Articles

Mainframe Data Lineage: The Critical Path to Regulatory Survival in Financial Services

July 17, 2025
Caitlyn Truong

The Billion-Dollar Cost of Operational Blindness

The financial services industry is learning expensive lessons about the true cost of treating mainframe systems as "black boxes." Over the past few years, three major banking institutions have paid nearly $1 billion in combined penalties—not for exotic trading losses or cyber breaches, but for fundamental failures in data visibility and risk management that proper mainframe data lineage could have prevented.

With mainframes processing 70% of global financial transactions daily, 95% of credit card transactions, and 87% of ATM transactions, these aren't isolated incidents—they're wake-up calls for an industry that can no longer afford operational blindness in its most critical infrastructure.

JPMorgan's $348M Wake-Up Call: When Trading Data Goes Dark

In March 2024, JPMorgan Chase paid $348 million in penalties for a decade-long failure that left billions of transactions unmonitored across 30+ global trading venues. The US Federal Reserve and Office of the Comptroller of the Currency found that "certain trading and order data through the CIB was not feeding into its trade surveillance platforms" between 2014 and 2023.

This wasn't oversight—it was systematic breakdown of market conduct risk controls required under US banking regulations.

The Mainframe Connection

JPMorgan, like 92 of the world's top 100 banks, relies heavily on mainframe systems for core trading operations. These IBM Z systems process the vast majority of transaction volume, but the critical problem emerges when trading data originates on mainframes and feeds downstream surveillance platforms. Without comprehensive data lineage, gaps create dangerous blind spots where billions in transactions can slip through unmonitored.

The $348 million penalty signals that regulators expect complete transparency in data flows. For banks running critical operations on mainframe systems without proper data lineage, JPMorgan's experience serves as an expensive reminder: you can't manage what you can't see.

Citi's $536M Data Governance Breakdown: A Decade of Blindness

The pain continued with Citibank's even costlier lesson. In October 2020, Citi received a $400M penalty from the Office of the Comptroller of the Currency, followed by an additional $136M in combined fines in 2024 from both the OCC and Federal Reserve—totaling $536M for systematic failures in data governance and risk data aggregation that regulators called "longstanding" and "widespread."

The Core Problem

The OCC found that Citi failed to establish effective risk data aggregation processes, develop comprehensive data governance plans, produce timely regulatory reporting, and adequately report data quality status. Some issues dated back to 2013—nearly a decade of compromised data visibility.

The Mainframe Reality

Like virtually all major banks, Citi runs core banking operations on mainframes where critical risk data originates. Every loan, trade, and customer transaction flows through these platforms before being aggregated into enterprise risk reports that regulators require. The problem? Most banks treat mainframes as "black boxes" where data transformations remain opaque to downstream risk management systems.

Citi's penalty represents the cost of operational blindness in critical infrastructure. The regulatory failures around data governance and risk aggregation highlight exactly the kind of visibility gaps that comprehensive mainframe data lineage addresses.

Danske Bank's $2B+ Problem: BCBS 239's Persistent Challenge

The pattern culminates with Danske Bank's ongoing struggle, which has resulted in $2B+ in penalties since 2020. While these stemmed from various violations, many could likely have been exposed earlier through proper BCBS 239 compliance. The bank's transaction monitoring failures and AML deficiencies represent clear gaps in the comprehensive risk data aggregation that BCBS 239 requires.

BCBS 239: Banking's Most Persistent Challenge

Nearly 11 years after publication and 9 years past its deadline, BCBS 239 remains banking's most persistent regulatory challenge. The November 2023 progress report reveals a sobering reality: only 2 out of 31 global systemically important banks achieved full compliance. Not a single principle has been fully implemented across all assessed banks.

The Escalating Consequences

The ECB has made BCBS 239 deficiencies a top supervisory priority for 2025-2027, explicitly warning that non-compliance could trigger "enforcement actions, capital add-ons, and removal of responsible executives." With regulatory patience exhausted, the consequences are no longer just financial—they're existential.

The Mainframe Blind Spot: Why Traditional Approaches Fail

Most BCBS 239 discussions miss a critical point: the majority of banks' risk data originates on mainframe systems that handle core banking operations and risk calculations. The Basel Committee's assessment highlights the core issue: "Several banks still lack complete data lineage, which complicates their ability to harmonize systems and detect data defects."

