westpac

When a bank that processes over A$1. 2 trillion annually decides to rewrite its core ledger system, engineers pay attention. Westpac's multi-year platform modernization isn't just a banking story-it's a deep-jump into distributed systems, event-driven architectures, and the painful realities of migrating stateful workloads at scale. For anyone building critical financial infrastructure, the lessons from Westpac's journey are both cautionary and instructive.

Westpac Banking Corporation, founded in 1817, operates one of Australia's largest technology estates. Behind the consumer-facing mobile app and internet banking portals lies a sprawling mesh of mainframe COBOL, Java microservices, Apache Kafka streams, and emergent AI fraud detection pipelines. This article decomposes Westpac's technology stack, highlights the architectural decisions that matter. And offers engineering insights for teams tackling similar transformations.

We'll explore how Westpac approaches core banking platform modernization, cybersecurity resilience (especially after the 2020 data breach), API gateway evolution. And observability at petabyte scale. Whether you're a principal architect at a fintech or a backend engineer eyeing a career in banking tech, the patterns and anti-patterns surfaced here are directly applicable.

Core Banking Platform Decomposition: From Monolith to Microservices

Westpac's legacy core banking platform (CBP) ran on IBM mainframes with COBOL and CICS transaction managers. As of 2021, the bank publicly committed to replacing this with a modular, cloud-native stack. The engineering challenge is monumental: the CBP handles account management - transaction processing, interest calculations. And regulatory reporting for millions of customers. Uptime requirements exceed 99. 99%-downtime costs are measured in millions of dollars per hour.

The migration strategy follows the strangler fig pattern. New microservices encapsulate discrete domains like "Debit Card Authorization" or "Mortgage Interest Accrual" and interface with the mainframe via a transaction orchestration layer built on Apache Kafka and Confluent Platform. Kafka's exactly-once semantics and compaction topics ensure that no transaction is duplicated or lost during the cutover. Westpac's engineers have spoken at Kafka Summit about their use of tiered storage to retain months of event history for audit compliance.

A critical lesson: domain boundaries must be aligned with regulatory frameworks. For example, the Australian Prudential Regulation Authority (APRA) requires immutable transaction logs. The team discovered that event sourcing with append-only Kafka topics satisfied APRA's requirements natively, avoiding custom audit tables. This architectural choice reduced compliance overhead by an estimated 30%.

Cloud Migration Strategy: AWS Multi-Account Landing Zone

Westpac adopted a multi-cloud strategy with AWS as its primary public cloud provider for non-heritage workloads? The landing zone spans over 200 AWS accounts organized by business unit and risk tier. Critical production workloads reside in a hardened "Gold" account that enforces AWS Well-Architected Framework pillars: operational excellence, security, reliability - performance efficiency, cost optimization. And sustainability.

Networking is handled via AWS Transit Gateway with VPC attachments segmented by data classification. Westpac's zero-trust approach means even internal microservices authenticate using IAM roles and ACM certificates. The bank runs a custom security hub that aggregates GuardDuty - Security Hub, and Macie findings into a single dashboard, reducing mean time to detection (MTTD) from hours to minutes.

A notable engineering win: Westpac's cloud center of excellence built a Terraform pipeline that provisions a full microservice environment (VPC - ECS cluster, RDS database, Lambda functions) in under 12 minutes. This cut deployment lead times from two weeks to hours. However, the team also reported that cost governance becomes exponentially harder at scale-they now use AWS Cost Anomaly Detection with custom alerts tied to ServiceNow for auto-ticketing.

Cybersecurity Architecture After the 2020 Data Breach

In September 2020, Westpac disclosed a data breach involving a compromised payroll system operated by a third-party supplier. The incident exposed personally identifiable information (PII) of thousands of customers. In response, Westpac overhauled its vendor risk management and internal network segmentation.

From an engineering perspective, the key remediation was implementing a zero-trust network architecture (ZTNA) using encrypted tunnels and micro-segmentation. All third-party integrations now require passing through an API gateway (Kong Enterprise) that enforces OAuth 2. 0 with mutual TLS, and westpac also deployed OWASP API Security Top 10 scanning in CI/CD pipelines, catching vulnerabilities like excessive data exposure before reaching production.

