Rule of thumb — if a bank already was there and dealing with things 30 years ago, it likely has some cobol left.

Generalizing — if the company had enough need for it 30 years ago, was big enough to but a mainframe and the thing they used it for barely changes — chances are it’s still there, if the company is still there.

Banks absolutely do have it in house, in a dedicated secure site with a fence and a moat