CLM software for banks: buy, build, or extend?

CLM software for banks can be bought, built, or extended — and many institutions make the wrong decision because they treat it as a pure cost issue rather than a risk issue. This article is Part 2 of our mini-series on Customer Lifecycle Management for Banks and provides the decision-making framework: which option is viable in which situation, what in-house developments actually cost historically, and which regulatory requirements frame a purchase decision anyway.

Customer Lifecycle Management for Banks: Build, Buy, or Extend at a Glance

With Customer Lifecycle Management software for banks, there are basically three paths open: complete in-house development (Build), purchasing a market-ready platform (Buy), or a hybrid solution where commodity functions are purchased and differentiation layers are built in-house (Extend). Deloitte summarizes the trade-offs as follows: "Buy" delivers the majority of required capabilities faster and with vendor expertise, but brings vendor lock-in, limited control, and innovation restrictions; "Build" gives full control, but creates additional complexity, higher costs, and a higher design, build, and maintain risk. No option alone delivers all desired outcomes — a balanced hybrid is recommended (Deloitte UK, "The new blueprint for digital banking").

The "sweet spot" described by FIS concretizes this hybrid: buy 70–80% of the required functions — commodity functions, compliance modules — and only build the differentiation layers, such as scoring or pricing logic, in-house (FIS, "Modernizing asset finance: The build vs. buy decision", 2025). For CLM platforms in banking, this specifically means: data governance, consent management, core banking system connectors, and regulatory reporting are commodities — in-house development is almost never worthwhile here. The actual orchestration logic and fine-tuning of scoring models, on the other hand, can be differentiating.

What In-House Developments Actually Cost Historically

The database on build risks is much more robust than many decision-makers assume. An analysis of over 5,400 IT projects with budgets exceeding $15 million shows: projects were on average 45% over budget, 7% over schedule, and delivered 56% less value than planned (McKinsey with the BT Centre for Major Programme Management at the University of Oxford, October 2012). 17% of the large-scale projects examined are even considered "black swans" with 200–400% budget overruns that can threaten the existence of the company — software projects carry the highest risk (McKinsey 2012). Particularly relevant for multi-year, in-house CLM developments: each additional project year increases cost overruns by 15% (McKinsey 2012).

Two specific banking examples from the same study illustrate the risk: a bank's data warehouse project was aborted after 18 months and around $10 million; in another case, the delayed involvement of the finance department postponed the go-live by over three months and cost more than $8 million (McKinsey 2012). The Standish Group CHAOS Report confirms this pattern based on size: large projects achieve only an 11% success rate (59% "challenged", 30% failed), whereas small projects achieve 61% success — based on over 25,000 projects from the years 2011–2015 (CHAOS Report 2015). An agile approach improves the rate significantly but does not eliminate the risk: agile projects achieve 39% success compared to 11% for waterfall, and for large projects 18% compared to 3% — large waterfall projects fail completely in 42% of cases (CHAOS Report 2015). Citing McKinsey, FIS gets straight to the point: "Two out of three large technology programs regularly exceed their original budget, miss schedules, and fail to fully deliver the expected business objectives" (FIS 2025).

Time-to-Value: The Often Underestimated Factor

In addition to the risk of failure, speed also speaks clearly in favor of purchased or hybrid solutions. Companies that prioritize time-to-market over perfect customization achieve a 2.3 times faster ROI through vendor partnerships, quoted from Deloitte (FIS 2025). According to the same paper, pre-built SaaS platforms achieve ROI within 3–6 months (FIS 2025). Integration speed has also changed structurally: with modern purchased core platforms and open APIs, partner onboarding time dropped from 9 months to 6 weeks (FIS 2025).

For banks, there is also a structural budget restriction: up to 70% of technology budgets are spent on mandatory maintenance and compliance ("Run the bank") — capacity for multi-year, in-house development is thus effectively limited, while global technology spending in banking increased by an average of 9% p.a. to $650 billion in 2023 (FIS 2025). Anyone who builds anyway is therefore competing for a shrinking remaining budget.

The Often Underestimated Buy Risk: Coupling Instead of Modularity

However, purchase decisions are not a sure-fire success. Deloitte identifies a risk that is frequently overlooked in vendor selection processes: platform providers often design their systems for maximum feature utilization, leading to unintended coupling and reduced modularity (Deloitte UK). Anyone purchasing a CLM platform should therefore explicitly check how easily individual modules — such as the prediction model or the orchestration layer — can be replaced without putting the overall system at risk. Our article on seamless integration without rip-and-replace delves deeper into how systems can be integrated without migration risk.

The Regulatory Constraint Framing the Decision

In the EU, the buy decision is not free anyway — it is bound by verification obligations. Before concluding a contract, institutions must assess whether a critical or important function is affected, check the supervisory requirements, identify all risks, conduct due diligence on the service provider, and assess conflicts of interest (para. 61 of the EBA Guidelines, applicable since September 30, 2019) (EBA Guidelines on outsourcing arrangements, EBA/GL/2019/02). For critical or important functions, the guidelines additionally require a documented exit strategy (para. 106), unrestricted inspection and audit rights for the institution and the supervisory authority (para. 87), and a substitutability assessment indicating alternative service providers and estimated annual budget costs in the outsourcing register (para. 55) (EBA/GL/2019/02). In essence, these requirements favor providers that inherently incorporate data sovereignty, auditability, and changeability, rather than grafting them on after the fact.

How Acceleraid Concretely Implements the Extend Approach

Acceleraid explicitly positions itself in the extend segment: the platform delivers CDP & Data Governance, Prediction Engine, CLM/CVM Orchestration, Experience Optimisation, and Regulatory Reporting as a purchased foundation — including German hosting and GDPR-by-design — while the AI model itself remains replaceable at any time, preserving knowledge, contexts, and configurations (Acceleraid Platform). For banks, the GenAI & LLM Enablement module with PII filtering can be deployed live in 8 weeks — a concrete proof of time-to-value for the buy/extend approach in their own product (Acceleraid Banking). Over 250 enterprise deployments and an ROI typically achieved in 6–9 months support the thesis that the sweet-spot approach of buying plus targeted extension works in practice (Acceleraid Platform).

Conclusion: Customer Lifecycle Management for Banks Needs No Build-or-Buy Ideology

The data is clear: in-house development of CLM software carries an empirically high risk of failure, while purchased or hybrid solutions deliver value faster and meet regulatory requirements more easily. The real decision is not between build and buy, but where exactly the line is drawn between commodity function and differentiation layer. The final part of this mini-series on the Operating Model addresses how this decision is subsequently anchored organizationally in teams, processes, and governance.

Illustration: AI-generated. AI-supported content: In creating our articles, we use AI technologies and automated agents, including those from Microsoft, Google, OpenAI, Anthropic, and other providers. Topics, technical direction, and final approval rest with our team.