The Challenger Built the Platform First. The Incumbent Still Wins.

Based on the research ofOzcan, Dinçkol, and Zachariadis, "The rise of platforms in regulated industries: Ownership, curation, and the asymmetric strategies of challenger versus incumbent banks," Research Policy, 2026

That is the finding running through Ozcan, Dinçkol, and Zachariadis's study of UK retail banking platforms, built from 82 interviews and archival data spanning 2016 to 2024. Challenger banks, born digital and unencumbered by legacy systems, can stand up a platform layer quickly. Incumbents, weighed down by decades of core banking infrastructure and compliance architecture, cannot. If platform strategy rewarded speed and cleanliness of build, the challengers would already own retail banking. They do not. The reason is that a working platform and a growing one are different achievements, and the industry's data sensitivity turns the gap between them into a trap for exactly the banks best positioned to build fast.

Building the platform is the easy part

A challenger bank's advantage is architectural: no core system from the 1990s, no thirty-year-old batch-processing overnight run, no compliance function organized around products that no longer exist. That advantage shows up immediately in how fast a challenger can stand up marketplace features, partner integrations, and app-based distribution. What it does not solve is trust. Retail banking platforms move account data, transaction histories, and payment credentials between the bank and whatever third party sits on the other side of the integration. Users who would happily let a challenger's slick interface sell them a savings product hesitate to let an unproven institution be the switchboard for their financial life. The paper's mechanism is a self-reinforcing cycle: because challengers cannot yet earn that trust at scale, they partially outsource the resource-intensive infrastructure behind the platform rather than build and staff it themselves; that outsourcing limits how deeply they can invest in the resilience and track record that would earn more trust; and the resulting resource strain caps how fast the user base can grow, which caps the revenue that would fund building the infrastructure in-house. Each piece of the cycle reinforces the others.

Starling Bank's own trajectory illustrates the ceiling this cycle imposes. Having built a genuinely well-regarded platform in the UK, Starling tried to extend it into the European Union through an Irish banking license, then withdrew that application in 2022. Two years later, incoming CEO Raman Bhatia told CNBC at the Money 2020 conference that Starling would not reapply for an EU license at all; instead, international growth would come through Engine, a software product Starling now licenses to other institutions such as Salt Bank in Romania and AMP in Australia so that they can run their own digital banks. Read against the paper's framework, that pivot is diagnostic. A challenger with a genuinely strong platform could not translate it into a larger direct user base abroad, and rerouted its ambition into selling the plumbing to other banks instead of adding more users to its own.

The incumbent's legacy IT is a real constraint, not an excuse

Incumbents have the advantage the paper says matters most for platforms: an existing user base, which is the raw material of any network effect. What they cannot do easily is curate and own a platform layer on top of that base, because legacy IT, compliance siloes, and fear of cannibalizing existing product lines box them in. BBVA's acquisition and eventual 2021 shutdown of the US neobank Simple is a documented case of exactly this constraint in action. BBVA bought Simple in 2014 for $117 million and promised, in the words of then-CEO Manolo Sanchez, to "let them flourish" and leave the team alone. It could not keep that promise. Simple had to migrate onto BBVA's Accenture Alnova core system, which had no API layer built for it at the time; Todd Baker of Columbia's Richman Center told American Banker that Simple "essentially paused all innovation and stopped making progress for two years post-acquisition" while competitors like Chime and Varo pulled ahead on customer acquisition. Brian Hamilton, who ran a different BBVA-acquired challenger, Azlo, described the same dynamic even more bluntly: underwriting decisions required risk committees in Houston and Madrid to agree, which, in his words, "of course... never happened." Baker's summary of the pattern is the paper's compliance-siloes-and-cannibalization-fear finding in one line: "The politics inevitably end up crushing the innovation... you would buy this new thing that was really cool and different, and then you would crush it."

This is not a story about incompetence. It is a story about structure. A bank the size of BBVA USA, and later PNC at $474 billion in assets, is bound by rules like the Durbin amendment's interchange-fee cap that a small, thinly capitalized partner bank is not; Baker noted that acquiring Simple cut its main source of freestanding revenue in half overnight, simply by moving it under a bigger balance sheet. Layer onto that a governance model built for a consumer-lending, deposit-taking, heavily audited institution, and even a bank with real intent to preserve a fintech's autonomy will, over time, subsume it. The incumbent's user-base advantage is real. So is the legacy drag that keeps it from converting that advantage into an owned, curated platform on its own.

