Banking & Finance

Governance, testing and privacy for banking data, from the mainframe to digital channels

icaria works on all of a bank's systems at once, from the mainframe to custom applications, packaged software and digital channels, without competing with day-to-day operations.

icaria Data Governance controls changes to the data model and compares the same data across systems in every migration.
icaria TDM brings complete, masked customers into testing, from core banking to the digital channels.
icaria Data Privacy blocks, anonymises or erases a data subject's data in every system that holds it.

Request a demo

Banking today

Several generations of systems, one customer

A bank runs legacy mainframe applications, packaged software and in-house developments alongside very recent platforms and channels. Each system has its own lifecycle and its own team, and migrations never stop: a core being replaced, a CRM being swapped out, a new channel being added.

The customer is the same in all of them. Their data has to reconcile across systems when it is migrated, reach digital channel testing complete, and be protected in every system that holds it, including those that were never designed for it.

icaria Data Governance

Change control and migrations: the same customer in core banking and the CRM

Each system evolves at its own pace, and a change to one system's data model affects every system that depends on it. icaria Data Governance synchronises the metamodel of each application, shows what has changed and compares what two systems hold about the same customer: it assigns each field to an information role, maps both records to a reference metamodel and compares them value by value.

Sample record with fictitious data

Information role Core bankingCUSTOMER (mainframe)CRMcontact Result

National ID number NATID AB123456C national_id AB123456C Match

Full name CUSTNAME O'BRIEN, SEAN full_name Seán O'Brien Match After the rule that reorders first and last names and normalises case and accents.

Home address ADDRLINE1 120 HIGH ST FLAT 4B street Flat 4B, 102 High Street Integrity defect

Postcode POSTCODE EC2V 7HH postal_code EC2V 7HH Match

Customer since OPENDATE 2004-03-15 created_at 2019-06-02 Integrity defect The CRM stores the date of its own data load, not the date the customer joined.

Status CUSTSTAT ACTIVE status Inactive Integrity defect

What icaria Data Governance controls in a bank

Model changes under control

The first metamodel synchronisation is kept as the reference snapshot. Later ones show which tables and fields were added, changed or removed, and the production, test and development instances of the same application are checked against each other to detect drift.

Legacy and modern systems, one method

The mainframe and open systems are documented the same way: DB2 for z/OS and AS/400, Fujitsu Symfoware, VSAM files, Oracle, SQL Server, PostgreSQL and other sources. That is how systems that share no tables, field names or formats can be compared.

Migrations checked value by value

In a migration, the source and target systems hold the same customers in different structures. Applied to both, the same comparison checks that the migrated data is equivalent and records every discrepancy as an integrity defect before the old system is retired.

icaria TDM

Customer 360 test data, from core banking to digital channels

Core banking used to be tested from the back office, one transaction at a time. Today testing starts in the app or in online banking, which show everything the customer holds with the bank. An icaria TDM project starts with the core and widens its scope phase by phase.

Core banking

The project starts with the core, usually on the mainframe, and the main applications around it. That is where the reference data for customers, contracts and accounts lives.
Systems in scope after this phase:
- Core banking (Systems the phase adds)
- Back office (Systems the phase adds)
Group systems

Next come the systems that share customers with the core, such as the insurance products the bank sells or departmental applications.
Systems in scope after this phase:
- Core banking
- Back office
- Insurance (Systems the phase adds)
- Departmental applications (Systems the phase adds)
Digital channels

Online banking, the mobile app and the aggregation and digital service APIs offered to third parties query several systems at once. Testing them needs the complete customer, consistent across all of them.
Systems in scope after this phase:
- Core banking
- Back office
- Insurance
- Departmental applications
- Online banking (Systems the phase adds)
- Mobile app (Systems the phase adds)
- Third-party services (Systems the phase adds)
New systems

Platforms that arrive later, such as a next-generation core or a process engine, join the scope as one more phase.
Systems in scope after this phase:
- Core banking
- Back office
- Insurance
- Departmental applications
- Online banking
- Mobile app
- Third-party services
- Next-generation core (Systems the phase adds)
- Process engine (Systems the phase adds)

A Spanish financial institution started with its mainframe core (around 1,300 tables). As systems were added, icaria now handles more than 2,000 tables every time a customer is moved.

icaria TDM · Consolidated position

One customer, several products and their full history

A retail banking customer holds several products at once, with joint holders, cross-charges between contracts and years of history. Together they make up the customer's consolidated position, and a digital channel test shows all of it on one screen.

Product HoldersHistoryDue datesSettlement

Current account Holder and joint holder Transactions; the balance is the result of all of them No maturity Interest and fees for each period

Credit card Cardholder and additional cards Transactions and monthly statements Debit date of each statement The statement is debited to the account

Mortgage Borrowers and guarantors Instalments paid and outstanding Each instalment and the final date The instalment is debited to the account

Linked insurance Policyholder and insured parties Premiums issued and paid Annual renewal The premium is debited to the account

Term deposit Holder Deposit and rollovers Maturity date Interest credited to the account

Investment fund Unitholder Subscriptions, redemptions and net asset value No maturity Redemptions credited to the account

Debits and credits on the current account Current account · Credit card · Mortgage · Linked insurance · Term deposit · Investment fund
Insurance linked to the mortgage Mortgage · Linked insurance

What this means for test data

Subset by customer, not by table

Selecting a customer brings along their contracts, their joint holders and the accounts they settle against. Each joint holder has products of their own, so the project decides how far each relationship is followed. If a relationship is cut, the product is orphaned and the test fails in the channel.

