Daniele Tonella, CTO at ING, breaks down how the bank is building the infrastructure and culture needed to stay ahead in an era of AI, open finance and agentic payments.
Financial institutions across Europe are weathering a storm of change, which includes mounting pressure to abandon legacy systems in favour of API‑led models, the arrival of PSD3 and the integration of AI across banking functions.
For banks like ING, the challenge is to keep pace with new technology, but to do so without compromising the trust and stability they’ve been known to provide. Reliability, as unglamorous as it may sound, is becoming a competitive differentiator as client expectations rise and regulatory scrutiny harshens under frameworks such as DORA.
Daniele Tonella, CTO at ING, spoke to Payment Expert at Money20/20 Europe in Amsterdam, outlining the bank’s API‑first architecture, its 100‑use‑case AI programme, and why the next few years will separate early transformers from those who hesitated.
Tonella explains that legacy technology is not the barrier it is often portrayed to be. The harder task, he says, is building a culture where stability outranks the temptation to launch constant updates.
Read the full interview below.
ING has described itself as a technology company that holds a banking licence. What does that mean for how you architect payments infrastructure?
That framing is probably six or seven years old now, and I think we are beyond it. Today we are a digital bank, one of the first, if not the first, in Europe. We started 20 years ago and we have an extremely mature position between the commercial side, the operational side and the tech side in terms of how we use technology.
We are not building tech for the sake of tech. We always have the client at the centre, and everything we do in tech has either the purpose of an immediate impact on the client or the purpose of exploring when the market is uncertain. Our engagement with stablecoins is an example of that. These are all exploratory in nature because it is unclear what shape the market is taking. We cannot go all in because it is unclear, but we cannot stay out either.
What do you think about the trade-off between modernising legacy infrastructure and maintaining stability?
There are so many answers to this question. The first is that the moment something gets released into production, it is legacy. It becomes something you have to cope with for everything that comes afterwards. So legacy has a negative connotation when you look back, but legacy applies to the future too. Everything we do today is already a legacy for the ones that come after us.
Legacy is also not bad by definition. Banking is the business of trust, and legacy has the merit of being tried, tested, approved, verified and governed. There is a lot of merit in that, which you do not necessarily have out of the box at the edge. The real delicate balance is how we innovate and evolve at the front while we carry along the legacy and modernise what we are sitting on – all while maintaining the ultimate mandate of trust we have from clients and the expectations from the regulatory side.
APIs have become the connective tissue of modern payments. How is ING’s API strategy evolving?
This is probably the core of the invisible transformation of the past eight to 10 years. Banks traditionally have monolithic core banking systems – one system with everything inside. We decided many years ago to move away from that. The core banking system is currently reduced to just a current account, and everything else sits behind APIs and microservices. We have a couple of thousand of them. Not everything is transformed like that already, but we are extremely well underway.
This is proving to be a substantial enabler of the transformation ahead of us. To give a technical example, there is a protocol in the AI space called MCP, announced by Anthropic last year. Because we have such a strong API architecture, we were able to open source a component that essentially converts those APIs to MCP. The bottom line is we are building our AI infrastructure on top of an API architecture that we started designing many years ago.
In the push to use payments data as commercial intelligence, where is AI actually moving the needle for ING?
We have five areas where we are focused. Cost is one, hyper-personalisation is another, and then we have lending in wholesale, call centres, and engineering. We have around 100 use cases, of which a couple are already in production.
In call centres, we already have a chatbot function and are exploring conversational AI with very good success. We have rolled out agentic mortgages – in the Netherlands today, a mortgage process goes through a number of agents without humans involved.
In engineering, the vast majority of engineers who code have a Copilot licence, so we have essentially completed adoption of what we call assisted AI, while we are now building the agentic AI engineering platform.
Open banking promised to unbundle the bank. How has ING’s view of fintech partnerships shifted?
Banking happens in an ecosystem. Open banking, PSD2, PSD3 – these regulations were all aiming at opening up the banking system to give more advantages to consumers. None of it ultimately ended with banks becoming pure plumbing, with everything else sitting in a fintech ecosystem.
We have a number of collaborations and partnerships, stablecoins being one area, but we also buy a lot of software and services from established fintechs as well as from emerging players in the space.
As PSD3 and the EU’s open finance framework take shape, where is the industry still underprepared?
Time will tell, and time will help us differentiate who started early enough with the transformation and who slept on it and is now trying to accelerate. Plugging AI agents, open banking and PSD3 into systems that were never designed for them – I think the next couple of years will show us clearly where that differentiation lands.
How do you build an engineering culture that values resilience as much as it values new features?
Historically, digital transformation was misread by many companies as needing to buy tools and technologies. Digital transformation is something else; it is transforming the way you serve clients, getting where they are with what they need in the moment they need it. That mistake of just buying tools also meant accelerating deployment while neglecting what we call non-functional requirements: security, governance, reliability, and system performance, which are all the invisible things.
In a digital world, these become client expectations. When you turn on a light at home, you do not think about reliability, but you expect it to work. Reliability has to be part of the culture in order to be visible and realistic.
DORA helped because that regulation brought reliability aspects to board-level attention that were otherwise hidden. Being a digital bank also helps. When I joined two years ago, my boss, the chief executive, was checking Downdetector twice a day, so I had to check it three times.
That stopped because stability came in. You only get stability if you give clear messages to the organisation that certain things are non-negotiable. In the pecking order of tech, production has a higher value than releasing software. We have been hammering that for two years, and the culture is now bearing fruit.
Which technological advancement in payments do you think is most underestimated right now?
The obvious answer would be stablecoins and everything happening in that space. Personally, I am not sure how big the impact will be – today there is a lot of movement, but it is highly fragmented. It is hard to tell whether we are going to go back to Swift and call it a day or whether it will fundamentally change things.
Agentic also plays a role. If you look at what Google has announced around a protocol for agentic payments, combined with Google Pay, you can see how that could come together. But client behaviours are still unclear and the direction this is all taking remains uncertain. ]
The Executive Ledger is Payment Expert’s new leadership series spotlighting senior payment executives across the global banking sector. The series explores how systemic institutions are responding to regulatory reform, real-time infrastructure demands, fraud risk, and intensifying competition in the payments market.
If you are a senior payments leader within the banking industry and would like to take part, please contact Senior Journalist Kieran O’Connor at [email protected]
