Engineering inside regulated banking infrastructure

The situation

Two environments, one constraint: every integration would be reviewed by compliance before it went anywhere near production. Inside a regulated US bank, engineering delivered directly into banking infrastructure; inside a major financial-services institution, vendor API integrations built within existing compliance frameworks.

What we did

• Designed integrations with the review in mind from the first commit: immutable audit trails, deterministic transaction identifiers, and documented data flows for BSA/AML and OFAC touchpoints — so compliance could trace any transaction end to end without an engineer in the room.
• Built vendor and network integrations to the institution’s control framework rather than around it: least-privilege access, key management inside the institution’s controls, change management with evidence.
• Handed over runbooks and trained the internal teams that would own the systems, with no ongoing dependency.

The outcome

Integrations that passed compliance review and stayed in production, owned by the institution’s own engineers.

What it shows

In a regulated bank, “done” means the auditor can follow it. Designing the audit trail before the feature is faster than retrofitting it after the finding.