Case studies
Problem, approach, outcome.
Three engagements chosen because the problems carry over to any organisation running critical systems under scrutiny: legacy consolidation, secure handling of identity and money, and infrastructure that has to satisfy a regulator.
Global asset manager · London · 2010 — 2013
Consolidating a fragmented legacy estate onto one platform
- Legacy modernisation
- Data consolidation
- Disaster recovery
- 30+Legacy systems decommissioned
- Group-wideRollout across business units
The problem
Business units had grown their own systems over many years. More than thirty of them overlapped, and keeping them consistent depended on complex reconciliation between systems. Total cost of ownership was high, and nobody in operations or management could see the business in one place.
The approach
- Extended the in-house investment management platform so it could take over what the legacy systems did, then rolled it out across the group in stages rather than as a big-bang cutover.
- Defined the infrastructure and disaster-recovery architecture for the consolidated platform.
- Built real-time position management and PnL aggregation, available on desktop, web and mobile.
- Put continuous integration, delivery and release tooling in place so the migration could ship frequently and safely.
The outcome
- More than 30 existing systems decommissioned.
- The reconciliation processes between them removed entirely.
- A large reduction in total cost of ownership, and one consolidated view of the business for operations and management.
Why it matters
Most large organisations run an estate like this: overlapping systems, manual reconciliation and costs that are hard to see. The method suits any legacy-modernisation program. It replaces capability incrementally, keeps services running throughout, and retires each system only once nothing depends on it.
Digital-asset exchange & custodian · Melbourne · 2018
Building a regulator-approved exchange and custody platform
- Secure integration
- Identity & onboarding
- Regulatory compliance
- AUSTRACApproved exchange and custodial service
- KYC / AMLOnboarding and due diligence automated
The problem
A new exchange and custody business had to launch a platform that held customer funds and identity data, met anti-money-laundering obligations, and satisfied the regulator, without slowing product delivery to a crawl.
The approach
- Owned product, infrastructure and platform development as Chief Systems Architect.
- Designed a distributed microservice architecture behind an API gateway, so each service could evolve independently while behaving consistently across the system.
- Automated KYC and AML onboarding and customer due diligence.
- Worked with the security team on a multi-layered security model covering data protection and regulatory compliance.
- Built a highly available, fault-tolerant platform and a deployment pipeline that made continuous delivery safe.
The outcome
- An AUSTRAC-approved cryptocurrency exchange and digital-asset custodial service.
- Customer onboarding and due diligence automated rather than handled by hand.
- A platform the team could keep shipping to with confidence after launch.
Why it matters
Any service that handles identity, payments or personal information faces the same pressures, whether it is run by a business or a government agency: a regulator or auditor watching, sensitive data to protect, and customers who expect it to work. Here, security, auditability and safe change were designed in from the start.
Multilateral trading facility · Abu Dhabi · 2020 — 2021
Secure, highly available infrastructure for a new regulated market
- Cloud infrastructure
- BCP / DR
- Security assurance
- One of the firstRegulated digital-asset MTFs in the world
- AutomatedBusiness continuity and disaster recovery
The problem
A new regulated trading venue needed highly available, secure infrastructure, a single trustworthy record of clients and transactions, and regulatory reporting. All of it had to stand up to the regulator’s technology governance reviews.
The approach
- Led the technical delivery team as Group Architect.
- Designed and built highly available, fault-tolerant, secure cloud infrastructure with automated business continuity and disaster recovery.
- Built a central client and transaction data store, with reconciliation, internal reporting and regulatory reporting on top of it.
- Commissioned independent security audits and penetration testing through external consultancies, and implemented their findings.
- Represented the firm at the regulator’s technology governance sessions and demonstrations.
The outcome
- Delivered one of the world’s first regulated digital-asset multilateral trading facilities.
- BCP and DR automated rather than written down and hoped for.
- Security posture independently tested, and the technology presented directly to the regulator.
Why it matters
Critical systems in any regulated or public setting answer to the same questions: has the security been independently tested, does the system keep running when something fails, is there one authoritative record, and can you report it to whoever oversees you? This delivery was built to answer yes to each.
Anonymised on purpose — referees on request
We do not publish client names without permission. If you are evaluating us for an engagement and need a referee, ask, and we will arrange one with the client's agreement.
next step
Got something that needs an experienced pair of eyes?
An initial discussion is free, thirty minutes, and has no deck. Tell us what you are wrestling with and we will tell you honestly whether we can help — and if we cannot, who might.