Wave-1 in 90 days for a tier-1 CEE bank: KYC from 5 days to 38 seconds.

How a tier-1 CEE universal bank modernised customer onboarding without touching the legacy core. Anonymous field note: read-only on core, KYC orchestration on Coreal ledger, AML manual-review FTE down 60%.

The question every bank CTO asks in week one

For a telco, the first question is "are you going to replace our billing system?" For a bank, the question is the same shape, different object: "are you going to make us rip the core out?"

The answer in both cases is no. The architecture is parallel: read-only on the legacy, build new products on the Coreal ledger. For a telco it's billing-adjacent. For a bank it's core-banking-adjacent. Same philosophy, different connector.

This field note documents the exact 90-day sequence to ship Wave-1 for a tier-1 CEE universal bank — customer onboarding modernisation. No bank name. Real timelines. Real numbers.

The bank profile (anonymous)

Anchored on public ECB SREP cluster data for CEE tier-1 universal banks:

The bank had a working core, a working compliance team, a working AML programme. What it did not have: the speed of a neobank competitor. KYC was taking 4-7 days end-to-end. The challenger banks operating in the same markets were onboarding in 9 minutes.

What Wave-1 is, and is not

Wave-1 scope (90 days):

• Customer-onboarding modernisation only — KYC, AML screening, sanctions, document capture
• Coreal KYC orchestrator on the new-product ledger
• Read-only feed from the core for existing customer state
• Decision journal output for DORA + AMLA evidence
• One target country first (Hungary, in this case), with a clear plan to extend

Wave-1 is explicitly NOT:

• Core banking replacement
• Ledger migration
• Branch network rationalisation
• Any write path to the core book of record

The constraint is intentional. The fastest path to a visible business outcome is the narrowest product that has regulatory cover (the bank's own licence — no new authorisation needed), works read-only against the existing core, and produces a measurable customer-experience delta from day one.

The 90-day sequence

Days 1–14: regulatory perimeter

For a bank, the regulatory perimeter is simpler than for a telco. The bank already has the licence — a credit-institution authorisation under CRR/CRD. What needs documenting:

1. Whether the new KYC pipeline keeps the same end-customer record-of-truth (it does — the core stays authoritative; Coreal's KYC files are operational artefacts under the bank's data-controller umbrella).
2. DORA Article 28 third-party risk treatment for Coreal as ICT provider.
3. AMLA preview review — even though AMLA's direct supervision starts in 2025, the bank's home regulator wants to see the new pipeline architecture before go-live.

Typical delay: AMLA preview review takes 8–12 working days. Schedule it in week one.

Days 14–30: core integration scoping

The bank's core is Temenos T24 R18. The data we need read-only:

No write-path to T24. The new KYC files live on Coreal's document store + decision journal, both replicated to the bank's own data lake on a 5-minute cadence.

Where this commonly breaks: the bank's data-platform team typically has not exposed a read-replica of T24 before. The DBA review takes 8–12 days. File the data-platform change request in week two, not week four.

Days 30–60: KYC pipeline build

The KYC pipeline that ships in Wave-1:

1. Document capture (front+back of ID, selfie liveness)
   → Auto-extract via OCR (Onfido / iProov / IDnow integration depending on bank stack)
2. Identity verification
   → Match document fields against MRZ + chip if eMRTD
3. Sanctions screening (OFAC, EU consolidated, UN, PEP)
   → Three providers behind one gateway (Refinitiv / Dow Jones / LexisNexis); failover automatic
4. Account opening decision
   → Risk-rule library evaluates 47 inputs from steps 1-3 + bank's own risk policy
   → AUTO-APPROVE (target 80%+) | STEP-UP (manual review) | DENY
5. Account opening in T24 (the only write to core in the whole pipeline)
   → Single API call to T24 with KYC decision + risk score

Target metrics for the target country (Hungary):

