Welcome back. This week the boundary moves. Not the geopolitical kind: the line between what an asset manager runs itself and what it hands to someone else. Three things happened in the last month that don't look related but are. Citi took over a $380bn middle office. The FCA published numbers showing most managers cannot evidence oversight of the controls they have already outsourced. And the industry quietly stopped treating make-versus-buy as a binary. This issue is about that line.

Citi wins the year's biggest middle office mandate. On 13 August, Citi Investor Services announced a full middle office mandate from Aegon Asset Management covering US$380bn in AUM and extending a 20-year relationship. The scope is the interesting part: full Investment Book of Record, trade management and settlement, and performance measurement via Aladdin Accounting. And the structural detail matters more: Aegon AM's operations team in Budapest transfers to Citi's Solutions Centre, and Aegon AM's global COO Mike Tumilty frames the whole move as "a clear next step in our evolution towards a global, scalable, and efficient operating model" following its Aladdin implementation. That's a lift-out inside a mandate. The people move with the work.

AI agents cross the deployment tipping point. KPMG's Q1 2026 AI Quarterly Pulse for asset management and private equity finds 39% of organisations now actively deploying AI agents, up from 24% in Q4 2025, with average projected AI spend of $148m over the next 12 months (up nearly 1.5x quarter on quarter). Three in four require human validation of agent outputs. On the hedge fund side, SS&C and Alternative Fund Insight's multi-manager survey finds 46% running AI in production, with 68% pointing at the middle office as the primary impact zone. The uncomfortable number is governance: Grant Thornton's 2026 AI Impact Survey found only 22% of asset managers very confident they could pass an independent AI governance audit, and 53% citing governance and compliance barriers as contributors to AI underperformance. Deployment is outrunning the control layer.

Governance is moving in-house. FundGuard's analysis of the Funds Europe Top 200 delivers three numbers that belong together: 89% of the Top 50 UCITS managers now run an internal ManCo, against 71% across the broader set; 33% run two fund administrators, and 45% operate across two or more domiciles; fewer than 21% of Top 50 employees are investment professionals. Read as one picture: oversight, governance and risk functions are being internalised while execution stays deliberately distributed across multiple providers. Deliberate is the operative word. Multi-admin is being used as a risk and optionality strategy, which works only if the book of record can survive an administrator transition.

The old binary is dead. Managers are no longer choosing between insourcing and outsourcing; they are negotiating the line process by process, and the line keeps moving.

Lift-outs have moved from exception to tool. Apex Group's research finds two-thirds of managers who have completed a lift-out would do it again, with 70% citing access to modern technology platforms as the driver. Aegon's Budapest transfer is the live case study: the mandate and the people move together.

Co-sourcing is the quiet middle option. Vistra's framework describes it precisely: the manager keeps ownership of systems, data and decision points while a partner runs significant parts of the process inside the manager's own environment. Citco's "no shadow" model pushes further in the other direction: treat the administrator's data as the golden record and replace duplicated shadow books with exception-based oversight. Control, the argument runs, no longer requires duplication.

Full outsourcing is still growing. Alpha FMC's 2025 Global Operations Survey has 24% of firms planning to increase middle or back office outsourcing. So the trends are not competing: they're simultaneous. PwC Luxembourg frames it best: the decision is no longer binary, each organisation calibrates its own blend, and GenAI is "reshaping the cost-benefit equation entirely."

Architecture Canvas lens: every one of these boundary decisions lands on the operating model as owners, controls and oversight obligations. Which is exactly where the FCA's latest numbers land hard (see Regulatory Impact). If a firm cannot say which processes it runs, which it delegates, and how each is overseen, it is making every boundary decision blind.

Citi is assembling a multi-client Aladdin middle office. In February, BlackRock appointed Citi to provide select middle office services for $4.0 trillion of US-domiciled iShares ETFs on Aladdin. In August came Aegon at $380bn on the same playbook. Citi's stated strategy is a scalable, multi-client Aladdin operating model, spreading the cost of platform-adjacent operations across many managers. The economics are the story: the margin in middle office flows to whoever operates the shared factory.

State Street lands Principal's fund business. In June, State Street expanded its relationship with Principal Financial Group to provide custody, fund accounting and administration for Principal Funds. Principal's president and CEO Kamal Bhatia framed it as "strategic partnering and outsourcing" accelerating the transformation of its US wealth and retirement business. Another marquee name choosing an integrated servicing stack.

Northern Trust industrialises ETF servicing. Late July brought two moves in two days: an ETF servicing platform launch with Harding Loevner as first client, and a fund administration win with Dawson Partners. The signal: mutual fund and ETF worlds are converging onto single servicing stacks, and the custodians are racing to be the one partner across both.

The FCA's financial crime review: the outsourcing finding ops teams should read first. On 22 July the FCA published its findings from engaging with 242 asset management and alternatives firms on their financial crime controls. The headline for operations: around 40% of firms outsource parts of CDD and EDD, usually to fund administrators, but only 36% of those could evidence full oversight of the provider's onboarding, and some could not describe the process at all. The FCA's position is unequivocal: firms "remain fully responsible" for compliance with the MLRs. Other findings matter too: more than a fifth had no complete business-wide risk assessment, over a quarter had no formal transaction monitoring, and more than half of MLROs were part-time or shared, including more than a quarter of firms above £10bn AUM. Only a little over a third discuss AML risk regularly at governance forums.

Stephenson Harwood's read is that the review "goes beyond technical AML compliance" and into governance and the quality of control over outsourced processes. Gibson Dunn adds the private markets angle: administrator oversight "should be run as a third-party and operational-resilience matter," with defined sampling, reporting and escalation. The through-line with issue 002's AIFM reform is the same: the FCA is systematically relocating accountability to the firm's own model, whatever the rulebook.

Moves from the past two months.

This week's operating model insight: The Accountability Clause.

You can outsource the task. You cannot outsource the accountability. Every operating model carries this clause, and it is being stress-tested from two directions at once.

From the regulator: the FCA's numbers show 40% of firms outsource CDD and EDD while only 36% of those can evidence oversight of it. From the market: the boundary itself is being redrawn everywhere, through lift-outs, co-sourcing, no-shadow models and multi-client platform factories. Both point the same way. The line between retained and delegated work is now a design variable, and most firms have not designed the layer that sits on top of it: the oversight layer.

Three things to do:

The firms treating the make-buy line as a procurement event will keep discovering their model's gaps at audit. The firms treating it as a design decision will be able to point at the line and say: that's where we chose it, that's who owns it, and here's how we know it's still working.

This week's companion piece on opmodal's Insights page goes deeper: The outsourcing boundary is a design decision, not a procurement decision.

Target State is published weekly by opmodal. Subscribe free at target-state.beehiiv.com. Look out for the paid tier opening this autumn.

Architecture Canvas is a methodology developed by opmodal for capturing, governing, and improving operating models in complex businesses.