Westpac's security operations center (SOC) adopted an AI-driven SIEM, correlating events from over 50,000 endpoints using machine learning models trained on historical attack vectors. The bank's CISO reported a 40% reduction in false positives within six months. For readers designing similar systems, the takeaway is clear: threat modeling must extend beyond your own code to cover supplier APIs and data lakes.

API Platform and Open Banking Compliance

Australia's Consumer Data Right (CDR) legislation mandates that major banks expose product and customer data via standardized APIs. Westpac's Open Banking implementation is built on an API-first architecture using the Consumer Data Standards (CDS) v1. 15. The platform processes over 40 million API calls per month, with average latency under 50 ms at the 95th percentile.

The API gateway is a heavily customized version of Apigee X, handling rate limiting, authentication (OIDC). And payload validation. Westpac engineers built a custom mock server using WireMock for sandbox environments, allowing accredited data recipients (ADRs) to test without hitting production. The mock server replays recorded CDS responses with injected random latency to simulate real-world conditions.

A notable architectural decision: Westpac opted for serverless compute (AWS Lambda) for CDR-specific backend processors. This allows auto-scaling during peak hours (end-of-month bursts) but requires careful cold-start management. The team pre-warms Lambdas using an EventBridge scheduler that invokes a healthcheck every 5 minutes during business hours.

Mobile Banking App Engineering: React Native vs Native

Westpac's mobile app (13 million+ downloads) underwent a rewrite in 2019. The initial version used a hybrid WebView approach, leading to poor scroll performance and high crash rates (0. 4% session crash rate). The rewrite chose React Native for cross-platform development, with native bridges for high-intensity feature like Apple Pay integration and fingerprint authentication.

The engineering team faced challenges with gesture handling and animation synchronization across iOS and Android. They adopted react-native-reanimated v2 to achieve 60 FPS transitions. Data syncing between app and backend uses a custom offline-first library built on IndexedDB (via WatermelonDB) that reconciles conflicts using last-writer-wins with a timestamps from the server.

Westpac's mobile SRE team monitors app performance using New Relic Mobile, tracking user journey flows (login to transaction history). They observed that 70% of support calls originated from a single transaction approval screen-a UX flaw that was fixed by adding a loading skeleton and debounced validation. The fix dropped call volume by 12%.

Real-Time Fraud Detection with Apache Flink

Westpac processes over 3,000 transactions per second at peak. Detecting anomalies in real-time requires a stream processing engine that can operate on sub‑100 ms latency. After evaluating Apache Spark Streaming and Flink, the bank chose Apache Flink for its low-latency state management and exactly-once semantics.

The fraud detection pipeline ingests transaction events from Kafka into a Flink job that performs geo-velocity checks, merchant category analysis. And user behavior profiling. The model is an ensemble of gradient-boosted trees (XGBoost) and a deep neural network trained on 18 months of historical data. Features include transaction amount deviation, time since last card use,, and and device fingerprint hash

Westpac reports that this system blocks 85% of fraudulent transactions in real time, with a false positive rate below 0. 2%. The engineering team continually Updates the model via an MLOps pipeline built on SageMaker and Flink's operator state snapshots. A key lesson: state backends must use RocksDB with incremental checkpointing to avoid GC pauses that exceed the 50ms SLA.

Observability and Incident Response

Westpac runs its observability stack on Prometheus, Grafana, and a custom OpenTelemetry collector for distributed tracing. Over 500,000 metrics stream per minute from microservices, databases, and network gear. The SRE team has defined Service Level Objectives (SLOs) for 50 critical services, including the payments pipeline (99. 995% availability) and account lookup (P99 latency

Incident response follows the Google SRE model with on-call rotations, blameless postmortems, and a chatbot (built on Slack and AWS Lex) that runs pre‑defined playbooks. Westpac's "Chaos Engineering" team runs GameDay exercises quarterly, injecting failures (e g., killing 20% of payment workers) and measuring how automatically the system recovers using Kubernetes auto-healing.

