Microservices Architecture for UK FinTech — FCA COBS Built In

FCA IBS-Per-Service Microservices Design

FCA PS21/3 microservices: each FCA Important Business Service (IBS) is an independent microservice with its own deployment pipeline, database, and availability monitoring. IBS examples: Payment Processing Service (PISP payments — IBS: customer can initiate payment), Account Information Service (AISP — IBS: customer can view account), and Customer Support Service (IBS: customer can report problem). IBS isolation: Payment Processing Service failure does not affect Account Information Service (critical for PS21/3 Impact Tolerance). Each IBS has its own Multi-AZ RDS and ECS Fargate service — independent scaling and failure domain.

FCA Consumer Duty Microservices Pattern

Consumer Duty monitoring as a microservice: Consumer Duty Monitoring Service runs independently of product services — collects outcome metrics (claims acceptance, complaint rate, vulnerable customer flags) via event streaming. Event-driven: product services publish domain events (claim submitted, complaint raised, vulnerable customer flagged) → Kafka → Consumer Duty Monitoring Service (consumes events, aggregates metrics). Benefits: Consumer Duty monitoring logic isolated from product code (easier to audit, update independently for FCA requirement changes), and Consumer Duty service can be deployed independently of product releases.

API Gateway Pattern for FCA FinTech Microservices

AWS API Gateway as FCA microservices entry point: single API Gateway routes to appropriate microservice (Payment Service, Account Service, Customer Service). FCA audit trail: API Gateway access logs (CloudWatch) — every API call logged with timestamp, user identity, endpoint, response code. Rate limiting: per-customer rate limits at API Gateway level (FCA PS21/3 — no rate limiting that blocks legitimate customer IBS access). JWT authentication: Cognito User Pool (JWT token) → API Gateway authoriser → microservice. Request tracing: AWS X-Ray — end-to-end trace of each API request through microservice chain (essential for FCA incident investigation — "which service caused the delay?").

FinTech Service Mesh and Distributed Tracing

Service mesh for FCA FinTech: AWS App Mesh (Envoy proxy sidecar) provides: (1) mutual TLS (mTLS) between all microservices — FCA PS21/3 data in transit encryption, (2) circuit breaker (Envoy circuit breaker — prevents cascade failure across IBS), (3) retry logic (transient failures — automatic retry with exponential backoff), (4) distributed tracing (AWS X-Ray via Envoy — traces cross-service calls). FinTech use case: payment initiation crosses 4 services (API Gateway → Payment Initiation → Fraud Detection → Banking Rail Connector) — X-Ray shows latency contribution of each hop. FCA PS21/3: distributed tracing enables accurate IBS availability measurement (measure from customer request to IBS response, not individual service availability).

FCA COBS

FCA PS21/3

FCA Consumer Duty

PCI-DSS

UK GDPR

AML MLRs 2017

Cyber Essentials Plus

ISO 27001