All projects
Financial servicesRegional bank·2024–25

Multi-AZ core banking platform

Regulated AWS landing zone with zero-downtime payment rail cutovers.

Zero SEV-1 incidents across 18 months of production traffic.

Duration

9 months

Engagement

Build + operate

Industry

Financial services

Client

Regional bank

Cloud ComputingDevOpsCyber Security
Multi-AZ core banking platform — Regional bank

0

SEV-1 incidents

Across 18 months in production

< 2 min

Cutover downtime

Per payment rail migration

Daily

Deploy frequency

From monthly weekend windows

−60%

Audit prep time

Evidence generated from the platform

Project brief

What this project was really about

A regulated regional bank needed payment and deposit services off ageing data centres without risking weekend-long change windows. We designed a multi-account AWS landing zone, migrated critical rails in rehearsed waves, and left behind a platform the bank’s own SRE team could run.

01 — Challenge

Legacy data centres could not meet new uptime commitments. Change windows were measured in weekends, and audit evidence lived in spreadsheets rather than systems.

  • Active-passive DR with unproven failover
  • Manual release trains blocking daily product delivery
  • Fragmented identity and network controls across environments
  • Regulators demanding continuous control evidence

02 — Solution

We stood up a Control Tower–aligned landing zone, migrated payment services behind progressive delivery, and wired GitOps so every change was reviewed, signed and reversible.

  • Multi-account AWS with enforced SCPs and logging
  • EKS workloads with blue/green and canary cutovers
  • Aurora Multi-AZ with automated failover drills
  • Private connectivity back to on-prem cores during dual-run
03 — Approach

How we delivered it

A phased programme with evidence at every gate.

  1. 01

    Discover & threat model

    Mapped payment flows, RTO/RPO targets, and control gaps with risk and architecture stakeholders.

  2. 02

    Landing zone & golden paths

    Account vending, identity, network, observability and IaC templates with paved roads for product teams.

  3. 03

    Wave migrations

    Rehearsed cutovers on non-critical rails first, then payment services with dual-run and instant rollback.

  4. 04

    Handover & operate

    Runbooks, chaos drills and an SRE playbook transferred to the bank’s platform guild.

04 — Architecture

System shape

  • 01Multi-account AWS with Control Tower patterns
  • 02EKS for stateless payment services
  • 03Aurora with cross-AZ failover
  • 04Private connectivity to on-prem cores
  • 05Centralised logging, SIEM and audit trails
  • 06Argo CD + progressive delivery gates

Deliverables

What shipped

  • Production landing zone & account factory
  • Migrated payment and deposit services
  • GitOps pipelines with progressive delivery
  • SRE runbooks and chaos drill schedule
  • Compliance evidence pack for auditors

Stack

AWSEKSTerraformArgo CDAuroraKafka

Client voice

The cutovers were boring. That is the highest compliment in banking.

Ananya Rao

VP Engineering · Regional bank

More work

Related projects

Have a programme that needs the same discipline?

Tell us about the constraints, the risk, and the outcome you need. We will respond with a clear engagement shape — not a slide deck of buzzwords.