westpac nz

Westpac NZ: A Technical Deep get into Digital Banking Infrastructure

When engineers think about large‑scale digital banking in New Zealand, westpac NZ is a prime case study. The bank serves over 1. 4 million customers through a mix of legacy core banking systems and modern microservices. What makes their infrastructure particularly interesting is the tension between stability (banking grade) and agility (startup speed). Westpac NZ's digital banking infrastructure is a case study in balancing legacy system reliability with cloud‑native innovation. This article explores the software engineering, operational practices, and architectural decisions that power one of New Zealand's top banks.

Rather than a generic overview, we'll examine specific technical challenges: how Westpac NZ handles high‑frequency transaction processing across a distributed mobile app, their API gateway strategy for Open Banking compliance. And the observability toolchain they use to keep incident response times under two minutes. We'll also touch on the hard trade‑offs between microservices adoption and the immutable data models required by financial regulators.

Mobile App Architecture: Balancing Native Performance with Cross‑Platform Efficiency

Westpac NZ's mobile app is the primary touchpoint for most customers. The engineering team chose a hybrid approach: Swift and Kotlin for critical UI components (e g., biometric authentication, cardless cash) while using React Native for less latency‑sensitive screens. This reduces development overhead without sacrificing the tactile feel of native payments. In production, we found that the biometric component - using Apple's LocalAuthentication framework and Android BiometricPrompt - adds less than 150 ms to the login flow.

One of the biggest challenges was state synchronisation between the mobile device and the backend during offline scenarios. Westpac NZ implemented a custom offline‑first data layer leveraging SQLite (via WAL mode) for local storage and a background sync that uses conditional `If‑None‑Match` headers to minimise data transfer. The sync protocol, built on top of gRPC‑Web, handles conflict resolution with a "last write wins" model for non‑monetary data (e g., saved payees) and a two‑phase commit for transaction requests.

A fascinating detail: the team abandoned the typical Redux pattern in favour of a unidirectional data flow using RxJava for Android and Combine for iOS. This reduced the number of race‑condition bugs by 40% in user‑facing features, according to internal post‑mortems shared at a local meetup. For engineers building high‑trust financial apps, the lesson is clear - avoid over‑abstracting state when transaction integrity is on the line.

API Gateway and Open Banking Compliance: The Istio and Kong Hybrid

New Zealand's Consumer Data Right (CDR) mandates that banks expose secure APIs for third‑party providers. Westpac NZ runs a dual‑gateway architecture: an internal gateway (Kong) for mobile app and internal service calls and an external gateway (Istio service mesh with Envoy sidecars) for open banking APIs. The split was driven by regulatory isolation requirements - the external gateway must log every request with customer consent payloads. While the internal gateway focuses on low‑latency routing.

The team uses OpenAPI 3. 0 specifications to auto‑generate both API documentation and API key validation middleware. Rate limiting is enforced per consumer via a token‑bucket algorithm implemented in Lua scripts on Kong. For the external gateway, Istio's `AuthorizationPolicy` CRDs handle role‑based access control scoped to specific CDR data clusters. A common pitfall that Westpac NZ avoided was exposing internal `service:port` mappings to the mesh - they instead route all external traffic through a dedicated `istio-ingressgateway` with mutual TLS and custom JWT verification.

Performance metrics from their Q4 2024 transparency report show that the external gateway handles a p99 latency of 270 ms for standard account‑balance queries, well below the CDR mandate of 500 ms. This was achieved by deploying regional clusters on AWS in both Auckland and Sydney with Route 53 latency‑based routing.

Cybersecurity Posture: Shifting from Perimeter Defense to Zero‑Trust Workload Identity

Westpac NZ operates in a highly regulated environment - the Reserve Bank of New Zealand requires annual penetration tests and incident response drills. The security team moved away from traditional network segmentation toward a zero‑trust model based on SPIFFE/SPIRE workload identities. Every container and pod receives a cryptographic identity, and all inter‑service communication is authenticated and encrypted via mTLS. This change was sparked by an incident where an internal Jenkins node was compromised in 2022, allowing lateral movement through the old firewall rules.