History within a window

Transactions, premiums and instalments are limited by date so that years of data are not copied. What reaches the environment has to reconcile: balances with their transactions, and every charge with the account it settles against.

The same customer in every system

Masking replaces name, ID number and accounts with the same result in every application, so the masked customer is the same in the core, in insurance and in the channels.

icaria Data Privacy

Privacy inside the mainframe and proprietary systems, joined up with open systems

In banking, personal data sits on the mainframe, in in-house developments, in packaged software and in open systems. Privacy controls have to be applied inside each one and work as a single process. icaria Data Privacy works on all of them at once.

Identification and location

Find a data subject across all their systems

icaria Data Privacy identifies the data subject from a request, from business rules or from an external process, and follows the relationships of their main record to locate their data in every application in scope, with the same data model for the mainframe and for open systems.

Uses the platform's connectors: DB2 for z/OS and AS/400, IMS DL/I, Fujitsu Symfoware, Oracle, SQL Server or PostgreSQL.
Where there is no direct connection, it works through file exchange.
Applies the same policy to one person or to whole cohorts defined by rules.

Blocking, anonymisation and erasure

Act inside each source system

The action runs on the data of each affected application, whether built in-house or bought off the shelf: blocking, anonymisation or physical deletion, as the plan sets out. That way, restriction of processing and erasure also reach legacy systems.

Anonymises personal data and keeps the operational information that is still valid.
Handles the rights of access, rectification, erasure and portability.
Integrates through REST services with the platform that receives the requests.

Safekeeping and traceability

Keep, reverse and prove every action

Before production is modified, the plan can store the original information in a restricted-access recovery repository, which allows an authorised lookup or reversal until final deletion. Every data subject, process and status is logged for audit.

Keeps retained data accessible even if the source technology becomes obsolete.
Permanently deletes the repository when the retention period ends.

Financial services customers

Implementing icaria Data Privacy enabled us to manage the blocking and erasure of personal data in a consistent, standardised way across the subsidiaries of Grupo Ibercaja.

Javier Martínez LafuenteDirector of Management Oversight · Grupo Ibercaja

We were looking for a tool that could adapt to our heterogeneous technology ecosystem and meet the requirements of the GDPR. With icaria TDM we found the flexibility we needed and a solution that covers a wide range of data management needs across the whole data lifecycle.

Jorge RodríguezData Platform Manager · Cetelem

No impact on production

Work on production without competing with the bank's operations

The thread scheduler sets, by calendar and time slot, how many threads each process uses: few at peak hours, more in off-peak windows and none on excluded dates. It applies to subsetting, bulk masking, the data finder and privacy processes.

Sample schedule

Monday to Friday: 0:00–7:00: 8 threads; 7:00–16:00: 2 threads; 16:00–24:00: 5 threads
Weekends: 0:00–24:00: 8 threads
Month-end close: 0:00–24:00: Excluded

Off-peak windows

The load is concentrated at night and at weekends, when the mainframe has spare capacity. At peak hours the process keeps moving with the threads the bank assigns to it, and on critical dates it does not run.

Low, bounded consumption

The number of threads is matched to the capacity the database can spare in each time slot, so each process's consumption is low and known in advance. Extraction runs under a read-only user so that production tables are not locked.

Custom and packaged applications, together

One project brings the mainframe core, packaged products and in-house developments together on a single metamodel foundation and works on all of them at once, with the same method and no separate tool for each technology.

Let's talk about your bank's data

We'll review your systems with you, from the mainframe to the digital channels, and show you how icaria controls their changes, prepares test data and protects personal data.

Request a demo Talk to an expert

Frequently asked questions

What does icaria offer a bank?

Three products on a single metamodel foundation. icaria Data Governance controls changes to the data model and compares the same data across systems, including during migrations. icaria TDM brings complete, masked customers into test environments, from the core to the digital channels. icaria Data Privacy executes data subject rights on production data. They can be bought separately or together.

How does icaria Data Governance help with a migration between systems?

The data of the source and target systems is mapped to the same reference metamodel, with rules the architect defines, and compared field by field according to its information role. Each discrepancy is recorded as an integrity defect and published to the health monitor, so you can check that the migrated data is equivalent before the old system is retired.

Where does a TDM project start in a bank?

With core banking and its main applications, where the reference data for customers, contracts and accounts lives. Once that model is built, the scope widens in phases to the systems that depend on the core, such as insurance or departmental applications, and to the digital channels.

How does a customer's consolidated position reach the test environment complete?

icaria TDM subsets by customer: it starts from the selected people and follows the relationships to their contracts, joint holders and settlement accounts, so each product arrives with the data it depends on. History is limited by date, and the project defines how far each relationship is followed.

Can icaria Data Privacy act on the mainframe and on proprietary systems?

icaria Data Privacy works on the data sources of the icaria platform, which include DB2 for z/OS and AS/400, IMS DL/I and Fujitsu Symfoware as well as open databases, and on files where there is no direct connection. A single plan locates the data subject's data in every application in scope and runs the blocking, anonymisation or deletion that applies in each one.

Does it affect production operations?

Processes are scheduled so that they do not compete with them. The thread scheduler sets, by calendar and time slot, how many threads each process uses, with less load at peak hours and more in off-peak windows, and extraction runs under a read-only user so that tables are not locked.

Does masked data still match across systems?

Yes. Masking replaces personal data with the same result in every application, so the join keys are kept and the masked customer is the same in the core, in insurance and in the channels.

What else does icaria TDM give a bank's testing teams?

A repository that keeps copies of prepared data to load into different environments without extracting from production again; a data finder that lets teams find customers by business criteria and move them to their environment through self-service, with users and roles; and synthetic data for features that do not yet have data in production.