With mainframes handling 83% of all global banking transactions, understanding these systems is no longer optional. Yet banks continue to struggle because:

  • Legacy Complexity: Decades-old COBOL programs lack documentation and follow code patterns that traditional lineage tools can't interpret
  • Operational Opacity: Data transformations through complex JCL jobs, VSAM files, and DB2 operations remain invisible to downstream risk management systems
  • Technical Barriers: Business analysts can't access or understand mainframe data flows without deep technical expertise

How Mainframe Data Lineage Solves the Crisis

The solution lies in comprehensive mainframe data lineage that addresses these fundamental blind spots:

Complete Visibility: Modern tools can trace data flows from mainframe CICS transactions through DB2 operations to downstream systems, mapping exactly how critical risk data moves through complex transformations that conventional tools miss.

Business Accessibility: The right platforms enable business analysts to discover and act on mainframe information without requiring technical expertise—transforming data lineage from technical obscurity into actionable business intelligence.

Automated Monitoring: Real-time tracking of mainframe batch processes detects when critical risk calculations fail or produce inconsistent results, preventing the systematic failures that cost JPMorgan, Citi, and Danske Bank billions.

Regulatory Preparedness: Banks can trace exactly where specific data resides within mainframe environments and extract it rapidly when regulators demand it—the core capability that BCBS 239 requires.

The Regulatory Survival Imperative

After a decade of BCBS 239 implementation struggles and nearly $1 billion in recent penalties, it's clear traditional approaches aren't working. Banks still wrestling with data aggregation challenges haven't invested in understanding their mainframe data flows.

The evidence is overwhelming:

  • JPMorgan's trading surveillance gaps cost $348M
  • Citi's data governance failures cost $536M
  • Danske Bank's ongoing compliance failures exceed $2B
  • Only 2 of 31 major banks achieve full BCBS 239 compliance

With the ECB intensifying enforcement and supervisory patience exhausted, mainframe data lineage isn't just modernization—it's regulatory survival infrastructure.

The Path Forward: From Black Box to Transparency

The financial services industry stands at a crossroads. Banks can continue treating mainframe systems as mysterious legacy platforms while paying escalating regulatory penalties, or they can invest in the comprehensive data lineage capabilities that modern compliance demands.

The choice is clear: illuminate your mainframe data flows or continue paying the billion-dollar cost of operational blindness. With regulators expecting rapid and recurring risk data aggregation, banks can no longer afford to manage what they cannot see.

Ready to illuminate your mainframe data flows and achieve regulatory compliance? The path forward starts with understanding what you can't currently see—before regulators demand answers you can't provide.

You may also like

IBM's RPG (Report Program Generator) began in 1959 with a simple mission: generate business reports quickly and efficiently. What started as RPG I evolved through multiple generations - RPG II, RPG III, RPG LE, and RPG IV - each adding capabilities that transformed it from a simple report tool into a full-featured business programming language. Today, RPG powers critical business applications across countless AS/400, iSeries, and IBM i systems. Yet for modern developers, understanding RPG's unique approach and legacy codebase presents distinct challenges that make comprehensive data lineage essential.

The Strengths That Made RPG Indispensable

Built-in Program Cycle: RPG's fixed-logic cycle automatically handled file operations, making database processing incredibly efficient. The cycle read records, processed them, and wrote output with minimal programmer intervention - a major strength that processed data sequentially, making it ideal for report generation and business data handling.

Native Database Integration: RPG was designed specifically for IBM's database systems, providing direct interaction with database files and making it ideal for transactional systems where fast and reliable data processing is essential. It offered native access to DB2/400 and its predecessors, with automatic record locking, journaling, and data integrity features.

Rapid Business Application Development: For its intended purpose - business reports and data processing - RPG was remarkably fast to code. The fixed-format specifications (H, F, D, C specs) provided a structured framework that enforced consistency and simplified application creation.

Exceptional Performance and Scalability: RPG applications typically ran with exceptional efficiency on IBM hardware, processing massive datasets with minimal resource consumption. RPG programming language has the ability to handle large volumes of data efficiently.

Evolutionary Compatibility: The language's evolution path meant that RPG II code could often run unchanged on modern IBM i systems - a testament to IBM's commitment to backward compatibility that spans over 50 years.

The Variations That Created Complexity

RPG II (Late 1960s): The classic fixed-format version with its distinctive column-specific coding rules and built-in program logic cycle, used on System/3, System/32, System/34, and System/36.

RPG III (1978): Added subroutines, improved file handling, and more flexible data structures while maintaining the core cycle approach. Introduced with System/38, later rebranded as "RPG/400" on AS/400.

RPG LE - Limited Edition (1995): A simplified version of RPG IV designed for smaller systems, notably including a free compiler to improve accessibility.

