The Bank of New York Mellon Corporation (BNY) Earnings Call Transcript & Summary

Okay. Disclosure first and then intro. For important disclosures, please see Morgan Stanley research disclosure website at morganstanley.com/researchdisclosures. The taking of photographs and use of recording devices is also not allowed. If you have any questions, please reach out to your Morgan Stanley sales representative. Okay. With that as a backdrop, I am thrilled to have with us today, Bridget Engle, Chief Information Officer and Head of Engineering at BNY Mellon. Thanks so much for joining us.

Thank you for having me.

Bridget, so you've had a very varied experience in technology in a variety of different financial organizations. And BNY Mellon has just so many different parts of all of those threads; wealth, global markets, payments, et cetera. And I think you've talked openly about some resiliency challenges that were faced by BNY Mellon when you joined, when was that, in 2017?

Yes. Yes.

And you have made massive modernization investments in the plant and equipment here at BNY Mellon. So, if you could just give us a sense as to where you are on the resiliency journey? And maybe you could also describe what resiliency really means to you, it would be helpful. And where do you feel your investments have already paid off?

Sure. So, first of all, what does resiliency mean to me? I use, maybe it's a little bit dating myself, but I think dial tone, right? We have to make sure that for our clients, there is a dial tone every time you pick up the phone. And so everything that goes into making sure -- bad things happen, oftentimes, the CEO or Board don't necessarily want to hear that there was a problem. But unfortunately, technology fails, software fails, hardware fails. And so each one of those pieces has to make sure it picks up and a lot of that, oftentimes, I say goes to a question of imagination. Can you imagine all the things that can possibly go wrong? And can you put different mitigants in place to actually overcome that? So yes, I think -- when I think about when I arrived, I wasn't sure I had the disclosure. There was an enormous book of work that I had when I walked into the bank when I joined 5 years ago and end-of-life hardware, software, inconsistent software and data and frankly, just too many high-priority incidents that were impacting our clients. So, we made significant investments to upgrade our infrastructure. And back then, we were spending roughly about $2.5 billion. And over the course of the years, that has risen to last year, $3.5 billion, in terms of our investments. And so a lot of what we went into was evaluating where we were and how much resiliency we had. So one of the things we made an active decision to do was to add another data center into our footprint, because we had two. But in order to get the kind of real-time resiliency we needed, we needed a data center that was within, if you will, a 30-mile radius roughly thereabouts, but that was because we wanted to have data replication. And that's important to make sure that we can recover our transactions from a real-time perspective, so adding additional data center into the footprint. We also invested in effectively rebuilding all of our infrastructure. We basically if you can imagine, put up a wall and we took new floor space and we laid out our whole architecture for the physical plant and the data centers. And we set them up in neighborhoods for each of our businesses. And we did that with a very intentioned sort of point of view that we wanted to make sure that we had isolated pockets. I often describe it as a submarine or a battleship. If one of those were to take a missile or have something go wrong, you can shut off the compartments and contain the water from spreading into other parts of your businesses. And so by having these neighborhoods as we set up the infrastructure, that allowed us to have a lot more agility and to really reduce the surface area of problems, should they occur. The other thing when we went about doing this, we didn't build in traditional hardware. We went after software-defined IT infrastructure that was largely a hyper-converged infrastructure that allowed us to have a private cloud complex within the businesses in terms of what we had. And then as a part of that, we went through and we assessed all of our applications that were in our distributed portfolio. And we virtualized over 95% of them in either containers or in virtual machines, VMware, those kinds of technologies. And the reason for that was it gives you a great deal of agility. So in today's world, one of the biggest challenges we all talk about is cyber, right? And so "Log4j" was something that was out there. It's a vulnerability, but they didn't get it right. We wound up patching, multiple times, in terms of having to patch across the environment. And having those virtualized, containerized environments gave us a great deal of agility without the risk of kind of hurting our systems or taking them down. The other thing we invested in was enhancing our monitoring. So oftentimes, we have signals or signals intelligence, right, kind of like the intelligence community uses. All of the telemetry from our infrastructure we brought into our monitoring ecosystem, and we visualize that in our CTOC, which is our Cyber, Technology & Operations Center that sits on our executive floor. It's got a beautiful 106-foot digital screen. But really, it was democratized and it (sic) [ data that ] was previously locked up. And I sometimes talk about it as like a doctor, the orthopedic has his specialty, the heart doctor has their specialty, and they all have their tools. Well, similarly, in technology organizations, we have people who understand the servers, people who understand storage or network and even something like databases. There's not just one tool set. If it's Oracle or Sybase or Snowflake, each of them have different tools. And so when you have problems, what do you wind up doing? Oftentimes, many companies, they have an incident call. Everybody gets on and they go, "What do you see? What do you see?" And so you have to get the diagnostic. And this ultimately gives us huge transparency across the environment with AI and ML to make sure, again, that we can kind of draw those insights. So years ago, in terms of payoff and results, we were seeing hundreds of those kinds of problems. We've seen virtually none in the last 18 months. So significant improvement in terms of the incidents and problems. At the same time, we look at the number of changes we put through our environment, which we've more than doubled over the course of the last number of years with very few incidents, basically four nines of reliability (sic) [ e.g., 99.99% success rate ] as a result of change, nothing kind of impacting the environment. So, I would say the systems have performed well, and we've seen that through COVID as well as all the volatility in the last number of years. And I think now that we've got the foundations in place, the payoff isn't so much monetary as it is in clients, and they see the difference, and we hear that from -- them in terms of resiliency being a commercial attribute for what we do. And now that even our CEO talks about resiliency being commercial, I think it's kind of permeated the organization.

