The Core Banking Reality Check: 10x Raises, Regulators Move, Composability Grows Up

As of this week, the core banking modernisation trade is no longer a "brave CIO" story. It has hit profitability, priced-in cheques and a regulatory calendar that will not wait.

The week the category found its floor

For a decade, cloud-native core banking has been the sector everyone said would win eventually. As of late August 2026, "eventually" arrived. Between a £40m growth cheque, a $100m ARR milestone and a European regulator finally putting a stamp on the successor to PSD2, the modernisation story looks less like a promise and more like a portfolio.

Three signals matter most, and they all fit together.

10x Banking's £40m raise

On 4 August, 10x Banking announced a £40m funding round led by AshGrove Capital. Enterprise Times and Tech Times covered the round, which valued the raise at roughly $54m in dollar terms.

The unusual detail: this is the first raise 10x has done since it turned EBITDA positive. Enterprise Times reports that 10x grew ARR by 30% year on year and added ten new financial institutions in the run up to the round, including Remara and The Co-operative Bank of New Zealand. By the end of 2026, 10x expects an additional 500,000 customer accounts to go live across New Zealand, Australia, South Africa and Thailand.

The message from the raise, and this is where the "reality check" bit kicks in, is that cloud-native cores can now be sold on commercial performance, not just architectural theology. AshGrove is a debt-focused specialist, not a moonshot venture fund. Its money comes with covenants.

Why a "boring" raise is the interesting one

Two years ago, the plausible bear case on cloud-native core banking was that vendors would burn out before banks would sign the seven-year contracts they needed. As FinanceX Magazine argued this month, that bear case has now expired. Vendors with real ARR, real customers and real profitability can attract capital that expects returns, not just optionality.

Thought Machine crosses $100m ARR

Thought Machine, the London-based core banking engine behind Vault, delivered the second data point of the summer. Reporting from FinTech Futures shows Thought Machine's annual recurring revenue surpassed $100m in the second quarter of 2026, following 2025 annual revenue of $100m that was up 57% year on year.

Thought Machine's roster is the argument for tier-one adoption. It powers cores at Lloyds Banking Group, Standard Chartered and JPMorganChase, among others. That mix (a UK universal bank, an emerging-markets corporate powerhouse and the largest US bank) is the strongest counter to any lingering "cloud cores are a challenger toy" narrative.

Mambu, composability and the middle of the market

The third leg of the modernisation stool is Mambu, which continues to define the "composable banking" segment. According to a 2026 review by Crassula, Mambu's SaaS core remains the reference architecture for digital banks and lenders assembling products from modular building blocks rather than customising monolithic code.

That combination (Thought Machine at the top, 10x pushing into the mid-market and Mambu holding composable mid-market and lender territory) is what commercial proof looks like as a category, rather than at a single vendor.

PSD3 and PSR: the calendar finally binds

While the vendors were closing rounds, Brussels was closing text. According to Morrison Foerster, the European Parliament and Council reached provisional agreement on PSD3 and the accompanying Payment Services Regulation on 27 November 2025. The agreed texts were published on 23 April 2026, with the ECON Committee voting on 5 May 2026. Publication in the Official Journal is expected in summer 2026, with the PSR coming into force twenty days later.

Firms should expect the new regime to bite in late 2027, with transitional provisions on licensing. Practical implications: dedicated open banking APIs become mandatory for account servicing payment service providers; data access reaches parity with ASPSPs' direct customer channels; account information service provider consent cycles extend from 180 to 365 days; prescriptive requirements for API performance and uptime arrive, alongside removal of the "obstacles" (unnecessary re-authentication, dashboard friction) that let some banks quietly throttle third-party access under PSD2.

According to Morrison Foerster and Embat, the operational implication is that banks can no longer treat open banking APIs as compliance overhead. They will be treated by regulators as customer channels.

FIDA turns "open banking" into "open finance"

Sitting alongside PSD3 is the Financial Data Access Regulation, or FIDA. According to BNP Paribas Securities Services and analysis from KPMG, FIDA extends open finance beyond payment accounts into savings, investments, mortgages, pensions and insurance. Data holders will have to share customer data with data users at the customer's request, through standardised, consent-driven schemes.

Norton Rose Fulbright expects formal adoption of FIDA in mid-2026, with implementation likely in late 2027. That timing is the same window as PSD3, and it forces a specific architectural question on every European bank: whether the open banking API estate stood up for PSD2 can be reused, or whether FIDA requires a materially new layer.

BaaS keeps growing, more carefully

Below the regulatory ceiling, the BaaS market is still growing, but more selectively. According to Sumsub, the global BaaS market is worth roughly $22.5bn today and is expected to reach $70.8bn by 2032. Softjourn frames the 2026 environment as one dominated by compliance demands, faster product launches and continued embedded finance growth, with B2B eCommerce a specific expansion vector.

Two vendors continue to define the European frontier. Solaris still holds a full BaFin banking license and powers embedded finance for European brands. Griffin sits on its own UK banking license and pitches a single contract that combines BaaS and bank, aimed squarely at UK fintech engineers who no longer want to stitch together a sponsor bank and a middleware layer. Both models are being validated in an environment where regulators are pushing back on single-bank-partner arrangements.

What this week actually means for banks

Three things are true today that were not true a year ago. First, cloud-native core banking has a commercial spine. 10x is profitable, Thought Machine has crossed $100m ARR, and Mambu is still holding composable-banking ground.

Second, the regulatory clock has started. PSD3's Official Journal publication is a matter of weeks, not quarters, and FIDA is on the same trajectory. Any bank still treating open banking APIs as a compliance side project has already lost the argument internally.

Third, BaaS is maturing into a market with grown-up unit economics. Full-licence models like Solaris and Griffin are being priced differently from thin middleware vendors, and boards are asking about the capital structure behind their embedded finance partners.

The uncomfortable summary for laggards is that the modernisation deferrals have run out of runway. The elegant summary for early movers is that the market has finally caught up to their thesis.