RPG IV/ILE RPG (1994): The major evolution that introduced modular programming with procedures, prototypes, and the ability to create service programs within the Integrated Language Environment - finally bringing modern programming concepts to RPG.

Free-Format RPG (2013): Added within RPG IV, this broke away from the rigid column requirements while maintaining backward compatibility, allowing developers to write code similar to modern languages.

The Weaknesses That Challenge Today's Developers

Steep Learning Curve: RPG's fixed-logic cycle and column-specific formatting are unlike any modern programming language. New developers must understand both the language syntax and the underlying program cycle concept, which can be particularly challenging.

Limited Object-Oriented Capabilities: Even modern RPG versions lack full object-oriented programming capabilities, making it difficult to apply contemporary design patterns and architectural approaches.

Cryptic Operation Codes: Traditional RPG used operation codes like "CHAIN," "SETLL," and "READE" with rigid column requirements that aren't intuitive to developers trained in modern, free-format languages.

Complex Maintenance Due to Evolution: The evolution from RPG II (late 1960s) through RPG III (1978) to RPG IV/ILE RPG (1994) and finally free-format coding (2013) created hybrid codebases mixing multiple RPG styles across nearly 50 years of development, making maintenance and understanding complex for teams working across different generations of the language.

Proprietary IBM-Only Ecosystem: Unlike standardized languages, RPG has always been IBM's proprietary language, creating vendor lock-in and concentrating expertise among IBM specialists rather than fostering broader community development.

The Legacy Code Challenge: Why RPG Is Particularly Difficult Today

RPG presents unique challenges that go beyond typical legacy system issues, rooted in decades of development practices:

  • Multiple Format Styles in Single Systems: A single system might contain RPG II fixed-format code (1960s-70s), RPG III subroutines (1978+), RPG LE simplified code (1995+), and RPG IV/ILE procedures with free-format sections (1994+) - all working together but following different conventions and programming paradigms developed across 50+ years, making unified understanding extremely challenging.
  • Embedded Business Logic: RPG's tight integration with IBM databases means business rules are often embedded directly in database access operations and the program cycle itself, making them hard to identify, extract, and document independently.
  • Minimal Documentation Culture: The RPG community traditionally relied on the language's self-documenting nature and the assumption that the program cycle made logic obvious, but this assumption breaks down when dealing with complex business logic or when original developers are no longer available.
  • Proprietary Ecosystem Isolation: RPG development was largely isolated within IBM midrange systems, creating knowledge silos. Unlike languages with broader communities and extensive online resources, RPG expertise became concentrated among IBM specialists, limiting knowledge transfer.
  • External File Dependencies: RPG applications often depend on externally described files (DDS) where data structure definitions live outside the program code, making data relationships and dependencies difficult to trace without specialized tools.

Making Sense of RPG Complexity: The Data Lineage Solution

Given these unique challenges - multiple format styles, embedded business logic, and lost institutional knowledge - how do modern teams gain control over their RPG systems without risking business disruption? The answer lies in understanding what your systems actually do before attempting to change them.

Modern data lineage tools provide exactly this understanding by:

  • Analyzing all RPG variants within a single system, providing unified visibility across decades of development spanning RPG II through modern free-format code.
  • Mapping database relationships from database fields through program logic to output destinations, since RPG applications are inherently database-centric.
  • Discovering business rules by analyzing how data transforms as it moves through RPG programs, helping teams reverse-engineer undocumented logic.
  • Assessing impact before making changes, identifying all downstream dependencies - crucial given RPG's tight integration with business processes.
  • Planning modernization by understanding data flows, helping teams make informed decisions about which RPG components to modernize, replace, or retain.

The Bottom Line

RPG systems represent decades of business logic investment that often process a company's most critical transactions. While the language may seem archaic to modern eyes, the business logic it contains is frequently irreplaceable. Success in managing RPG systems requires treating them not as outdated code, but as repositories of critical business knowledge that need proper mapping and understanding.

Data lineage tools bridge the gap between RPG's unique characteristics and modern development practices, providing the visibility needed to safely maintain, enhance, plan modernization initiatives, extract business rules, and ensure data integrity during system changes. They make these valuable systems maintainable and evolutionary rather than simply survivable.

Interested in preserving and understanding your RPG-based systems?  Schedule a demo today.

When Grace Hopper and her team developed COBOL (Common Business-Oriented Language) in the late 1950s, they created something revolutionary: a programming language that business people could actually read. Today, over 65 years later, COBOL still processes an estimated 95% of ATM transactions and 80% of in-person transactions worldwide. Yet for modern development teams, working with COBOL systems presents unique challenges that make data lineage tools absolutely critical.

