Legacy Modernisation for UK FinTech — FCA PS21/3 Built In

UK FinTech Legacy Platform Landscape

Common UK FinTech legacy platforms requiring modernisation: (1) legacy core banking (TEMENOS T24, Misys Fusion, FIS — on-premises, expensive to operate, slow to change), (2) legacy payment systems (VocaLink BACS, older Faster Payments integration — migrating to NPA — New Payments Architecture), (3) COBOL mainframe (larger UK banks and building societies — IBM z/OS, COBOL 85 — extremely expensive to run and change), (4) legacy Java EE applications (WebLogic, JBoss, IBM WAS — migrating to Spring Boot on ECS Fargate), (5) legacy PHP FinTech platforms (pre-2015 builds — PHP 5.x, Laravel 4/5 — post-GDPR and Consumer Duty obligations not built in).

FCA Consumer Duty Legacy UX Remediation

FCA Consumer Duty PS22/9 is the single biggest driver of UK FinTech legacy remediation in 2025–2026. Consumer Duty legacy UX failures (most common): (1) renewal pricing journey — legacy systems that increase renewal premium without FCA PS21/11 parity check, (2) cancellation journey — legacy systems where cancellation requires a phone call (Consumer Duty: cancellation no harder than sign-up), (3) fee disclosure — legacy systems with hidden charges in small print (Consumer Duty: all fees transparent at point of purchase), (4) complaint journey — legacy systems where complaint process is buried or inaccessible, (5) vulnerable customer journeys — legacy systems with no vulnerability identification or support pathway. ClickMasters Consumer Duty legacy audit: 2-day audit identifying all Consumer Duty UX failures before remediation scope agreed.

NPA (New Payments Architecture) Migration

NPA (New Payments Architecture): Pay.UK's programme to replace BACS and Faster Payments with a new ISO 20022 standard. UK banks and payment processors must migrate to NPA. ISO 20022 migration: (1) message format change (BACS AUDDIS/ADDACS XML → ISO 20022 pain.001/camt.054 messages), (2) data enrichment (ISO 20022 carries more structured data than legacy BACS — remittance information, end-to-end IDs), (3) payment initiation (REST API replacing legacy BACS file submission), (4) settlement (NPA overlay services — Request to Pay, Enhanced Data). ClickMasters NPA migration: legacy BACS file generation system → NPA ISO 20022 REST API. Strangler Fig: old BACS file generation continues during migration, NPA API runs in parallel.

FCA PS21/3 Legacy Resilience Uplift

FCA PS21/3 (Operational Resilience) requires existing systems to meet Impact Tolerance — legacy systems typically fail PS21/3 because: (1) no Multi-AZ (single point of failure), (2) no automated failover (manual intervention required), (3) no chaos testing evidence (FCA requires quarterly Impact Tolerance testing), (4) deployment downtime (legacy systems require maintenance windows — FCA requires IBSs to remain available during deployments). Legacy PS21/3 uplift: (1) move to cloud (AWS ECS Fargate — automatic Multi-AZ, no maintenance windows), (2) RDS Aurora (< 30 second automated failover), (3) blue-green deployment (zero downtime), (4) CloudWatch Synthetics (IBS availability monitoring). Full PS21/3 uplift: 12–20 weeks for a legacy on-premises FinTech application.

FCA PS21/3

FCA Consumer Duty

AML MLRs 2017

UK GDPR

Cyber Essentials Plus

ISO 27001