At least in the banks I deal with, there is a huge difference between what is considered core, and peripheral services that 1) rarely hold sensitive data, if an

At least in the banks I deal with, there is a huge difference between what is considered core, and peripheral services that 1) rarely hold sensitive data, if any; 2) never hold the master and 3) are not part of the day to day banking experience (i.e. sending cheque books, delivering credit cards). The psychological barrier I see is 'running the transaction' vs. 'reporting on it weeks after the fact'.