Enterprise Banking Platform

Architecture Overview

flowchart TD
    subgraph Client ["Mobile App Frontend"]
        MobileApp["<i class='fas fa-mobile-screen-button'></i> Mobile Banking App<br/><small>iOS & Android Client</small>"]:::accent
        SDK["<i class='fas fa-camera'></i> Document & Face Capture<br/><small>Onboarding Capture SDK</small>"]
        MobileApp --- SDK
    end

    subgraph Edge ["API Gateway & BFF Layer"]
        WAF["<i class='fas fa-shield-halved'></i> AWS WAF & CloudFront<br/><small>DDoS & Layer 7 Protection</small>"]
        BFF["<i class='fas fa-network-wired'></i> Mobile API Gateway (BFF)<br/><small>Device Attestation & Auth</small>"]:::accent
    end

    subgraph Backend ["Mobile App Backend Microservices (EKS + Istio)"]
        Orch["<i class='fas fa-diagram-project'></i> Onboarding Orchestrator<br/><small>State Machine & Journey Flow</small>"]:::accent
        KYC["<i class='fas fa-id-card'></i> e-KYC & OCR Service<br/><small>Document Verification & AML</small>"]
        Bio["<i class='fas fa-fingerprint'></i> Biometrics & Liveness<br/><small>Facial Match & Anti-Spoof</small>"]
        Profile["<i class='fas fa-user-gear'></i> Customer Profile Service<br/><small>Demographics & Metadata</small>"]
        Notify["<i class='fas fa-bell'></i> Notification Service<br/><small>SMS OTP & Push Alerts</small>"]
    end

    subgraph Security ["Zero-Trust & Identity"]
        Auth["<i class='fas fa-user-shield'></i> Identity Provider (OIDC)<br/><small>User Credentials & Tokens</small>"]
        Vault["<i class='fas fa-lock'></i> Vault + SPIFFE/SPIRE<br/><small>Workload Identity & Dynamic PKI</small>"]:::accent
    end

    subgraph Core ["Core Banking & Payment Interface"]
        CoreBanking["<i class='fas fa-building-columns'></i> Core Banking & Payment Systems<br/><small>Account Creation & Host Ledger</small>"]:::accent
        DB["<i class='fas fa-database'></i> Customer DB & Audit Store<br/><small>Amazon Aurora (Encrypted)</small>"]
    end

    MobileApp -->|1. Submit Onboarding Data| WAF
    WAF --> BFF
    BFF <-->|Token & Device Validation| Auth
    BFF -->|2. Start Journey| Orch

    Orch -->|Verify Document| KYC
    Orch -->|Liveness Check| Bio
    Orch -->|Send Verification OTP| Notify
    Orch -->|Persist Profile| Profile
    
    Vault -.->|mTLS Attestation| Backend

    Profile --> DB
    Orch -->|3. Provision Account| CoreBanking
    CoreBanking --> DB

    classDef accent fill:#1f2630,stroke:#f97316,stroke-width:2px,color:#f97316;

Overview

The Enterprise Banking Platform modernized the bank’s digital channel, delivering an end-to-end cloud-native Customer Onboarding Journey with high security, zero friction, and sub-minute account opening. Built with a dedicated Mobile Backend-for-Frontend (BFF) architecture on AWS EKS, the platform securely orchestrates mobile document capture, real-time e-KYC and facial liveness verification, automated identity attestation, and downstream account provisioning with core banking and payment systems.

Key Features

• Mobile Frontend & Onboarding Journey: Seamless client-side document scanning and biometric liveness verification integrated into native iOS and Android banking apps.
• Mobile API Gateway (BFF): Centralized backend-for-frontend layer handling device attestation, session tokens, request throttling, and payload sanitization behind AWS WAF.
• Onboarding Journey Orchestrator: Event-driven saga workflow coordinating OCR document verification, AML/sanctions screening, biometric matching, and automated OTP delivery.
• Zero-Trust Security & Workload Identity: Automated mTLS and secrets rotation across microservices using SPIFFE/SPIRE and HashiCorp Vault.
• Abstracted Core Banking & Payment Integration: Decoupled, resilient interface provisioning customer accounts, CIF numbers, and initial funding into the core banking ledger.