Okay. Great. That's a great backdrop and understanding. It sounds like you've taken the organization to a place where you are ahead of the pack as opposed to when you started, right?

Yes. You have to keep running. So I never like to say ahead of it, but we have to keep on that treadmill.

So when I'm thinking about the coming years, can you give us a sense as to how you're expecting the technology investment strategy to develop and change?

Sure. So now that the foundation is placed, I always like to liken this to a building. To me it's like we've set the concrete and that's the foundation. Now we have to actually deal with the house, and the house are our applications and our systems. And so a lot of work is going into simplifying and modernizing our application portfolio. Overall, the number of applications that we have has remained rather constant. However, the mix of the kinds of applications we have within the portfolio has changed quite a bit. And so we've decreased the on-prem applications that we have by roughly 15%. We've reduced our mainframe footprint in applications by 23%. And we've retired over 1,000 applications as a part of the work that we're doing. But we've also built contemporary applications, so back to -- we've got roughly the same number of applications. We've been building applications and leveraging more cloud and SaaS applications as part of the overall mix. When I talk about simplifying and modernizing, maybe just making it real. There's a computer science adage that's called Conway's Law, and it states that systems, technology represents the organizations and the communication structure that built them. And so what in sort of simple terms, that means is we've got these monolithic applications that have multiple components in them that do not lend themselves to agility. They don't lend themselves to being able to make changes at speed and pace to be responsive to your clients. And so our strategy is to take those applications and decompose them into service-based architecture that allows us to be much more agile in terms of what we're doing. We also, no surprise, have data that's locked up in those silos and those systems. And so investing in our data and breaking that down and making sure we have a single source of truth with single master reference data that is used throughout the firm. And kind of the analogy I talk about is that we have clean water running through our pipes, but also that each of the businesses is using that data to connect things like clients. The other areas we're investing in is digitization and automation. And we've made a lot of progress, but we still have 20,000 people in our operations, and they're still doing more manual, repetitive tasks and we think that we can do better. There's north of 13,000-plus faxes that come into the environment, and we've been looking for innovative ways to be able to combat that. And one of the things we've done was to create some tools that allow us to basically put a zero-footprint application on our clients' desktops and to communicate with them more digitally. It allows for chat, and we're able to meet them where they are in terms of helping to drive the real-time engagement, in terms of file exchanges and the like. And then the last is really driving the company to be much more agile. I think that will generate more speed and productivity for the firm.