When the gap gets outsourced, someone else absorbs the strain

Into the space between a challenger that cannot grow fast enough and an incumbent that cannot build fast enough, platform-as-a-service providers emerged, exactly as the paper predicts. Their pitch is straightforward: banking-as-a-service infrastructure, compliance tooling, and card-issuing rails that let both challengers and incumbents plug in a platform layer without owning all of it themselves. What their history since 2022 shows is that this intermediary role concentrates, rather than resolves, the industry's resource strain.

Railsr, the London embedded-finance pioneer formerly known as Railsbank, was once valued near $1 billion and had raised more than $185 million. By March 2023 it owed roughly £36 million to creditors, could not find a buyer after its advisers approached 248 prospective investors, and was sold in a pre-packaged bankruptcy to a shareholder consortium for a fraction of that valuation, going into administration to survive as a going concern. Solaris, the German banking-as-a-service group formerly known as Solarisbank, followed a related path: after a €56 million loss in fiscal 2022 driven substantially by its UK subsidiary Contis, German regulator BaFin ordered a special audit and restricted its growth, and by October 2024 Solaris was cutting roughly 240 of its 700 staff and sunsetting the embedded-finance unit built around that same Contis acquisition. Both companies had genuine demand for what they sold. Neither could carry, on thin infrastructure margins, the compliance and resilience burden that neither a resource-constrained challenger nor a legacy-bound incumbent wanted to fully own itself. The regulatory foundation that created their market, the UK's 2016 Competition and Markets Authority order and the January 2018 arrival of PSD2, mandated the data-sharing rails; it did not guarantee that whoever built infrastructure on top of those rails would survive owning the risk that data sensitivity creates.

Buying power, not platform quality, decides who curates

Here is where the paper's sharpest claim lands. Once a platform-as-a-service layer exists, you might expect its position between challenger and incumbent to be neutral, or even to favor the smaller, nimbler challenger that adopted it first. The paper finds the opposite: powerful incumbent buyers reverse the platform power asymmetry, using their negotiating weight to force closed curation on the intermediary, and the industry's own regulators have documented the structural reason why. In 2023, the UK's Joint Regulatory Oversight Committee published commercial pricing principles for so-called premium open banking APIs precisely because, as the regulators put it, third-party providers can be placed in "a relatively weak bargaining position in relation to negotiating fees and charges" because the bank on the other end of the API controls access to the customer's account. The committee's own language calls this a "bottleneck monopoly." A PaaS provider does not get to set curation terms unilaterally; whichever counterparty controls the account relationship, which in UK retail banking is overwhelmingly the incumbent, gets to decide how open or closed the resulting platform stays.

That is the mechanism that flips the asymmetry the challenger seemed to hold at the start. The challenger built its platform first and still cannot grow its user base past the trust ceiling. The incumbent could not build a platform fast and still owns the account relationships that give it buying leverage over whatever intermediary steps into the gap, which lets it dictate curation on terms that favor closed, controlled access over the open marketplace model that platform theory usually predicts will win. Starling's own pivot to selling Engine as software rather than growing its own consumer platform abroad is a quiet admission of the same logic from the other direction: when you cannot win the user-base fight directly, the fallback is to become infrastructure for whoever already has one.

The platform that gets built easiest is not the platform that ends up owning the curation rules.

None of this means incumbents are safe by default, or that challengers should give up on platform strategy. It means the variable worth watching is not who ships first. It is who will hold the buying power once a platform-as-a-service layer inevitably appears to bridge the gap between an easy build and a large user base. Ozcan, Dinçkol, and Zachariadis note that this dynamic is not unique to banking; healthcare and insurance carry the same combination of data sensitivity, incumbent account relationships, and regulatory weight that produces it. Any operator building a platform strategy in a regulated, data-sensitive market should ask not "can we build this," which is usually the easy question, but "once a third party fills the gap between our platform and our users, who will have enough leverage over that third party to set the terms." In UK banking, the answer was almost never the side that built the platform first.