One accounts API
Every client surface reads and writes through the same interface.
All Projects
Fullstack · Digital banking platform
Building a digital banking platform compliance didn't have to fight
A fullstack banking platform — accounts API, mobile banking app and ops console built as one system — replacing a legacy pair of clients staff had learned to work around.
Start a Project- Client
- Cobalt
- Industry
- Digital & retail banking
- Year
- 2023
- Duration
- 22 weeks
- Role
- Full-stack engineering + compliance review
- Team
- 6 engineers, 1 compliance liaison
- Platform
- Fullstack
The challenge
A teller desktop client and a customer-facing mobile app each reinterpreted KYC checks and audit logging in their own code, which is why no two surfaces recorded the same event the same way. Compliance spent more time reconciling what each system claimed had happened than reviewing whether it should have happened at all.
Approach & solution
Approach
We refused to let either client own compliance logic. Every screen — teller desktop, mobile, ops console — was rebuilt to call one accounts API, with KYC checks and audit logging enforced once behind that interface rather than reimplemented in front of it three separate times.
Solution
An accounts API with encryption and audit logging enforced at the service layer, a mobile banking app and an ops console that read from it without drifting apart, and an audit trail the compliance team hands to regulators without translating it first.
What shipped
The capabilities behind the screens.
One accounts API
Every client surface reads and writes through the same interface.
KYC enforced once
Checks live behind the API, not reimplemented in every client.
Service-layer audit logging
Every action is logged once, at the source, not per client.
Mobile banking app
Customer-facing accounts, transfers and statements on one shared core.
Ops & teller console
Staff-facing operations reading the exact data customers see.
Unified event log
One record of what happened, shared by every surface and every audit.
Tech Stack & Architecture
The client-side architecture and interface layer shipped for this engagement.
4 tools · 1 primary
Services, APIs, and business logic running the system end to end.
3 tools · 1 primary
Datastores and pipelines chosen for this engagement's consistency and throughput needs.
2 tools · 1 primary
Deployment, orchestration, and delivery tooling running the platform in production.
3 tools · 1 primary
System architecture
Technical challenges
Keeping two clients from re-diverging after launch
The old teller and mobile clients had drifted apart because each had somewhere to put its own logic. The new API exposes no client-specific endpoints, so there's structurally nowhere for either surface to fork behavior into.
Enforcing KYC once without slowing down the teller desk
Centralizing checks risked adding a network hop to every teller action. KYC state is cached at the API layer and invalidated on change, so a repeat check is a cache read, not a re-verification.
Encryption and audit logging without a throughput cliff
Per-field encryption on every write threatened peak-hour teller throughput. Encryption was moved to a write-through layer that batches key operations, keeping p99 write latency inside the desk's existing budget.
How it was built
The stages this engagement ran
01
Brief & Strategy
2 weeks
Mapped where the teller and mobile clients had silently diverged on KYC and logging.
02
Strategy & Planning
3 weeks
The one-API rule was agreed with compliance before any client screen was touched.
03
UX & UI Design
3 weeks
Mobile, teller and ops flows designed in parallel against the same API contract.
04
Development
9 weeks
Accounts API shipped first; all three clients built against it rather than a mock.
05
QA & Optimization
3 weeks
Compliance ran a full audit dry-run against the new log before go-live.
06
Deployment & Support
2 weeks
Rolled out branch by branch, teller desktop first, mobile app last.
Results
What changed, in the numbers.
“Compliance stopped asking which system was right. There's only one system now.”
Isabel Cruz · IT Director · Cobalt
Selected screens
Cobalt, in the product
Related work
Works you may also like.
Technical briefingNot a sales desk