A Netherlands-based bank carried a legacy retail banking platform that blocked it from delivering modern digital experiences to its growing customer base.
The Software House replaced that platform with cloud-native banking channels, migrated 30,000 customers to a modern identity system, and built a compliance-by-design architecture covering GDPR, KYC, and AML operations.
Partnership goal:
→ To replace a legacy retail banking platform with secure, cloud-native digital channels that met regulatory requirements and scaled to future product growth.
About the client
*This information describes a real project, but The Software House cannot disclose the client’s name.
The client is a Netherlands-based retail bank that operates as a subsidiary of a large European private investment group and serves customers in the Dutch, German, and British internet banking markets.
INDUSTRY
Fintech & Banking
COUNTRY
The Netherlands
SERVICE
Modernization, Cloud & Data
Business context
The bank ran a legacy retail banking platform that lacked modern identity security, compliant onboarding workflows, and nominated and joint account management.
Settlement and analytical calculations ran on Microsoft SQL Server virtual machines, forcing engineers to chain through multiple machines to access data, leaving no capacity for product development.
Challenges:
Replacing the legacy identity platform and modernizing KYC, AML, and GDPR compliance workflows,
Building banking operations from scratch: nominated accounts, cash withdrawal, joint accounts, and Mambu savings and deposit products,
Replacing VM-based SQL Server pipelines with a cloud-native data warehouse.
Solution
1. Identity and compliance
Identity platform migration
The legacy application stored credentials with no path to modern password policies or multi-factor authentication.
Migrated all users from the legacy application to AWS Cognito, preserving existing credentials,
Allowed users to log in with old passwords and set new passwords under the modern security policy, avoiding a forced reset,
Established AWS Cognito as the single identity provider, enforcing modern password standards and MFA.
KYC onboarding
The bank served 3 distinct customer types, each requiring a different onboarding path through the same compliance checks.
Built an end-to-end onboarding process across 3 journey types: standard individual accounts, migrated legacy users, and joint account invitations,
Covered identity registration, KYC, and AML data collection, biometric verification, and deduplication against migrated records in each journey,
Concluded with account provisioning in Mambu, a linked payment account, and synchronized records in Salesforce CRM.
GDPR right-to-erasure
No erasure workflow existed on the platform, leaving the bank exposed to GDPR right-to-erasure obligations.
Implemented the right-to-erasure workflow using AWS Cognito as the identity layer,
Validated the GDPR deletion flag in Salesforce CRM through a safety gate before removing any credentials,
Covered the channels and identity layer only, leaving Salesforce data deletion to a separate process.
AML compliance workflows
Compliance teams had no visibility into payments processed on AML-frozen accounts after the gateway had already cleared them.
Implemented the Payment Booked on Frozen Account workflow for SEPA Credit Transfers processed on AML-frozen accounts,
Created an audit record in Salesforce CRM as an AML or Frozen Ledger Payment for each flagged transaction,
Gave compliance teams full visibility into payment activity on frozen accounts without blocking or altering completed transfers.
Impact
30,000 customers moved to a secure, compliant identity stack. No access disruption, full GDPR erasure capability, and AML audit trails built in from day one.
Architecture diagram
2. Banking operations
Nominated account management
Customers had no way to register, manage, or protect external accounts as withdrawal destinations.
Delivered the full lifecycle for nominated accounts, external bank accounts customers registered as withdrawal destinations,
Added accounts with IBAN country validation and duplicate prevention,
Removed accounts with a last-active-account protection guard,
Required MFA verification on all operations and persisted results as Financial Account records in Salesforce CRM.
Cash withdrawal
There was no mechanism to move funds from a savings account to an external bank account.
Implemented outbound transfers from savings accounts to nominated accounts,
Validated the savings balance in Mambu, enriched the payment with customer data, and initiated an outbound SEPA Credit Transfer via Form3.
Joint accounts
The bank offered no shared account product for couples, family members, or business partners.
Built an invitation-based onboarding for joint savings accounts, with the primary holder creating an Opportunity in Salesforce CRM,
Required the invited user to enter an invitation code, complete biometric verification, and be provisioned as a co-owner in Mambu,
Required co-owner approval via a Salesforce Case before account closure, ensuring both parties consented.
Mambu savings and deposit products
Savings and fixed-term deposit products lacked core banking integration and real-time visibility for customer service agents.
Implemented savings accounts in Mambu, covering balance management, interest calculations, and fee application,
Validated savings balance before provisioning each fixed-term deposit with an automatic fund transfer and a guaranteed interest rate,
Supported a 14-day cooling-off period and early maturity with fee calculation on deposit closure,
Propagated all Mambu account events to Salesforce CRM Financial Account records in real time, eliminating manual reconciliation.
Impact
The bank went from zero retail product infrastructure to a fully operational suite, including withdrawals, joint accounts, and fixed-term deposits, all running on automated, real-time data.
3. Data infrastructure
Data platform modernization
Settlement calculations and analytical workloads ran on VM-based SQL Server infrastructure that timed out frequently and consumed all available engineering capacity.
Replaced VM-based SQL Server pipelines with dbt for data transformations and Apache Airflow for orchestration.
Rewrote existing SQL processes on Amazon Redshift as the first step away from VM infrastructure.
Pivoted to Snowflake after evaluating platform fit, delivering a unified cloud-native data warehouse.
Redirected engineering capacity from infrastructure maintenance to product development.
Impact
The engineering capacity that infrastructure maintenance had consumed was freed to build new product capabilities on a platform built to scale.
Check out our previous project with this bank:
SEPA certification enabled one bank to reach 36+ countries
Outcomes
Users kept banking as normal while everything underneath them was replaced.
→ Secure identity for 30,000 customers.
AWS Cognito replaced legacy credentials, enforcing modern password standards and MFA with no disruption to access.
→ Full retail banking suite built from scratch.
Nominated accounts, withdrawals, joint accounts, and fixed-term deposits – all live and connected through Mambu and Salesforce.
→ Compliance across regulations.
GDPR erasure, KYC onboarding, and AML audit trails delivered as core platform features, not retrofits.
→ Data pipelines moved to the cloud.
Snowflake, dbt, and Airflow replaced VM-based SQL Server, freeing engineering capacity for product development.