Okay. So there's a lot to unpack there. I just have one very simple question on the faxes. I thought we got rid of them, but when you say 13,000, you're talking about...

A day.

A day?

A day.

Okay. So I guess some users need retraining.

Well, it's an opportunity for us to work with our clients on what we can do to help them.

Great. Okay, good. I wanted to unpack a few things. But before I do that, I do want to just ask about a recent announcement, Pershing X, Wove platform. Is that an example of a house on top of the foundation? Or how would you describe what that is?

Yes. I think that's a great kind of example of building. And that was built from both to take the house analogy, both new lumber that we brought in, but we were also able to salvage things as a part of looking at our wealth tech capabilities and using those to be able to be a more modular house in terms of the acceleration of what we're building.

Because maybe you could just describe in a couple of bullet points what Wove is for people who might not have seen the press release yet.

So Wove, -- and I think the problem that we're trying to resolve for the wealth advisors is this "swivel chair," right? So they've given it a name, as our teams have talked about, and just swivel chairing between the different applications. And so it's really a single intuitive place to be able to bring together the workflows, the tools that the financial advisors need to be able to deliver to their clients. And we think that there's a lot more. I mean this is just our launch that we talked about last week, but we think there's obviously a road map in terms of how we're going to deliver that.

Okay. You mentioned agile and that you're moving towards an agile dynamic operating model. How should we think about the investment spend required to deliver those agile results?

So I think there's two ways to maybe look at, I think, the investment spend. I think we're roughly, as I said, spending $3.5 billion and part of that is also generating efficiencies. And so one of the questions, I think, is do you capture that efficiency and take that to the bottom line and reduce your investment spend? Or do you redeploy that capacity in terms of, perhaps, more modernization, investing in creating new products to be able to drive higher market share growth or maybe even build more scale and capture more efficiency. From an agile perspective, what I'm sort of very excited about is that it reduces what I call the "wait state" for technology. And I've seen this. This is not just a phenomenon at this bank. But IT typically finds itself in traditional waterfall methodologies, waiting for requirements that are never on time, that are never complete. They're changing all the time. And so in agile development, I think bringing those pods of individuals together rather than that happening side of desk is going to bring significant productivity to the work that we do. And again, I think Pershing X was really a great example of that in terms of we hired our employee #1 towards the end of 2021 (sic) [ Engineers started in mid-2022 and six ] months later, we had an MVP because this was done in a fully scaled agile way. And so that first MVP was out there. And then 6 months later, we went live with that. And as the team has matured their agile practices and rituals, we've seen a 40% increase in terms of the number of sprints delivered over that period of time, with the team just getting better and better at the groove working together with themselves.

Okay. Great. Just backing up for one second to the budget that you mentioned, $3.5 billion on technology. Could you give us a sense as to what the governor on that tech budget is? Is that your decision? Is it business units that own it? And maybe you can give us a sense of also the composition of that budget between, say, run the bank, change the bank type of thing?

