When Payment HSM Migration Moves from Theory to Practice: The Access Bank Experience

In our previous two blogs, we discussed how to migrate a Payment HSM and why migration can be beneficial for financial institutions. We covered the migration process, the business drivers behind it, and the practical considerations that can make a transition smoother and less disruptive.

In this blog, we take the discussion one step further: what does a successful Payment HSM migration actually look like in practice?

The experience of Access Bank provides a useful example.

The real challenge is not replacing the HSM

Payment HSMs tend to have long lifecycles. Once embedded in a payment environment, they become part of the infrastructure supporting card issuance, transaction processing, payment switches, ATMs, POS terminals, and digital channels.

That makes migration a different proposition from a conventional technology refresh.

The objective is not simply to introduce a newer HSM. The challenge is to improve the underlying platform while keeping the surrounding payment ecosystem stable.

This is where the distinction between migration and replacement becomes important.

A replacement approach can involve significant changes to applications, integrations, testing, and operational processes. A well-planned migration, by contrast, aims to change the HSM platform while preserving as much of the existing environment as possible.

Access Bank's project illustrates this approach.

A migration driven by growth and efficiency

Access Bank operates across Nigeria and Africa and serves millions of customers across retail, corporate, commercial, and digital banking. As transaction volumes increased, the bank's legacy Payment HSM infrastructure was no longer aligned with its longer-term requirements.

The bank was looking for more than additional performance. The new platform needed to support higher transaction throughput, maintain PCI PIN and PCI DSS compliance, reduce total cost of ownership, and enable migration without disrupting existing payment applications.

That combination is significant. It meant the project had to address performance, economics, compliance, and operational continuity at the same time.

Compatibility made the difference

Access Bank selected Utimaco CryptoSec Payment HSM and integrated it into critical card issuance and payment processing functions, including Visa, Mastercard, Verve and Afrigo card services, as well as ATM, POS, web and e-commerce transactions.
One of the most important factors was command compatibility.

CryptoSec Payment HSM's support for standard payment HSM commands allowed Access Bank to migrate between HSM providers without modifying its existing payment applications. According to the case study, this reduced complexity, risk and implementation time.

This is a broader lesson for migration projects. The best migration is often the one that changes the technology underneath the applications without requiring those applications to change with it.

Prove it before putting it into production

The project also demonstrates why proof-of-concept testing is an important part of migration planning.

Utimaco provided Access Bank with remote access to CryptoSec Payment HSM for early testing and subsequently delivered a physical appliance for on-site validation. Technical support was provided throughout the proof of concept.

This staged approach gave the bank an opportunity to validate the target platform before making the transition, while identifying compatibility and operational issues early.

In a payment environment, that matters. Migration risk is not eliminated by choosing a new platform; it is reduced by understanding how that platform behaves within the existing environment before the change becomes operationally critical.

What changed after migration?

The outcome was not simply a successful technology transition.

Access Bank achieved a substantial performance improvement, compliance with PCI PIN and PCI DSS requirements, and a significant reduction in total cost of ownership compared with the previous platform. The new infrastructure also provided scalability for future transaction growth without proportional cost increases.

Perhaps more importantly, these improvements were achieved without changing the bank's existing payment applications.

That is what makes the project relevant beyond this individual deployment. It demonstrates that Payment HSM migration can be a controlled infrastructure change rather than a wholesale transformation of the payment stack.

From migration project to infrastructure strategy

The earlier blogs in this series addressed the why and the how of Payment HSM migration. The Access Bank experience adds the missing third dimension: proof.

A migration can provide a way to address aging infrastructure, rising costs and growing transaction volumes without automatically introducing a major application modernization project.

For Access Bank, the result was a Payment HSM environment with higher performance, lower total cost of ownership, continued compliance, and room for future growth.

The broader takeaway is simple: the value of Payment HSM migration is not the act of moving from one platform to another. It is what the organization can improve while making that move.

Learn more about the Access Bank story here

Utimaco’s Solutions Enabling Migration 

Utimaco’s CryptoSec Payment HSM enables seamless migration between payment HSM providers through compatible commands and APIs, eliminating the need to recreate command sets or rewrite applications. It offers a comprehensive set of standardized commands, providing immediate access to cryptographic banking functions.