NZ Banking Control Architecture 2026–2035

The Reserve Bank of New Zealand published three plausible 2035 banking scenarios on 17 September 2026 and declined to say which will occur; the set is not exhaustive, not mutually exclusive, carries no probabilities, and the Bank states the future may contain elements of all three. That is intellectually honest and operationally unusable, because a control must be specified against a condition. This study asked what control architecture would hold across all three, and found that the question a board actually faces is not which future to back. Of sixty controls identified, forty-two — seventy per cent — are required under every scenario, including the least disruptive. Five change materially and none of those five appears or disappears; thirteen address risks the international corpus does not yet know how to control. A control counts as universal only if it is required at the lowest setting of both governing parameters — necessary even under Scenario 1 — which is a stricter test than appearing in all three narratives. In a market where five New Zealand-owned banks hold 8.5% of lender assets, that singularity is what makes robustness affordable at all. What varies is intensity, and intensity scales with two things an institution can already observe: how much of its critical operations are performed outside the accountable legal entity, and how much banking function around it sits outside the prudential perimeter. The second is partly a function of the first, because banking is defined by function and regulated by entity. The unit of analysis is the critical service, not the institution — a New Zealand bank may sit in Scenario 1 for mortgages and Scenario 3 for payments, and on the open banking schedule many already do. The binding constraint is not 2035. Four regulatory programmes commence between 2025 and 2029, and two windows inside that schedule — eighteen months and twelve — separate the issue of standards from their commencement. Inside a window, requirements are legible and obligations have not attached; it is the only period in which an institution can discover it cannot meet a requirement without the discovery being a breach. A correction is recorded: the two most resilience-relevant standards commence in late 2029, not December 2028 as the supplied material states. More immediately, the convergence is already complete — open banking payment initiation live since 1 December 2025, identity assurance moved outside the prudential outsourcing regime, scam liability attached 30 November 2025 — with the bank holding the accountability and directly controlling about half the mechanism. The study is candid about its limits. The thirteen unevidenced controls cluster in two places rather than scattering: AI and agentic oversight, and arrangements in which an institution is accountable for activity it does not direct. Three negative findings foreclose recommendations the brief invited — most significantly that the United Kingdom's critical third parties regime does not transfer, because scale rather than legislative capacity is the binding constraint. Whether New Zealand's Operational Resilience Standard covers the dependencies its draft Outsourcing Standard excludes is unresolved in the published drafts, and is the single most consequential open question here. An institution could reasonably consider starting with the six capabilities that sit highest in the architecture's dependency structure, and in particular with independent depositor-record capability — the longest lead time and highest retrofit cost in the matrix, answerable now and not dependent on the standard's final content. Sequencing resilience work to December 2028, or deferring no-regrets controls pending evidence of disruption, would in our view misread both the schedule and the trigger. Figures and findings above are drawn from the source study, where each carries its evidence class and verification date. The final paragraph is FalconBridge's judgement, offered for the reader's own decision; recommendations throughout the study are suggestive, not directive. E&OE. All rights reserved.