It's funny. Sometimes the different business leaders think I am the one making the decisions, and I'm not. I tell them that all the time. But I do have obviously a voice in terms of making sure we are thinking about technical debt and where we are in investing for the future and making sure we're not missing opportunities. But that $3.5 billion you talked about is roughly 20% of the core revenue, and we don't really see a big step change this year. But as a firm, we don't calibrate the tech spend as a percent of revenue. We really think each investment has to stand on its own. And so whether the question is, does it have compelling economics? Is it driving growth for the firm? Are we able to get maybe more scale and efficiency or a better client experience? Those are the primary things that we're really driving with the organizations. And I think the other things maybe just to add is that as a firm, we're pivoting towards higher ROI, more tangible payback. To your question on the percent of run versus change, we've really sort of moved into, about 50% now being on change, the bank initiatives. And within that, that may understate the impact to retrospectively look because in prior years, one of the things we were doing with that change budget was not just building change for the infrastructure, but it was also how do the applications work? Do I need them to make changes in the way the application behaves or other characteristics in order to get the resiliency or recovery benefits that we had to have? So now that we have brought our applications to this heightened level of resiliency, and we're exercising that on a pretty regular basis in terms of rotating our applications across our different data centers. So we don't just do DR (sic) [ "disaster recovery" ] tests any longer, we're actually practicing that through the rotations. I think more of that is really going towards change the bank. The other point maybe to make is disciplined prioritization, so really focused on margin. Most of the growth spend is going towards the Market and Wealth Services businesses, which had a 48% pretax margin last quarter. And then the efficiency spends, the dollars we're earmarking for efficiency are earmarked for Securities Services, our Investment Management, our Wealth Management businesses. And then the other point maybe also to highlight is that as a firm, we're self-funding more. And so we're seeing nearly 2x the efficiency saves that -- we've seen in the last couple of years. And technology, I'm proud to say, has been a big part of helping the firm get there in that. So -- and one of the key things we talk about with the team is making sure we have the tools to measure and track our performance and make sure that the batting averages for all the teams, they know where they are and where we think they can actually do better. But over the longer term, I think the trajectory is flattening as the resiliency investments have faded, and I think we're getting more done for the same dollars.

So are you suggesting that the level of spend as a percentage of revs comes down over time? Or is there a slower growth rate in tech spend that we should be expecting?

I think it's hard to call it because I think the appetite is there as a firm to invest if the returns are there, which is why I said, we don't really look at that as a percent of revenue as much as, do we believe in what we think is our business case. And so again, a great example was this Pershing X belief and how we decided as a firm to be able to put the dollars behind that and to see that business grow. And I think with the results, the fact that we've executed in record time. I think this is one of the things. Sometimes you say things, but do you really execute on it? And can you kind of see the momentum behind what's being done? And that's why I think that question of track record, and so are people delivering, will be a key theme in terms of the firm and how we reward investments.

So you've mentioned several of the different businesses just now that BNY Mellon's involved in. You've got Pershing, core servicing, multiple investment boutique managers, for example. There's more beyond that. How do you think about integrating the tech stack so that all the systems are interoperable? Are they already at that stage at this point with the foundation that you've laid?

So the foundation has been about a lot of the infrastructure. Again, we've created some agility through that virtualization and containerization. But one of the things we have done that has built, I think, a fair amount of integration without full modernization has been our investments in terms of APIs. It allows our systems, even legacy, to be able to talk to one another and our clients to be able to integrate with us in a much easier way. And the APIs are especially useful in this journey as we're driving modernization to be able to kind of accelerate those efforts to connect our systems. And one of the measures, just to kind of put some stats behind it, the number of APIs we have has tripled over the last number of years across our both internal and our external APIs with a 10x increase in terms of the APIs for our clients and an 18x increase in the number of APIs internally. So I think that would underscore our systems are talking to one another. And in January of this year, we saw a record 912 million API calls in just that month. So we are seeing a lot of activity and APIs, I think, are a key part of what we're doing. The second has been this journey that we talked about in terms of data. Many companies, as we said, are kind of built in this siloed way. And getting that master data, even though it has taken sometimes, often times, I don't know if you've seen the movie, but like building the Field of Dreams. Will they come, right? And so we've built enterprise client master data, product master data, securities data with a great example of two systems built over time using different security masters. Having reconciliation problems downstream. Well, it's no real surprise, right? So this is just getting it on the priority list and making sure we're getting these items cleaned up and then continuing this journey of decomposing and driving the service-based architecture. And I think one of the things we have tried to do to make sure because, again, you can have great intent but how do you actually make it realized inside the organization, and we've created a robust architecture function. And sometimes, they kind of are the lofty tower and so forth. But they really are a part of looking through as we build applications as we set out the architecture, do they have the right stack? Are we reusing capabilities that exist in another business? So again, back to Pershing X. One of the reasons that they were able to move so quickly is they took LEGO blocks out of the kit of our wealth tech and put them into the house that they were building for Pershing X. And that's been enormous in terms of an accelerator for us.

