Ask anyone in a bank, insurer or lender where a figure in a regulatory report came from, and you will usually get an answer. It might take a few days, involve a few people, and require some digging, but the trail is usually there.
For a long time, that was enough. Evidence was assembled when needed, and that process was accepted. The expectation has now changed. It is no longer enough to find the answer. Organisations need to show it, on demand and at scale.
BFSI organisations face increasingly complex regulatory obligations that require evidence for transactions, PII, and other sensitive data. These include Anti-Money Laundering, Privacy Acts, the Credit Contracts and Consumer Finance Act, credit codes, and a range of prudential standards.
Most organisations have relied on manual reconstruction to meet these demands. They trace the journey after reporting, with people who know where to look. That approach works in isolated cases, but it does not prove lineage at scale.
Regulators, auditors, and the business now expect automated, continuous traceability. The requirement has shifted from “we can produce this if you give us time” to “here it is”. That changes what the data environment needs to do.
For many organisations, the gap between being able to reconstruct lineage and being able to evidence it continuously is wider than it appears.
Two forces have made manual lineage unsustainable
Firstly, evolving regulatory expectations are raising the bar on data traceability and lineage. It's no longer sufficient to just show the output. The question is whether the full data journey (source, movement, transformation, access, arrival) can be verified continuously, not reconstructed after the fact.
For instance, recent Consumer Data Right (CDR) amendments allow the bundling of consents. Each sub-consent within a bundle must remain individually identifiable, scoped, and auditable. This complicates tracing consents to activities and systems, like marketing campaigns driven in marketing platforms, sales actions in CRMs, as well as third-party integrations and analytics use cases.
The scale of these traceability requirements is now pushing the limits of teams relying on manual lineage analysis, checks, investigations and audits.
Secondly, AI has added an entirely new dimension to data lineage demands. Credit decisions, fraud detection, AML monitoring and a widening range of customer-facing decisions in BFSI is now being shaped by AI models, and the data those models consume sits squarely in regulatory scope. For instance, new automated decision-making transparency obligations being inserted into the Privacy Act requires BFSI organisations to disclose where AI is used to make decisions using PII.
Regulators, model risk frameworks and internal audit functions are now extending the questions long asked of credit and capital models to the broader AI estate - asking the same things: where did the data come from, was it clean, can the decision be explained, and who along the lineage journey is accountable?
Data lineage is no longer just a compliance requirement for reporting. It's becoming a prerequisite for operating AI responsibly in a regulated environment.
The true scale of the lineage problem
Data lineage in a complex BFSI environment depends on what happens to data from when it’s captured to when it’s reported, including:
- How data was captured, entered, and stored, and whether it was accurate at the point of capture.
- How data was transported and transformed at any point between data entry and data destination. And were there manual data interventions along the way?
- How data platforms ingest, validate, cleanse, and model data.
- How data is made available for consumption and constructed for reporting.
In most organisations:
- User experience layers, integration architecture, and data platforms were often built years ago, before modern data governance requirements were in considered.
- Teams act with inertia (“It’s always been done this way”), rather than operate based on up-to-date requirements.
- Data hand-offs between teams and systems are non-aligned, rather than ordered based on clear accountabilities across the end-to-end data journey.
- Risk management approaches are orientated to historical regulations and technology architectures, rather than orientated to what’s here and what’s coming.
The results are familiar. Although regulatory and business reporting appears at first glance to provide both quality and completeness, dig deeper and it often doesn’t withstand scrutiny. For example:
- Transaction data is in the report, but there is no fast, effective way to audit its sources.
- The same customer exists across multiple systems in different forms, with poor links to product and transaction data, and weak traceability to consents.
- AI is increasingly hidden within off the shelf software, but there is poor visibility of full set of evolving AI models, the growing sources of data ingested, and all the downstream decisions, actions, and impacts.
Data governance isn't an overlay on top of a report or a data platform. It's a foundation; built end-to-end from capture to consumption.
How Fusion5 approaches this
Organisations managing this well approach data governance before building the next compliance reports or data pipelines. They build foundations to ensure that responding to a compliance question or a model risk review isn't an exercise in reconstruction. It's a query.
Fusion5 helps BFSI organisations across New Zealand and Australia modernise data foundations so lineage, governance and auditability are built into the operating environment. We connect regulatory obligations to architecture, metadata, patterns, platforms and governance processes, so evidence is automated as part of normal operations rather than reconstructed under pressure.
A question worth asking
Can your data environment demonstrate, right now, where information came from, how it was transformed, and whether it can be trusted before it reaches the regulator, the auditor, the model risk committee or the board?
If the answer isn't a confident yes, that's worth a conversation.
Ian Vanstone | Chief Technology Officer - Data & Integration NZ
Ian works with business and technology leaders to turn data, AI, and digital transformation ambitions into practical, achievable outcomes. He shares real-world insights that help organisations make better decisions, unlock value from data, and navigate change with confidence.