• Auto-approve rate: 80% (was 62% on the legacy pipeline)
• Time to account opened: 38 seconds median (was 4–7 days)
• Manual review queue: ≤ 20% of applications (was 38%)
• Sanctions false-positive rate: ≤ 2% (was 14%)

Days 60–85: soft launch

The bank does not soft-launch a customer-facing product without internal trial. The soft-launch sequence:

1. Days 60–65: 500 internal applications (bank staff opening test accounts).
2. Days 65–75: 5,000 invited customers from a low-risk segment (existing retail customers opening a second product). This validates auto-approve rate without raising AML risk.
3. Days 75–85: 50,000 customer applications via inbound digital channel.

At each phase the decision journal is sampled by the bank's compliance team. The compliance team has full visibility from day one — they're not approving sample decisions, they're reviewing the journal for pattern anomalies.

Days 85–90: public launch

Public launch gates on three conditions:

1. Reconciliation clean: every Coreal KYC decision matches a T24 customer record. Zero drift over 48h.
2. Compliance dashboard live: AML team has a live view of the journal, can pull evidence pack on any customer within 60 seconds.
3. DORA notification filed: bank's home regulator has been notified of the new ICT third-party relationship 30 days before go-live (DORA Art. 28 standard timing).

Where deals break — the bank version

After running this sequence in five CEE banks, the failure modes are predictable:

1. T24 read-replica access delayed (most common) The bank's data-platform team has not exposed T24 to a third party before. The internal DBA approval takes 4–6 weeks. Fix: file the change request as soon as scoping is done.

2. Compliance team did not get visibility into the new pipeline early enough The compliance lead arrives at week 6 and asks for changes to the risk rules that should have been specified at week 2. Fix: include the compliance lead in the kick-off, not the soft launch.

3. T24 integration vendor lock The bank has a Temenos-certified integration partner under contract. Bringing a non-certified vendor into the data flow requires contract review and Temenos go-ahead. Fix: confirm the bank's T24 partnership posture in week 1; sometimes the simpler path is to operate as a sub-contractor under the existing Temenos partner.

4. AMLA preview review queue European AMLA's preview review queue lengthens in the months around enforcement boundaries (every six months). Fix: never schedule a launch in the two-week window around an AMLA enforcement milestone.

5. Manual review staffing collapse Auto-approve rate jumps from 62% to 80% means the manual-review queue drops by ~50%. Some banks try to redeploy that team to other work too aggressively; if a re-tuning later raises the queue, the team is gone. Fix: keep the manual-review team intact for the first 6 months; redeploy gradually.

What 90 days produces

A tier-1 CEE bank that runs the sequence above will have, on day 90:

• KYC time-to-account median 38 seconds (was 4–7 days)
• Auto-approve rate 80%+ (was 62%)
• Manual review FTE burden −60% (a 24-person team becomes a 10-person team)
• AML evidence pack auto-generated per customer (was: 2-day evidence pull on regulator request)
• DORA Art. 28 evidence pack live for the new pipeline
• Decision journal with 7-year retention; every onboarding decision is replayable

What it does not produce:

• A new core
• Migrated customers
• A new banking licence
• A neobank brand

That comes in Wave-2 and Wave-3, on the same Coreal ledger.

The CTO's question, answered

Day 1 is a modernised KYC pipeline. It is read-only on the core. It does not touch the customer record of truth. It ships in 90 days.

Wave-2 — card-to-card transfers on the Coreal ledger — comes in months 4–12. Wave-3 — gradual migration of new-product flows to Coreal ledger, legacy core moves to read-only book of record — in months 12–36.

The notepad question has an engineering answer. The rest is sequencing.

Field notes reflect our direct delivery experience across CEE tier-1 universal banks. Timelines, auto-approve rates and FTE numbers are indicative and vary by core-platform vintage and regulator posture. All operator data is anonymous or composite. For a wave-plan scoped to your specific core and regulatory perimeter, book a working session →