A notable incident: in 2022, a database failover of a PostgreSQL RDS instance caused a 12‑minute outage for one business unit. Postmortem revealed the connection pool size was too low under failover load. The fix: dynamic connection pool resizing based on Prometheus metrics, using Kubernetes HPA. This reduced recovery time to under 2 minutes in subsequent tests.

Data Engineering: Lake House Architecture for Analytics

Westpac's data platform for analytics (risk modeling, customer 360, regulatory reporting) is a lake house built on AWS and Databricks. It ingests over 50 TB of data daily from transactional databases, app events, and external sources (credit bureaus, market feeds). The storage layer uses Apache Parquet with Delta Lake for ACID transactions, enabling concurrent reads/writes without corruption.

The engineering team uses dbt for transformation, maintaining 2,000+ data models that adhere to the Kimball star schema for dimensional modeling. A key innovation was building an automated lineage tracker that maps dependencies between raw Kafka topics and dashboards in Tableau. This lineage is critical for APRA audits-proving that reported numbers can be traced back to source transactions.

Westpac also operates a feature store (Feast) to serve pre‑computed features to both real‑time Flink jobs and batch‑training jobs. This eliminates duplication and ensures consistency between training and production. The feature store contains over 10,000 features, managed through versioning and a CI/CD pipeline that validates data drift before promotion.

Developer Experience and Internal Tooling

Westpac invested heavily in an internal developer platform (IDP) called "Kuber" (a play on Kubernetes and the bank's branding). Kuber provides templated Git repositories, CI/CD pipelines (GitLab). And a self-service portal for provisioning environments. Developers select a service template (e g., "Java Spring Boot Kafka Consumer") and automatically get a production-ready scaffold with logging, monitoring, and security scanning pre‑configured.

The platform also includes a built-in canary deployment tool that automatically shifts 5% traffic to a new version, monitors error rates. And rolls back if anomaly detected. This reduced deployment‑related incidents by 60%. Kuber's cost dashboard shows per‑service cloud spend, helping developers improve resource requests.

One of the most popular internal tools is a "Chaos Monkey for Databases"-a synthetic load generator that simulates slow queries and connection storms against staging RDS instances. This helps test alerting and autoscaling before they become production problems.

Frequently Asked Questions

Q1: What technology stack does Westpac use for its core banking system?
A: Westpac is migrating from IBM mainframe/COBOL to a modular microservices architecture using Java - Apache Kafka, AWS services (ECS, RDS, Lambda). And Kubernetes for orchestration. The new core relies on event sourcing and CQRS patterns.

Q2: How does Westpac ensure security after the 2020 data breach?
A: They implemented zero-trust network architecture with micro-segmentation, OAuth 2. 0/mTLS for all third-party APIs, OWASP API Security scanning in CI/CD. And an AI-driven SIEM with machine learning models to reduce false positives.

Q3: Which cloud provider does Westpac use?
A: Westpac primarily uses Amazon Web Services (AWS) for non‑heritage workloads, with a multi‑account landing zone and strict adherence to the Well‑Architected Framework. They also maintain on‑prem data centers for mainframe operations.

Q4: What is Westpac's mobile app written in?
A: The current mobile app is built with React Native, using native bridges for biometrics and payment integrations. Data sync relies on WatermelonDB for offline‑first functionality.

Q5: How does Westpac detect fraud in real time?
A: Westpac uses Apache Flink for stream processing, ingesting transactions from Kafka and applying an ensemble of XGBoost and neural network models. The system blocks 85% of fraud with a false positive rate under 0. 2%,?

What Do You Think

Should mid‑sized banks skip mainframe modernization altogether and adopt a greenfield core banking platform from a vendor like Thought Machine or Mambu,? Or is the strangler fig pattern still the safest bet for risk‑critical infrastructure?

Given the complexity of Australia's Consumer Data Right, would an event‑sourced API gateway with CQRS have been easier to audit than Westpac's current Apigee‑centric approach?

For mobile banking apps, does React Native's developer velocity justify the added complexity of native bridges for high‑performance features,? Or should banks invest in fully native iOS and Android teams from day one?