Cecilia Carbonelli pauses Haventree’s tech overhaul to fix security
When Cecilia Carbonelli joined Haventree Bank in 2019, she discovered critical security weaknesses that forced her to pause a planned technology overhaul. By focusing on foundational fixes, she enabled the bank to launch a secure, customer‑direct digital platform in 2024. Her approach—aligning IT s…
By Felo News Desk · Published
When Cecilia Carbonelli stepped into the role of chief information officer at Haventree Bank in 2019, she was ready to rebuild the institution’s technology stack from the ground up. Within days, she realized that the foundation itself was shaky. “I didn’t know the full extent of the problem, but I found out in my first week,” she says. The decision to pause the transformation and focus on security became the right call, setting the stage for a safer, more resilient digital future.
Security First: The Catalyst for Change
Haventree’s technology group had grown from a 12‑person infrastructure team to a 60‑person engineering squad, yet the bank still relied heavily on external vendors for product development. The new CEO, eager to launch a direct‑to‑consumer platform, asked for an IT strategy. Carbonelli flipped the script, insisting that a business strategy must come first. This alignment ensured that every technology decision was tied to a clear commercial objective.
Her priority was to address security gaps that could jeopardize customer data and regulatory compliance. She introduced a dedicated director of IT risk and governance, tasked with mapping the bank’s adherence to OSFI guidelines. The role became a reality check, forcing the organization to confront its weaknesses head‑on.
Building the Core: From Vendor Lock‑In to In‑House Control
Unlike many competitors that buy pre‑built digital platforms, Haventree chose to build its own. The bank selected Temenos as its core banking ledger after a rigorous six‑month vendor evaluation. While the ledger itself is vendor‑owned, Haventree retained full control over the customer‑facing code—onboarding flows, web applications, and the integration layer.
Carbonelli’s hiring strategy focused on talent that could thrive in a small, fast‑moving environment. She brought in a vice‑president of engineering from fintech, leveraging his network to attract developers eager to build the next big thing. Compensation gaps were addressed by offering the opportunity to shape the bank’s digital future—a compelling proposition for many candidates.
Governance and AI: Preparing for the Future
Regulatory scrutiny is intense for any Canadian bank, regardless of size. Carbonelli’s governance framework included continuous mapping against OSFI’s model risk guidelines, B‑10 and B‑13 vendor rules, and an AI governance structure that pre‑empted the 2027 E‑23 mandate. When Microsoft’s Copilot appeared in the bank’s software suite, the team pre‑emptively disabled it, scanned SharePoint for personal data, and cleaned up exposure before re‑enabling the tool on a controlled basis.
The first AI initiative focused on underwriting: an agent reads lengthy property appraisal reports, summarizes key points, and assigns a risk score—saving roughly 20 minutes per file. Quantum key management remains on the horizon, with infrastructure leads inventorying encryption keys to mitigate future risks.
Launch and Beyond: A Gradual, Sustainable Rollout
After 18 months of infrastructure upgrades, Haventree launched its direct‑to‑consumer platform in the summer of 2024. The rollout began with deposit products, ensuring a steady cash flow before adding mortgages and guaranteed investment certificates (GICs). The bank kept its broker network alive while expanding its digital footprint.
Carbonelli emphasizes that launching a platform is only half the battle. Data migration, legacy system decommissioning, and ongoing governance require dedicated resources and timelines. “You can’t keep the old pair of shoes,” she says, comparing the cleanup to a wardrobe overhaul.
Why This Matters for the Banking Sector
Haventree’s journey illustrates that prioritizing security and governance can accelerate digital transformation without compromising compliance. By aligning IT strategy with business goals and building internal expertise, the bank has positioned itself to compete with larger institutions on a level playing field.
As the banking industry faces increasing regulatory pressure and rapid technological change, Carbonelli’s approach offers a blueprint for smaller banks seeking sustainable growth.
Key facts
- Security gaps forced a pause in tech overhaul, leading to a stronger foundation.
- IT strategy was aligned with business goals before any new tech was built.
- Haventree built its own digital platform instead of buying one.
- Governance and AI frameworks were established ahead of regulatory mandates.
- The direct‑to‑consumer launch began with deposits before adding mortgages and GICs.
Why it matters
Haventree’s story shows that a pause to fix security can actually speed up digital transformation, proving that foundational stability is essential for long‑term innovation in banking.
Frequently asked questions
What prompted the pause in Haventree’s tech transformation?
Critical security weaknesses discovered during the hiring process led Cecilia Carbonelli to halt the overhaul and focus on foundational fixes.
How did Haventree manage vendor relationships?
The bank selected Temenos for its core ledger but retained full control over customer‑facing code, balancing vendor lock‑in with internal development.
What governance measures were put in place?
A director of IT risk and governance was created to map compliance against OSFI guidelines, and an AI governance structure was established before deploying any AI tools.
When will the bank launch its next product?
After the initial deposit and mortgage offerings, Haventree plans to add guaranteed investment certificates (GICs) and other products as deposits grow.
Sources
- [1] digitaljournal.com — originally reported as “When pausing a transformation is the right call”