Is cloud a part of this as well?

So cloud is definitely a part of our journey. At this point, we have roughly 25% of our applications that are in the public cloud. And our strategy is to be able to leverage the capabilities and the economies of scale to be able to drive the business and to serve our stakeholders. One of the things to maybe highlight is, I think oftentimes people try and start the cloud journey, and they haven't looked at our (sic) [ their ] applications. One of the things, even though it was a bit more infrastructure-focused was, we talked about the fact that we rationalized a lot of our applications, retiring 1,000 as we went through. But we also, as I said, moved them to virtualization and containerization. And that ultimately gave us cloud-ready workloads that give us a good position to be able to use the cloud. Ultimately though, our strategy is to be able to use the cloud for the right things at the right time. I think one of the things people have found is that data egress charges out of the cloud wind up eroding what you think are your cost savings because you've only moved parts of your workload across the environment. And so we've been thoughtful about what is it that we are moving? Is it actually going to increase our toll charges in terms of how we're building them? But on the other hand, for elastic on-demand workloads like those we're doing with data science, it's been an enormous boost in terms of making sure you can spin up 1,000 GPUs and turn that down as you don't need it anymore. So I think it's sort of fit-for-purpose, use case driven and really trying to make sure we unlock the agility that we need.

Okay. So it sounds like you're benefiting from automation in significant ways. Is there anything that you're benefiting from that we haven't touched on yet as it relates to automation?

We had talked through our accounting automation. And I think the one thing there has been we really focused on trade capture, making sure we're getting all trades in and getting that to STP. When we were starting some of this, it's a pretty poor stat, but we were like at 6%. And we have progressed that to over 90% in terms of where we are in terms of trade capture and making sure that we can drive NAV production across the environment. I think reconciliations and the repair process through automation has benefited greatly from the investments we made. And then payments is just obviously eking out the last couple of percentages. We're at 97.7%. And driving to 100%, probably never be at exactly 100%, but driving to drive as fast as we can.

Now you oversee a huge amount of data and you get a view on the financial world globally that is probably second to none. What do you see as the near- and medium-term opportunities associated with that?

I think all of the work that we've done to invest in data and you just kind of step back and say, we're touching 20% of the world's investable assets. And we really do think that, that gives us a really amazing view into one of the world's most expansive data sets. And I think everything I touched on in terms of all of the data investments, creating certified, authorized data sets for each of our lines of businesses, and making sure that we get them into our lake. So that's a place that everyone gets to be able to source that out of the environment. Making sure we can inventory and catalog and provide the lineage because -- not just from a backup, we obviously have regulatory obligations that we have to be able to do that. But the richness of that data, I think, translates into unique insights for our clients and better inform more commercial decisions. I think one example is the cloud-based Data Vault that we launched that we believe can help our clients to collect, connect, store and be able to distribute their data across their organizations. And we can share it to them seamlessly via the Vault, the clients get to see the full relationship in all of their data in that. And I think the other is leveraging those unique vantage points that we have in terms of the intersection of markets and where we can really provide new client-facing insights with our Alta Report or the iFlow Insights report.

What about artificial intelligence, the buzzword of at least this year? Can you give us a sense as to where BNY Mellon stands on this topic and any use cases that you're anticipating here over the medium term?

