Multi-AZ core banking platform
Regulated AWS landing zone with zero-downtime payment rail cutovers.
Duration
9 months
Engagement
Build + operate
Industry
Financial services
Client
Regional bank
0
SEV-1 incidents
Across 18 months in production
< 2 min
Cutover downtime
Per payment rail migration
Daily
Deploy frequency
From monthly weekend windows
−60%
Audit prep time
Evidence generated from the platform
Project brief
What this project was really about
A regulated regional bank needed payment and deposit services off ageing data centres without risking weekend-long change windows. We designed a multi-account AWS landing zone, migrated critical rails in rehearsed waves, and left behind a platform the bank’s own SRE team could run.
01 — Challenge
Legacy data centres could not meet new uptime commitments. Change windows were measured in weekends, and audit evidence lived in spreadsheets rather than systems.
- Active-passive DR with unproven failover
- Manual release trains blocking daily product delivery
- Fragmented identity and network controls across environments
- Regulators demanding continuous control evidence
02 — Solution
We stood up a Control Tower–aligned landing zone, migrated payment services behind progressive delivery, and wired GitOps so every change was reviewed, signed and reversible.
- Multi-account AWS with enforced SCPs and logging
- EKS workloads with blue/green and canary cutovers
- Aurora Multi-AZ with automated failover drills
- Private connectivity back to on-prem cores during dual-run
How we delivered it
A phased programme with evidence at every gate.
- 01
Discover & threat model
Mapped payment flows, RTO/RPO targets, and control gaps with risk and architecture stakeholders.
- 02
Landing zone & golden paths
Account vending, identity, network, observability and IaC templates with paved roads for product teams.
- 03
Wave migrations
Rehearsed cutovers on non-critical rails first, then payment services with dual-run and instant rollback.
- 04
Handover & operate
Runbooks, chaos drills and an SRE playbook transferred to the bank’s platform guild.
04 — Architecture
System shape
- 01Multi-account AWS with Control Tower patterns
- 02EKS for stateless payment services
- 03Aurora with cross-AZ failover
- 04Private connectivity to on-prem cores
- 05Centralised logging, SIEM and audit trails
- 06Argo CD + progressive delivery gates
Deliverables
What shipped
- Production landing zone & account factory
- Migrated payment and deposit services
- GitOps pipelines with progressive delivery
- SRE runbooks and chaos drill schedule
- Compliance evidence pack for auditors
Stack
Client voice
“The cutovers were boring. That is the highest compliment in banking.”
Ananya Rao
VP Engineering · Regional bank
Related projects
Have a programme that needs the same discipline?
Tell us about the constraints, the risk, and the outcome you need. We will respond with a clear engagement shape — not a slide deck of buzzwords.