The Strengths That Made COBOL Legendary

English-Like Readability: COBOL's English-like syntax is self-documenting and nearly self-explanatory, with an emphasis on verbosity and readability. Commands like MOVE CUSTOMER-NAME TO PRINT-LINE or IF ACCOUNT-BALANCE IS GREATER THAN ZERO made business logic transparent to non-programmers, setting it apart from more cryptic languages like FORTRAN. This was revolutionary - before COBOL, business logic looked like assembly language (L 5,CUSTNAME followed by ST 5,PRINTAREA) or early FORTRAN with mathematical notation that business managers couldn't decipher.

Precision Decimal Arithmetic: One of COBOL's biggest strengths is its strong support for large-precision fixed-point decimal calculations, a feature not necessarily native to many traditional programming languages. This capability helped set COBOL apart and drive its adoption by many large financial institutions. This eliminates floating-point errors critical in financial calculations.

Proven Stability and Scale: COBOL's imperative, procedural and (in its newer iterations) object-oriented configuration serves as the foundation for more than 40% of all online banking systems, supports 80% of in-person credit card transactions, handles 95% of all ATM transactions, and powers systems that generate more than USD 3 billion of commerce each day.

The Weaknesses That Challenge Today’s Teams

Excessive Verbosity: COBOL uses over 300 reserved words compared to more succinct languages. What made COBOL readable also made it lengthy, often resulting in monolithic programs that are hard to comprehend as a whole, despite their local readability.

Poor Structured Programming Support: COBOL has been criticized for its poor support for structured programming. The language lacks modern programming concepts like comprehensive object orientation, dynamic memory allocation, and advanced data structures that developers expect today.

Rigid Architecture and Maintenance Issues: By 1984, maintainers of COBOL programs were struggling to deal with "incomprehensible" code, leading to major changes in COBOL-85 to help ease maintenance. The language's structure makes refactoring challenging, with changes cascading unpredictably through interconnected programs.

Limited Standard Library: COBOL lacks a large standard library, specifying only 43 statements, 87 functions, and just one class, limiting built-in functionality compared to modern languages.

Problematic Standardization Journey: While COBOL was standardized by ANSI in 1968, standardization was more aspirational than practical. By 2001, around 300 COBOL dialects had been created, and the 1974 standard's modular structure permitted 104,976 possible variants. COBOL-85 faced significant controversy and wasn't fully compatible with earlier versions, with the ANSI committee receiving over 2,200 mostly negative public responses. Vendor extensions continued to create portability challenges despite formal standards.

The Legacy Challenge: Why COBOL Is Hard to Master Today

The biggest challenge isn't the language itself - it's the development ecosystem and practices that evolved around it from the 1960s through 1990s:

  • Inconsistent Documentation Standards: Many COBOL systems were built when comprehensive documentation was considered optional rather than essential. Comments were sparse, and business logic was often embedded directly in code without adequate explanation of business context or decision rationale.
  • Absence of Modern Development Practices: Early COBOL development predated modern version control systems, code review processes, and structured testing methodologies. Understanding how a program evolved - or why specific changes were made - is often impossible without institutional knowledge.
  • Monolithic Architecture: COBOL applications were typically built as large, interconnected systems where data flows through multiple programs in ways that aren't immediately obvious, making impact analysis extremely difficult.
  • Proprietary Vendor Extensions: While COBOL had standards, each vendor added extensions and enhancements. IBM's COBOL differs from Unisys COBOL, creating vendor lock-in that complicates understanding and portability.
  • Lost Institutional Knowledge: The business analysts and programmers who built these systems often retired without transferring their institutional knowledge about why certain design decisions were made, leaving current teams to reverse-engineer business requirements from code.

Why Data Lineage Is Your COBOL Lifeline

This is where modern data lineage tools become invaluable for teams working with COBOL systems:

  • Automated Documentation: Lineage tools can map data flows across hundreds of COBOL programs, creating the documentation that was never written
  • Impact Analysis: Before making changes, teams can see exactly which programs, files, and downstream systems will be affected
  • Business Context: By tracing data from source to consumption, teams can understand the business purpose behind complex COBOL logic
  • Risk Reduction: Visual data flows help prevent the costly mistakes that come from modifying poorly understood legacy systems

The Bottom Line

COBOL's deep embedding in critical business processes represents a significant business challenge and risk that organizations must address. Success with COBOL modernization - whether maintaining, replacing, or transforming these systems - requires treating them as the complex, interconnected ecosystems they are. Data lineage tools provide the missing roadmap that makes COBOL systems understandable and manageable, enabling informed decisions about their future.