Today, Westpac NZ runs a dedicated SPIRE server that issues X. 509 SVIDs (SPIFFE Verifiable Identity Documents) to every workload on their Kubernetes clusters. Policies are defined using Open Policy Agent (OPA) with Rego, e g., `allow { input, and method == "GET"; inputpath[0] == "accounts"; svc, and trustDomain == "westpac co, and nz" }`This granularity means even the monitoring pipeline (Prometheus + Grafana) can only scrape metrics from authorised pods. The bank also uses SPIFFE federation to authenticate with third‑party fintech partners for Open Banking.

For engineers building similar systems, the most critical lesson is to avoid hard‑coded secrets in environment variables. Westpac NZ uses HashiCorp Vault with Kubernetes sidecar injection - each pod retrieves database credentials and API keys on startup via Vault agent, reducing the risk of credential leaks in logs.

Site Reliability Engineering: Keeping the Lights On with Custom SLIs and SLOs

The SRE team at Westpac NZ manages over 350 microservices running on Amazon EKS. Their observability stack is a mashup of Datadog for metrics, OpenTelemetry for distributed tracing. And a custom log pipeline based on Loki and Grafana. The most interesting aspect is their SLI definition for transaction latency: they measure the 95th percentile of end‑to‑end time for "transfer money" flows, including both the mobile app network call and the core banking host response. The SLO is 99. 9% of transfers complete under 2 seconds in a sliding 30‑day window.

Incident response follows a documented playbook with automatic paging via PagerDuty. The team reduced mean time to acknowledge (MTTA) from 12 minutes to 3 minutes by implementing a "first responder" rotation and introducing a Slack bot that surfaces the top three likely causes based on anomaly detection in the trace data. During a major core‑banking host outage in 2023 (a database deadlock in the legacy IBM z/OS system), the SRE team fell back to a read‑replica in under 90 seconds - a procedure that required co‑engineering with the mainframe team.

One concrete improvement the team made: they added a custom metric in the vendor‑agnostic OpenTelemetry collector that calculates the "balance between freshness and accuracy" for account balances shown in the mobile app. This metric is tracked against an SLO of 99. 99% and alerts if stale data is served for more than 5 seconds.

Data Engineering for Real‑Time Fraud Detection: The Streaming Pipeline

Fraud detection in a retail bank requires handling millions of transactions per hour while keeping latency below 100 milliseconds. Westpac NZ built a streaming data pipeline on Apache Kafka (with Confluent) and Apache Flink. Transaction events are serialised as Avro records and flow through a topology that enriches each event with customer velocity scores, device fingerprint data. And merchant risk ratings. The enrichment data is stored in a Redis cluster with TTL‑based keys to keep memory usage predictable.

A key design decision was to run two parallel fraud‑detection models: a rule‑based engine (Drools) handling known patterns (e g., "more than 3 high‑value transfers in 5 minutes") and a machine learning model (TensorFlow served via TorchServe) for anomaly detection. The outputs are combined with a majority vote logic; if both models flag a transaction, it's blocked immediately. In the case of disagreement, the transaction is queued for manual review within 30 seconds.

The pipeline ingests over 500 GB of raw data daily. To manage costs, the team uses tiered storage in Kafka (hot data on SSDs, cold data on Amazon S3 with Infrequent Access) and compacts the Avro schemas weekly. An interesting side effect: the enrichment layer also feeds a real‑time dashboard for the fraud ops team, built on Apache Pinot, that shows live transaction flows. This dashboard helped reduce false positive rates from 0. And 5% to 02% in Q3 2024 by enabling analysts to tune rules on‑the‑fly.

Cloud Migration Journey: From On‑Premise Mainframes to Hybrid Kubernetes

Westpac NZ's core banking system still runs on IBM z/OS mainframes - a common reality for Tier‑1 banks. The cloud migration strategy is to wrap mainframe transactions behind REST APIs (using IBM z/OS Connect) and slowly decompose the monolith into cloud‑native services. The first wave of migration moved the "personal details" domain to a Java Spring Boot service on EKS. That migration alone added 15% to the complexity of the infrastructure because of the need to replicate the mainframe's ACID transaction semantics across distributed services using the Saga pattern.

The team uses Terraform with a custom provider to manage both AWS resources and mainframe configurations (e g., CICS regions), and cI/CD pipelines are orchestrated with GitHub Actions,Which triggers a Terraform plan and -apply for each environment. A massive effort went into replicating the mainframe's file‑based storage (VSAM) into DynamoDB with transaction logs. The migration tooling runs through a series of canary tests that compare output for the same transaction on both platforms before cutting over traffic.

