeleton crews already stretched thin by daily operations.
Your expensive development team, cloud architects, and business analysts become inefficient and underutilized because everything funnels through the same overworked experts. The business logic embedded in decades-old COBOL programs often exists nowhere else, creating dangerous single points of failure that can derail years of investment and waste millions in team resources.
Organizations waste enormous effort converting obsolete, duplicate, and inefficient code that should be retired or consolidated instead. Mainframe systems often contain massive amounts of redundant code - programs copied by developers who didn't understand dependencies, inefficient routines that were never optimized, and abandoned utilities that no longer serve any purpose. Research shows that 80% of legacy code hasn't been modified in over 5 years, yet teams spend months refactoring dead applications and duplicate logic that add no business value.
The mistake is treating all millions of lines of code equally rather than analyzing which programs actually deliver business functionality. Proper assessment identifies code for retirement, consolidation, or optimization before expensive conversion, dramatically reducing modernization scope and cost.
Many modernization projects fail because organizations begin with technology solutions rather than business outcomes. Teams focus on "moving to the cloud" or "getting off COBOL" without defining what success looks like in business terms. According to research, 80% of IT modernization efforts fall short of savings targets because they fail to address the right complexity.
The costly mistake is launching modernization without stakeholder alignment on specific goals - whether that's reducing operational costs, reducing risk in business continuity, or enabling new capabilities. Projects that start with clear business cases and measurable objectives have significantly higher success rates and can demonstrate ROI that funds subsequent modernization phases.
Mainframe modernization doesn't have to be a gamble. The organizations that succeed are those that proactively address complexity, map dependencies early, democratize knowledge, focus on business value, and align around clear objectives from day one. These aren't just best practices—they're the difference between transformation projects that deliver measurable ROI and those that become cautionary tales.
The good news? Modern data lineage and AI-powered analysis tools can help you avoid all five of these mistakes, giving your team the visibility and intelligence needed to de-risk your modernization initiative before investing millions in execution.
Schedule a demo with Zengines to see how AI-powered mainframe data lineage can accelerate your modernization while reducing risk, cost, and reliance on scarce expertise.