Integration, Automation and Open API in Banking Infrastructure to Accelerate Service Innovation - How Crypto paves the way

Banks have started a process of reinventing their value proposition as a highly automated and integrated platform for a continuously innovating portfolio of financial services. Payment is key to this and in the same time under threat by external market entrants.

This article looks at the drivers for change and their impact on the banks’ IT and crypto architecture. It suggests 6 crucial technical features required by the crypto architecture as key enablers for a successful transition.

We have dedicated several blogs on disruptive changes driven by regulations and compliance (e.g. PSD2 or PCI PTS HSM v3), technical innovation (such as cloud computing, blockchain or Quantum secure cryptography (PQC)) and enforced competition through new market entrants. 

Another driver is the customers’ demand for innovative, sophisticated added-value services - spoiled by the digital economy and its sheer never ending supply of new services.

The need for Platform Innovation

Put under severe pressure by non-banking entrants & Fintechs into the payment market and following the example of IT companies, banks are embracing the idea of platform innovation as a source for new service generation. 

In a survey conducted in the Global Transaction Banking Sector by McKinsey and published 2020, 89% of the respondents see platform innovation as a key to build competitive advantage. 95% want to target their investment towards the creation of customer experience [1].

50% of the banks interviewed allocate an IT investment budget exceeding 100 Million € to reach this goal [1].

Let us just revisit the term platform innovation. It is the creation of a fertile environment, allowing for internally and externally (ecosystem)-driven innovation through free access to the available (virtualized) services. The services can be orchestrated to new, value-adding composite services, driven and complemented by unleashed internal value creation and external ecosystems. If managed properly, it can incite an emerging process of continuous value creation [3].

Going digital and generating automated straight-through processes

Interestingly, the focus on Cybersecurity (which has been evaluated as AA use case by 75% of the respondents for current projects) is losing importance. For future projects, only 25% consider it highly an AA use case [1]. 

Digital services embracing analytics and process automation are considered critical now. Examples are liquidity forecasting, exposure management and even chatbots for customer service automation [1].

Drivers of Platform Innovation

How is platform innovation accomplished?

There are three enablers for platform innovation:

  • Internally driven innovation (Organic Innovation)
  • Innovation generated through Mergers and Acquisition (External Innovation)
  • Open Innovation, enabled through opening the banks’ APIs to external service providers (Open Innovation)

Consequences for IT 


Digitizing services demands automated end-to-end processes. Monolithic isolated applications and infrastructures are major disturbances in this quest.


Internal services are increasingly integrated, to consolidate the data (needed for analytics), but also to generate new meta services. 

Internationalization of services fuses formerly autonomous banking entities into an integrated service landscape.

Mergers and acquisitions are the 3rd driving force for integration. Historically disjunctive infrastructures and services have to be brought together for efficient consolidated operations and data integration.

Open API 

We keep on speaking about ecosystem innovation. This requires opening up the formerly closed banking infrastructure to external service providers. At least in Europe and driven and regulated by the PSD2. Regulation, infrastructures need to open up and embrace external services.

In conjunction with new security regulation this creates a perfect storm

The above described factors led to a “strategic trend” to phase out legacy frameworks [1].

Security-oriented regulations like PCI PTS HSM v3 and FIPS 140-2 do their part to accelerate this process.

It appears that the seemingly immortal good old mainframes finally reach the end of the line now.

How can crypto reduce TCO and still be a key enabler for innovation?

Total cost of ownership of cryptography needs to be brought down to be able to cope with the increasing competition in the payment segment.

At the same time availability of many new services as well as the opening of the bank's APIs increase the security requirements from the infrastructures and the demand for coping with this broad variety of services (from data-center-based to the cloud). 

The answer in business terms is to provide a better and all-embracing crypto architecture, which at the same time reduces the overall cost-burden.

An important step is to upgrade and consolidate to newer, more secure HSM infrastructures that are able to handle more banking services concurrently. This is a realistic and accomplishable goal. But the following six technical features need to be considered when upgrading the current infrastructure:

  • Move to partitioned HSMs
  • Delegate banking applications partially to the cloud and manage crypto from a secure location (BYOK)
  • Turn the overall crypto architecture less complex and more straightforward and get rid of disturbing parallel structures
  • Merge payment and general purpose HSMs
  • Make the crypto architecture flexible and crypto-agile

Current legacy architecture does not need to be thrown overboard immediately, but can be phased out gradually. A good crypto infrastructure shall be able to handle 

  1. The old legacy systems as well,
  2. The transition process in an agile way with limited effort.

The article “7 Steps to Reduce Total Cost of Ownership Around HSMs to Gain Force in a disrupting finance market” (in publication) provides a closer look at the six technical features addressed above. And our series on TCO dives into each aspect separately, providing the technical information needed by CISOs and IT change managers in financial institutions, to conduct a successful upgrade towards a future-oriented, flexible and value generating service platform.

References and Further Reading

About the author

Ulrich Scholten es un empresario y científico activo a nivel internacional. Es doctor en tecnologías de la información y posee varias patentes sobre sensores basados en la nube. Sus investigaciones sobre computación en la nube se publican con regularidad en revistas y congresos de gran prestigio. De 2008 a 2015, fue investigador asociado en el Instituto de Investigación de Servicios de Karlsruhe (KSRI), una asociación de KIT e IBM, donde investigó los efectos de red en torno a las plataformas web junto con SAP Research.

To find more press releases related with below topics, click on one of the keywords:

¿En qué podemos ayudarle?

Hable con uno de nuestros especialistas y descubra cómo Utimaco puede ayudarle hoy mismo.
Ha seleccionado dos tipos diferentes de Download, por lo que necesita presentar formularios diferentes que puede seleccionar a través de las dos pestañas.

Su(s) solicitud(es) de Download:

    Al enviar el siguiente formulario, recibirá enlaces a las descargas seleccionadas.

    Su(s) solicitud(es) de Download:

      Para este tipo de documentos, es necesario verificar su dirección de correo electrónico. Recibirá los enlaces a las Download seleccionadas por correo electrónico después de enviar el siguiente formulario.

      Descargas de Utimaco

      Visite nuestra sección de descargas y seleccione recursos como folletos, fichas técnicas, libros blancos y mucho más. Puede ver y guardar casi todos ellos directamente (pulsando el botón de descarga).

      Para algunos documentos, es necesario verificar su dirección de correo electrónico. El botón contiene un icono de correo electrónico.

      Download via e-mail

      Al hacer clic en dicho botón se abre un formulario en línea que le rogamos rellene y envíe. Puede recopilar varias descargas de este tipo y recibir los enlaces por correo electrónico simplemente enviando un formulario para todas ellas. Su colección actual está vacía.