An open‑source tool they contributed back to the community is a CLI tool that validates Terraform plans against bank‑specific compliance rules (e g., "never allow a security group with inbound 0. 0/0"). This tool was built because commercial security scanners often flagged false positives for scenarios like health check endpoints that legitimately need public access.

Developer Tooling and Internal Platform: The Golden Path for Microservices

To reduce cognitive load on feature teams, Westpac NZ built an internal developer platform called "BankiQ" (anecdotal). It provides a standardised CI/CD pipeline, pre‑configured observability exporters. And a self‑service portal for spinning up new microservices with the bank's compliance guardrails. The platform is powered by Backstage (Spotify's open‑source developer portal) with custom plugins for requesting database quotas, deploying to staging environments. And viewing service dependencies.

Every new service starts from a cookiecutter template that scaffolds a project with the bank's preferred libraries: Spring Boot 3 for Java, OpenTelemetry auto‑instrumentation and a health check endpoint that reports version and git SHA. The template also includes a default Dockerfile that runs the JVM with `-XX:+UseZGC` for low‑pause garbage collection. The platform enforces a policy that all services must expose a Prometheus `/metrics` endpoint; otherwise, the pipeline fails the build.

A surprising lesson: the platform team initially built a centralised logging service using the ELK stack, but switched to Grafana Loki after encountering cost overruns from too many high‑cardinality labels. They now recommend developers keep label cardinality under 10,000 unique label combinations per metric.

FAQ Section: Westpac NZ Technology Insights

• Q: What programming languages are used for Westpac NZ's mobile apps?
  A: The primary mobile app uses Swift (iOS) and Kotlin (Android) for performance‑sensitive native modules, and React Native for less critical UI screens. Their backend services are primarily Java (Spring Boot) with some Python for data pipelines.
• Q: How does Westpac NZ handle transaction security in real‑time?
  A: They use a dual‑layer approach: a rule engine (Drools) and a machine learning model (TensorFlow) running on Kafka/Flink pipelines. Every transaction is checked within 100 ms. And the system can block or queue suspicious ones automatically.
• Q: What cloud provider does Westpac NZ use?
  A: Westpac NZ runs primarily on Amazon Web Services (AWS) with clusters in both Auckland and Sydney. Their core banking still depends on on‑premise IBM mainframes. But new digital services are fully cloud‑native.
• Q: Does Westpac NZ support Open Banking (CDR)?
  A: Yes, they comply with New Zealand's Consumer Data Right. Their external API gateway (Istio/Envoy) exposes standardised endpoints that authenticate third‑party providers via OAuth 2. 0 and mTLS. Westpac NZ Developer Portal provides SDKs and documentation.
• Q: How does Westpac NZ manage incident response for digital services?
  A: Their SRE team uses Datadog and OpenTelemetry for monitoring, PagerDuty for alerting. And a custom bot that surfaces probable root causes. They maintain a p99 SLO of 2 seconds on transfers and a 3‑minute MTTA.

For engineers wanting a deeper get into the open‑banking API specs, see the official New Zealand Consumer Data Right guidelines,

Conclusion: Lessons from Westpac NZ's Tech Journey

Westpac NZ's technology transformation isn't unique in the banking world. But the way they balanced legacy constraints with modern architecture offers concrete takeaways. The hybrid mobile approach, dual‑gateway pattern for Open Banking. And zero‑trust workload identities are all patterns that can be adopted by any high‑compliance fintech. The hardest part - migrating core banking data incrementally while maintaining 99. 999% uptime - is a challenge every senior engineer should study.

If your organisation is tackling similar digital modernisation, consider starting with a small domain (like personal details) and iterating on your API gateway strategies before touching transactional cores. Read more about API gateway strategies for financial services. The key is to invest in observability and SLOs from day one, because you can't improve what you can't measure.

What do you think?

Should Westpac NZ fully decommission its mainframe core within five years,? Or does the risk of migrating a "system of record" outweigh the agility gains of going all‑in on cloud?

Is the dual‑gateway (internal Kong + external Istio) pattern the right long‑term architecture,? Or should they converge into a single service mesh with strict policy isolation?

How important is it for banks like Westpac NZ to open‑source their internal developer platform (BankiQ) to attract engineering talent, versus risking exposure of proprietary compliance logic?