Sure. I think we are very excited. I think everybody is very excited about AI, and the use cases typically for us fall into predictive analytics, anomaly detection. There's been automation capabilities that we see. And then more broadly, knowledge management with all of the unstructured data that exists across the ecosystem. I think one great example of more of the traditional AI is, you may know we're the sole provider of clearance services for the U.S. Treasury market. We settle $10 trillion every day. And so as a part of that, a small portion of those transactions actually fail to settle and are a cost for our clients. So not something they asked for, but our teams identified and built a predictive machine learning model that basically assigned the probability of settlement failure. And so we were able to take that, deliver that out to markets and connect that to clients to avoid those kinds of failures through the environment. But I think the thing everybody, obviously -- this watershed moment back in November with generative AI and ChatGPT and the like. I think the potential there is -- it's profound. I mean I think it's probably on par with the advent of the Internet and what it's going to mean for financial services and markets. And one of the things is really ultimately mobilizing that vast amount of data that we said, both structured and unstructured, to be able to leverage that in generative AI, and hyper-personalization and delivering that to our clients and new solutions that our businesses are imagining. And it's even, if I just turned sort of introspectively on ourselves, Copilot has been around for a while. But with what they've done with the ability to have a "copilot," effectively a paired programming partner for our developers. Their code quality, their time to deliver is going to accelerate dramatically. And one of the things I've talked to many of the tech companies, and I'm seeing kind of the early signs of this is, we still -- we've talked about that modernization, right? COBOL code, Fortran, large language models, programming languages have a lexicon and a taxonomy to them. I think they're going to lend themselves very well to being translated into more contemporary languages. And so people have had to slog through hundreds of millions of dollars, years and years of investments, to modernize many of those assets. And I think we're at the sort of interesting inflection point, where I think this is not going to be science fiction but going to become a real reality.

So in our 1.5 minutes left, one question on talent, one question on cyber, one question on outlook. So speed round, 30 seconds each. How do you think about talent acquisition with everything you just mentioned?

It's everything. I mean the talent really powers -- so, focused on early stage building our talent, not just buying our talent. Making sure we're getting diversity through our campus, we have just tripled the number of campus hires that we've done this year. Making sure they have just-in-time training and we're using AI to help them in terms of tipping them along in that regard.

Okay. Cyber risk. How do you protect yourself against that?

This is a long -- that in 30 seconds. But cyber is the biggest risk, and I think it's the one that...

We'll go over for you.

Okay.

Yes.

So phishing, smishing, vishing, these a -- 75% of breaches are traced to the human element. And so we have to make sure that we are vigilant. And when you look at the generative AI -- you used to be able to spot phishing because the grammar, it was imperfectly done. Now you've got these engines that are going to write them perfectly and you're not going to be able to tell, right? People get texts, the smishing on their phones. I have no technology to be able to protect people from that. And people are going to websites that look like ours, entering credentials and people are sitting on the other end of that. Which brings me to the scariest thing I've seen and learned about is the selling of credentials. There are hundred million dollar Bitcoin wallets on the dark web. They don't have to hack anymore. They are buying credentials to be able to get into systems. And so that is something that I think has made me take notice. And so a lot of this is looking at our controls, how we're investing. Trusted Access is something that is a kind of brand-name internally, but it really is about zero trust principles and making sure that we basically take down to a minimum viable requirement what access people need and only ask them to step up with multifactor or other kinds of controls to make sure that they're not able to just go to any website without actually thinking about it before they go.

Okay. Last question here is -- and I think we might have already answered this, but you tell me, the next significant development in tech that will impact the financial services industry.

Yes. I mean I think you have to -- I was going to say, I think if you thought about financial services, there's also not just AI, but the blockchain and where digital assets go. I don't think that's over. I think digitizing assets, tokenizing them is going to be -- tokenization is a key technology that has a lot of promise. But I don't think it's as high as kind of what we're going to get out of the generative AI.

Okay. So that's our next 30-minute session. Bridget, thanks so much for joining us today and teaching us a lot about what's going on at BNY Mellon's tech infrastructure. Thank you.

Thank you.