The next time you make an online payment, remember: there's probably COBOL code processing your transaction. And somewhere, a development team is using data lineage tools to keep that decades-old code running smoothly in our modern world.

To see and navigate your COBOL code in seconds, connect with our team today.

Mainframe modernization projects represent some of the highest-stakes technology initiatives an organization can undertake. These systems run critical business operations, store decades of institutional knowledge, and process millions of transactions daily.

Yet despite billion-dollar budgets and multi-year timelines, modernization projects fail at alarming rates—not because the technology is impossible to replace, but because teams make predictable, avoidable mistakes during planning and execution. The difference between a successful modernization that delivers ROI and a failed project that wastes millions often comes down to understanding these critical pitfalls before they derail your initiative. Here are the five biggest mistakes organizations make in mainframe modernization—and how to avoid them.

#1: Underestimating embedded complexity

Mainframe systems combine complex data formats AND decades of embedded business rules that create a web of interdependent complexity. VSAM files aren't simple databases - they contain redefinitions, multi-view records, and conditional logic that determines data values based on business states. COBOL programs embed business intelligence like customer-type based calculations, regulatory compliance rules, and transaction processing logic that's often undocumented.

Teams treating mainframe data like standard files discover painful surprises during migration when they realize the "data" includes decades of business logic scattered throughout conditional statements and 88-level condition names. This complexity extends to testing: converting COBOL business rules and EBCDIC data formats demands extensive validation that most distributed-system testers can't handle without deep mainframe expertise.

#2: Delaying dependency discovery

Mainframes feed dozens of systems through complex webs of middleware like WebSphere, CICS Transaction Gateway, Enterprise Service Bus, plus shared utilities, schedulers, and business processes. The costly mistake is waiting too long to thoroughly map all these connections, especially downstream data feeds and consumption patterns.

Your data lineage must capture every system consuming mainframe data, from reporting tools to partner integrations, because modernization projects can't go live when teams discover late in development that preserving these data feeds and business process expectations requires extensive rework that wasn't budgeted or planned.

#3: Tolerating knowledge bottlenecks

Relying on two or three mainframe experts for a million-line modernization project creates a devastating traffic jam where entire teams sit idle waiting for answers. Around 60% of mainframe specialists are approaching retirement, yet organizations attempt massive COBOL conversions with skeleton crews already stretched thin by daily operations.

Your expensive development team, cloud architects, and business analysts become inefficient and underutilized because everything funnels through the same overworked experts.  The business logic embedded in decades-old COBOL programs often exists nowhere else, creating dangerous single points of failure that can derail years of investment and waste millions in team resources.

#4: Modernizing everything indiscriminately

Organizations waste enormous effort converting obsolete, duplicate, and inefficient code that should be retired or consolidated instead. Mainframe systems often contain massive amounts of redundant code - programs copied by developers who didn't understand dependencies, inefficient routines that were never optimized, and abandoned utilities that no longer serve any purpose. Research shows that 80% of legacy code hasn't been modified in over 5 years, yet teams spend months refactoring dead applications and duplicate logic that add no business value.

The mistake is treating all millions of lines of code equally rather than analyzing which programs actually deliver business functionality. Proper assessment identifies code for retirement, consolidation, or optimization before expensive conversion, dramatically reducing modernization scope and cost.

#5: Starting without clear business objectives

Many modernization projects fail because organizations begin with technology solutions rather than business outcomes. Teams focus on "moving to the cloud" or "getting off COBOL" without defining what success looks like in business terms. According to research, 80% of IT modernization efforts fall short of savings targets because they fail to address the right complexity.

The costly mistake is launching modernization without stakeholder alignment on specific goals - whether that's reducing operational costs, reducing risk in business continuity, or enabling new capabilities. Projects that start with clear business cases and measurable objectives have significantly higher success rates and can demonstrate ROI that funds subsequent modernization phases.

Ready to modernize with confidence?

Mainframe modernization doesn't have to be a gamble. The organizations that succeed are those that proactively address complexity, map dependencies early, democratize knowledge, focus on business value, and align around clear objectives from day one. These aren't just best practices—they're the difference between transformation projects that deliver measurable ROI and those that become cautionary tales.

The good news? Modern data lineage and AI-powered analysis tools can help you avoid all five of these mistakes, giving your team the visibility and intelligence needed to de-risk your modernization initiative before investing millions in execution.

Schedule a demo with Zengines to see how AI-powered mainframe data lineage can accelerate your modernization while reducing risk, cost, and reliance on scarce expertise.

Subscribe to our Insights