The regulatory deadline is fixed. The original engineers left years ago. The documentation covers maybe 40% of what the system actually does. This is the real shape of most legacy fintech modernization projects and where generic advice breaks down.
The hard problems are specific: reverse-engineering systems nobody understands, migrating KYC vendors without re-verifying your users, getting SEPA certification on cloud infrastructure under a board deadline, and bridging synchronous legacy flows with asynchronous modern services, all while DORA and PSD3 enforcement close in.
TL;DR
Reverse engineering comes before architecture. When original developers are gone and docs are incomplete, the first deliverable is system knowledge, not a migration plan. Code archaeology, behavior testing, and service boundary mapping build the working model that everything else needs.
KYC vendor migration doesn't require re-verifying your users. An async middleware layer handles the sync-to-async translation. Structured data portability handles the record transfer across the vendor boundary.
SEPA certification on cloud infrastructure is achievable under a hard deadline. A Dutch bank expanded from 3 to 36 SEPA countries on AWS via Form3, delivering the first SEPA-compliant cloud architecture in its history against a board-mandated timeline.
Microservices aren't always the right call in regulated fintech. A modular monolith backed by narrowly scoped services can cut bond issuance time from weeks to hours and costs by 80%.
What makes legacy fintech modernization different from a standard cloud migration?
Three problems compound in regulated fintech, and each makes the others harder.
Missing knowledge: the engineers who built the system are gone. Documentation covers the happy path only. Every architectural decision from the last decade is encoded in the codebase.
Architectural mismatch: legacy fintech systems were built around synchronous request-response flows and nightly batch jobs. The modern stack runs on asynchronous events, webhooks, and real-time settlement.
The regulatory timeline doesn't flex. DORA enforcement started in January 2025. PSD3 timelines are set. SEPA Instant compliance is mandatory for EU payment service providers.
Generic cloud migration advice stops at the infrastructure layer. Modernizing legacy fintech architecture means solving knowledge first, then the mismatch, then the compliance layer. Skipping the sequence is where projects fail.
How do you reverse-engineer a legacy fintech system when the original developers are gone?
Fintech reverse engineering legacy code starts with accepting that documentation won't appear. The team has to build that knowledge as they go.
That means four tracks running in parallel.
Static analysis: dependency graphs, schema archaeology.
Behavioral testing: observing outputs to infer business rules rather than reading a specification.
Log and transaction mining: production logs capture what the system does versus what it was built to do.
Service boundary mapping: finding seams where future decomposition can happen without rewiring everything.
Working with a US-listed fintech modernizing legacy infrastructure, the delivery team ran all four tracks on a codebase with no active maintainers. Over the engagement, they became the primary subject matter experts, holding system knowledge the client had lost.
That shift, from delivery team to primary SME, is the real output of fintech reverse engineering. Every architectural decision follows from it.
How do you bridge a synchronous legacy system with an asynchronous, webhook-driven modern stack?
A webhook-driven async KYC provider fires a response when verification completes. A legacy codebase with no concept of async webhook KYC integration can't consume that model directly. This challenge, bridging sync legacy async modern systems, requires a dedicated architectural layer, not a configuration change.
The solution is a middleware layer that accepts the synchronous call from the legacy system, submits the request to the new provider, holds state, and resolves when the webhook arrives. The legacy system sees a synchronous response. The KYC provider gets a fully async integration.
In the same US-listed fintech engagement, this pattern covered a full KYC vendor migration without re-verifying a single user. The legacy provider (Socure) was replaced with Sumsub. KYC data moved between instances with verification status intact. New revenue features, a fiat fee module, and P2P transfers were shipped alongside the migration.
What does it take to achieve SEPA certification on cloud-native infrastructure?
Cloud migration comes first, and SEPA certification follows as the outcome, not the target you build toward. A SEPA certification cloud migration requires solving three layers at once: the payment rail, the banking engine, and the regulatory compliance architecture.
A Dutch bank came to this with a legacy on-premise system serving three countries, with capped currencies and limited cross-border reach. The board had a deadline. Hiring inside that window was not realistic.
The migration ran on AWS-based serverless infrastructure. Form3 brought SEPA, SEPA Instant, and SWIFT behind a single API. Mambu handled loans, deposits, and accounts. Credit risk, CDD, KYC, and AML compliance ran on the new stack.
Cross-border volume increased 12 times. Coverage expanded from 3 to 36 SEPA countries. New revenue opened up through SEPA-enabled payments. The legacy banking on premise to AWS migration landed on deadline, and SEPA certification came with it as confirmation, not as the goal that shaped the build: proof that you can modernize banking platform architecture without missing a regulatory window.
The Dutch bank case study shows this bank cloud migration SEPA certification pattern, Form3 and Mambu on AWS, under a hard regulatory timeline. The partnership continued: a later engagement modernized the same bank's retail platform for 30,000 customers, covering identity, KYC, and AML compliance end to end.
Does modernizing a regulated banking platform always mean microservices?
The default modernization narrative ends with microservices. In regulated fintech, that default is often wrong.
For Obligate, a regulated DeFi platform for on-chain bonds under a Swiss legal framework, the team re-evaluated a full microservices approach and built a modular monolith supported by narrowly scoped external services. Bond issuance time dropped from weeks to hours. Costs fell by 80%.
Microservices multiply the compliance surface area. Distributed tracing, service mesh, and independent deployment pipelines each become audit surfaces. A modular monolith with clean internal boundaries achieves the same extensibility with fewer failure points.
How do you keep a fintech platform modern while DORA and PSD3 deadlines close in?
DORA mandates operational resilience for EU financial entities, enforced from January 2025. PSD3 extends open banking obligations and tightens security requirements. Neither waits for a modernization project to wrap up.
DORA compliance modernization belongs inside the platform work, not parallel to it. ICT risk controls, third-party risk management, and operational resilience testing shape architectural decisions. Building these in from the start costs significantly less than retrofitting them later.
BrickVest, a real estate fintech, has been continuously modernized for over seven years, through six or more stack upgrades across multiple regulatory cycles, with a team that scaled to 22 specialists at peak. The platform's sustained health supported BrickVest's acquisition by Patrizia. Modernization as a practice, not a project.
For teams under active DORA and PSD3 pressure, compliance requirements define the minimum viable architecture. The modernization effort extends from that baseline.
Key insights
Reverse engineering is the first deliverable. System knowledge has to precede migration plans, or architectural decisions become guesses. The pattern that works runs system analysis first, an architecture proposal second, and a phased roadmap third, never the reverse.
KYC vendor migration without user re-verification is achievable. Async middleware handles the sync-to-async translation. Structured data portability covers the record transfer.
SEPA certification cloud infrastructure follows a repeatable pattern. Form3 for rails, Mambu for core banking, AWS for infrastructure, with compliance services on the new stack from day one.
Compliance is an architectural constraint, not a checkpoint. What gets designed costs a fraction of what gets retrofitted.
The teams that get through legacy fintech modernization treat the knowledge gap as the primary risk, not the technology one. System understanding before migration plans. Compliance by design from day one.
Authors
Jakub Matuszak
Marketing Specialist at The Software House, focused on B2B tech insights and turning complex topics into actionable guidance for engineering leaders.