A. “Bank‑Hosted” Fintech Payments Architecture

1. Executive Summary

This document provides a comprehensive technical overview of the architecture for deploying Fintech's Distributed Ledger Technology (DLT) based solution within a bank's infrastructure. The architecture is designed for a "Bank-hosted" model, where Fintech provides the software, and the bank manages the entire IT environment, ensuring alignment with stringent security and compliance requirements.

Key architectural tenets include:

Per-Bank Tenancy: Strict runtime isolation with a dedicated cluster for each bank.
Edge Security: Comprehensive security measures at the network perimeter, including Web Application Firewalls (WAFs) and TLS termination.
Data Sovereignty: All sensitive data remains within the bank's control and environment.
High Availability & Disaster Recovery: A robust framework to ensure business continuity and meet strict Recovery Time/Point Objectives (RTO/RPO).
Fintech observability hub: Fintech runs its own Infra and runs an overall observability hub. Infrastructure/operational metrics/logs go to bank SIEM but some infra/operational metrics per bank policy (no PII/business payloads) go to Fintech observability hub. Volume metering is required for billing
Ledger: Distributed ledger for atomic settlement (e.g., PvP/DvP). Bank nodes participate; APIs orchestrate flows.

2. High-Level Architecture Decisions

This section outlines the primary architectural choices and their rationale, providing a quick reference for different deployment environments.

Area	Bank in Cloud (e.g., AWS)	Bank On-Premise (e.g., OpenShift)
Deployment Model	One Kubernetes cluster per bank (in AWS, Azure, GCP)	One OpenShift cluster per bank, managed within bank’s data centers.
Ingress & Flow	Client UI → AWS WAF → AWS ALB → Kubernetes Ingress/API Gateway → Pods.	Client UI → ADC (Application Delivery Controller, equivalent to AWS ALB ) with WAF built-in (F5/Citrix) → OpenShift Router / API Gateway → Pods.
TLS Termination	Terminated at the AWS ALB with TLS re-encryption to the Kubernetes Ingress.	Terminated at the bank's Application Delivery Controller (ADC) at the edge.
WAF Placement	AWS WAF attached to the ALB; optional in-cluster WAF for deeper inspection.	WAF co-located with the ADC at the edge (e.g., F5 BIG-IP + ASM).
Identity & Access Management (IAM)	Coarse-grained IAM: Handled at the ALB/WAF level, federated with the bank's IdP.
Fine-grained IAM: Enforced at the API Gateway or application logic using JWT claims.	Coarse-grained IAM: At the ADC or OpenShift Router, integrated with the bank's IdP via SSO.
Fine-grained IAM: Inside the API Gateway or microservices via tokens.
Secrets & Keys	- Bank Secret Manager (e.g., AWS Secrets Manager) via the Secrets Store CSI driver of External Secrets Operator (ESO)

Sensitive keys are stored in an HSM/KMS. | - Network HSMs
OpenShift Secrets Store CSI driver or External Secrets Operator (ESO). | | High Availability | - Multi-AZ architecture;
PodDisruptionBudgets (PDB) and anti-affinity rules ensure fault tolerance. | PDBs and anti-affinity rules for high availability and load distribution. | | Egress | • Egress gateway with allow-lists • protocol-related P2P ports open for blockchain nodes • DoS shaping on node P2P | also need private network -Equinix Fabric | | External API calls (Sanctions List, AML API) | • Prefer private endpoints (AWS PrivateLink / Azure Private Link / GCP PSC). • Internet fallback = HTTPS + WAF + mTLS + IP allow-lists. | • On-prem via MPLS/Equinix/VPN. |

AWS PrivateLink allows you to privately and securely access a service (your own or third-party) over the AWS network without exposing it to the public internet or requiring VPC peering.

3. Detailed Architecture Components

3.1. Tenancy and Runtime

Runtime Isolation: A single, dedicated Kubernetes cluster is deployed for each bank in their preferred environment (AWS, GCP, Azure, On-prem).
Infrastructure Provisioning: Fintech provides hardened and audited Infrastructure as Code (IaC) templates (e.g., Terraform and Helm manifest) for the bank's platform team to provision the necessary infrastructure.